CELIO HEALTH CONSUMER HEALTH DATA PRIVACY POLICY

Version 2026-09-21 · effective September 21, 2026. This page is the permanent record of this version and is never edited. The current version is always at /consumer-health-data-privacy.

Effective Date: September 21, 2026

1. Scope and Identity

Celio Health (“Celio”) is a trade name of New Century Labs, LLC, an Oregon limited liability company doing business as Celio Health (“New Century Labs,” “we,” “us,” or “our”). Celio is not a separate legal entity.

This Consumer Health Data Privacy Policy applies to “consumer health data” processed through Celio when a state consumer-health-data law applies, including Washington’s My Health My Data Act and similar laws. It is separate from our general Celio Privacy Policy.

2. Consumer Health Data We Collect

Depending on the services you request, we may collect:

• Information identifying that you are seeking laboratory testing or other health-related services.
• Tests requested, order and requisition information, specimen and collection information, and laboratory results.
• Symptoms, health history, medications, conditions, or other information you provide for clinical review.
• Health-related measurements, demographics, or attributes needed to evaluate, order, perform, interpret, or display laboratory testing.
• Information that can reasonably be used to infer health status from your use or purchase of a Celio health service.

We do not intentionally collect precise location to infer visits to healthcare facilities for advertising purposes.

3. Sources of Consumer Health Data

We collect consumer health data from:

• You, including information entered into Celio accounts, checkout, questionnaires, or customer support.
• Independent licensed clinicians or clinical organizations involved in reviewing or authorizing your requested services.
• Clinical laboratories and specimen-collection providers involved in your testing.
• Service providers that process information for Celio as part of providing the service you requested.

4. Why We Collect and Use Consumer Health Data

We collect and use consumer health data only as reasonably necessary to provide the products or services you request, including to:

• Route a laboratory request for independent clinical review when required.
• Generate, coordinate, and support requisitions and specimen collection.
• Send necessary information to the performing laboratory.
• Receive, organize, display, and deliver laboratory results.
• Provide customer support, investigate service issues, and maintain security.
• Maintain records required for legal, regulatory, accounting, dispute-resolution, and fraud-prevention purposes.
• Use aggregated or validly de-identified information as permitted by applicable law.

If we want to collect, use, or share additional categories of consumer health data or use existing health data for a materially different purpose requiring consent, we will provide the required disclosure and obtain consent before doing so.

5. Consumer Health Data We Share

We may share the categories of consumer health data described above only as reasonably necessary to provide the service you request or as otherwise permitted by law.

Categories of recipients may include:

• Independent licensed clinicians and clinical organizations performing clinical review or ordering functions.
• Clinical laboratories and specimen-collection providers.
• Technology, hosting, security, communications, customer-support, and other processors that handle consumer health data solely to provide services to New Century Labs under applicable contractual and legal restrictions.
• Government or public-health authorities when disclosure is required or permitted by law.

New Century Labs does not sell consumer health data.

6. Your Consumer Health Data Rights

Where applicable law provides these rights, you may request to:

• Confirm whether we collect, share, or sell consumer health data about you.
• Access consumer health data about you.
• Obtain information about the categories of consumer health data collected or shared and the categories of recipients.
• Withdraw consent for future collection or sharing where processing is based on consent.
• Delete consumer health data, subject to exceptions and retention obligations permitted by law.

To make a request, email customerservice@celiohealth.com. You do not need to create a new account to make a request. We may take commercially reasonable steps to authenticate your identity.

If we deny a request and applicable law provides a right to appeal, reply to our decision or email customerservice@celiohealth.com with the subject line “Privacy Appeal.” We will review the appeal and respond as required by applicable law.

7. Security and Access Controls

We restrict access to consumer health data to workforce members, processors, and contractors who need access to provide the requested service or another legally permitted purpose. We maintain administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of consumer health data.

8. Sale, Advertising, and Geofencing

New Century Labs does not sell consumer health data.

We do not use consumer health data for targeted advertising.

We do not use geofencing around healthcare facilities to identify, track, collect data from, or send advertising to consumers based on their attempt to obtain healthcare services.

9. Changes to This Consumer Health Data Policy

We will not collect, use, or share additional categories of consumer health data or materially expand the purposes described in this Policy where applicable law requires prior notice and consent without first providing that notice and obtaining the required consent.

We will post updates to this Policy and its effective date. Where applicable law requires consent to a change, the change will not apply to affected processing until the required consent is obtained.

10. Contact

Celio Health / New Century Labs, LLC

Email: customerservice@celiohealth.com

Customer service: (800) 519-2997