THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

BioCollections Worldwide, Inc. ("BCW," "we," "us," or "our") is a CLIA-certified biospecimen collection and processing organization headquartered in Miami, Florida, with collection sites throughout the United States, Puerto Rico, and internationally. We know the health, personal, and business information you share with us is sensitive, and we are committed to keeping it secure. To protect your data, we maintain strict administrative, physical, and technical safeguards, including role-based access controls, network firewalls, encrypted communications, and secure facilities.

This Privacy Policy applies to personal information we collect and process in connection with our business activities, including information relating to research study participants and biospecimen donors, as well as clients, customers, business contacts, website users, and other individuals who interact with BCW.

This Privacy Policy outlines how we collect, use, and disclose personal information, Protected Health Information ("PHI"), and study-related data in connection with our business activities, including research studies, biospecimen collection and processing, testing, and related services. This policy applies to BCW and its affiliated divisions and operating units, including Talent Testing Service ("TTS"), I Know My Status ("IKMS"), Laboratorio Clinico BCW, whenever they process PHI on your behalf. To ensure strict data protection, all personnel must complete mandatory HIPAA training, execute confidentiality agreements, and comply with our internal privacy policies.

How We May Use and Disclose Health Information About You

The following categories describe the ways we are permitted to use and disclose PHI without your authorization, where permitted by law.

For Clinical Research Purposes
To conduct, support, or facilitate research, including sharing coded/de-identified data with study sponsors, CROs, and lab partners. Where required, uses align with approved Informed Consent Forms or IRB authorizations. We may also use and disclose information as necessary to administer, monitor, and comply with applicable research protocols and requirements.

For Testing, Treatment, and Related Healthcare Operations
To bill and receive payment for services, verify insurance, and process claims.

For Payment
To collect, process, and test specimens, as well as manage internal quality assurance, regulatory compliance, accreditation standards, and administrative operations.

As Required or Permitted by Law
We may use or disclose PHI without your authorization in the following limited circumstances, to the extent permitted by applicable law:

• When required by federal, state, or local law, including public health reporting obligations
• To public health authorities for purposes such as disease surveillance, prevention, or control
• To appropriate government authorities if we reasonably believe you may be a victim of abuse, neglect, or domestic violence
• For health oversight activities, including audits, inspections, and licensure or disciplinary actions
• In response to a court order, subpoena, discovery request, or other lawful process, subject to applicable legal requirements and protective measures
• To law enforcement officials for limited purposes, such as identifying or locating a suspect, witness, or missing person
• To coroners, medical examiners, or funeral directors as necessary to carry out their duties
• For organ, eye, or tissue donation purposes
• To avert a serious and imminent threat to your health or safety or that of others
• For specialized government functions, such as military, national security, or protective services, where applicable
• For workers' compensation purposes, to the extent authorized by law

Business Associates and Service Providers We may share PHI with third-party vendors and business associates who perform services on our behalf, such as laboratory testing partners, courier and cold-chain logistics providers, IT and data storage vendors, and billing services. These parties are contractually required, through Business Associate Agreements or other appropriate agreements, to safeguard your information consistent with HIPAA and applicable law.

Uses and Disclosures Requiring Your Written Authorization Other than the uses and disclosures described above, we will not use or disclose your PHI for any other purpose, including most marketing communications, the sale of PHI, or uses unrelated to the research study or testing service you agreed to, without your specific written authorization. If you provide such an authorization, you may revoke it in writing at any time, except to the extent we have already acted in reliance on it or as otherwise permitted or required by applicable law.

Website Tracking & Cookies

Our website (www.biocollections.com) and its affiliated websites use necessary, functional, and analytical cookies/tracking technologies to ensure site function and analyze traffic. We may also use cookies and similar technologies to understand website usage, improve our websites and services, and, where applicable, support communications or other legitimate business purposes. Users can manage or withdraw cookie preferences via their browser settings.

Data Retention

BCW retains health, personal, and research records only for as long as necessary to fulfill research protocols, satisfy legal/CLIA requirements, or meet statutory retention limits. We may retain information for longer periods where it is necessary to comply with legal obligations, resolve disputes, enforce agreements, or protect our rights and legitimate business interests.

Privacy Incidents and Breach Notification

BCW actively investigates any suspected privacy or security incidents. If a breach of unsecured PHI or personal data occurs that requires notification under applicable law, we will notify you and appropriate regulatory agencies promptly as required by law.

Your Individual Rights

With respect to PHI we maintain about you, you generally have the right to:

Request Access. You may request to inspect and obtain a copy of your PHI, including research and specimen testing records, subject to certain limitations permitted by law.
Request Amendment. You may request that we amend PHI you believe is incomplete or inaccurate, for as long as we maintain that information.
Request an Accounting of Disclosures. You may request a list of certain disclosures of your PHI made by BCW, other than disclosures for treatment, payment, healthcare operations, or those you have separately authorized.
Request Restrictions. You may request that we restrict certain uses or disclosures of your PHI. We are not required to agree to all requested restrictions, but will comply with any agreed-upon restriction unless required by law to do otherwise.
Request Confidential Communications. You may request that we communicate with you about your PHI by alternative means or at alternative locations.
Request a Paper or Electronic Copy of This Policy. You may request a paper or electronic copy of this Policy at any time, even if you previously agreed to receive it electronically.
Withdraw From a Research Study. You may withdraw your participation in a research study at any time; however, information already collected as part of the study prior to withdrawal may continue to be used as described in the applicable informed consent and this Policy, unless otherwise required by law.
File a Complaint. You may file a complaint with BCW or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated, as described below.

Depending on your location and applicable law, you may also have rights regarding your personal information, including the right to request access to, correction of, deletion of, or a copy of certain personal information we maintain about you, and to object to or limit certain processing of your personal information or request portability of your information. You may also have the right to appeal certain decisions regarding your privacy request. These rights are subject to applicable legal exceptions and limitations.

Individuals in the European Economic Area may have additional rights and protections under applicable data protection laws, including the General Data Protection Regulation ("GDPR"). Where applicable, BCW will provide additional information and protections required by those laws.

To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information provided at the end of this Policy.

Our Responsibilities (Legal obligations)

• We are required by law to maintain the privacy and security of your PHI.
• We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information, as required by applicable law.
• We will not use or share your information other than as described in this Policy unless you provide written authorization, which you may revoke at any time.
• We are required to abide by the terms of this Policy while it is in effect.

Changes to This Policy

We reserve the right to change the terms of this Policy at any time, and any revised Policy will apply to all PHI we maintain, including information created or received before the revision. A copy of the current Policy will be made available at our collection sites and posted at www.biocollections.com. You may also request a copy at any time from our Privacy Officer.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with BCW's Privacy Officer using the contact information below, or with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. Filing a complaint will not affect your ability to continue participating in a research study or receiving services, and we will not retaliate against you for filing a complaint. Where required by applicable law, you may also have the right to file a complaint with the appropriate privacy or data protection authority in your jurisdiction.
U.S. Department of Health and Human Services, Office for Civil Rights 200 Independence Avenue, S.W., Washington, D.C. 20201 Toll-Free: 1-877-696-6775 | www.hhs.gov/ocr/privacy/hipaa/complaints

Privacy Contact Information

Organization: BioCollections Worldwide, Inc.
Address: 5735 NE 2nd Avenue, Miami, FL 33137
Phone: 305-792-2090
Email: quality@biocollections.com
Website: www.biocollections.com