Viome Privacy Notices for U.S. State Residents

Last Updated: November 15, 2024

This state privacy policy or notice (“Privacy Notice” or “Notice”), together with the Viome Privacy Policy (“Privacy Policy”), includes the information and disclosures we are required to provide certain U.S. State residents under applicable U.S. State Privacy Laws identified in this Notice (including “CCPA” and “MHMDA”) and it supplements our Privacy Policy. You should read this Notice and our Privacy Policy carefully.

Applicability

This Privacy Notice applies to U.S. residents of the States of California, Colorado, Virginia, Utah, Nevada, Connecticut, and Washington. This Notice contains information required by the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act, the Colorado Privacy Act (“CPA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Utah Consumer Privacy Act (“UCPA”), the Nevada Data Privacy Law (“NPL”), the Connecticut Data Privacy Act (“CTDPA”), and the Washington My Health My Data Act (“MHMDA”) as amended from time to time (collectively, “U.S. State Privacy Laws”). Viome applies certain privacy controls to all U.S. customers as stated in our Privacy Policy. This Notice makes sure we cover state-specific requirements.

Conflicts

In the event of any conflict between the terms of this Notice and the Privacy Policy, the terms of this Notice will prevail.

Summary of this Notice

• You have the right to know if we sell or share your Personal Information (“PI”).

• You have the right to know if you can opt-out of a sale or sharing of your PI with a third party.

• You have the right to receive an overview of the PI we collect, how we use it, and who we share it with.

• You have a right to limit use and sharing of your sensitive PI.

• You have the right to access your PI and get a copy of it.

• You have the right to correct inaccurate PI.

• You have the right to delete your PI.

• How you can contact us if you have a question.

CCPA and Other State Privacy Notices

When we talk about “Personal Information” or “PI” in this Notice, we mean any information that identifies, relates to, describes, is capable of being associated with you, or could reasonably be linked, directly or indirectly, with you, and as otherwise defined in the U.S. State Privacy Laws. The U.S. State Privacy Laws do not consider publicly available information, deidentified, or aggregate consumer information as “Personal Information.”

We will not attempt to reidentify deidentified information (except as necessary in rare, documented instances based on business necessity under specific produces) and will use it only in deidentified form.

1. Your Rights

Under U.S. State Privacy Laws, you have the right to:

• Know what PI we collect, use, disclose, share, or sell.

• Receive a copy of your PI.

• Correct inaccurate PI.

• Delete your PI.

• Receive your PI in a portable and, if technically feasible, in a readily usable format.

• Opt-Out: of targeted advertising; the sale or sharing of your PI with third parties and/or profiling. Please see our Cookie Policy for more information.

• Limit the use and sharing of your sensitive PI. Sensitive PI includes, but is not limited to, PI that reveals your racial or ethnic origin, religious beliefs, mental or health conditions or diagnosis, sex life or sexual orientation, citizenship or immigration status, genetic data, precise geolocation, or as otherwise defined in applicable U.S. State Privacy Laws. Your Viome Registration Information and Self-Reported Information likely include sensitive PI.

• Not receive discriminatory treatment if you exercise your State Privacy Law rights.

How to Exercise Your Rights

You may correct or update your PI by using your Viome Account Settings. To access Account Settings, you must log in to your Viome Account.

If you do not have a Viome Account, and would like to make a State privacy rights request, or to reconsider or appeal an action we made related to your privacy request, you can email us at privacy@viome.com with the subject line “State Privacy Rights Request”. We will require some additional information to verify your identity in order to process your request.

Request Access

Subject to the following limitations, you may request access to the specific pieces of PI collected:

i) It should be limited to your PI only.

ii) Collected in the 12-month period preceding the date of your request; and

iii) Access is limited to no more than twice in a 12-month period.

To request access, contact our Customer Service by sending a request using the details below.

Visit https://support.viome.com and request Assistance with State Privacy Laws, Access to PI.

Submit a request by email at: privacy@viome.com using your Viome account email address with the subject line: State Privacy Laws: Access to PI

Request Deletion

You may request deletion of PI we process about you, subject to certain limitations. Your rights under State Privacy Laws are not absolute. For additional details regarding account deletion please read our Privacy Policy on Account Closure. Your PI may not be deleted if they are necessary to:

i) Complete the transaction for which they were collected, provide the Service requested, or perform a contract with the Consumer

ii) Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity

iii) Debug products to identify and repair errors that impair existing intended functionality

iv) Ensure the right of another Consumer to exercise his or her right of free speech, or exercise another right provided for by law

v) Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code

vi) Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, and the deletion of the information is likely to render impossible or seriously impair the achievement of such research (if the Consumer has provided informed consent)

vii) To enable solely internal uses that are reasonably aligned with the expectations of the Consumer

viii) Otherwise use your PI, internally, in a lawful manner that is compatible with the context in which you provided them

ix) To comply with a legal obligation

To request deletion, contact our Customer Service by sending a request using the details below.

Visit https://support.viome.com and request Assistance with State Privacy Laws: Deletion of PIor by email at privacy@viome.com using your account email address to request Assistance with State Privacy Laws: Deletion of PI

Our Response

We will respond to your request within 15 days, and in more difficult cases we may extend our response time by another 15-30 days. You can also exercise some of your rights through your Account Settings.

Your rights under the U.S. State Privacy Laws are not absolute and Viome may exercise limitations or exemptions as permitted by the U.S. State Privacy Laws.

Right to Opt-Out of Sale or Sharing

Like many websites, Viome uses cookies (including other tracking technologies such as Pixels) for targeted or cross-context behavioral advertising. Cookies and Pixels require your Web-Behavior Information to work.

The CCPA provides you the right to opt-out of having your PI sold. Under the CCPA, use of your data for cross-context behavioral advertising may constitute a “sale” or “sharing” of personal information. We let advertising providers and pixels to collect identifiers (IP addresses, cookie IDs, and mobile IDs), activity data (browsing, clicks, app usage), device data, and geolocation data through our sites and apps when you use our online Services as further described in our Cookie Policy. In the past 12 months, these categories of personal information may have been “sold” or “shared” as defined under CCPA. We do not have actual knowledge of selling or sharing personal information of users under the age of 16.

Other than as defined under the CCPA as “sale” or “sharing” for advertising, Viome has not sold any PI of Consumers. Viome does not sell Consumer PI to third parties.

No Discrimination

Viome does not discriminate against any Consumer for exercising their rights under the State Privacy Laws.

Global Privacy Control (“GPC”) Signals

Viome believes in providing you with a frictionless experience by responding to Global Privacy Control (“GPC”) signals sent by your browser or mobile device. A GPC is a signal from your browser that notifies us of your privacy preferences, such as whether or not you want us to drop cookies or Pixels on your device. To check your GPC preferences, check out the settings or extensions in your browser or mobile device. Learn more about GPC. Otherwise, you can always opt-out of cross-context behavioral or targeted advertising any time via the Opt-Out Consent option provided to you. You can learn more about use of cookies and pixels by reading Viome Cookie Policy located at: https://www.viome.com/cookie-policy.

Notice of Financial Incentives

Viome may provide special offers and benefits to certain customers. For example, a customer may be invited to get a free Kit via a discount code, receive a Kit as a giveaway promotion, or we may provide with you with the opportunity to win our Kits and Services in a sweepstake or a contest. Such offers and benefits are voluntary, and customers can choose not to accept the free offers. However, if a customer accepts a free offer, we collect the same Personal Information from a customer with a free Kit as a customer who purchased their Kit from us. Both customers’ Personal Information will be handled as detailed in our Privacy Policy and this Notice.

While we do not assign a monetary value to the personal information we collect from a customer with a free Kit, we do receive value in the form of customer loyalty, Research Studies, or Research Participation (if you choose to participate), and increased engagement. The value of the personal information that we collect is reasonably related to the expenses related to our offering to you. This value will vary by customer depending on their engagement on the Viome Services, and many other factors.

Verifying Your Identity

Only you or your authorized representative can act on your behalf to make a verifiable Consumer request on your PI under State Privacy Laws. Your request must:

i) Provide sufficient information to verify that you are a California Consumer

ii) Provide sufficient information that allows us to verify you are the person or the duly authorized representative of the person about whom we collected the PI

iii) Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond

iv) Viome may request additional materials or information for the purposes of validating the authenticity of your request

Note: We cannot give effect to your request if we are unable to verify your identity or authority to make the request.

Complaints:

If you have any complaints or concerns, we encourage you to reach out to us first at privacy@Viome.com. We will attempt to resolve your matter efficiently and effectively within a reasonable timeframe.

If you are a California resident, you may file a complaint with the California Attorney General, or your California county district attorney. If you are a Virginia resident, you may file a complaint with the Virginia Attorney General or contact the Virginia Consumers Protection Hotline at 1-800-552-9963.

2. What We Collect

As detailed in our Privacy Policy, we collect Personal Information for various purposes with privacy principles in mind.

Below, we describe the categories of Personal Information as defined under the CCPA for California residents and may include reference to certain key definitions from our Privacy Policy. Some of the categories below require separate opt-in consent and these categories do not necessarily reflect all of the types of information that we may collect about you. We will provide you a separate notice if we collect any additional Personal Information about you. Some Personal Information included in the categories may overlap with other categories.

Categories of PI Collected and the Source

The type of PI that Viome collects, or has collected from Consumers and study participants in the twelve (12) months prior to the effective date of this Notice, and sources from which they were collected:

• Identifiers, such as name, email, address, phone numbers, IP address, credit card details, birthdate, etc. (Redcap, website, webforms, or mobile app)

• Personal Information, such as name, address, date of birth, IP address, credit card details, birthdate, medical records, etc. (Redcap, website, webforms, or mobile app)

• Biometric Information, such as your Biological Samples (provided by Consumer, study participant and third-party vendors), as defined in the Terms and Privacy Policy.

• Registration Information, such as name, email address, address, country of residence, biological sex, date of birth, phone, password, etc. (Registration)

• Self-Reported Information, such as answers to research and study questionnaires, age, race, color, gender, biological sex, ethnic origin, height, weight, sample collection date, health history, current health state, lifestyle, dietary and other habits (e.g., tobacco use), food sensitivities, sleep data, health data, or exercise data, allergies, physical health conditions, mental health conditions, family history of known health conditions, medications used, surgeries, etc. (questionnaires, Customer Service, feedback, Study Participations, and Research questionnaires)

• Protected Classification Characteristics, such as age, biological sex, ethnicity, parent or legal guardian of a child, disability related health conditions, marital status, disabilities, pregnancies, etc. (questionnaires, Research, surveys, Registration)

• Sensory Data, such as audio, electronic, visual, or similar information health conditions (Consumer or Consumer’s physician)

• Commercial Information, such as purchase activity, credit card details, shipping address, billing address, interactions with Customer Service, purchase history, previous tests, etc. (web server that hosts the order system and Customer Service)

• Geolocation Data, such as physical location of mobile device or computer (web server)

• Professional, Education, or Employment Data, such as highest education received, field of employment or occupation (Registration, Initial questionnaire, study questionnaires, Consent Forms, and Customer Service)

• Tracking Technology Data, such as cookies, web beacons, tags, scripts and device identifiers, behavior data on our website (web server and external parties)

• User Content, such as profiles, posts, emails, feedback, suggestions, notes, messages, photos, and videos uploaded by Consumer (company servers and social and marketing media platforms)

• Internet or Electronic Network Activity, such as accessing Viome website use and interactions with its content, Account activity, content on social media, feedback, contests, sweepstakes, etc. (web server and sales and order system)

• Web-Behavior Information, such as your device ID, IP address, Google analytics, purchase activity, Customer Service interactions, web traffic Consumer use of website, sign up to Account, data generated from Services, collected through log files, browser type, domains, page views, etc. (web server and external parties)

• Inferences and Derived Data, such as Sample Data, Test Data, Test Results, analytics on Consumer data, recommendations (Viome artificial intelligence database and Viome proprietary technology)

• Other Types of Information, as identified in Viome Privacy Policy: https://www.viome.com/privacy-policy

Viome may access publicly available information or public records from federal, state, or local government records (e.g., vital records, census data).

3. How We Use Your Personal Information

As defined under the CCPA for California residents, Viome may use Personal Information listed above for the business or commercial purposes described below or at your direction. Such purposes include:

• To Provide our Services to you

• Allow Consumer to place orders and make payments for the Service

• To fulfill Consumer’s Service orders including shipping

• Data analysis to provision the Services and send Test Results

• Improve the analytics and AI technology used to generate recommendations

• Recruit Consumers for external Study Participations

• Allow Consumer to be part of Viome Research

• Allow Consumer to participate in Study Participations

• To send questionnaires, surveys, study notifications

• Provide Consumer with marketing and advertising communications

• Allow Consumer to share their experience and feedback with others

• Quality assurance on Service

• To provide security and integrity of our data and systems

• Provide Customer Service Support

• To determine the eligibility of a Consumer for ordering a Test

• To obtain a Test requisition approval from a licensed physician

• To obtain an approval for Test Result release from a licensed healthcare professional

Categories of PI Disclosed to Third Parties:

Viome may share certain PI collected as stated in this Notice with third parties such as service providers, collaborators, and consultants, for business operation and other purposes including:

• Audit: Audits related to orders, confirmations, verifications, returns, payment processing, data privacy and security, and accounting and finance

• Provisioning: For delivery of orders by shipping carriers (local and international) and payment processors transactions

• Security: Protect Consumer and company data against malicious, deceptive, fraudulent, or illegal activity, detect security incidents, provide general IT service and security, data encryption, de-identification, assure data safety, accuracy, privacy, and integrity, access control and reporting. Please see Privacy Policy on Information Security Measures

• Inventory Management: Manage inventory, order system, and fulfilling Consumer orders

• Research: Scientific research by Viome Research Institute with the intent to improve Service and publish discoveries in peer-reviewed scientific journals

• Customer Service: Optimize Customer Service, automate routine inquiries, improve quality and efficiency

• Product Improvement: Systems used for improving data analytics, minimal or negligible exposure to outside vendors

• Quality Assurance: Enhance the quality of Sample collection process, minimize sample collection errors and test failures, reduce Sample return turn-around time, and provide data relevant to process improvements

• Study Participations: Study specific collaborations with collaborators on disease conditions, clinical trials, and treatments

• Test Request Approval: Approval of a Test Request by a licensed physician from our physician oversight and support service partner (“EHS”) or another licensed healthcare provider

• Test Result Review and Approval: Review and approval for release of Test Result

• Pre and Post Test Consultations: For conducting pre-test and post-test consultations with a licensed healthcare provider, an EHS healthcare professional or counselor

• EHS Post Consultation Survey: Conduct surveys on post-test consultations after and obtain feedback on the consultation

If you have given your explicit consent, for example via a Consent Form or a data transfer authorization or other consent document, we may use, disclose, or share your Personal Information for business, commercial or research purposes to third parties. The purpose, such as recruitment for Research Participation, or transfer your data to your physician or clinician, may vary and will be described in the Consent Form or the authorization used.

In the past 12 months, we have disclosed Personal Information to service providers and contractors for the business purposes described above, and to third-party advertising and marketing companies for cross-context behavioral or targeted advertising as further described in our Cookie Policy located at: https://www.viome.com/cookie-policy.

We do not use or disclose sensitive Personal Information for purposes other than the business purposes permitted by CCPA, which include, for example, to perform our Services, to detect and prevent security incidents, to perform services on behalf of the business, and other purposes as allowed by CCPA.

Methods for Submitting Requests

Visit https://support.viome.com and send a request to our Customer Service or

Email privacy@viome.com using your account email address to request (CCPA Right Request)

Submit by mail:

Viome Customer Service

Viome Life Sciences, Inc.

205 108th Ave NE, STE 150

Bellevue, WA 98004

Phone: Call Customer Service at 1-855.958-4663

4. Changes to this Notice

Viome will periodically review and update this Notice. We recommend visiting this page to stay aware of any changes. If we modify this Notice, we will make the revised notice available through our website.

Key Definitions

• Consumer: Under CCPA, natural persons who reside in California, including (1) individuals who are in California for other than a temporary and transitory purpose; and (2) individuals who are domiciled in California, but are outside the state for a temporary or transitory purpose

• PI: as defined in the CCPA, and includes information that can be used to identify you, either alone or in combination with other information, and any other information that could reasonably be linked with a particular Consumer or device

Washington Consumer Health Data Privacy Policy

If you are a Washington resident, the Washington My Health My Data Act (“MHMDA”) requires us to provide you with the following additional information about: (1) the categories of “Consumer Health Data” (as defined in the MHMDA) we collect including how we use the data; (2) the categories of sources from which the consumer health data are collected (3) the categories of consumer health data that are shared; (4) a list of the categories of third parties and specific affiliates with whom we share the consumer health data; and (5) how a consumer can exercise the rights provided by the act.

Please see the following chart for the information:

Your MHMDA Rights

• You have the right to confirm whether we collect your Consumer Health Data, how we use it, and whether we shared or sold it, including the contact information of any third parties to whom we shared or sold your Consumer Health Data. 

• You also have the right to obtain a copy of that Consumer Health Data free of charge. 

• You have the right to withdraw your consent from our collection and sharing of Consumer Health Data. 

• You have the right to have your Consumer Health Data deleted. 

How to Exercise Your Rights?

To exercise your MHMDA rights, you may utilize the controls in your Viome Account Settings or email us at privacy@Viome.com.

Complaints

If you have any complaints or concerns, we encourage you to reach out to us first at privacy@Viome.com. We will attempt to resolve your matter efficiently and effectively within a reasonable timeframe.

If for any reason we decline a request you make while exercising these rights, you have the right to appeal our decision. If you are a Washington resident, you may file a complaint with the Washington Attorney General or contact the Washington Consumers Protection Hotline at 1-800-551-4636.

How to Contact Us

If you have any questions regarding the information presented on this Notice, please contact us at privacy@viome.com using your account email address with the subject line (Rights under State Privacy Laws).

Viome Life Sciences, Inc.

Attn: Chief Privacy Officer

205 108th Ave NE, STE 150

Bellevue, WA 98004

Email: privacy@viome.com