Daye Health Platform (DHP)

PRIVACY NOTICE

Version 3.2

Effective Date: August 20, 2026

We at Daye are conscious that when using the Daye Health Platform (“DHP”), our customers entrust their most intimate health-related details to us. This is why when developing, improving and offering DHP, we prioritise transparency to our customers and security of their information. The DHP Privacy Notice aims to inform you how Daye handles and protects your personal information when you use the different services and products offered through DHP as detailed in our DHP Terms and Conditions. All capitalised terms used in this Notice shall have the meaning ascribed to them in the DHP Terms and Conditions.

It is important that you read this document together with our Website Privacy Policy which contains more general information about how we process data about general visitors of Daye’s Website.

To use DHP, Daye customers are required to create a dedicated account on Daye’s Website (“DHP Account” or “Account”) which requires going through an identity verification procedure which includes the provision of a selfie and an up to date identity document. Before using DHP and creating a DHP Account please read this Privacy Notice carefully. By accessing or using DHP or any products and services offered through DHP, you acknowledge that you’ve read this Privacy Notice and you agree with its contents. If you do not agree to this Privacy Notice, please do not use DHP.

Important information and who we are

Daye is a group of companies offering Daye products and services globally (“Daye”, “we” or “us”). Daye is made up of different legal entities registered throughout the United Kingdom, the European Union and the United States of America. So when we mention Daye in this document, we are referring to the relevant company in the Daye Company Group which provides the DHP services and products to you and is therefore responsible for the processing of your personal information.

For residents of the United Kingdom, the European Economic Area (which includes all European Union member states) and Switzerland, the service provider and controller of your data will be Anne’s Day Ltd (“Daye UK”), a company established in the United Kingdom under company number 11044785, registered at 4th Floor, One Whittington Avenue, London EC3V 1LE, United Kingdom.

For residents of the United States, the service provider and controller of your data will be Anne’s Day Inc. (“Daye US”), incorporated and registered in the United States of America with registration number 32-0655300, registered at 2140 S. Dupont Highway, Camden, Delaware 19934, United States of America.

Daye operates in your region through the relevant Daye company identified above. To run our services efficiently, the members of the Daye Company Group support each other with activities such as hosting, technical operations, platform administration and customer support. This means that, while your data controller is the Daye company identified above, your personal information — including health-related and other special-category data processed through DHP — may be transferred to and processed by another Daye group entity. Wherever your information is processed within the group, it remains protected by this Privacy Notice and the safeguards described in the “International transfers” section below.

EU and EEA representative (Article 27 GDPR): Daye UK acts as data controller for individuals in the European Economic Area but is not established in the Union. We have therefore appointed Daye Biotech Limited (company number 788588, registered at Pavilion House, 31 Fitzwilliam Square, Dublin 2, Ireland, D02 F403) as our representative in the Union under Article 27 of the EU GDPR. You may contact our representative regarding the processing of your personal data or the exercise of your data protection rights at privacy@yourdaye.com.

If you have any questions about this privacy notice or our data protection practices with regard to DHP, or if you wish to exercise your data protection rights, please contact our Data Protection Officer at privacy@yourdaye.com.

1. The information we collect about you and how we use it

When you use DHP, incl. any products or services offered on DHP, we will collect, use, store, transfer and process different kinds of personal information about you as described below:

We may collect the information above in different ways, including:

• Directly from you, for example – when you fill in questionnaires or when you participate in surveys.
• By generating it ourselves, e.g. our systems generate randomly your Medical ID, your Kit Activation Code, etc. when you place an order.
• By receiving it from third parties, for example - when laboratories we work with share your Microbiome, STI, HPV or Hormone Screening Data with us.

2. Lawful ground for processing your personal information

We will process the personal information categories described in Section 1 above when at least one or more of the conditions below are met:

1. This is required to meet our contractual legal obligations to you or to exercise our rights;
2. You’ve consented to this;
3. It is within our legitimate business interests to do that when this will not cause disproportionate harms to your privacy and data protection rights, e.g.
   1. to send you direct marketing messages;
   2. to detect, prevent, investigate and report crime;
   3. to improve our existing and to develop new products and services;
   4. to enforce the DHP Terms and Conditions;
   5. to comply with our contractual obligations vis-a-vis our partners;
   6. to conduct gynae health research.
4. When we are required by law to do so; or
5. When this is necessary to protect your or someone else’s life.

We may also process medical information about you which may be afforded a higher level of protection under data protection laws. We will do that only if:

1. You’ve given us explicit consent to do so;
2. This is necessary for the establishment, exercise or defence of legal claims by Daye;
3. This is necessary for reasons of substantial public interest, incl. in the area of public health;
4. This is necessary for the purposes of preventive medicine;
5. This is necessary for archiving purposes in the public interest, scientific, historical research or statistical purposes; and
6. When this is necessary to protect your or someone else’s life.

3. How we share your personal information

3.1. Members of the Daye Company Group. We will share your personal information with other entities part of the Daye Company Group insofar this is necessary for the delivery of the DHP products and services or for the management of our business. This may include third-parties that are involved in a merger, acquisition, financing, reorganization, bankruptcy, or similar corporate transaction.

3.2. Laboratories we work with. We will also share your blood or vaginal sample and your Kit activation code/barcode with the laboratories we work with for the purpose of analysing your sample and producing Screening Data. Those laboratories are based in the same country or region (e.g. European Economic Area) where you reside. We may share your postcode and ethnicity data with laboratories who help us provide screening for sexually transmitted infections. This is to support with reporting positive results to the competent public authorities (legal requirement to monitor spread of infections). Remember - we will share any directly identifiable attributes (such as names, personal identity number and addresses) with the laboratories we work with only when this is required under our contract with the laboratories or under applicable law.

3.3. Other partners and service providers. We will share your personal information with other service providers, professional advisors, auditors or partners of our choice insofar this is necessary for the provision of DHP products and services or where we have a lawful basis for that, e.g. - our hosting service provider – Google, the provider of our electronic patient medical record services - Cliniko, healthcare specialists, pharmacies we work with such as Cedarwood, Blueco and Phlo, accountants, etc. We will make sure that all those third parties are bound by contractual confidentiality and data protection undertakings and will not use your information in a way different than as described in this document.

3.4. Public authorities. If your Screening Data indicates a positive result for a sexually transmitted infection or human papillomavirus, we or the laboratories we work with may also share anonymised (de-identified) Screening Data with the relevant healthcare public authorities for statistical purposes and to comply with relevant legal obligations for reporting such diseases. In those cases, we may also notify your intimate partners and share your personal information, if you explicitly consent to that and authorise us to do so.

Please note that we may anonymise (de-identify) your data and we may share it with other third parties in a format in which your data is no longer attributable to you as an individual. For more information, please see “Research” section of the DHP Terms and Conditions.

4. International transfers

We generally seek to store your personal information in the region where you reside.

However, we may also transfer, store and process your personal information in another country or region such as the UK, the European Economic Area (EEA) and the US.

When we do that, we will ensure compliance with the applicable rules on transfers of personal information to third countries outside of the region where you are established.

For example, if you are a resident in the UK, a EEA country or Switzerland, when your personal information is stored or otherwise processed in a country that is not considered to offer an adequate level of protection to your personal information compared to the standards of your country of residence, we will make sure the recipient of the data in that third country is bound by the standard contractual clauses as approved by the UK Parliament or respectively the EU Commission and by relying on any other supplementary safeguards necessary to ensure your personal information continues to enjoy the same level of protection.

5. Your legal rights

Depending on your location and applicable law, you may have certain rights regarding the personal information we collect, use, disclose, and otherwise process about you. These rights may include:

• The right to access and obtain a copy of your personal information. If you’d like to receive a copy of your health information or Screening Data, Daye allows you to download a file with all that information through the DHP so you can then send it to your own doctor or print it for your own archives.
• The right to request correction of inaccurate or incomplete personal information.
• The right to request deletion of your personal information, subject to certain legal exceptions. For example, Daye will not be obligated to comply with your deletion request in contexts in which we have to retain your information for regulatory or legal reasons.
• The right to restrict or object to certain processing activities.
• The right to withdraw consent at any time where we rely on consent as the legal basis for processing.
• The right to request portability of your personal information in a structured, commonly used, and machine-readable format where required by law.
• The right not to be subject to unlawful discrimination or retaliation for exercising your privacy rights.
• The right to opt out of certain uses of personal information, including targeted advertising, profiling, automated decision-making, or the sale or sharing of personal information, where such rights are provided by applicable law.
• The right to lodge a complaint with a competent data protection or privacy regulator, including a supervisory authority in the European Economic Area, the United Kingdom, or Switzerland, where applicable.

To exercise any of these rights, please contact us using the contact details provided in this Privacy Notice. We may need to verify your identity before processing your request. We will respond within the time period required by applicable law and may decline requests where permitted by law.

Please note that if you’d like to receive a copy of your health information or Screening Data, Daye allows you to download a file with all that information through the DHP so you can then send it to your own doctor or print it for your own archives.

We are not obligated to comply with your right to erasure in contexts in which we have to retain your personal information for regulatory or other legal reasons.

6. Further details

We retain your personal information only as long as necessary to provide the products or services you’ve requested on DHP, comply with legal obligations, resolve disputes, and enforce our agreements.

If you are looking for more information on how we process your personal information please consult our Website Privacy Policy.

7. Cookies and tracking technologies

If you decide at any time that you no longer wish to accept cookies, pixels and related tracking technologies for any of the purposes described in this privacy policy, then you can change your preferences in the cookie banner available in the Daye Website or instruct your browser, by changing its settings, to stop accepting these or to prompt you before accepting them from the websites you visit.

If you do not accept all cookies, however, you may not be able to use all portions of the Daye Website or all functionality of the products and services available on DHP.

For more information on our use of Cookies, please see our Cookies Policy.

We respond to the Global Privacy Control (GPC) signal as required by CCPA and other laws. For more information see www.globalprivacycontrol.org.

8. Notice to US Users - Your Privacy Rights

This section supplements the information contained in this Privacy Policy and applies to individuals residing in the United States of America and particularly states that provide privacy rights under applicable law.

Our services are generally not subject to HIPAA unless expressly stated or provided through a covered healthcare provider or health plan.

If you are a US resident, you may have the following rights in addition to those described in Section 5 above.

1. Right to Opt Out of the Sale of Personal Information: The right to direct a business not to sell personal information to third parties.
2. Right to Opt Out of Sharing for Cross-Context Behavioral Advertising: Particularly under California law, individuals may opt out of the sharing of personal information for targeted advertising purposes.
3. Right to Opt Out of Targeted Advertising: Many state laws allow consumers to opt out of advertising based on personal information obtained from activities across websites, applications, or services.
4. Right to Opt Out of Profiling: The right to opt out of profiling that produces legal or similarly significant effects, such as decisions regarding employment, housing, education, financial services, or healthcare.
5. Right to Limit Use and Disclosure of Sensitive Personal Information: California residents may direct businesses to limit the use of sensitive personal information to certain permitted purposes.

If we decline to take action on your request, you may have the right to appeal our decision. To submit an appeal, please contact us using the contact details provided in this Privacy Notice and include “Privacy Rights Appeal” in your communication.

We will not discriminate against you for exercising any privacy rights available to you under applicable law. However, we may provide different levels of service or functionality where the difference is reasonably related to the value of the data provided or otherwise permitted by law.