Introduction and Purpose

Freenome Holdings, Inc., (“Freenome, “us,” “our,” or “we”) is committed to protecting the privacy of your personal information. This Privacy Notice explains who we are, the types of personal information we may collect from or about you; how we collect, protect, disclose, share, and use that personal information; and how you can exercise your privacy rights.

This Privacy Notice applies to personal information that we collect through or in relation to the following, described in greater detail throughout this Privacy Notice:

•  Our website at www.freenome.com, and any other website we may create from time to time (“Websites”).
• Participation in a clinical study or study that we sponsor or are involved with (“Clinical Study”).
• Our research activities (“Research”).
• The use of our services or engaging with us for commercial purposes (“Commercial Relationships”).
• In-person or virtual trade shows, conferences, seminars, webinars, focus groups, or other events we host or in which we participate; our social media channels; surveys or questionnaires in which you voluntarily participate; and any feedback you voluntarily provide to us in any form (collectively referred to as “Informational Activity”).

If you have any questions or concerns about our use of your personal information, then please contact us using the contact information provided at the bottom of this Privacy Notice.

What Does Freenome Do?

Freenome develops early cancer detection blood tests powered by our multiomics platform. Since our beginning, Freenome has had a clear vision: building a multi-disciplinary team with expertise in computational biology and machine learning techniques to reinvent disease management through early detection and precision intervention. In this way, we seek to radically transform the way patients with cancer are managed, equipping people everywhere with the knowledge and tools they need to maintain a healthier life, and one day, prevent cancer altogether.

Freenome does not sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means your personal information to another business or a third party for monetary or other valuable consideration. Freenome does not share your personal information with third parties for cross-context behavioral advertising.

What Personal Information Does Freenome Collect and Why?

In general, we will collect and use your personal information (1) with your express consent; (2) with your implied consent; (3) as permitted or required by applicable laws. We will use your personal information only for the purposes described in this Privacy Notice or for purposes described at the time we collect personal information directly from you.

We may also use your personal information for other purposes that are closely related to the reasons we initially collected your data (such as conducting our business operations, scientific or historical research purposes, data security purposes, data de-identification or anonymization purposes, or statistical purposes) but only if doing so is permitted by applicable laws.

Providing us your personal data is entirely voluntary. However, if you choose not to provide your personal data, you may not be able to use certain functionalities of our Websites, participate in our Clinical Study or Research, enter into a Commercial Relationship with us, or engage in our Informational Activities.

Specifically, the personal information we collect depends on whether you are:

• a current, potential, or former clinical study participant (collectively referred to as a “Study Participant”).
• A visitor to our Website or a participant in an Informational Activity (collectively referred to as a “Visitor”).
• a health care provider or a clinician (collectively referred to as an “HCP”).
• an individual who engages with us for Research or collaboration purposes, or who enters into a Commercial Relationship with us (referred to as a “Business Partner”).
• an individual or entity that contracts with Freenome to provide goods or services to Freenome, (referred to as a “Contractor”).

If you are an employee of Freenome, we will provide you with any required notices during your employment. If you are applying for a job at Freenome, we will provide you with any required notices during your application process.

Study Participants

The types of personal information Freenome collects about you as a Study Participant depend upon the Clinical Study you join or express interest in joining. Specific details about the types of personal data collected, how it will be collected, and why it will be collected will be addressed in study-specific documentation that Study Participants will be provided and can review prior to participation in a study. Participation is entirely voluntary.

As a Study Participant, your personal data will generally be processed for the purposes of:

• Assessing eligibility to participate in a Clinical Study.
• Administering the Clinical Study.
• Monitoring the Clinical Study.
• Assessing the overall safety and effectiveness of the Clinical Study.
• Gathering results and drawing conclusions regarding the effectiveness and viability of the Clinical Study.

If you are a Study Participant and have questions or concerns about how your personal information is being collected, used, or shared during the Clinical Study, please contact your Clinical Study representative directly.

HCPs

We interact with HCPs during our Research activities and our Commercial Relationships. If you are an HCP involved or assisting with our Research, or are engaged with us in a Commercial Relationship, we may collect and use your personal information including your name, postal address, email address, and your professional background. We may use this information for some or all of the following:

• Establishing and managing your relationship with Freenome.
• Establishing, performing, or maintaining an agreement or contract with you.
• Providing you marketing information about our Products that may interest you, subject to applicable marketing laws.
• Invite your participation in Informational Activities, subject to applicable marketing laws.
• Processing and responding to your Requests for Responses.
• Complying with applicable law.
• Establishing, exercising, or defending our legal claims.
• Carrying out any other purpose(s) set forth in any additional consent you provide.

If the Research activities we conduct include collecting the personal data of any HCP patients or customers with which we have no direct contact, we will execute a separate contract with such HCPs to ensure that their patients’ or customers’ personal data is processed lawfully.

Contractors

Depending on where you reside, as part of becoming a Freenome Contractor, we may collect some or all of the following information for purposes of the hiring and onboarding process for the Contractor position:

• Full name.
• Contact details such as phone number, email address, and/or physical address.
• Social Security number (if you live in the US).
• Professional information, such as government- or regulatory-maintained disciplinary records (e.g., exclusion lists).
• Your education history, employment history, and curriculum vitae.
• Information collected for purposes of public health (such as body temperature or evidence of vaccination(s)).

During your engagement with Freenome as a Contractor, we may process some or all of the following information for purposes of establishing, performing, or maintaining the terms of an agreement or contract with you:

• Bank account and routing numbers if you chose to and can be paid via direct deposit.
• Records of required training.
• Freenome usernames and passwords and similar online identifiers if access to Freenome’s network is necessary and approved.
• Emergency contact telephone numbers.
• Tax information.

With regard to the performance of your services, Freenome may collect personal information reported through a whistleblowing hotline or a regulatory reporting channel, and the content of professional emails to the extent permitted by applicable law.

If you are permitted to use Freenome’s network as part of your duties as a Contractor, we may collect some or all of the following information for purposes of operating and managing our business:

• System-generated logs regarding internet, network, email, and telephone use.
• Date and time of access card use if you are provided with one.
• CCTV security surveillance footage when you are physically present on Freenome premises.

Freenome may also use your personal information for purposes not described above, including without limitation, to:

• Invite you to participate in Informational Activities, subject to applicable marketing laws.
• Processing and responding to your Requests for Responses.
• Complying with applicable law.
• Establishing, exercising, or defending our legal claims.
• Carrying out any other purpose(s) set forth in any additional consent you provide.

Business Partners

Depending on the nature and purpose of our Business Relationship, we may collect and use the following personal information from our Business Partners:

• Full name.
• Job title.
• Job contact details, such as mailing address, email address, or telephone number.
• Curricula Vitae.

We may use this information for some or all of the following purposes:

• Establishing and managing our engagement.
• Establishing, performing, or maintaining an agreement or contract with you.
• Evaluate your ability to perform the services on which our engagement is based.
• Providing you marketing information about our products or services that may interest you, subject to applicable marketing laws.
• Invite your participation in Informational Activities, subject to applicable marketing laws.
• Processing and responding to your Requests for Responses.
• Complying with applicable law.
• Establishing, exercising, or defending our legal claims.
• Carrying out any other purpose(s) set forth in any additional consent you provide.

Visitors

If you visit our Websites, our physical offices, participate in Informational Activities, register for a Freenome mailing list, sign up for our newsletter, submit information to us via email or a web form, contact us via post, or call us on the phone, we may collect some or all of the following information:

• Your name.
• Your contact information, such as email address, telephone number, or mailing address.
• The reason you contacted us.
• Any personal information you voluntarily provide us.
• Any additional information to which you provide consent for us to process.
• CCTV security surveillance footage when you are physically present on Freenome premises.

If you interact or engage with us through Social Media platforms, including but not limited to Facebook, Twitter, LinkedIn, or YouTube, we may collect the content of your post (which may include photographs or videos you post), the nature of your interaction (such as a “Like” or a “Retweet”), and your screen name. Our use of this information may include:

•  Inviting your participation in Informational Activities, subject to applicable marketing laws.
• Operating and managing our business (including developing, maintaining, and supporting our operations).
• Complying with applicable law.
• Establishing, exercising, or defending our legal claims.
• Carrying out any other purpose(s) set forth in any additional consent you provide.

How Does Freenome Interact With Me?

We interact with you in three primary ways: directly, through third parties, or indirectly.

Direct interaction: Freenome collects personal information about you when you provide it to us directly. For example, when you complete a form on our Websites, call a representative on the phone, write us a letter, send us an email, send us a fax, post on our social media channels, or otherwise provide us your personal information.

If you contact us by phone, note that your call may be used for training purposes, and it may be recorded. Freenome may also record telephone calls we make to you unless you tell us not to. These calls are recorded for quality management, improvement, and training.

Interaction through third parties: Freenome collects personal information about you from third parties when you or the law allows authorized third parties to provide it to us. For example, we may collect personal information about you from third party health care providers during our Research activities. We also collect personal information about you from third parties who host social media webpages that we manage, consistent with applicable privacy and data protection regulations.

Indirect interaction: We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use personal information about you. For further information about what Cookies are, the types of Cookies we use, why we use them, and how you can control them, please see our Cookie Notice.

Who Does Freenome Share My Personal Information With?

In general, we share your personal information with people and organizations to accomplish the purposes of our data collection described in this Privacy Notice. Specifically, we may disclose your personal information to the following categories of recipients. At times, we may share your data in a way that is not described in this Privacy Notice, and if we do, we will inform you of our data sharing practices at the time we collect the information and obtain your consent prior to such sharing.

• A person or entity with your consent to the disclosure (for example, a personal representative).
• Our Contractors to provide you with services you request.
• Our Business Partners to perform our contractual obligations.
• Third party services providers who provide services to us and/or you, such as logistics providers and carriers, staffing agencies, information technology vendors, or cloud service providers.
• An actual or potential buyer (and its agents and advisers) in connection with any actual or proposed purchase, reorganization, merger or acquisition of all or part of our business, debt financing, sale of any company assets or similar transactions as well as in the event of bankruptcy or receivership where personal information could be transferred to third parties as a business added. Provided that in each instance we must use your personal information only for the purposes disclosed in this Privacy Notice.
• Any competent law enforcement body, regulatory, government agency, court, or other third party where we believe disclosure is necessary or required: (i) as a matter of national security; (ii) in compliance with applicable law or regulation, such as in accordance with breach notification requirements, or in relation to a worker’s compensation or other insurance claim; (iii) to exercise, establish, or defend our legal rights; (iv) to protect your vital interests or those of any other person; (v) to help with public health and safety issues; or (vi) to work with a medical examiner or funeral director.

We do not sell your personal information. We do not share your personal information for marketing purposes unless you have approved for us to do so. Pursuant to local laws, we may remove the identifiers from your personal information in a way that such information can no longer be used to identify you and we may share this information (called “de-identified” or “anonymized” data) with third parties for any lawful purpose.

How Does Freenome Keep My Personal Information Secure?

We use appropriate administrative, technical, physical, and organizational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. Specific measures we use include, but are not limited to, encryption, user access and authentication controls, data integrity controls, continuous security monitoring, and event logging. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed as being 100% secure.

Data Retention

We retain personal information we collect from you in accordance with applicable laws and regulations. In some jurisdictions, we retain your personal information when we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax, or accounting requirements). In other jurisdictions, we will retain your personal data for as long as necessary to fulfill the purposes for which that personal information was collected.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Your Privacy Rights

You may have the data protection rights listed below. To exercise these rights, please contact us in writing using the contact details provided under the “How to Contact Us” heading below. Freenome will not discriminate against you in any way for exercising your data protection rights.

• If you wish to access, request a copy of, correct, delete, or update your personal information, you may do so at any time and we will comply with all lawful requests. In some limited circumstances, we may be allowed to charge you a reasonable fee for the administrative costs of complying with an access request.
• In addition, you may object to processing of your personal information and ask us to restrict or limit processing of your personal information. Please note that in some instances, we may say “no” to your request if it would affect your care.
• You have the right to opt-out of Informational Activities and other marketing communications we send you at any time. You may exercise this right by clicking on the “unsubscribe” or “opt-out” link provided in the communications we send you. To opt-out of other forms of Informational Activities and other marketing communications (such as by post or telephone), please contact us using the information provided below.
• Similarly, if we have collected and processed your personal information with your consent, then you may withdraw your consent at any time. A consent withdrawal does not apply to the data we collected prior to your withdrawal. In some instances we may still be able to process your personal data even if you withdraw your consent, but only when doing so is allowed by law or regulation. Where required by law, we will inform you of the consequences of withdrawing your consent.
• You may ask for a paper copy of this Privacy Notice at any time, even if you have agreed to receive the Privacy Notice electronically. We will provide you with a paper copy promptly.
• You may request that we contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will say “yes” to all reasonable requests.
• You may designate someone to act on your behalf. For example, if you have given someone power of attorney or if someone is your legal guardian, then that person can exercise your rights and make choices about your personal information including your health care data. We will make sure the person has this authority and can act for you before we take any action.
• You have the right to complain about our collection and use of your personal information. If you have a complaint, please contact us using the mailing details under the “How to Contact Us” heading below, or you can lodge your complaint with the appropriate data protection regulator: EEA residents can find information about your data protection regulator here, and EU residents can contact the Information Commissioner’s Office.
• You have the right to request confidential communications. To exercise this right, you can send us a written request (using the mailing address provided below) asking us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will say “yes” to all reasonable requests. Please submit all requests in writing to the address listed below.
• In some circumstances, you also have the right to get a list of those with whom we’ve shared your personal information. If this right applies to you, we will provide you a list of the times we have shared your health information, who we shared it with, and why.

Children’s Personal Information

From time to time, Freenome may host a web page or pages which are available, in part, to children under the age of 13. However, we do not intend to direct any of our web pages to such children nor do we intend to collect information from these individuals.

If you are a parent or guardian and believe your child has provided us with personal information that you would like to review or request be deleted please contact us at privacy@freenome.com. If we learn that we have personal information from a child under the age of 13 without permission from the child’s parent or guardian, we will remove and/or delete that information pending receipt of an appropriate consent.

International Data Transfers

We save and process your personal data on our servers located in the US. As a result, and depending on where you live, your personal information may be processed in countries that have data protection laws that are different to the laws of your country.

However, we have taken appropriate safeguards to require that the personal information we process will remain protected in accordance with this Privacy Notice when transferred internationally, including when processed internationally by our third-party service providers and partners.

The transfer of personal data to third-party service providers outside of the UK, Switzerland, or the EEA takes place on the basis of data protection adequacy decisions by the UK, Swiss, or the European Commission or via the implementation of EU data protection standard contractual clauses. Further details are available upon request.

Freenome’s Participation in the Data Privacy Framework

We comply with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF,” collectively, all three frameworks are referred to as the “DPF Frameworks”) as set forth by the U.S. Department of Commerce, which has jurisdiction over our compliance with the DPF Frameworks. We have certified to the U.S. Department of Commerce that we adhere to the DPF Frameworks. We are subject to the investigatory and enforcement powers of the Federal Trade Commission (“FTC”).

If there is any conflict between the terms in this privacy policy and the DPF Principle, the DPF Principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

In compliance with the DPF Frameworks we commit to resolve your complaints regarding our handling of your personal data received in reliance on these Frameworks. Should you have a complaint, please contact using the information listed below, in the “How to Contact Us?” section.

If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit JAMS for more information or to file a complaint. JAMS is internationally based, and the services provided by JAMS are provided at no cost to you.

Please note that under certain circumstances, you may be able to invoke binding arbitration to handle complaints related to the DPF Principles not resolved by the other mechanisms listed above, i.e., contacting us or contacting JAMS. For more information about binding arbitration, please visit: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2.

Accountability for Onward Transfer

From time to time we may transfer your personal data to third-parties acting as an agent on our behalf, but will do so only for limited and specific purposes. Before we share your data, we will obtain contractual assurances from such third parties that they will safeguard personal data in a manner consistent with this notice and that they will provide at least the same level of protection as is required by the relevant DPF principles. We recognize our responsibility and potential liability for onward transfers to third parties and if we have knowledge that a third party is using or disclosing personal data in a manner contrary to this notice and/or the level of protection as required by the DPF principles, we will take reasonable steps to prevent, remediate or stop such use or disclosure.

If we disclose your personal data to a non-agent third party, we will do so consistent with any notice provided to you and any choice you have exercised regarding processing and disclosure.

California Do-Not-Track Disclosures

At this time, our Websites do not respond to Do Not Track (“DNT”) signals sent from your web browser. A uniform standard has not yet been adopted to determine how DNT signals should be interpreted and what actions should be taken by websites and third parties that receive them.

Updates to This Privacy Notice

We may update this Privacy Notice from time to time as we deem necessary and in our sole discretion. When we update our Privacy Notice, we will provide notice on our Websites or as otherwise required by applicable law. We encourage you to periodically review this Privacy Notice to remain informed about how we collect, use, and share personal information. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws.

You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the bottom of this Privacy Notice. Any changes to this Privacy Notice take effect immediately after being posted or otherwise provided by Freenome.

How To Contact Us

If you live in the US:

Freenome Holdings, Inc.
Attn: Legal Department, Privacy
279 East Grand Avenue
5th Floor
South San Francisco CA 94080
Email: privacy@freenome.com
Tel: (855) 242-8829.

If you live in the EEA or the UK:

You can contact us directly using the information listed above, or by mail at:

Freenome Ltd
Attn: Privacy Manager
MediCity – D6 Building
1 Thane Road, Nottingham, UK NG90 6BH

The data controller of your personal information is Freenome Holdings, Inc.

Last updated: February 2024