Effective date: September 24, 2026

Enovone, Inc. (“Enovone”, “we”, “us”) is committed to respecting your privacy and the confidentiality of your health information. This Privacy Policy describes how we collect, use, disclose and protect your personal information and your protected health information through our website at https://enov.one, our patient application, and the AI assistant (“Ena”) available within them (together, the “Services”).

By using the Services you accept the terms of this Privacy Policy. If you are a patient, the consent documents you sign in the patient application also apply to you, and they describe in more detail what you have authorised.

Information We Collect

• Personal details — such as your name, email address, phone number and date of birth;
• Health information — including your medical history, medication and supplement use, questionnaire answers, laboratory results and genetic data;
• Your conversations with Ena — the messages you send to our AI assistant and the replies you receive. These are retained as part of your health record, in the same way a message to your care team would be;
• Payment information — such as your card details, handled by our payment processor;
• Log data — information your device sends automatically, such as IP address, browser type, operating system, the pages you visit, and the date, time and duration of your visit;
• Cookies and similar technologies — see “Cookies, Analytics and Advertising” below.

How We Use Your Information

We use the information described above, including your conversations with Ena, for purposes including but not limited to:

• providing and coordinating your care, and communicating with you about it;
• processing payment for our services;
• reviewing the safety, accuracy and quality of the care, information and services we provide to you and to other patients;
• operating, supporting, securing, improving and developing the Services and their features;
• training and evaluating our personnel, and training, evaluating and improving the tools and systems we use to deliver the Services, including the AI assistant;
• research and analysis, including research carried out with de-identified information or with a limited data set used under a data use agreement;
• education, marketing and promotion using de-identified information, including de-identified case studies and examples; and
• complying with applicable legal and regulatory requirements.

We may carry out any of these purposes ourselves or through service providers and partners acting for us under appropriate safeguards.

The AI Assistant (Ena)

Ena is our AI assistant. You can use it to ask questions about your genetics, laboratory results, reports and care plan. Ena provides information and decision support. It does not practise medicine, does not diagnose and does not prescribe, and it is not a substitute for advice from a licensed clinician. If you think you may be having a medical emergency, call 911.

We keep your conversations with Ena and use them for the purposes listed above. Where we use third-party technology providers to operate the assistant, our agreements with them restrict how they may use your content; how long those providers retain content, and for what purposes, is governed by their own published terms rather than by this policy.

How We Do Not Use Your Information

We do not sell your conversations with Ena, and we do not use them for third-party advertising. We may use them to communicate with you about your own results, your care, and the services we provide to you.

De-identified Information

Once information about you has been de-identified in accordance with applicable law, it is no longer your protected health information. We may retain, use and disclose it indefinitely, including after you stop using the Services, and you will not receive payment for it.

Case Studies, and Anything That Identifies You

We may create, use, publish and share de-identified case studies, examples, statistics, insights and other materials drawn from your information — including your genetics, laboratory results and conversations — in marketing, promotional, educational, scientific and business materials, in any medium, and without restriction as to time or territory. Everything used this way is de-identified in accordance with applicable law first.

We do not use your name, photograph, likeness, voice, contact details or any other information that identifies you in marketing or promotional material unless you give us separate, specific permission for that use. You may decline, and you may withdraw that permission later. Declining will not affect your care or your access to the Services.

If we wish to use your identifiable information in a particular research study, or to enrol you in a study that changes your care, we will ask you for separate written informed consent for that study. You may refuse without affecting your care.

Disclosure of Information

We may disclose your personal and protected health information:

• to the licensed entities we facilitate access to — including clinicians, registered nurses, pharmacies, and diagnostic or supplement manufacturers (“Partners”) — so that they can provide care, treatment, tests, medications and supplements to you;
• to another licensed clinician, including one practising at a different clinic, for a second opinion, specialist input or supervision of your care. Any clinician who reviews your record in this way is subject to professional obligations of confidentiality;
• to third-party service providers, known as Business Associates under HIPAA, who assist us in delivering the Services and have agreed to appropriate safeguards;
• to comply with legal and regulatory requirements, or in response to lawful requests by public authorities; and
• in the event of a merger, acquisition or sale of assets, always ensuring the confidentiality of your information.

How Long We Keep Your Information

Because your conversations with Ena form part of your medical record, we retain them for as long as we retain the rest of that record, and for any longer period permitted or required by law, even if you stop using Ena. Other information is kept for as long as it is needed for the purposes described in this policy, or as required by law.

Your Rights

You have the following rights in relation to your protected health information:

• Right to Access — you can access and review the personal and protected health information we hold about you.
• Right to Amend — if you find an inaccuracy, you can ask us to correct it.
• Right to an Accounting of Disclosures — you can request a report of non-routine disclosures of your health information.
• Right to Request Restrictions — you may ask for limits on certain uses and disclosures.
• Right to Request Confidential Communications — you may specify how or where you wish to be contacted about your health information.
• Right to be Notified of a Breach — if there is a breach of your unsecured health information, we will tell you.
• Right to a Copy of this Notice — you are entitled to a paper copy of this Privacy Policy at any time.

You may also withdraw the authorisation you gave for research, quality improvement and de-identified uses at any time by writing to support@enov.one. Withdrawal is not retroactive: it does not apply to information already used or disclosed, to uses we are permitted or required by law to continue, or to de-identified information, which can no longer be linked to you.

Depending on where you live, you may have additional rights under state privacy law, such as the right to know what personal information we hold, to request its deletion or correction, and not to be discriminated against for exercising those rights. To exercise any right, write to support@enov.one.

Cookies, Analytics and Advertising

We use cookies and similar technologies on our website to remember your preferences, to measure how the site is used, and to measure and improve our advertising. Some of these technologies are provided by third parties, including Google and Meta, and they may receive information about your visit to our website. You may instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

These advertising and analytics technologies operate on our public website. They are not used to target advertising based on your health information or your conversations with Ena.

Security of Information

We prioritise the security of your personal and protected health information and use industry-standard measures to protect it from unauthorised access, disclosure, alteration or destruction. We remind users, however, that no method of electronic transmission or digital storage is 100% secure.

Log Data

We use log data to monitor and maintain the security of our systems and services, to detect and prevent unauthorised access or misuse, and to improve system performance and reliability. Log data is maintained in secure, access-controlled environments and is not used to personally identify you, except as required to comply with law, to protect the security of our systems, or as otherwise permitted by regulation.

Communications

We may use your personal information to contact you with healthcare-related materials and other information that may be of interest to you, in accordance with the HIPAA Privacy Rule.

Children

The Services are intended for people aged 18 and over. We do not knowingly collect information from anyone under 18.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Where a change is material we will ask you to review and accept the updated version in the patient application; otherwise your continued use of the Services after we post a modification constitutes acceptance of it.

Contact Us

If you have questions or concerns about this Privacy Policy or our HIPAA compliance, please contact our Privacy Officer: Franz Harmer.

Email: support@enov.one

Phone: (833) 828-5216

Address: Enovone, Inc., 2261 Market Street STE 5495, San Francisco, CA 94114

By using the Services, you acknowledge that you have read, understood and agree to be bound by this Privacy Policy.