SECTION 1: WHO IS THERIOME?

Theriome, Inc. is a metabolomic wellness assessment company. We analyze blood-based biomarker data — including hundreds of metabolite markers — and generate personalized wellness reports across multiple health domains. Our platform is designed to provide you with educational insights about your metabolic health, not to diagnose, treat, or cure any disease.

Theriome is a covered entity or business associate under the Health Insurance Portability and Accountability Act (“HIPAA”) and is committed to protecting your health information as required by law.

SECTION 2: WHAT INFORMATION WE COLLECT

By completing the intake survey and providing a blood sample, you authorize Theriome to collect and process the following information:

• (a) Personal identifiers: name, date of birth, email address, mailing address, and phone number;
• (b) Health survey responses: answers to questions about your lifestyle, symptoms, health history, and wellness goals;
• (c) Specimen data: your blood sample, identified by a unique specimen barcode;
• (d) Metabolite biomarker data: results from laboratory analysis of your blood sample;
• (e) AI-generated wellness recommendations: personalized wellness insights generated by Theriome’s platform; and
• (f) PDF wellness report: a compiled report delivered to you and/or your ordering provider or wellness facilitator.

SECTION 3: HOW WE USE YOUR INFORMATION

Theriome uses your information solely to provide your wellness assessment. Specifically, we use your information to:

• Process and analyze your blood sample in our laboratory systems;
• Generate your personalized metabolic wellness report;
• Deliver your report to you and/or the provider or wellness facilitator who referred you;
• Maintain records of your assessment as required by applicable law; and
• Improve the accuracy and functionality of our platform (using de-identified or aggregated data only).

We do not sell your health information. We do not use your PHI for marketing without your separate written authorization.

SECTION 4: HOW WE PROTECT YOUR INFORMATION

Your data is protected under the HIPAA Privacy Rule and the HIPAA Security Rule. Specifically:

• All data is stored on secure, HIPAA-compliant AWS infrastructure with a Business Associate Agreement in place;
• Access to your data is limited to authorized Theriome personnel on a minimum-necessary basis;
• Your data is encrypted in transit and at rest; and
• In the event of a breach affecting your information, Theriome will notify you as required by the HIPAA Breach Notification Rule.

SECTION 5: YOUR HIPAA RIGHTS

As a patient whose health information is protected under HIPAA, you have the following rights:

• Right to Access — Request a copy of your health information held by Theriome
• Right to Amend — Request corrections to inaccurate or incomplete information
• Right to Accounting of Disclosures — Request a record of certain disclosures Theriome has made of your PHI
• Right to Restrict Uses — Request restrictions on certain uses or disclosures of your PHI
• Right to Confidential Communications — Request that we contact you in a specific way or at a specific location
• Right to Revoke Authorization — Revoke this consent at any time by submitting a written request to mohr@therio.me. Revocation will not affect actions Theriome took before receiving your request, nor records Theriome is required to maintain under applicable law.
• Right to File a Complaint — File a complaint with Theriome or with the U.S. Dept. of Health & Human Services

To exercise any of these rights, contact: Alex Mohr, HIPAA Security Officer — mohr@therio.me

SECTION 6: WELLNESS — NOT MEDICAL — DISCLAIMER

IMPORTANT: Theriome’s wellness assessments are provided for informational and educational purposes only. The results of your metabolic assessment are not a medical diagnosis, are not a prescription or treatment plan, and do not establish a physician-patient relationship with Theriome or any of its personnel.

You are encouraged to share your wellness report with a licensed healthcare provider who can provide medical interpretation and advice appropriate to your individual health circumstances.

SECTION 7: WHO WILL RECEIVE YOUR REPORT

Your completed wellness report will be delivered to the party or parties you select below. By selecting “your ordering provider or wellness facilitator,” you authorize Theriome to deliver your report to the individual who referred you.

SECTION 8: AUTHORIZATION FOR DATA PROCESSING

By signing below, I, the Patient, authorize Theriome, Inc. to:

• Collect and process my personal health information and metabolite biomarker data as described in this Agreement;
• Store my information on Theriome’s secure HIPAA-compliant infrastructure;
• Deliver my wellness report to the party or parties I selected in Section 7; and
• Retain my records in accordance with applicable law.

I understand that:

• This is a wellness service, not a medical service;
• I may revoke this authorization at any time in writing by contacting mohr@therio.me;
• Signing this Agreement is required to receive Theriome’s wellness assessment services;
• I have been given the opportunity to ask questions before signing; and
• I have received, or been given access to, Theriome’s Notice of Privacy Practices.

Conditioning of Services: Theriome requires this authorization to provide your wellness assessment. If you do not sign this authorization, Theriome will be unable to process your blood sample or generate your wellness report. You will not be penalized for declining, but the service cannot be performed without authorization to process your health information.

Redisclosure Notice: Once your wellness report is delivered to the recipient(s) you select in Section 7, that information may be redisclosed by the recipient and may no longer be protected by federal privacy regulations.

SECTION 9: GOVERNING LAW

This Agreement is governed by the laws of the State of Arizona. It may be executed electronically pursuant to the Arizona Electronic Transactions Act (A.R.S. § 44-7001 et seq.) and the federal E-SIGN Act (15 U.S.C. § 7001). Your electronic signature has the same legal effect as an original ink signature.

SECTION 10: EXPIRATION

This authorization expires two (2) years from the date of signature for new uses and disclosures of your health information. Theriome may retain your records beyond this period as required by Arizona law (A.R.S. § 12-2297) and HIPAA (45 C.F.R. § 164.530(j)), which require a minimum 6-year retention period. De-identified data may be retained indefinitely for platform improvement.