Privacy & Consumer Health Data Policy

This Privacy and Consumer Health Data Policy (the “Policy”) describes how Advocate AI Corp. DBA Reticular (“Reticular,” “we,” “our,” or “us”) collects, uses, discloses, retains, and protects personal information through reticular.com, our mobile application, genetic screening and Embryo Report products, counseling and support services, and related features (collectively, the “Services”). This Policy also serves as our consumer health data privacy policy where applicable law requires one.

Genetic and reproductive health information can be especially sensitive. We do not sell genetic data or consumer health data, and we do not use genetic test results, report contents, uploaded medical files, or counseling notes for targeted advertising.

1. Information We Collect

Account, identity, and contact information. We may collect your name, email address, phone number, login and account identifiers, communication preferences, and information you provide when you contact us, take a quiz, request information, book a call, or participate in counseling. Authentication providers process credentials used to sign in; Reticular does not receive your password from a third-party sign-in provider.

Genetic, reproductive, and other consumer health data. Depending on the Service you choose, we may collect or derive:

• Saliva or cheek-swab sample identifiers and sample-processing status;
• DNA and genomic data, including raw or processed sequencing files, variants, genotypes, carrier findings, polygenic risk scores, and information inferred from genetic analysis;
• Embryo and PGT-related data, including PGT-A reports, embryo identifiers, chromosome results, embryo grades, sequencing or genotype files, and analyses derived from those records;
• Fertility, pregnancy-loss, medical, family-history, medication, laboratory, diagnostic, demographic, ancestry, and treatment information you choose to provide;
• Quiz answers and product recommendations that may reveal or infer fertility goals, treatment status, or other health-related interests; and
• Reticular reports, report status, genetic counselor notes, support communications, eligibility reviews, and other outputs produced while providing the Services.

A laboratory or sample-processing provider, rather than Reticular, may take possession of and process your physical biological sample. Reticular receives sample status, analysis data, and results needed to provide the Service. The provider’s handling and retention of a physical sample is also subject to its agreement with Reticular and applicable law.

Partner and household information. Couple-based Services may associate two adults’ account, order, sample, genetic, reproductive health, and report information. If you provide information about a partner or another person, you must be authorized to provide it. Each person may be asked to create an account, submit a sample, or provide consent before we process information that relates to them.

Order, shipping, and payment information. We may collect the product purchased, purchase amount, discounts, transaction status, payment-provider identifiers, refund information, recipient name, email, and shipping address. Stripe processes website card payments and may make eligible installment options such as Affirm available. Flex processes HSA/FSA checkout. Apple processes App Store purchases. The applicable payment provider collects payment credentials and other information it needs to authorize the transaction; Reticular generally receives transaction status and identifiers rather than full payment-card details.

App, device, and usage information. We may collect device and browser type, operating system, IP address, approximate location, referral URL, timestamps, pages and features used, downloads, cookie and device identifiers, campaign parameters, and advertising click identifiers. If you enable App features, we may also receive push-notification tokens, microphone recordings submitted for voice features, and whether device-level biometric authentication is enabled. Face ID and Touch ID templates remain on your device and are not received by Reticular.

Communications and scheduling. We collect messages you send to us and operational records about email, text-message, phone, support, and appointment communications, including delivery status and consent records where applicable. A counseling or support provider may create notes needed to provide the Service. We do not record a call unless we give notice and obtain any consent required by law.

2. Sources of Information

We collect information from the following categories of sources:

• You, including through accounts, purchases, quizzes, forms, uploads, samples, messages, and calls;
• A partner, purchaser, or authorized representative who provides information for a couple-based Service;
• Clinics, genetic counselors, laboratories, PGT providers, and other providers you authorize or that help fulfill the Service you request;
• Payment, financing, HSA/FSA, shipping, fulfillment, authentication, and communications providers; and
• Your browser, device, cookies, and analytics or advertising partners where enabled.

3. How We Use Information

We use personal information, including consumer health data, to:

• Create and secure accounts and verify identity;
• Fulfill orders; ship and track kits; confirm sample or embryo-data compatibility; process samples and genomic files; perform genetic analyses; and generate, deliver, explain, and support reports;
• Link the required participants in a couple-based Service and coordinate the applicable analysis and counseling;
• Determine, document, and process eligibility for the limited No-Finding Promise when the purchased product is expressly eligible;
• Process purchases, HSA/FSA transactions, financing options, refunds, and related records;
• Schedule counseling and support, respond to requests, and send operational communications;
• Send marketing email or text messages when permitted and honor unsubscribe, STOP, cookie, and other preference choices;
• Prevent fraud, protect security, troubleshoot, audit, and comply with law;
• Measure use of our general-audience pages and the effectiveness of campaigns; and
• Improve and develop the Services using aggregated or deidentified information.

We do not use identifiable genetic data, report contents, uploaded health files, or counseling notes to train general-purpose artificial intelligence models or for unrelated research without separate, express consent. We may use information that has been deidentified so that it cannot reasonably be linked to you, and we do not attempt to reidentify it except to test and improve our deidentification safeguards. Deidentified genetic or phenotypic information may be disclosed to qualified research partners only when permitted by applicable law and subject to safeguards requiring it to remain deidentified.

4. How We Disclose Information

We disclose information only as described below, at your direction, or as otherwise permitted or required by law. The information disclosed depends on the Service and provider involved.

• Infrastructure and security providers, such as Supabase, Vercel, and cloud-computing providers, for authentication, hosting, databases, storage, monitoring, and security;
• Laboratory, genomic-analysis, clinical, and counseling providers for sample processing, quality review, genetic analysis, report preparation, and counseling;
• Payment and benefits providers, including Stripe, Flex, Apple, and payment-method or financing partners such as Affirm, to authorize and administer purchases, HSA/FSA payments, and refunds;
• Shipping and fulfillment providers for kit delivery, returns, tracking, and fulfillment;
• Document, application, and AI service providers, such as Reducto, Modal, and OpenAI, when needed to provide a feature you use, subject to contractual and technical controls;
• Communications, scheduling, and customer-relationship providers, such as Resend, Cal.com, Lightfield, and configured email or SMS providers, to deliver communications and coordinate support;
• Analytics and advertising providers, such as Google, Vercel Analytics, PostHog, Meta, and TikTok, for general website measurement and campaign attribution where enabled; and
• Professional advisers, authorities, and transaction parties when reasonably necessary to comply with law, protect rights and safety, obtain professional advice, or complete a financing, acquisition, reorganization, bankruptcy, or sale of assets subject to applicable privacy obligations.

We may disclose identifiers, order and shipping information, sample status, and the genetic or health data needed for laboratory, analysis, report, fulfillment, counseling, or support providers to perform the Service you requested. We do not intentionally disclose genetic results, report contents, uploaded health files, counseling notes, or quiz answers to advertising platforms for targeted advertising. We do not currently share consumer health data with any corporate affiliate.

We do not sell genetic data or consumer health data. We do not disclose genetic data to an insurer or employer for underwriting, coverage, benefit, or employment decisions. We do not voluntarily disclose genetic data to law enforcement; we may respond if legally compelled by valid process, after evaluating the request and any available objections.

5. Cookies, Analytics, and Advertising Choices

We use necessary cookies for security, authentication, and core functionality. Where enabled and permitted, optional analytics and advertising technologies help us understand general website use, attribute campaigns, and measure actions such as quiz completion, checkout starts, and purchases. These technologies may process browser and device information, IP address, general location, referral information, campaign identifiers, and limited conversion details.

You can manage optional technologies through our cookie banner, browser settings, and applicable platform controls. If you decline optional analytics and advertising cookies, we will not intentionally load optional advertising pixels for that browser session, except where otherwise permitted by law. You may also email us with the subject “Do Not Sell or Share My Personal Information.”

6. Genetic and Consumer Health Data Rights

Depending on where you live, you may have the right to confirm whether we collect, use, share, or sell your personal or consumer health data; access or obtain a portable copy; correct it; delete it; withdraw consent from future collection or sharing; limit certain uses of sensitive personal information; opt out of sale, sharing, targeted advertising, or certain profiling; and receive a list of third parties or affiliates with whom your consumer health data was shared. You also may have the right to appeal a decision we make about a request and to exercise rights without unlawful discrimination.

You may also request deletion of your genetic data and account, a copy of your genetic data, or destruction of a biological sample held by a sample-processing provider. Where required by applicable law, we will direct relevant processors and providers to honor an authenticated deletion, consent-revocation, or sample- destruction request. Some limited information may be retained when legally required or permitted, including transaction, security, compliance, and dispute records.

Submit a request to contact@reticular.ai or support@reticular.ai. You do not need to create a new account to make a request. We may ask for information reasonably necessary to authenticate you or an authorized agent. We will respond within the period required by applicable law. To appeal, email contact@reticular.ai with the subject “Privacy Rights Appeal” and explain the decision you are appealing. If an appeal is denied, you may contact your state attorney general or other applicable privacy regulator.

7. Consent and Service Necessity

We collect and disclose consumer health data with your consent or to the extent necessary to provide a product or Service you request, as permitted by applicable law. Where a separate consent is required, the request will identify the data, purpose, recipients, and how to withdraw consent. Withdrawing consent applies prospectively and may prevent us from completing a Service that requires the affected information. It does not require us to undo processing already completed lawfully or retain information we are legally required to keep.

8. Security

We use administrative, technical, and physical safeguards designed for the sensitivity of the information, including encryption in transit and at rest, role-based access controls, logging and monitoring, and access limited to personnel and providers who need the information to perform the requested Service. No system is completely secure, and we cannot guarantee that unauthorized access or disclosure will never occur.

9. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing reports and counseling, maintaining accounts, fulfilling transactions, meeting legal or regulatory obligations, resolving disputes, preventing fraud, and enforcing agreements. Retention varies by data type and Service. Genetic files and reports are generally retained while your account is active or as needed to provide the Service unless you request deletion and no exception applies. Payment and transaction records may be retained longer for tax, accounting, fraud, and legal obligations.

After we authenticate a deletion request, we aim to remove covered information from active Reticular systems within 30 days unless applicable law permits or requires retention. Deletion from archived or backup systems may take longer and, where Washington law applies, no more than six months. We notify relevant processors and providers of covered deletion requests as required by law. Deidentified information that cannot reasonably be linked to you may be retained.

10. International Processing

Reticular is based in the United States. Information may be processed in the United States and other locations where our providers operate. Those locations may have privacy laws different from the laws where you live. We use protections required for applicable transfers.

11. Children

The Services are intended for adults age 18 or older. We do not knowingly collect personal information from children through the Services. Contact us if you believe a child has provided information to us.

12. Changes to This Policy

We may update this Policy as our Services or legal obligations change. We will post the updated Policy and revise the effective date. If a change materially affects how we use previously collected sensitive or consumer health data, we will provide any additional notice or request any consent required by law before applying the change.

13. Contact Us

Questions, complaints, or privacy-rights requests may be sent to contact@reticular.ai. Genetic- data access, deletion, and sample-destruction requests may also be sent to support@reticular.ai. Reticular is Advocate AI Corp. DBA Reticular, San Francisco and Boston, United States. You may also file a complaint with your state attorney general or another regulator with authority over your concern. California complaints concerning the Genetic Information Privacy Act may be submitted to the California Attorney General or another enforcement authority identified by that law.

Last Updated: August 13, 2026