Life100 is committed to developing and delivering health screening services that provide positive health outcomes by identifying risks and assessing current lifestyle decisions. Privacy is given serious importance at Life 100. We are committed to ensuring that your personal information is kept safe and secure and is used responsibly and only for the purpose for which it was obtained.

Life100 is bound by the Privacy Act 2020. The Privacy Act imposes legal obligations on us in relation to how we use, hold and disclose your personal information. Our Privacy Policy does not limit your existing rights under the Privacy Act. If you wish to seek further information on the Privacy Act please refer to www.privacy.org.nz.

Collection of personal information

Life100 collects and holds personal information (obtained either directly or indirectly) in order to:

• Provide you with products and services;

• Assist you with the use of our website;

• The ongoing administration, operation and marketing of our products and services

• Conduct internal research and development of our platforms and the services we provide;

• Improve the products and services we provide to you;

• Communicate with you, including responding to any complaints;

• Protect and enforce our legal rights and interests; and

• Any other purpose authorised by you or the Privacy Act 2020.

Who do we disclose your personal information to?

Without your specific consent we will not disclose or otherwise share your personal information with anyone else, except for the purposes set out below.

We may disclose your personal information to another company or entity associated or related to us or to third parties including local and international service providers to whom we outsource some of our activities. Our contracts with such related parties or third parties include security and privacy terms and conditions that protect your personal information. We may disclose your personal information to any person or entity who can legally require us to supply your personal information to them (for example, a Court or a regulatory authority) or to any other person authorised by the Privacy Act 2020. For the avoidance of doubt, we confirm that we will not provide any data (genetic or non-genetic) to any insurance company or employer.

Storage of personal information

Life100 takes all reasonable steps to keep personal information accurate and up to date.

We store your personal information in electronic records and take reasonable, industry standard steps to protect personal information from loss, misuse or unauthorised access, disclosure, or modification. Information is destroyed or permanently de-identified when it is no longer required for any purpose for which it was collected or when we are no longer required by law to retain it. Employees, volunteers, and data processors working on behalf of the Life 100 are obliged to respect the confidentially of any personal information we hold.

Protecting your personal information

Life 100 will at all times work to ensure that we are taking all reasonable steps to protect your personal information. If we become aware of any security breach relating to your personal information, we will ensure that the breach is managed in accordance with Notifiable Privacy Breach provisions contained in the Privacy Act 2020. This may include notification to you and the Privacy Commissioner where that breach is likely to result in or potentially cause serious harm as defined in the Act. An incident would be assessed on a case-by-case basis by our Privacy Officer.

Requesting access to your personal information

We endeavour to ensure that the personal information we hold about you is accurate, complete and up-to-date. You have rights under the Act and the Privacy Principles to find out what personal information we hold about you and to get a copy of and request correction to the personal information you have supplied. This may be done by making a request in writing and sending it to us at 35 Allenby Ave, Auckland 0624 or by email to shelley@life100.co.nz.

Your personal information will only be kept for as long as it is needed. There may be circumstances where we are required to keep the information for a specified amount of time to meet various legal and regulatory requirements.

Use of Data

We will use your personal information for the purposes for which we collected it, for other related purposes that you would reasonably expect, and as otherwise permitted or required by law. By providing us with your personal information, you consent to us holding, using, and disclosing your personal information for the following purposes:

• To offer the most relevant information and updates related to the work we do at Life 100

• To communicate with you about research and events

• To obtain your feedback on our work

• For any other purposes for which you have given permission

Website and Cookies

When you access our website we may place small data files (or cookies) on your computer or other device to collect information about which pages you view and how you reach them, what you do when you visit a page, the length of time you remain on the page, and how we perform in providing content to you.

A cookie does not identify individuals personally, but it does identify computers. You can set your browser to notify you when you receive a cookie and this will provide you with an opportunity to either accept or reject it in each instance.

We may gather your IP address as part of our business activities and to assist with any operational difficulties or support issues with our services. This information does not identify you personally.

By using our Services you are agreeing to this Policy and you provide your informed and explicit consent to the uses of your Personal Information (defined below) including your Genetic Data. This Policy notifies you of the use of your Personal Information and by proceeding to use our Services you confirm your understanding of its terms.

Partners

Life100 partners with Nebula Genomics to carry out DNA testing. We treat your Personal Information with great care and use this data to provide you the requested DNA testing and reporting services.

To accomplish some of the services, Nebula Genomics may disclose your Genetic Data to third parties that they partner with, such as their partner laboratories. If you chose to participate in their scientific research, they may also disclose your Genetic Data to those third parties that they partner with to conduct such research. Nebula Genomics or Life 100 will never disclose your Genetic Data for research purposes without you first choosing to participate in such research.

Finally, if we are required by law, such as by court order or subpoena, we may share your Genetic Data with law enforcement. We do not disclose your Genetic Data to any law enforcement agency, unless we are legally required to do so.

Genetic Data

Nebula Genomics only use your Genetic Data to process, analyse, and deliver your genetic results as part of the Services you request. Nebula Genomics process Genetic Data pursuant

to your affirmative opt-in consent. To receive results from Nebula Genomics Services you must first create a Nebula account, register your DNA Test kit, and submit your saliva sample to the Nebula Genomic laboratories or our partner laboratories which then analyse your samples and provide us with the resulting data. Nebula uses your Genetic Data for these primary purposes:

Analyse Genetic Data to provide you with information about:

• your ancestry and ethnicity;

• the makeup of your oral microbiome;

• other insights into what your DNA reveals about your traits, personal health, and wellness, based on this information they may also invite you to participate in certain surveys which are entirely optional.

Customise the Nebula Library according to genetic profile;

• Study aggregated, de-identified (or pseudonymized) Genetic Data to provide more accurate ancestry results, oral microbiome, and polygenic score percentiles;

• Improve features and functionality in Nebula Genomics existing Services, as well as build new products to add to their Services and ultimately better serve you.

If you opt into optional research, to analyse Genetic Data to conduct scientific, statistical, and historical research (in which case Nebula Genomics will provide you with separate notice with an opportunity to consent, if required by applicable laws). Your participation in research is completely voluntary, and Nebula Genomics ask for consent from you during your enrolment and registration process prior to using your Genetic Data for any research purposes unrelated to providing the Services. Please refer to the Nebula Genomics Privacy Policy for more information https://nebula.org/blog/privacy-policy/

As Required By Law

We may be required to share your User Data by law, such as by a lawful court order or subpoena. If we are required by law to share your User Data, we will attempt to provide you with notice prior to disclosing your data, unless we are prohibited by law from doing so. Absent a lawful court order or other law requiring us to disclose your User Data, we do not voluntarily disclose your Personal Information with any law enforcement agency.

Business Purposes

In the event that Life100 is acquired or transferred including in connection with corporate transaction, bankruptcy, or similar proceedings (including financing, merger, acquisition, dissolution, or a transfer, divestiture, or sale of a portion or all of our business or assets), we will share your Questionnaire Data and Genetic Data with the acquiring or receiving entity as a part of the transaction or negotiation for such a transaction. Nonetheless, the promises of this Policy will continue to apply to your Personal Information that is transferred to the new entity.

Any new entity will only be allowed to use your User Data, Survey Data, and Genetic Data pursuant to this Policy, or as otherwise authorised by you.

Data Retention Policies

We retain your Personal Information for as long as necessary to provide the products and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes. Because these needs can vary for different data types in the context of different products, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the data, the availability of automated controls that enable users to delete data, and our legal or contractual obligations.

Right to Delete

You may have a right to request that we delete your Personal Information, subject to certain exceptions. To make a verifiable request to delete the Personal Information we have collected about you, you may reach out to the shelley@life100.co.nz

Privacy complaints process

If you are unhappy with how we have handled your personal information, you may send a complaint to Shelley Stoddart. Please provide us with the full details of your complaint along with any supporting documentation.

Shelley can be contacted as follows:

• Email: shelley@life100.co.nz

• Post: 35 Allenby Ave, Devonport, Auckland 0624, New Zealand

If your concerns are not resolved to your satisfaction, you can contact the Privacy Commissioner as below:

• Attention: The Privacy Commissioner

• Email: enquiries@privacy.org.nz

• Website: www.privacy.org.nz

• Telephone: 0800 803 909

This Privacy Policy may be updated

Life 100 reserves the right to change this Privacy Policy at any time. Any change will apply from the date we upload an updated Privacy Policy on our website. Please refer to our website for any updates.

This Privacy Policy was last updated on 2 February 2024