Cookie Policy

1. INTRODUCTION

Spark Diagnostics LLC d/b/a SparkDX ("SparkDX," , "MySparkDX.com", "we," "us," or "our") uses cookies and similar tracking technologies on our website at www. Sparkdx.com and, where applicable, within our mobile application (the sparkdx app) to help provide, secure, and improve our Services.

This Cookie Policy explains what these technologies are, how we use them, and the choices you have.

This Cookie Policy should be read alongside our Privacy Policy and Terms of Service, which together govern your use of our Services.

We strive to describe our cookie practices accurately and consistently with the controls described in this Cookie Policy (including the cookie consent banner and cookie settings link).

2. WHAT ARE COOKIES AND SIMILAR TECHNOLOGIES?

Cookies

Generally, cookies are small text files that websites place on your device when you visit. Cookies allow a website to recognize your device, remember your preferences, keep you logged in, and gather information about how you interact with the site.

Specifically, the following definitions are necessary to understanding our Cookie Policy:

• “Cookie Data” means information collected through cookies and similar technologies described in this Cookie Policy, such as device identifiers, browser information, and information about interactions with our website or app.

• “Strictly Necessary Cookies” means cookies essential to enable you to navigate our website and use its features (for example, account login, checkout processing, and security).

• “Analytics Cookies” means cookies used to understand how visitors use our website (for example, pages visited and whether users encounter error messages).

• “Functional Cookies” means cookies that enable enhanced features and personalization (for example, remembering language preference or dismissed banners).

• “Marketing/Communications Cookies” means limited cookies and similar technologies used to measure the effectiveness of our own marketing campaigns and communications (for example, UTM tracking and email open tracking pixels).

Cookies may also be categorized by the following based on its source:

• Session cookies: Temporary cookies that are deleted from your device when you close your browser.

• Persistent cookies: Cookies that remain on your device for a specified period (or until you manually delete them), even after you close your browser.

• First-party cookies: Set directly by SparkDX when you visit our website.

• Third-party cookies: Set by third parties (such as analytics providers or social media platforms) through our website.

Strictly Necessary Cookies are always used because they are required for core site functionality and security.

All other cookies (including analytics, functional, and marketing/communications cookies) are used only as described in this Cookie Policy and are subject to the choices you make through our cookie consent banner and settings.

You may withdraw or modify your choices at any time by using the cookie settings link in the footer of our website.

Similar Tracking Technologies

In addition to traditional cookies, we or our third-party partners may use the following technologies to collect data from you:

• Web beacons / pixel tags, which are small transparent images embedded in web pages or emails that track whether a page or email has been opened and the IP address of the device used.

• Local storage, which is browser-based storage that allows websites to store data on your device without an expiration date (similar to persistent cookies but stored differently).

• Session storage, which is similar to local storage, but data is cleared when the browser session ends.

• Mobile app identifiers, which are only relevant when using the SparkDX mobile app, in which case we may use mobile device identifiers (such as the iOS Identifier for Advertising (IDFA) or Android Advertising ID) and app analytics SDKs to understand app usage and performance.

• Log files, which are server-side records of your requests to our web servers, including IP address, browser type, pages accessed, and timestamps.

3. WHY WE USE COOKIES

We use cookies and similar technologies for the following purposes:

• To make our website and app function properly.

• To enhance the security and integrity of the Services.

• To remember your preferences and settings.

• To understand how users interact with our website and app.

• To measure the effectiveness of our marketing and communications.

• To improve the performance and content of our Services.

We do not use cookies to target you with advertising based on your wellness or health data and we do not sell cookie data to third parties.

Under federal jurisdiction, SparkDX discloses and you acknowledge: (a) as a general matter, cookies and similar technologies used on the SparkDX platform and associated apps are not intended to collect PHI; however, depending on how a user interacts with the SparkDX platform , certain information collected or transmitted through cookies and similar technologies may constitute protected health information (“PHI”) as defined under Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA") if it is individually identifiable and relates to a health condition, health care services, or payment for health care; (b) examples of information that may be collected through cookies and similar technologies and that could be PHI in context include, without limitation, identifiers and online activity data associated with a user's interaction with health-related pages or functions (such as pages or workflows relating to scheduling, patient portal access, care navigation, benefits, billing, or similar health care-related services), including device identifiers, cookie identifiers, IP address, timestamps, page views, clickstream data, and URLs or page titles that reveal health-related content; (c) SparkDX will access, use, and disclose any PHI only as permitted by HIPAA and only to the extent necessary to operate the SparkDX platform and perform legitimate functions, and will apply confidentiality and security protocols designed to safeguard PHI and protect patient privacy and confidentiality; (d) SparkDX will share PHI, if at all, only on a job-related need-to-know basis and consistent with applicable federal requirements, and SparkDX will require that any vendor that may access PHI in connection with cookies and similar technologies be subject to appropriate contractual requirements, which may include a business associate agreement where required by HIPAA; (e) SparkDX does not authorize the use of PHI collected through cookies and similar technologies for purposes not permitted by HIPAA, and any use or disclosure outside HIPAA-permitted purposes will require a valid authorization where applicable; and (f) users should avoid entering information into free-text fields or other inputs on the SparkDX platform that they do not want treated as PHI, and users may manage cookie preferences through available controls; however, disabling certain cookies may affect The SparkDX platform functionality. This clause is intended to provide clear notice that, while cookies and similar technologies are generally used for operational, security, and user-experience purposes, information collected through such technologies may be PHI depending on the context of use, and SparkDX will safeguard and handle PHI in accordance with HIPAA and applicable federal law.

4. TYPES OF COOKIES WE USE

Strictly Necessary Cookies

These cookies are essential to enable you to navigate our website and use its features. Without these cookies, core functionality such as shopping cart management, account login, checkout processing, and subscription management would not work.

Because these cookies are essential to the operation of our website, they cannot be disabled through our cookie preference settings. However, you can set your browser to block these cookies, though doing so may prevent certain features from functioning.

Examples include the session ID cookie, cart cookie, CSRF token, checkout session, authentication token, subscription session, and fraud prevention cookie, as described below:

• Session ID cookie

◦ Provider: SparkDX

◦ Duration: Session

◦ Purpose: Maintains your login session across pages

• Cart cookie

◦ Provider: SparkDX / Shopify

◦ Duration: 30 days

◦ Purpose: Stores your shopping cart contents

• CSRF token

◦ Provider: SparkDX

◦ Duration: Session

◦ Purpose: Prevents cross-site request forgery attacks

• Checkout session

◦ Provider: Shopify

◦ Duration: Session

◦ Purpose: Enables secure checkout flow

• Authentication token

◦ Provider: SparkDX

◦ Duration: 30 days (if 'Remember Me')

◦ Purpose: Keeps you logged in to your account

• Subscription session

◦ Provider: SparkDX

◦ Duration: Session

◦ Purpose: Manages subscription selection and payment

• Fraud prevention

◦ Provider: Shopify

◦ Duration: 1 year

◦ Purpose: Detects and prevents fraudulent transactions

Performance and Analytics Cookies

These cookies collect information about how visitors use our website — for example, which pages are visited most often, how long users spend on each page, and whether they encounter error messages. All information collected by these cookies is aggregated and anonymized; it is used solely to improve how our website works and cannot be used to identify you personally.

We use this information to improve how our website works.

Our analytics cookies include Google Analytics cookies and identifiers as described below:

• _ga (Google Analytics)

◦ Provider: Google LLC

◦ Duration: 2 years

◦ Data Collected: Distinguishes unique users; session counts; pages visited; anonymized IP

• _gid (Google Analytics)

◦ Provider: Google LLC

◦ Duration: 24 hours

◦ Data Collected: Distinguishes unique users within a day

• _gat (Google Analytics)

◦ Provider: Google LLC

◦ Duration: 1 minute

◦ Data Collected: Throttles request rate

• Google Analytics Measurement ID

◦ Provider: Google LLC

◦ Duration: 2 years

◦ Data Collected: Session engagement; conversion events; traffic sources

• Hotjar / similar heatmap tool (if used)

◦ Provider: Hotjar Ltd.

◦ Duration: 1 year

◦ Data Collected: Anonymized session replays; click maps; scroll behavior

We have configured Google Analytics with IP anonymization enabled and with data retention set to the minimum feasible period, as described in this Cookie Policy. You can opt out of Google Analytics tracking by visiting https://tools. Google.com/dlpage/gaoptout or adjusting your cookie preferences. ,

Functional Cookies

Functional cookies enable enhanced features and personalization that improve your experience on our website (for example, remembering language preference, previously viewed products, or whether you have dismissed a banner or notification).

Examples include language preference, cookie consent record, dismissed banners, product preferences, and Shopify customer tag, as described below:

• Language preference

◦ Provider: SparkDX

◦ Duration: 1 year

◦ Purpose: Remembers your selected language (if applicable)

• Cookie consent record

◦ Provider: SparkDX / Consent tool

◦ Duration: 1 year

◦ Purpose: Records your cookie consent preferences

• Dismissed banners

◦ Provider: SparkDX

◦ Duration: 6 months

◦ Purpose: Remembers if you have dismissed promotional banners

• Product preferences

◦ Provider: SparkDX

◦ Duration: 30 days

◦ Purpose: Saves your product selection preferences

• Shopify customer tag

◦ Provider: Shopify

◦ Duration: 2 weeks

◦ Purpose: Identifies returning customers for personalized experience

Marketing and Communications Cookies

We use limited marketing cookies to help us understand the effectiveness of our own marketing campaigns and email communications. We do not use third-party advertising network cookies to track you across other websites or to display behavioral advertisements.

Examples include email open tracking pixels, UTM parameter tracking, and conversion tracking as described below:

• Email open tracking pixel

◦ Provider: Email service provider (e.g., SendGrid)

◦ Duration: Session

◦ Purpose: Tracks whether order confirmation and results emails are opened; not used for cross-site tracking

• UTM parameter tracking

◦ Provider: SparkDX (Google Analytics)

◦ Duration: 30 days

◦ Purpose: Measures which marketing campaigns drive website visits

• Conversion tracking

◦ Provider: Google Analytics

◦ Duration: 90 days

◦ Purpose: Tracks whether a user who arrived from an ad completed a purchase

We do not use cookies to display targeted health or wellness advertisements based on your test data. You can reset your advertising identifier through your device's privacy settings.

Mobile Application Tracking Technologies

The SparkDX mobile app uses analytics software development kits (SDKs) and device identifiers to understand how users interact with the app. This may include:

• App Analytics, which measures screen views, feature usage, session duration, crash reports, and app performance. This data is aggregated and used to improve the app experience.

• Push Notification Tokens, which is only used when you grant permission. We use Push Notification Tokens to send you test result notifications and account updates. You can disable Push Notifications Tokens at any time through by disabling notifications in your device settings.

• Camera Usage, for which you must grant permission. The app may access your device camera to capture test strip images for result analysis. Camera images are processed to extract test results and are not stored permanently unless necessary for result verification.

Mobile app data collection is governed by our Privacy Policy and, where applicable, by the privacy settings on your device. You can reset your advertising ID at any time through your device's privacy settings.

5. THIRD-PARTY COOKIE PROVIDERS

The following third parties may set or access cookies through our website or app, and each third party has its own privacy and cookie policies:

• Google LLC (Analytics)

◦ Category: Analytics

◦ Privacy Policy / Opt-Out: https://policies.google.com/privacy and https://tools.google.com/dlpage/gaoptout

• Shopify Inc.

◦ Category: Essential / Functional

◦ Privacy Policy / Opt-Out: https://www.shopify.com/legal/privacy

• Stripe, Inc. (payment)

◦ Category: Essential

◦ Privacy Policy / Opt-Out: https://stripe.com/privacy

• SendGrid / Twilio (email)

◦ Category: Functional / Marketing

◦ Privacy Policy / Opt-Out: https://www.twilio.com/legal/privacy

• Hotjar Ltd. (if used)

◦ Category: Analytics

◦ Privacy Policy / Opt-Out: https://www.hotjar.com/legal/policies/privacy

We do not permit third-party advertising networks to set tracking cookies on our website in connection with behavioral advertising.

Where third parties provide services to us (for example, analytics, e-commerce, payments, or email delivery), they may process cookie data in connection with providing those services as described in this Cookie Policy and their own policies.

6. COOKIES AND WELLNESS DATA

Cookies and similar technologies used on our website do not collect, access, or process your wellness test results, biomarker values, cortisol levels, ketone measurements, or other health-related data generated by our products.

Your wellness test data is collected, processed, and stored through our secure backend systems (not through browser cookies) and is governed by our Privacy Policy.

We do not use your wellness data for cookie-based advertising or tracking, and we do not share your wellness data with cookie technology providers.

7. HOW TO MANAGE AND CONTROL COOKIES

Cookie Consent Banner and Cookie Settings

When you first visit our website, you will be presented with a cookie consent banner that explains the types of cookies we use and allows you to accept, decline, or customize your cookie preferences. You may change your preferences at any time by clicking the cookie settings link in the footer of our website.

Browser Settings

Most browsers allow you to control cookies through their settings, including viewing and deleting cookies, blocking cookies, blocking third-party cookies, and clearing cookies when you close your browser.

Below are links to cookie management instructions for the most common browsers:

• Google Chrome: chrome://settings/cookies

• Mozilla Firefox: about:preferences#privacy

• Apple Safari (macOS): https://support.apple.com/guide/safari/sfri11471/mac

• Apple Safari (iOS): Settings > Safari > Privacy & Security

• Microsoft Edge: edge://settings/privacy

• Android Chrome: Settings > Site Settings > Cookies

Please note blocking all cookies may prevent you from using certain features of our website, including account login, checkout, and subscription management.

Opting Out of Google Analytics

To opt out of Google Analytics tracking on any website, you may install the Google Analytics Opt-out Browser Add-on available at https://tools. google.com/dlpage/gaoptout. This action should prevent Google Analytics JavaScript from collecting and sending data to Google.

Do Not Track Signals

Some browsers include a do not track (DNT) setting that sends a signal to websites requesting that your browsing not be tracked. As there is no uniform technical standard for interpreting DNT signals, our website does not currently alter its behavior in response to DNT signals. However, we honor opt-out requests submitted through our cookie consent banner or by contacting us directly.

Mobile App Preferences

Within the SparkDX mobile app, you can manage notification preferences and certain data collection settings in the app's Settings menu. You can also reset or limit your device's advertising identifier through your device's privacy settings.

Impact of Disabling Cookies

If you choose to disable or block certain types of cookies, functionality may be affected as described in this Cookie Policy.

• Essential cookies disabled: You will not be able to log in to your account, add items to your cart, or complete purchases.

• Analytics cookies disabled: We will not be able to understand how our website is used, which may affect our ability to improve the user experience.

• Functional cookies disabled: Your preferences (such as language settings and dismissed banners) will not be saved between sessions.

8. COOKIE DATA RETENTION

The retention periods for specific cookies are listed in Section 4 of this Cookie Policy.

• Session cookies are deleted when you close your browser.

• Persistent cookies remain on your device until they expire or you delete them manually.

• Analytics data collected through cookies is retained by Google Analytics for up to 14 months, after which it is automatically deleted from Google's servers.

• Our server-side log files (which may include IP addresses collected through cookies) are retained for up to 12 months for security and troubleshooting purposes.

You can delete cookies from your device at any time by clearing your browser's cookies and site data.

9. FEDERAL LAW COMPLIANCE FRAMING

Accuracy and Non-Deception.

SparkDX intends for this Cookie Policy and related disclosures (including cookie banners and settings) to be accurate and not misleading, including with respect to what data is collected, how it is used, and what choices are available.

Federal Privacy and Data Security Laws.

Depending on the context of our Services and data processing activities, certain U.S. federal laws may be relevant to privacy and data security practices, including Section 5 of the Federal Trade Commission Act (unfair or deceptive acts or practices), the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act, the Children's Online Privacy Protection Act, and the Fair Credit Reporting Act.

Children's privacy.

Our website and Services are not directed to children under 13.

If we learn that we have collected online information from a child under 13 through cookies or similar technologies in a manner that requires parental consent, we will take steps to address it consistent with applicable requirements.

HIPAA-related clarification.

To the extent SparkDX is acting as a covered health care provider or otherwise subject to HIPAA requirements for protected health information, SparkDX will obtain any required individual consent for uses or disclosures as applicable.

10. CHANGES TO THIS COOKIE POLICY

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, changes in applicable law, or changes to our Services. When we make material changes, we will update the effective date at the top of this Cookie Policy and, where appropriate, notify you by email or through a website banner.

Please periodically review our Cookie Policy to stay informed about how we use cookies Your continued use of our website after the updated Cookie Policy is posted constitutes your acceptance of the changes.

11. CONTACT US

If you have questions or concerns about our use of cookies or this Cookie Policy, please contact our Privacy Team:

Spark Diagnostics LLC d/b/a SparkDX

Attn: Privacy Officer.

423 Metro Park Dr,

McKinney, TX 75071.

Email: info@sparkdx.com.

Website: www. sparkdx.com.