This section describes the general categories of Personal Information that we may collect for the purposes described in this Privacy Policy. Personal Information generally refers to any information that can be linked to an identified or identifiable person. The term Personal Information also covers certain categories of "sensitive" or "special" Personal Information that often receive additional protections and/or are subject to additional restrictions under applicable laws.

In this Privacy Policy, we refer to this data as "Sensitive." Depending on the location (such as in the European Union and the United Kingdom), it may include, but not be limited to, race, ethnicity, information needed to identify you using facial recognition technology and health data.

When you use the Services, several types of information may be collected from you, including: (1) Device Information; and (2) Personal Information.

We may automatically collect Device Information regarding your use of or access to the Services, such as:

• The type of device you use to access the Services;
• The date and time you access the Services;
• The type of web browser you use to access the Services;
• The sections within the Services that you access;
• The Internet Protocol ("IP") address (a number that is automatically assigned to a computer when the Internet is used);
• The user language;
• The operating system;
• The presence/absence of "flash" plug-ins;
• The screen resolution; and
• The connection type that you use to access the Services.

In addition, we may collect location information through the use of technology when you use our Services, such as data associated with your IP address or other online or device identifier. If you do not want us to collect and use this information, you may be able to disable the location features on your device. Check your device manufacturer settings for information on how to do so.

This information (collectively, "Device Information") does not, by itself, personally identify users. We use this Device Information to monitor the effectiveness of the Services, to help personalize your experience and to consider potential improvements to the Services. Device Information may be collected through cookies or similar technologies. For more detailed information on cookies, please refer to the "Cookies and other Online Interactions" section below.

Access to and/or use of some Services (such as certain restricted portions of the Baseline website and the mobile App in its entirety) require disclosure of certain Personal Information as further described below.

Verily may collect Personal Information from you directly, for example in response to a questionnaire or when you contact us with inquiries or other requests. Verily may also obtain Personal Information indirectly, such as from publicly available sources (e.g., websites or publicly accessible databases), third-party data vendors, and third-party partners and collaborators. Verily may also collect Personal Information from you from wearables and similar devices (e.g. Verily's Study Watch). The categories of Personal Information that Verily may collect about you include:

• Direct identifiers and contact information, including your name, address, phone number, or email address.
• Demographic information, including race, ethnicity, gender, age, location, and user obtained through surveys or questionnaires, such as study eligibility surveys.
• Name, and contact information, of our customers, third-party partners and collaborators, and their employees, with whom we may interact.
• Account registration information, such as your email address and password and user profile data provided when you create or update your Baseline account.
• Health-related information, such as information about a health condition or medical history as part of your use of the Services.
• Biospecimens, if you participate in study-related activities.
• Identity verification information such as Social Security Number or similar government identifiers, driver's license and other government identification documents (which may contain document numbers, birth date, gender and photo).
• Biometric data (specifically facial identifiers) also used in the identity verification process.
• Payment or banking information.
• Product survey response information.
• Information you submit when you contact us for support.

The following categories may also be Personal Information depending on how they are used and linked to other information.

• If you receive an email from us, we may use certain tools to capture data related to when you open our message or click on any links or banners it contains.
• Website or mobile App interactions, including how you interact with links you can click on, information that you type into online forms or information about your device or browser.
• Information about how you interact with our Services. This includes data such as access dates and times, app features or pages viewed, app crashes and other system activity, and third party sites or services used before interacting with our Services.
• Browser type, operating system, IP address, domain name, click-activity, referring website, and/or a date/time stamp for visitors.
• Information regarding your body movements, pulse rate or similar information derived from your use of wearables and similar devices (e.g. Study Watch).

We use the Device Information collected through the Services for statistical and research purposes and for improving the functionality of the Services. This information may also be used for administrative purposes including, without limitation, to troubleshoot and resolve problems with the Services. We may rely on third-party partners to collect and analyze the Device Information. Device Information may also be collected through cookies. For more detailed information on cookies, please refer to the "Cookies and Online Interactions" section below.

We may use your Personal Information for everyday business purposes, such as account management, contract management, website administration, corporate governance, and reporting obligations. We may also use your Personal Information to provide you access to the Services, including, for example, to determine eligibility for our Services, verify your identity or process payments. We may also use Personal Information to respond to or follow-up on your comments, inquiries and other requests. This means that we may use your Personal Information to respond to your questions, perform our obligations to you, notify you when we think you may be interested in or eligible for other services (to the extent permitted and in accordance with applicable law), or perform other actions based on your consent. Where permitted, your Personal Information may also be used to create de-identified data sets.

In order to access certain restricted portions of the Baseline website, and to access the Baseline mobile App, you must have and login with a Google user account. Creation of a Google user account (if you do not already have one) requires you to provide your name and email address to Google. Please note, creation and maintenance of your Google user account is handled by Google, and is subject to its separate privacy policy, and NOT this Privacy Policy. We may receive certain information from Google related to your Google user account, such as email address, and will treat such information in accordance with relevant Google policies.

When you use the Baseline platform, you may be asked to provide information to be used to create your profile, determine your eligibility for a study, enroll you in a study, or for other study related services (such as identity verification and payment). You may also be required to accept our Baseline Terms of Service and acknowledge that you have read this Privacy Policy. Depending on the circumstances (e.g. the particular study for which your Personal Information may be used), you may be asked to separately consent to additional specific uses of your Personal Information (including in certain circumstances, your Sensitive Personal Information).

If you wish to participate in the project Baseline Community study or join other research studies, you may be required to read and sign an Informed Consent form  (the "ICF") for those studies. Note that, in some cases,  you may be required to confirm your consent to the ICF by providing your name and Google account information as an electronic signature.  The terms of the ICF will further describe collection and use of your information and, in the event of any conflict between this Privacy Policy and any terms of the ICF, the ICF will prevail to the extent of such conflict. Once you have joined a study and signed the ICF, you may be asked to provide additional information such as periodic health updates and responses to certain surveys on relevant topics based on the study protocol. Participation in research studies and study-related activities may occur at a study site or other offsite locations, or remotely through online services. You may also be requested to report to a laboratory or other clinical site to provide biospecimens, which will be transferred to Verily or an authorized agent.

We do not knowingly collect Personal Information from children under the age of 13 (or the relevant age in your location) ("Children" or "Child"). Children are not permitted to use the Services, and we request that Children not submit any Personal Information through the Services. Since information regarding Children is not collected, we do not knowingly distribute Personal Information regarding Children. If your Child has submitted Personal Information, please contact us to request that such information be removed. Once we are aware of information entered by a Child, we will exercise commercially reasonable efforts to remove such information from our databases and storage areas.

Most web browsers automatically accept cookies, but you can usually change your browser settings to prevent this. If you disable cookies, your ability to use some features of the Services may be limited.  For mobile devices, you may be able to manage certain cookies using your built-in mobile device settings and controls, or the settings also within your mobile application, where applicable. Choices are browser- and/or device-specific. If you clear your cookies from your browser on any of your devices, your choices will need to be reset. You should check how to do this on your device(s) and operating systems.

Some cookie providers may also offer you opportunities to control your preferences and to opt out of their cookies via their websites (e.g., Google, Facebook).

In addition, depending on your location and applicable laws, we may give you the option of adjusting your preferences with regard to the categories of cookies we use. When this option is available, you can configure your personal settings on our Cookies Banner under "Settings" or via other options that may be available on the relevant Service. If you use a different device to access the same Services, you may need to manage your settings for each separate device you use.

Do Not Track ("DNT") is a privacy preference that visitors can set in their web browsers. When a visitor turns on DNT, the browser sends a message to websites requesting that they don't track the visitor. At this time, we do not respond to these signals.

We may provide links to other third-party websites through the Services solely as a convenience to you. However, such linking does not mean, and should not be interpreted to mean, that Verily endorses, is affiliated with or makes any representations concerning such third-party websites. Verily neither reviews, nor controls, nor is responsible for these third-party sites or any content therein. By using such links, you will leave the Services. If you decide to access any of the third-party sites linked to the Services, you do so entirely at your own risk. Verily shall not be liable for any consequences arising from use of any third-party websites to which the Services link.

We strive to maintain the security of your information by using appropriate measures designed to protect our systems. However, we cannot guarantee the security of any information that is disclosed online.

How long we retain your Personal Information depends on the context in which, and purposes for which, we collected it. We generally retain Personal Information for as long as necessary for achieving the purposes for which it was collected or processed, unless a different retention period is required by applicable law.

Any of your biometric facial identifiers processed by Verily (or its service provider acting on its behalf) will be permanently deleted when the initial purpose for which it was collected or obtained has been satisfied or within three years after your last interaction with Verily, unless otherwise required by applicable law.

Depending on your location, you may have the opportunity to receive promotional emails or sign up for our Baseline text messaging program. In those cases, you have the ability to make choices regarding certain communications that we send to you.

We may use your email address to communicate with you about our services and for the purpose of sending promotional materials to you, to the extent permitted and in accordance with applicable law. You can stop receiving promotional emails by following the unsubscribe instructions in emails that you receive. If you decide not to receive promotional emails, we may still send you essential communications, such as information regarding your use of the Services and your participation in clinical studies, in accordance with applicable law.

If you opt into our Baseline text messaging program, we will not charge you a fee for text messages, but wireless carrier charges may apply. Your wireless carrier may collect data about your wireless device usage, and its practices are governed by its own policies. To stop receiving text messages from the Baseline program, text STOP to 88243. The text messages you receive may also provide you with instructions for opting out of text messages for a specific study. Depending on the studies that you join, message frequency may vary. To get help, you can text HELP to 88243 at any time.

If the California Consumer Privacy Act ("CCPA") applies to your Personal Information, we provide this additional information so you can understand and exercise your rights under the CCPA.

Please note that many of these rights are subject to exceptions and limitations and that the CCPA generally does not apply to  data that is subject to certain federal and state laws applicable to clinical trials and other health data.

We disclose your Personal Information for the business and commercial purposes described in this policy.

As a California resident, you have the following consumer rights:

• Right to access your Personal Information
• Right to deletion of your Personal Information
• Right to prohibit the sale of your Personal Information, if applicable

We do not sell your Personal Information. We do not discriminate against California residents who exercise any of their rights described in this Privacy Policy. However, Verily may require use of your Personal Information to provide access to the Services. Therefore, when you exercise your deletion right, in particular, you may lose access to certain aspects of the Services that require your Personal Information.

Verily provides two mechanisms that allow you to submit requests to access, review, update and delete your Personal Information. You can submit such requests by (1) emailing us at datarightsrequest@verily.com or (2) calling our toll-free number at 833-821-6366.

After you make your request, we will use the information we have about you to verify your identity (and if applicable, your authorized agent's identity). Our verification process may include a request for additional information to confirm your identity or your authorized agent's identity (such as your name, email address and date of birth) or to obtain proof that you have given your authorized agent permission to act on your behalf. If our verification process is successful, we will respond to your request within the time and in the manner required by applicable law. If we cannot validate the identity of you and/or your authorized agent or obtain proof that you have given your authorized agent permission to act on your behalf, we will attempt to contact you to inform you.

If you designate an authorized agent to submit requests to exercise certain privacy rights on your behalf, we will require verification that you provided the authorized agent permission to make a request on your behalf. You must provide us with a copy of the signed permission you have given to the authorized agent to submit the request on your behalf and verify your own identity directly with us. If you are an authorized agent submitting a request on behalf of an individual, you must attach a copy of the following information to the request:

1. A completed Authorized Agent Designation Form (or equivalent form) indicating that you have authorization to act on the individual's behalf.
2. If you are a business, proof that you are registered with the Secretary of State to conduct business in California.

The Verily databases and Services where we store Personal Information may be located in the United States and in other countries that may have privacy laws that differ from where you live. Data protection and privacy laws vary among countries, with some considered to provide more protection than others. Regardless of where your Personal Information is processed or stored, we apply the protections described in this Privacy Policy. We also comply with certain legal frameworks relating to the cross-border transfer of Personal Information by implementing appropriate contractual or other measures, including but not limited to, the European Union or United Kingdom Standard Contractual Clauses, where required. Where permitted by applicable law, you may request a copy of such contractual clauses by contacting us using the information provided below.

It may be necessary for us to modify this Privacy Policy. We will notify all users by posting an amended version of the Privacy Policy on the Services. Such modifications will become effective on the day they are posted. We encourage you to frequently review the Privacy Policy for any modifications.

If you have any questions or concerns about this Privacy Policy or the use of your information, please contact prisec@verily.com.

Attn: Verily Privacy Office
Baseline Study LLC
C/o Verily Life Sciences LLC
269 East Grand Avenue
South San Francisco, CA, 94080