State Privacy Law Addendum

1Scope

This State Privacy Law Addendum (the "Addendum") supplements the BioBylt Labs Privacy Policy and describes additional privacy rights available to residents of U.S. states with comprehensive consumer privacy statutes in effect as of the Effective Date. Rights described below apply only to categories of personal information that are governed by the applicable state statute. Information that constitutes Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is governed primarily by HIPAA and is addressed in the Notice of Privacy Practices issued by the BioBylt Labs-affiliated provider group. This Addendum does not create privacy rights for residents of states not listed below. Residents of unlisted states may still contact us at support@biobyltlabs.com with privacy questions or concerns.

2Covered States

Residents of the following states have rights under their state's comprehensive consumer privacy law:

• California — CCPA / CPRA (California Consumer Privacy Act, as amended by the California Privacy Rights Act) · effective 2020 / 2023.
• Virginia — VCDPA (Virginia Consumer Data Protection Act) · effective January 2023.
• Colorado — CPA (Colorado Privacy Act) · effective July 2023.
• Connecticut — CTDPA (Connecticut Data Privacy Act) · effective July 2023.
• Utah — UCPA (Utah Consumer Privacy Act) · effective December 2023.
• Texas — TDPSA (Texas Data Privacy and Security Act) · effective July 2024.
• Oregon — OCPA (Oregon Consumer Privacy Act) · effective July 2024.
• Montana — MCDPA (Montana Consumer Data Privacy Act) · effective October 2024.
• Iowa — CDPA (Iowa Consumer Data Protection Act) · effective January 2025.
• Delaware — DPDPA (Delaware Personal Data Privacy Act) · effective January 2025.
• New Hampshire — NHPA (New Hampshire Privacy Act) · effective January 2025.
• New Jersey — NJDPA (New Jersey Data Privacy Act) · effective January 2025.
• Nebraska — NDPA (Nebraska Data Privacy Act) · effective January 2025.
• Tennessee — TIPA (Tennessee Information Protection Act) · effective July 2025.
• Minnesota — MCDPA (Minnesota Consumer Data Privacy Act) · effective July 2025.
• Maryland — MODPA (Maryland Online Data Privacy Act) · effective October 2025.
• Rhode Island — RIDTPPA (Rhode Island Data Transparency and Privacy Protection Act) · effective January 2026.
• Indiana — IDPA (Indiana Consumer Data Protection Act) · effective January 2026.
• Kentucky — KCDPA (Kentucky Consumer Data Protection Act) · effective January 2026.

3Consumer Rights

Subject to the specific provisions and exemptions of each applicable state law, residents of covered states generally have the following rights with respect to personal information BioBylt Labs collects from them (excluding PHI governed by HIPAA):

• Right to know / right of access. The right to confirm whether we are processing your personal information and to obtain a copy of that information.
• Right to correct. The right to request correction of inaccurate personal information.
• Right to delete. The right to request deletion of personal information we have collected, subject to applicable exceptions (including records we are required to retain by law).
• Right to data portability. The right to obtain a copy of your personal information in a portable, machine-readable format where technically feasible.
• Right to opt out of targeted advertising. The right to opt out of the use of your personal information for targeted advertising.
• Right to opt out of sale. The right to opt out of the sale of personal information. BioBylt Labs does not sell personal information in the traditional sense but discloses how information is shared in our Privacy Policy.
• Right to opt out of profiling. The right to opt out of profiling that produces legal or similarly significant effects.
• Right against discrimination. The right not to be subjected to discriminatory treatment for exercising any of the rights described above.
• Right to appeal. Where provided by state law, the right to appeal our denial of a privacy request.

California residents have additional rights under the CCPA/CPRA, including the right to limit the use of sensitive personal information and the right to know specific categories of information collected, sold, or shared in the prior twelve (12) months. Detailed information about how BioBylt Labs collects, uses, and discloses California residents' personal information — including the categories of information collected and disclosed in the preceding twelve (12) months — is set forth in our Privacy Policy.

4Exercising Your Rights

To submit a privacy rights request, email support@biobyltlabs.com with your full name, state of residence, and a description of your request. We will verify your identity before responding to substantive requests and will respond within the timeframe required by applicable state law (generally 45 days, subject to extension where permitted). There is no charge for requests submitted in good faith and at reasonable frequency. You may designate an authorized agent to submit a request on your behalf. We may require verification of the agent's authority and of your identity before responding.

5HIPAA Preemption

Protected Health Information (PHI) collected and maintained in connection with your telehealth encounter with a BioBylt Labs-affiliated provider group is governed by HIPAA. Rights with respect to PHI are described in the Notice of Privacy Practices issued by the provider group. Where state privacy law and HIPAA would impose conflicting obligations, HIPAA typically controls.

6Contact

Privacy rights requests and questions about this Addendum may be directed to support@biobyltlabs.com.