PRIVACY POLICY

Naveris, Inc. (“Naveris”, “We” or “Us”) is committed to protecting your privacy. We are located in the USA and personal information provided to us from outside the USA will be transferred to the USA. This Privacy Policy describes the specific practices and guidelines that we follow to help ensure the confidentiality and security of your personal information when you use our websites located at www.naveris.com, the Naveris portal, mobile applications, and any websites or services that reference this Privacy Policy (collectively the “Websites” or “Services”).

This Privacy Policy does not apply to Protected Health Information as defined by and subject to the Health Insurance Portability and Accountability Act (“HIPAA”). For information on how we use and disclose Protected Health Information, and your rights regarding Protected Health Information, see our HIPAA Notice of Privacy Practices available.

Information We Collect and Sources of the Information
Naveris may collect, store, and use personal information when it is voluntarily submitted to us by you (emails, Website review, submission of forms, correspondence, notes of telephone calls) or automatically collected from activity with our Websites or Services. We may also collect personal information from our business partners and service providers and from authorized third-party sources such as your employer or an agent or third party acting on your behalf.

The categories of information that we may collect from you include the following:

Personal identifiers such as name, address, telephone number, email address, account name, and unique personal identifiers such as IP addresses and device identifiers
Professional or employment-related information, such as professional or employment history, performance evaluations, education, work history, credit information, bank account numbers, or other financial information for payment and background checks
Protected classification characteristics under California or federal law such as age, race, marital status
Geolocation data
Internet or other electronic network activity information, such as information regarding your interaction with any websites associated with our business

The specific categories and sources of personal information depend on the Service and your interaction with us.

How We Use Your Personal Information
Naveris will use your personal information for the following business purposes:

Providing you with the Services, such as managing your account, processing or fulfilling transactions, and any other purpose for which it was collected.
Communicating with you and providing support, such as to provide you information about the Services, to provide you with customer support, and to address your inquiries, feedback, requests, and other communications you send us.
Operating, evaluating, and improving our business, such as performing accounting, auditing, record keeping, and other internal functions; analyzing, maintaining, and improving our Services; and developing new products and services.
Complying with law, such as to comply with legal obligations and process and contractual obligations, as well as our policies.
Identification and authentication, such as to verify your identity and to protect the security of your personal information.
Marketing, such as to understand your preferences better and to appropriately personalize our marketing.
Exercising our legal rights where it is necessary to do so, for example to detect, prevent and respond to fraud claims, intellectual property infringement claims, or violations of law or our terms and conditions.
Protecting against harm: we may use personal information as we deem necessary to protect the rights and safety of us, you, or others.

De-identified, aggregated, pseudonymized and anonymized data may be used for any purpose, including scientific research purposes, such as for the improvement and development of our products. When we maintain and use de-identified data, we will not attempt to re-identify the data unless expressly permitted or required by law.

Sharing Your Personal Information
Naveris may disclose certain categories of your personal information to others in order to achieve our business purposes as follows

Service providers and business partners: We engage service providers and our business partners to assist us with operating our businesses and providing you with our Services. Naveris will give these service providers only the personal information they require to perform the contracted-for services, and we require such providers to agree to contractual terms to maintain the confidentiality of the information they receive.
To comply with law or cooperate with reasonable legal requests: We may disclose your personal information to law enforcement agencies, courts, other government authorities or other third parties where we believe necessary to comply with a legal obligation. We may disclose personal information as we deem reasonably necessary to support lawful investigations or otherwise to protect our rights or the rights of you or any other party.
In the context of a transaction: We may disclose your personal information to potential transaction partners, service providers, advisors, and other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell or transfer all or a portion of our assets or business.

Retention of Personal Information
We will keep your personal information for as long as we have a relationship with you or until we no longer need it to fulfil the purposes for which it was collected. Once our relationship with you has come to an end or we no longer need the information to fulfil the purposes for which it was collected, we will retain your personal information for a period of time that enables us to:

Maintain business records for analysis and/or audit purposes.
Perform internal research to assess and improve our business.
Comply with record retention requirements under the law or other relevant legal requirements or our internal document retention policy.
Defend or bring any existing or potential legal claims.
Deal with any complaints regarding the Services.

Additional Disclosures for California Residents
This section applies to the personal information of residents of California and supplements the other sections of this Policy.

For information on the categories of personal information that we have collected in the past 12 months, the purposes for which we process that personal information, and how we disclose that personal information, please refer to the sections above.

In the preceding 12 months, we have disclosed the following categories of personal information for a business purpose described above. We also may “sell” or “share” your personal information, as defined by applicable law, with third parties for those business purposes. In the preceding twelve (12) months, we may have sold or shared your personal information, or disclosed it for a business purpose, to the following categories of third parties:

Category	Categories of Third Parties to Whom We Disclosed Personal Information for Business Purposes	Categories of Third Parties to Whom We Sold or Shared Personal Information
Identifiers	Relevant healthcare providers of patients	Analytics providers
Personal information described in § 1798.80(e)	N/A	N/A
Protected classification characteristics under California or federal law	Relevant healthcare providers	N/A
Internet or other similar network activity	N/A	Analytics providers
Professional or employment-related information	N/A	N/A

We do not have actual knowledge that we sell or share personal information of minors under 16 years of age. We do not use personal data for profiling or other automated decision purposes.

Your California Privacy Rights and Choices
The California Consumer Privacy Act (“CCPA”) provides consumers with specific rights regarding their personal information, subject to certain exceptions, as described below. This section describes your CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights
You have the right to request that we disclose certain information to you about our collection and use of your personal information in accordance with applicable law. Generally, this Privacy Policy provides information about our collection and use of personal information. If you want specific information about your data, you will need to request this information in writing. Once we receive your written request and verify your identity, as required under the law, we will disclose to you:

The categories of personal information we collected about you.
The categories of sources for the personal information we collected about you.
Our business or commercial purpose for collecting, selling, or sharing that personal information.
The categories of third parties with whom we share that personal information.
The specific pieces of personal information we collected about you (also called a data portability request).

Correction Rights
You have the right to request that we correct the personal information we maintain about you if that information is inaccurate.

Deletion Request Rights
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive your written request and verify your identity, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

Opt-Out of Sale or Sharing
You have the right to opt-out of the sale or sharing of your personal information. To opt out of the sale of your personal information or sharing of your personal information for cross-context behavioral advertising, click or use the Global Privacy Control signal. Note that if you clear your cookies on a particular browser or device, you may need to re-submit your opt-out request. Requests sent using the Global Privacy Control will apply to the device and browser from which they are submitted. For more information about the Global Privacy Control, please visit https://globalprivacycontrol.org/.

Exercising Access, Data Portability, Correction, and Deletion Rights
To exercise the access, data portability, correction, and deletion rights described above, please submit a verifiable consumer request to us by either:

Call us at 833-628-3747
Email us at privacy@naveris.com

You may only make a consumer request for access or data portability twice within a 12-month period. Your written request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request. However, making a written request does not require you to create an account with us.

Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

Deny you goods or Services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or Services.

Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Additional Disclosures for Residents of Nebraska and Texas
This section applies to the personal information of residents of Nebraska and Texas and supplements the other sections of this Privacy Policy.

For information on the categories of personal information that we collect, the purposes for which we process that personal information, and how we disclose that personal information, please refer to the sections above. For an explanation of the types of information we share with third parties, please refer to the table in “Additional Disclosures for California Residents” section above.

In some cases we may share your information with third parties who may use your information for their own purposes, including for purposes of marketing and advertising. These disclosures may be considered “sales” or “targeted advertising” under applicable privacy laws. For more information about the categories of personal information that we may sell to or share with third parties, and the categories of such third parties, see the table in “Additional Disclosures for California Residents” section above.

Depending on where you reside, and subject to certain exceptions, you may have the following rights with respect to your personal information:

Access: You may have the right to request that we confirm whether we process your personal information and that we provide you access to such personal information.
Data Portability: You may have the right to request that we provide a copy of your personal information in a portable and, to the extent technically feasible, readily usable format.
Correction: You may have the right to request that we correct inaccuracies in the personal information that we process.
Deletion: You may have the right to request deletion of your personal information.
Opt-Out of Sales and Targeted Advertising: You may have the right to request that we not process your personal information for the purposes of targeted advertising and sales as those terms are defined by applicable state law. You may opt out of sales and/or targeted advertising by clicking and following the instructions. Where required by law, we also honor requests to opt-out submitted via privacy preference signals recognized under applicable local law, such as the Global Privacy Control.

You may submit requests to exercise your other rights by either:

Calling us at 833-628-3747
Emailing us at privacy@naveris.com

You may also have the right to appeal a refusal to take action on your request by emailing us at privacy@naveris.com with the subject line “Appeal of Rights Request Decision.”

Washington Consumer Health Data Privacy Notice
This notice is only applicable to residents of Washington state.

Naveris, Inc. (“Naveris,” “we,” “us,” or “our”) provides this Washington Consumer Health Data Privacy Notice as a supplement to our main Privacy Policy to explain our practices regarding collection, use, and sharing of consumer health data as defined by the Washington My Health My Data Act (“MHMDA”) that we may receive from visitors to the Naveris website (www.naveris.com) and from individuals who submit inquiries or requests through our Contact & Support page, provider or patient resource pages, or similar web-based tools (collectively, the “Website”).

HIPAA and Our Notice of Privacy Practices
Most health-related information that Naveris collects in connection with its diagnostic testing services (including NavDx^® and related liquid biopsy testing), laboratory operations, and patient support resources constitutes Protected Health Information (“PHI”) as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, “HIPAA”). PHI is governed exclusively by our Notice of Privacy Practices Under HIPAA, and not by this Notice.

For a full description of how Naveris handles personal information collected through the Website more broadly, please also see our Privacy Policy.

Consumer Health Data We Collect Through the Website
In the context of website interactions, “consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, but that does not constitute PHI subject to HIPAA. Through the Website, we may collect the following limited categories:

Self-Reported Health Information. Health-related information you choose to include when submitting an inquiry or request through our Contact & Support page or similar web-based tools — for example, information about a diagnosis, medical condition, or treatment that you voluntarily share in the body of a message or form field.
Location and Usage Data That May Infer Health Status. Internet protocol (IP) addresses, browser type, and website navigation, including visits to condition-specific or product-specific pages (such as our HPV+ Cancer & NavDx^®, Head & Neck Cancer, or Anal Cancer pages) that may, individually or in combination, permit inferences about your health status or condition.

How We Collect Consumer Health Data
We collect consumer health data through the Website in the following ways:

Directly from You. Information you type into our Contact & Support page, patient or provider resource forms, or similar web-based registration or outreach tools, including any health-related details you choose to include.
Automatically collected data about your device and browsing activity on the Website, including IP address, geolocation inferred from IP, pages visited, and time spent on condition- or product-specific pages. For more information about our use of cookies and tracking technologies, please see our Privacy Policy.

How We Use Consumer Health Data
We use consumer health data collected through the Website only for the following purposes, and will not use it for any purpose inconsistent with those described in this Notice without first obtaining your consent:

Responding to your inquiry or request submitted through the Website;
Routing your inquiry to the appropriate Naveris team (e.g., Client Services, patient resources, or provider support);
Improving the Website and understanding how visitors navigate product and condition-specific pages;
Ensuring the security and integrity of the Website; and
Complying with applicable legal obligations, including the MHMDA and other privacy laws.

We will not use consumer health data collected through the Website for targeted advertising or sale to third parties without your consent.

Sharing of Consumer Health Data
We do not sell consumer health data collected through the Website. We may share such data only in the following limited circumstances:

Internally, to Respond to Your Inquiry. We may share consumer health data with the Naveris team member or function best positioned to respond to your inquiry, consistent with the purpose for which you submitted it.
With Service Providers. We may share data with third-party vendors who provide services such as website hosting, customer relationship management, and technical support, under contractual obligations that prohibit them from using the data for any purpose other than providing services to Naveris.
For Legal and Safety Purposes. We may disclose consumer health data to comply with applicable law, respond to lawful government requests, or protect the rights, property, or safety of Naveris, our users, or the public.
Business Transfers. In connection with a merger, acquisition, or sale of substantially all assets, consumer health data may be transferred as part of that transaction, subject to this Notice and applicable law.

We will not share consumer health data collected through the Website for advertising, data brokerage, or any other purpose not described in this Notice without your prior written authorization.

Your Rights Under the MHMDA
As a Washington State resident, you have the following rights with respect to consumer health data we hold about you that is subject to this Notice. These rights are in addition to any rights you may have under HIPAA (see our Notice of Privacy Practices Under HIPAA) or other applicable state privacy laws (see the sections above).

Right to Confirm and Access. You have the right to confirm whether we are collecting, sharing, or selling consumer health data about you that is subject to this Notice, and to access the specific categories of such data we hold.
Right to Withdraw Consent. Where our collection or use of your consumer health data is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Right to Deletion. You have the right to request deletion of consumer health data we hold about you that is subject to this Notice, subject to exceptions such as data needed to comply with a legal obligation or protect against fraud.
Right to Non-Discrimination. We will not discriminate against you for exercising any of your rights under the MHMDA, including by denying services, charging different prices, or providing a different level of service.
Right to Appeal. If we decline to act on your request, you have the right to appeal our decision as described below.

How to Exercise Your Rights
To exercise any of the rights described in this Notice with respect to consumer health data subject to the MHMDA, please contact us through one of the following methods:

Email: privacy@naveris.com
Phone: (833) 628-3747
Mail: Naveris, Inc., Attn: Privacy Officer, 21 Hickory Drive, Suite 600, Waltham, MA 02451

We will respond to verifiable consumer requests within 45 days of receipt. If we require additional time (up to an additional 45 days), we will notify you of the extension within the initial 45-day period. We may need to verify your identity before processing your request. We will not require you to create an account solely to submit a request.

Please contact Naveris with any questions or concerns about this Notice or our consumer health data practices at: privacy@naveris.com.

You also have the right to file a complaint with the Washington State Attorney General’s Office: 1125 Washington St SE, Olympia, WA 98504 | (800) 551-4636 | www.atg.wa.gov.

Security of Your Personal Information
Naveris maintains reasonable and appropriate administrative, technical, and physical safeguards to protect personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction. It is important to remember, however, that no system can provide 100% security at all times. Accordingly, we cannot guarantee the privacy and security of information stored on or transmitted using our Services.

Cookies
When you use our online Services, both we and certain third parties (such as analytics providers) collect information about your online activities, over time and across third-party websites, to analyze and improve our services.

Certain elements of our Services and/or html email correspondence may use session cookies, persistent cookies or web beacons to anonymously track unique visitors, save website preferences, and to allow us to recognize visits from the same computer and browser. You have the option to reject some or all Website cookies on your computer and still use the Services. If you choose to reject all cookies, your access to the Website may be limited.

Aggregate Data Collection
Naveris tracks visits to our Services using visitor logs and tracking-codes to compile aggregate statistics. This aggregate information is collected service-wide, and includes website, application, and device statistics. When you browse our websites and access our applications, our system automatically collects information such as your web request, Internet Protocol (IP) address, browser type, browser language, domain names, referring and exit pages, Uniform Resource Locator (URL), platform type, location, unique device identifier, pages viewed and the order of these page views, the amount of time spent on particular pages, the date and time of your request and one or more cookies that may uniquely identify your browser.

When you access our Services through a mobile device, we may receive or collect and store a unique identification numbers associated with your device or our mobile application (including, for example a Unique ID for Advertisers (IDFA), Google Ad ID, or Windows Advertising ID), mobile carrier, device type, model and manufacturer, mobile device operating system brand and model, phone number, and, depending on your mobile device settings, your geographical location data or similar information regarding the location of your mobile device.

Third-Party Services
Naveris uses certain third-party services and analytics providers to: (1) send you customized notifications if you have provided us your email address, (2) analyze trends, (3) administer the Services, (4) improve the design of our Services, and (5) otherwise enhance, monitor, and troubleshoot the Services we provide.

Naveris does not directly display advertisements in our applications or services.

Linked Sites
Naveris may provide links to websites operated by third parties that are not covered by this Policy. Naveris does not maintain these sites and is not responsible for the privacy practices of sites it does not operate. We encourage you to review the privacy policies posted on those websites.

Information Access, Updates and Choice
You may choose to provide information to Naveris by completing the contact form, sending us an email, engaging with our client service team or otherwise contacting us. If you are a Naveris Portal user, you may have an opportunity to elect to receive certain communications from us. Naveris email correspondence will include instructions on how to update certain personal information and how to unsubscribe from our emails, newsletters, and postal mail correspondence. If you opt-in to Naveris services, including opt-in consent for SMS (text) messages, be advised that Naveris does not share any opt-in consent information with any third-party organizations.

You may “opt out” of receiving communications from us related to our products and services and/or to request the removal of your contact information from our database by writing to us at the email address set forth below. However, Naveris cannot withdraw any previous disclosures made with your authorization, and we reserve the right to retain and disclose your information as permitted or required by law or regulation. You may also request access to your personal data by writing to us using the contact information below.

Do Not Track
We do not currently employ a mechanism to act upon “Do Not Track” signals. If we do so in the future, we will describe how we do so in this Policy.

Children’s Privacy
Naveris Services are directed toward adults. We do not knowingly collect or solicit any personal information from children under the age of 13. If you are under 13, you must have permission from your parent or legal guardian before accessing or using our Services. If we become aware that we have collected any personal information from children under 13, we will promptly remove such information from our Services. If you believe that a child under the age of 13 may have provided us with personal information, contact us as specified in the Contact Us section of this Privacy Policy.

Changes to Our Privacy Policy
We reserve the right to update and revise this Privacy Policy as necessary. If we change our Privacy Policy and Notices, we will post those changes on our Websites to keep you aware of what information we collect, how we use it, and under what circumstances we may disclose it. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us
You can contact Naveris using our Website contact page or sending an email to one of the addresses below. We address questions and complaints about privacy and the collection or use of personal information in a timely manner. Please include your contact information and a detailed description of your request or privacy concern.

Naveris, Inc.
Attention: Privacy Officer
21 Hickory Drive, Suite 600
Waltham, MA, 02451
(833) 628-3747

Privacy Officer email: privacy@naveris.com

When we receive your correspondence, we are likely to request evidence of your identity, to ensure that your personal data and information connected with it is not provided to anyone other than to you.

Effective Date: May 27, 2021

Last Updated: September 24, 2026