What we collect, and what we will never do with it.

This summary is here for speed. It is not a substitute for the sections below, which are what govern.

• We collect what we need to sell you a panel, ship you a kit, match your sample to you, and show you your results.
• We do not sell your personal information. We do not share it for advertising. We do not run advertising or analytics trackers on this website.
• We share your details with a partner clinical laboratory, because that laboratory is the one that runs your test.
• We do not use your results or your genetic data for research, and we do not contribute them to any database or biobank.
• We do not give your data to employers or insurers, and we require valid legal process before giving anything to law enforcement.
• There is no subscription and no membership, so there is no profile being built to keep you subscribed.
• You can ask for a copy of your data, or ask us to delete it, and we will not charge you or treat you worse for asking.

Because health and genetic data carry obligations that ordinary personal data does not, two further documents sit alongside this one: our Consumer Health Data Privacy Policy, and the consent and limitations notice covering what a test can and cannot tell you.

Cellubrite Inc. is a healthcare technology company registered in the United States at 30 N Gould St, Ste R, Sheridan, WY 82801, United States. We sell at-home biomarker collection kits and we build the account in which your results are delivered and tracked. In this policy, "we", "us" and "Cellubrite" mean that company, and "you" means the person whose data it is.

We are not a laboratory and we are not a medical provider. Your sample is processed by an accredited CLIA-certified partner laboratory under that laboratory's own quality procedures. That laboratory handles your sample, and the test data it generates, under its own obligations as a clinical laboratory, in addition to this policy.

This policy covers cellubritehealth.com, the Cellubrite mobile app, and the account area where your kits, orders and results appear. Ordering happens on a storefront hosted by a third-party commerce platform, which processes your purchase under its own privacy terms as well as ours. Your use of the service is also governed by our Terms of Use and Sale.

Several state laws require that you be told, at or before the point of collection, what categories of personal information are collected and why. This section is that notice. Sections 04 to 06 give the detail.

Health, biological and genetic data are sensitive personal information under state law. We use them only to provide the service you asked for and for the other purposes listed in section 06. We do not use or disclose sensitive personal information to infer characteristics about you.

Retention is described in section 09. We do not sell or share any of these categories, as described in section 07.

Information you give us

• Account details: your name, email address, date of birth, sex, and the state you are in. Date of birth and sex are collected because reference ranges for many biomarkers differ by both, so a result cannot be interpreted without them.
• Order details: the panel you bought, when you bought it, and the address the kit ships to.
• Kit details: the kit identifier you register, and the date you collected your sample.
• Anything you send us: the contents of support messages and the address you send them from.

Information the test produces

• Blood panel results: each marker, its value, its unit, and its reference range.
• Genomic panel results: your genotype at the specific variants included in the panel you bought, and what that genotype means.

Information collected automatically

• Technical and usage data such as your device and browser type, approximate location derived from your IP address, and which pages or screens you opened. We use this to keep the service working and to understand which parts of it people struggle with.

What we deliberately do not collect

We do not ask for and do not want your Social Security number, your insurance details, or your payment card number. This is a cash-pay service and we do not bill insurance. Card details are handled by our payment provider and never reach our servers. We do not collect precise geolocation.

• From you: at checkout, when you create an account, when you register a kit, and when you contact us.
• From the partner laboratory: the result of the test it ran on your sample.
• From our commerce and payment providers: confirmation that an order was placed and paid for, and the details needed to fulfil it.
• From shipping carriers: the delivery status of your kit in each direction.
• Automatically from your device: the technical and usage data described above.

We do not buy personal information from data brokers, and we do not enrich what you give us with information bought from anyone else.

• To take your order, ship your kit, and get it back to the laboratory.
• To match the sample the laboratory receives to the right person, and to release the result to the right account.
• To show you your results against their reference ranges, and to show how a marker has moved across tests you have taken.
• To answer you when you contact support, including posting a replacement kit if the laboratory cannot process your sample.
• To keep the service secure, to detect and prevent fraud and misuse, and to debug what is broken.
• To meet our legal, tax and record-keeping obligations.
• To send you service messages about your order, your kit and your results. These are not marketing, and you cannot unsubscribe from them while an order is open, because they are how the service tells you what is happening.
• To send you marketing email, if you asked for it. You can stop this at any time and it never affects the service messages above.

We do not use your results, your genetic data, or any other sensitive personal information to target advertising. We do not use them to make automated decisions that produce legal or similarly significant effects about you, and we do not profile you.

These are commitments, not descriptions of current practice that we reserve the right to change quietly. If any of them stops being true, section 15 says how you will be told.

• We do not sell your personal information, for money or for anything else of value.
• We do not share it for cross-context behavioural advertising, and we do not run advertising trackers on this website.
• We do not disclose your results or your genetic data to employers, to health insurers, to life, disability or long-term care insurers, or to data brokers.
• We do not use your genetic data for research, and we do not contribute it to any research database, biobank, or public genomic database.
• We do not allow any third party to use your data for that third party's own purposes. Our service providers act on our instructions only.
• We do not use your health or genetic data to train machine learning models.

We disclose the minimum needed, to these categories of recipient, for these purposes only:

If the business is ever sold, merged, or reorganised, your data may transfer as part of it. We will tell you before that happens, and any acquirer is bound by the commitments in section 07 for data collected under this policy. If an acquirer wanted to use your data differently, it would have to ask you, not simply publish a new policy.

We keep your account, order and result data for as long as your account is open, so that your history stays available to you and a marker can be compared across tests. We do not keep data longer than we can justify against the purposes in section 06.

You can ask us to delete it at any time. We will do so, except where we are required to keep a record, for example to meet laboratory record-retention rules, tax and accounting obligations, or an ongoing legal claim. Where we have to keep something, we keep only that, we stop using it for anything else, and we delete it when the obligation ends.

The laboratory that ran your test keeps its own record of it under its own retention obligations, which we do not control and cannot shorten. Asking us to delete your data does not delete the laboratory's record.

Data is encrypted in transit. Access to result data inside Cellubrite is limited to the people who need it to run the service and support you, and that access is logged.

No service can promise perfect security, and we are not going to claim otherwise. What we will commit to is what happens if it fails: if a breach affects your data, we will notify you and the Federal Trade Commission as required by the Health Breach Notification Rule, and any state regulator entitled to notice, within the deadlines those rules set. We will tell you what was taken, not merely that something was.

You can help by using the same email address consistently, keeping that mailbox secure, and telling us quickly if you think someone else has access to it.

Whatever jurisdiction you are in, and whether or not your state has a privacy law, you can ask us to:

• Confirm whether we hold personal information about you, and give you a copy of it, in a portable format where that is technically feasible.
• Tell you the categories we collected, the sources, the purposes, and the categories of recipient.
• Correct anything that is wrong, including a date of birth or sex that is affecting how a reference range is applied to you.
• Delete your account and the data attached to it, subject to the retention exceptions in section 09.
• Withdraw a consent you previously gave, including consent to collect and process your health and genetic data.
• Stop sending you marketing email. Every marketing message carries an unsubscribe link.
• Limit how we use sensitive personal information, though in practice we already use it only to provide the service.

How to make a request

1. (1)Write to privacy@cellubritehealth.com from the email address on your account, and say which of the above you want.
2. (2)We verify who you are. Normally that means confirming control of the account email address. For a request about results or genetic data we may ask for one additional detail we already hold, such as an order number, because the consequence of getting this wrong is disclosing one person's genome to another.
3. (3)We respond within 45 days. If we need longer we will tell you why within those 45 days, and take no more than a further 45.
4. (4)If we refuse, we tell you why, and you may appeal by replying to that decision. We will answer an appeal within 45 days, and tell you how to complain to your state Attorney General if you are still unsatisfied.

An authorised agent may make a request for you, with written permission we can verify. We do not charge for any of this, and we will not give you a worse service, a worse price, or a different product because you exercised a right.

Some states give residents additional rights. The process in section 10 is the same for all of them. The rest of this section is what those states specifically require us to tell you.

California

We have not sold or shared personal information in the preceding twelve months, and we do not have actual knowledge of selling or sharing the personal information of anyone under 16. Because we do not sell or share, there is nothing to opt out of, though we honour opt-out preference signals as described in section 13. You have the rights listed in section 10, and the right not to be retaliated against for using them. The categories we collect, our sources, our purposes and our recipients are in sections 03, 05, 06 and 08.

Washington, Nevada and Connecticut

Washington's My Health My Data Act, Nevada's SB370, and the health data provisions of Connecticut law give specific rights over consumer health data. Those are set out in our separate Consumer Health Data Privacy Policy, which those laws require us to publish as its own document with its own link.

Other states with comprehensive privacy laws

If you live in a state with a comprehensive consumer privacy law, including Virginia, Colorado, Utah, Texas, Oregon, Montana, Delaware, New Jersey and others, you have access, correction, deletion, portability and opt-out rights, and a right to appeal a refusal. Because we do not sell personal information, do not use it for targeted advertising, and do not profile you, the opt-outs those laws provide have nothing to attach to here. We process your health and genetic data only with your consent, which you can withdraw.

State genetic privacy laws

A number of states, including California, Arizona, Utah, Florida, Texas, Maryland, Tennessee, Wyoming and Virginia, regulate direct-to-consumer genetic testing specifically. They require separate, express consent before genetic data is collected, used or disclosed, and a way to revoke it and have the sample destroyed. We obtain that consent before a genomic panel is processed, and it is described in the consent notice. You can withdraw it at any time by writing to privacy@cellubritehealth.com.

Genomic results are different from a blood value. They do not change over time, they say something about your biological relatives as well as you, and they cannot be unlearned once you have read them. We treat them accordingly, and so should you.

The Methylation Genomic Panel includes APOE, which is associated with risk of late-onset Alzheimer's disease. That is information some people want and some people specifically do not. Decide before you order, and consider discussing it with your healthcare provider or a genetic counselor first.

We do not use your genomic data for research, and we do not contribute it to any research database or biobank. If we ever wanted to, we would have to ask you first, separately, and a refusal would not affect your service. What a genomic panel can and cannot tell you is covered in the consent notice.

This website runs no advertising trackers and no third-party analytics. It sets only the cookies and local storage needed to make it work, such as remembering whether you chose the light or dark theme, whether you turned live chat on, and to keep you signed in to your account.

Live chat is the one thing on this website that loads a third party into your browser, and it stays off until you turn it on. If you do, our chat provider sets its own storage so a conversation survives a page reload, and it receives whatever you type into the chat window together with technical details of your visit, such as the browser you are using and the approximate location your network resolves to. Please do not type biomarker results or genetic information into it. Our chat provider acts on our instructions only and may not use what it receives for its own purposes.

You can turn live chat back off at any time using Cookie preferences at the bottom of any page. Doing so clears the storage the chat provider set in your browser and keeps it from loading again. It does not by itself delete a conversation you already had, so if you want that removed, ask us using the contact details at the end of this policy and we will delete it.

The storefront where you buy runs on a third-party commerce platform, which sets its own cookies for the shopping basket, checkout, and its own first-party analytics. That platform's cookie notice governs those.

We honour the Global Privacy Control and other browser opt-out preference signals. Since we do not sell or share personal information, such a signal does not change what happens to your data here, but it will be respected as an opt-out if that ever changes.

Your email address is the key that links your order, your kit and your results. If the address you use at checkout differs from the one you register your kit with, or from the one you sign in with, the three records will not join up and we will not be able to show you your results.

This belongs in a privacy policy rather than only in a help article, because it is also how we avoid showing one person's results to another. Use the same address at all three points, and tell us at support@cellubritehealth.com before you change it.

You must be 18 or over to order. The service is not directed at children, we do not knowingly collect information from anyone under 18, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us information, contact us and we will delete it.

If we change this policy we will update the effective date at the top of the page. Where a change materially affects how we use data we already hold about you, and in particular any change to the commitments in section 07, we will tell you directly and give you the chance to delete your data first, rather than relying on you noticing a date. This version is effective 29 July 2026.

Questions about this policy, or a request about your data, go to privacy@cellubritehealth.com. Say what you are asking for, and write from the email address on your account so we can find you. For help with an order, a kit or a result, write to support@cellubritehealth.com instead and you will get a faster answer.

If you are not satisfied with how we have handled a privacy request, you can appeal by replying to our decision, and you can complain to your state Attorney General. We would rather you came to us first, and we would rather hear it than not.