Privacy Statement — California

Last updated: June 10, 2026 · Draft pending legal review

This privacy notice applies to California residents ("consumers" or "you") only and supplements the information in the GEVITIX LAB Privacy Policy. We adopt it to comply with the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), and other California privacy laws. Terms defined in the CCPA/CPRA have the same meaning here.

Information We Collect

We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("Personal Information"). We have collected the following categories of Personal Information from California consumers on the GEVITIX LAB platform:

A. Identifiers — e.g. name, postal address, email address, phone number, date of birth, account name, IP address. Collected: Yes.
B. Customer-records categories (Cal. Civ. Code § 1798.80(e)) — e.g. name, signature, address, telephone number, payment card information, medical information, health insurance information. Some items overlap with other categories. Collected: Yes.
C. Protected classification characteristics — e.g. gender, age. Collected: Yes.
D. Commercial information — e.g. records of products or services purchased or considered, payment information, purchasing tendencies. Collected: Yes.
E. Biometric information — e.g. fingerprints, faceprints, voiceprints used for identification. Collected: No. (Health measurements you report are handled as medical information under Category B and, where applicable, as PHI under HIPAA — see exclusions below.)
F. Internet or other electronic network activity — e.g. browsing history, interactions with our website, device and browser type, cookies, chat and email transcripts. Collected: Yes.
G. Geolocation data — precise location such as latitude/longitude. Collected: No.
H. Sensory data — e.g. audio recordings of support phone calls. Collected: Yes [CONFIRM whether support calls are recorded].
I. Professional or employment-related information — e.g. occupation. Collected: Yes.
J. Non-public education information (FERPA) — Collected: No.
K. Inferences drawn from other Personal Information — e.g. communication preferences, consumer preferences and characteristics. Collected: Yes.

Sources of Personal Information

We obtain the categories above: directly from you (for example, forms and documents you submit); indirectly from you (for example, information collected automatically through your activity on our website); and from third parties that interact with us in connection with the services we perform (for example, providers, pharmacies and laboratories involved in your care).

What Personal Information Does NOT Include

Personal Information does not include: publicly available information from federal, state or local government records; de-identified or aggregate consumer information; or information excluded from the CCPA's scope, such as health or medical information covered by HIPAA and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data, and personal information covered by sector-specific privacy laws including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the California Financial Information Privacy Act, and the Driver's Privacy Protection Act.

Sensitive Personal Information

"Sensitive Personal Information" means information that reveals: your Social Security, driver's license or passport number; your account log-in or financial account, debit or credit card number in combination with any required credential allowing account access; your precise geolocation; your racial or ethnic origin, religious or philosophical beliefs, or union membership; the contents of your mail, email and text messages unless we are the intended recipient; and your genetic data. Unless publicly available, it also includes biometric information processed to uniquely identify you, and Personal Information collected and analyzed concerning your health or your sex life or sexual orientation.

Use of Personal Information

We may use or disclose Personal Information for these business purposes: to fulfill the reason you provided it; to provide you information, products or services; to send alerts and notices about our products, services, events or news that may interest you; to carry out our obligations and enforce our rights under contracts with you, including billing and collections; to improve our website and present its content to you; for testing, research, analysis and product development; as reasonably necessary and proportionate to protect the rights, property or safety of us, our patients or others; to respond to regulatory and law-enforcement requests as required by law, court order or governmental regulation; as described when collecting the information or as otherwise permitted by the CCPA; through service providers performing services on our behalf; with our affiliates and subsidiaries; and as otherwise required or permitted by law. We will not collect additional categories or use collected information for materially different, unrelated or incompatible purposes without notifying you.

Sharing Personal Information

We may disclose your Personal Information to third parties for a business purpose, including to: our affiliates; service providers and vendors; third parties you authorize in connection with products or services we provide to you; and other third parties as required or permitted by law. In the preceding twelve (12) months we have disclosed the following categories of Personal Information to third parties for a business purpose: None [CONFIRM and update post-launch — this will change once analytics, advertising and care partners are active].

Selling Personal Information

We do not sell your Personal Information to anyone.

Your Rights and Choices

Access and data portability. You may request that we disclose: the categories of Personal Information we collected about you; the categories of sources; our business or commercial purpose for collecting it; the categories of third parties with whom we share it; the specific pieces of Personal Information we hold about you (a data portability request), if specifically requested; and, if we have sold or disclosed Personal Information for a business purpose, two separate lists identifying the categories purchased and the categories obtained by each category of recipient.

Correction. You may request that we correct Personal Information about you. After verifying your request, we will evaluate the requested correction against information from other sources and disclose the actions taken.

Limiting sensitive Personal Information. You may request that we limit the use and disclosure of your Sensitive Personal Information, subject to exceptions. We use Sensitive Personal Information to perform the services you reasonably expect, to ensure security and integrity, to conduct non-personalized advertising, to perform services on behalf of our business, and to improve our services.

Deletion. You may request that we delete (and direct our service providers to delete) your Personal Information. We will comply unless an exception applies — we may retain information needed to: complete the transaction or perform our contract with you; detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity; debug and repair errors; exercise free speech or another legal right; comply with the California Electronic Communications Privacy Act; conduct public-interest research adhering to applicable ethics and privacy laws where deletion would seriously impair it and you gave informed consent; enable solely internal uses reasonably aligned with your expectations; comply with a legal obligation; or make other internal, lawful uses compatible with the context in which you provided it.

Exercising Your Rights

To exercise these rights, submit a verifiable consumer request by emailing fc@gevitixlab.com or via gevitixlab.com [CONFIRM toll-free number — CCPA requires two designated request methods]. Only you, or a person registered with the California Secretary of State whom you authorize to act on your behalf, may make a verifiable request; you may also make one on behalf of your minor child. You may make an access or portability request at most twice in a 12-month period. The request must provide enough information for us to reasonably verify your identity or authority, and describe the request with enough detail for us to understand, evaluate and respond. We cannot respond if we cannot verify identity or authority. Making a request does not require creating an account, and information you provide will be used only for verification.

Response Timing and Format

We endeavor to respond to verifiable consumer requests within 45 days of receipt; if we need more time (up to 90 days), we will tell you the reason and extension in writing. If you have an account, we will respond to it; otherwise by mail or electronically, at your option. Disclosures cover the 12 months preceding the request, and our response will explain any reasons we cannot comply. For data portability, we will provide your information in a readily usable format that allows transmission to another entity without hindrance. We do not charge a fee unless the request is excessive, repetitive or manifestly unfounded — in which case we will provide a cost estimate and rationale first, and we reserve the right to deny such requests.

Non-Discrimination

We will not discriminate against you for exercising any CCPA right. Unless the CCPA permits it, we will not: deny you goods or services; charge different prices or rates, including through discounts, benefits or penalties; provide a different level or quality of goods or services; or suggest that you may receive any of the above.

Changes to This Notice

We may amend this notice at our discretion at any time. When we make changes, we will notify you by email or through a notice on our website homepage.

Contact

Questions about this notice, our Privacy Policy, how we collect and use your Personal Information, or exercising your California rights: fc@gevitixlab.com · gevitixlab.com · [CONFIRM phone] · [CONFIRM legal entity name and registered postal address].

GEVITIX LAB is a patient management platform that works with independent physicians and practitioners. GEVITIX LAB does not directly provide medical or pharmacy services, and payment does not guarantee the writing or dispensing of a prescription. DRAFT — requires review by qualified US counsel; the "categories disclosed: None" statement and collection table must be re-verified at launch once analytics, advertising and clinical integrations are live, and CCPA requires at least two designated request methods (typically a toll-free number plus web/email).