PRIVACY POLICY

and personal data protection

Apixmed / Apixmed Prism

Editorial dated April 17, 2026

PREAMBLE

The individual entrepreneur Havrylyuk Yevheniy Serhiyovych, who provides services under the trademarks Apixmed and Apixmed Prism (hereinafter referred to as the "Contractor"), is a personal data operator within the meaning of the Law of Ukraine "On Personal Data Protection" dated 01.06.2010 No. 2297-VI (hereinafter referred to as the "Law") and a data controller within the meaning of the EU General Data Protection Regulation (GDPR, EU Regulation 2016/679) - in the part relating to the processing of data of persons residing in the EU.

This Privacy Policy (hereinafter referred to as the "Policy") is an integral part of the Apixmed Prism Public Offer and explains what personal data is collected, for what purpose it is processed, to whom it is transferred and what rights the Customer has. The terms used in this Policy correspond to the terms of the Public Offer. By continuing to use the Site or placing an order, the Customer confirms that he has read this Policy.

1. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

1.1. The Contractor processes the Customer's personal data on the following legal grounds:

1.1.1. Performance of the contract (Article 11 Part 1 Clause 2 of the Law; Article 6(1)(b) GDPR) - processing is necessary to fulfill obligations under the Public Offer: delivery of the Set, conducting analysis, providing the Report, communication regarding the order.

1.1.2. Explicit consent (Article 11 Part 1 Clause 1 of the Law; Article 6(1)(a) and Article 9(2)(a) GDPR) — the processing of genetic data and biomaterial as special category data is carried out on the basis of the Customer's explicit voluntary consent provided upon acceptance of the Public Offer.

1.1.3. Legislative obligation (Article 11 Part 1 Clause 3 of the Law; Article 6(1)(c) GDPR) — storage of financial documents and compliance with legislative requirements in the field of accounting and taxation.

1.1.4. Legitimate interest (Art. 6(1)(f) GDPR) — exclusively for technical and statistical data (anonymous analytics, fraud protection). Does not apply to genetic or other sensitive data.

2. CATEGORIES OF PERSONAL DATA COLLECTED

2.1. The Contractor collects and processes the following categories of personal data:

2.1.1. Identification and contact details:

a) surname, first name, patronymic;

b) date of birth;

c) telephone number, e-mail;

d) postal address (for delivery of the Set).

2.1.2. Genetic and biological data (special category):

a) age and gender of the Customer;

b) saliva sample (Biomaterial) — for the Option “With analysis”;

c) raw genetic data (raw DNA data) in 23andMe, AncestryDNA, VCF formats — for the “Interpretation” Option;

d) results of genetic analysis and/or interpretation;

e) Genetic report.

2.1.3. Service and payment information:

a) order details (selected Service, Option, date);

b) the fact and method of payment (without storing full card details);

c) history of communications with support service.

2.1.4. Technical data (collected automatically):

a) IP address, device and browser type;

b) statistical data on viewing the Site in anonymous aggregated form.

2.2. Genetic and biological data (clause 2.1.2) are processed exclusively on the basis of the Customer's explicit consent and in compliance with enhanced protection measures in accordance with Art. 7-1 of the Law and Art. 9 of the GDPR.

3. PURPOSE OF PROCESSING PERSONAL DATA

3.1. The Contractor processes personal data exclusively for the following purposes:

3.1.1. provision of the Service — conducting genetic testing and/or interpretation in accordance with the Public Offer;

3.1.2. delivery of the Set and logistical support of the order;

3.1.3. formation, storage and provision of access to the Genetic Report;

3.1.4. communication with the Customer: order confirmation, processing status, technical support;

3.1.5. compliance with legal requirements (accounting, tax reporting);

3.1.6. improving the quality of the Service based on depersonalized analytics - without the possibility of identifying a specific Customer.

3.2. The Contractor does not use personal or genetic data for automated decision-making without human participation, for advertising purposes, and does not transfer them to insurance companies, employers or government agencies, except in cases expressly provided for by the legislation of Ukraine.

4. PERIODS OF PERSONAL DATA STORAGE

4.1. The Contractor stores personal data for the following periods:

4.1.1. Identification and contact data - until the Customer's account is deleted and for 1 year thereafter, based on contractual necessity.

4.1.2. Genetic report (digital) - until the Customer withdraws consent to processing or receives a request for deletion.

4.1.3. Raw genetic data (raw DNA) - until the Report is generated, after which it is deleted.

4.1.4. Biomaterial (physical saliva sample) - is destroyed by the laboratory after completion of the analysis and transmission of the results to the Contractor.

4.1.5. Payment data and financial documents - 7 years in accordance with the requirements of the Law of Ukraine "On Accounting and Financial Reporting".

4.1.6. Support correspondence — 3 years.

4.2. After the expiration of the storage period, the data is deleted or depersonalized within 30 calendar days, unless their storage is required by law.

5. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

5.1. The Contractor does not sell or disclose the Customer's personal or genetic data to third parties for commercial purposes.

5.2. Data transfer is possible only in the following cases:

5.2.1. Accredited laboratory partners - for genetic analysis (Option "With analysis"). Partners act as data processors under a processing agreement and are required to adhere to confidentiality standards equivalent to this Policy.

5.2.2. Delivery service (Nova Poshta) - exclusively identification and contact data necessary for delivery of the Set.

5.2.3. Payment processor - for processing online payments; card details are not stored by the Contractor.

5.2.4. State authorities - exclusively on the basis of legislative requirements or a court decision that has entered into legal force.

5.3. If it is necessary to involve a laboratory partner located outside of Ukraine, the Customer consents to such transfer by accepting the Public Offer. The Contractor ensures that the partner provides a level of data protection not lower than that provided for by this Policy and the requirements of Chapter V of the GDPR.

6. RIGHTS OF THE CUSTOMER AS A PERSONAL DATA SUBJECT

6.1. In accordance with Art. 8 of the Law and Articles 15–22 of the GDPR, the Customer has the following rights:

6.1.1. Right of access - to receive confirmation of the fact of processing of your data and a copy of it.

6.1.2. Right to rectification — to request the correction of inaccurate or incomplete personal data.

6.1.3. Right to erasure — to request the destruction of personal data in cases provided for by law. The right does not apply to data the retention of which is mandatory by law.

6.1.4. Right to restriction of processing - to request suspension of processing while the objection is being considered.

6.1.5. The right to portability - to receive your personal data in a structured format and transfer them to another operator, if the processing was carried out automatically on the basis of consent or a contract (Article 20 GDPR).

6.1.6. Right to withdraw consent — to withdraw consent to the processing of genetic data at any time without giving reasons. Withdrawal does not affect the lawfulness of the processing prior to its receipt. After withdrawal, the provision of the Service becomes impossible.

6.1.7. The right to complain — to contact the Commissioner for Human Rights of the Verkhovna Rada of Ukraine as the supervisory authority in the field of personal data protection, or to the relevant supervisory authority of the EU country of residence (for persons from the EU).

6.2. To exercise any of the rights specified in clause 6.1, the Customer shall send a written or electronic request to the address: support@apixmed.com. The Contractor shall consider the request and provide a response within 30 calendar days from the date of its receipt.

6.3. In case of withdrawal of consent, the Contractor:

a) terminates data processing carried out solely on the basis of consent;

b) deletes or anonymizes the relevant data within 30 calendar days, unless their retention is required by law;

c) informs laboratory partners who have accessed the data of the need to delete them;

d) sends the Customer confirmation of the actions taken.

7. PROTECTION OF PERSONAL DATA

7.1. The Contractor takes organizational and technical measures to protect personal data from unauthorized access, disclosure or destruction in accordance with Art. 24 of the Law and Art. 32 of the GDPR, in particular: data encryption during transmission and storage; separation of access rights; storage of genetic data separately from general personal data with an increased level of protection; regular access audit.

7.2. In the event of a security breach that may pose a risk to the rights of the Customer, the Contractor shall notify the Commissioner for Human Rights of the Verkhovna Rada of Ukraine within 72 hours and notify the Customer without undue delay (Articles 33–34 of the GDPR).

8. COMMUNICATIONS

8.1. Transactional messages (order confirmation, processing status, Report readiness) are sent based on contractual necessity and do not require separate consent.

8.2. Marketing and informational messages are sent solely on the basis of the Customer's express separate consent. The Customer may refuse them at any time via the "Unsubscribe" link in the letter or by contacting support@apixmed.com. Refusal does not affect transactional messages regarding the order.

9. CHANGES TO THE POLICY

9.1. The Contractor reserves the right to make changes to this Policy. The current version is always available on the Site.

9.2. The Contractor shall notify the Customer of any significant changes (purpose of processing, data categories, rights of the Customer) by e-mail or through the Personal Account no less than 10 calendar days before the changes come into force. Continued use of the Service after the changes come into force means the Customer's consent to the updated version.

10. CONTACTS FOR PERSONAL DATA ISSUES

10.1. The person responsible for personal data protection is:

Havrylyuk Yevheniy Serhiyovych

Email (general): eugene.havryliuk@apixmed.com

Email (support): support@apixmed.com

10.2. Applications regarding the exercise of the rights of the data subject, complaints and requests shall be sent to the following address: support@apixmed.com.