Solium Privacy Policy

Solium is a wellness platform currently in pre-launch development. We are building a service for adults (18 and older) to test, track, and improve men's reproductive and hormonal health — including testosterone and other hormone testing, at-home sperm testing, lifestyle tracking, and educational content. Our company is in the process of being formally incorporated. Once incorporated, this policy will be updated to reflect our legal entity name and registered address.

Solium is a wellness and consumer technology company. We are not a healthcare provider, a clinical laboratory, a pharmacy, or an insurance company, and we do not provide medical advice, diagnosis, or treatment. Where clinical services, lab testing, or prescriptions are made available through Solium, those services are delivered by independent third-party providers we refer to in this policy as "Affiliated Providers" (see Section 4.2).

For privacy questions or requests, contact us at: hello@soliumhealth.com

2.1 Information You Provide Directly

When you join our waitlist or interact with our website, we collect:

• Email address
• Whether you are signing up for yourself or a partner
• Your stated primary fertility or health goal (e.g., trying to conceive, planning, optimizing for the future, recovering from a difficult result, or improving testosterone or general men's health), if you choose to provide it
• Any messages you send us through our contact form or by email

2.2 Information We Will Collect Once Our Subscription Service Launches

Once our paid subscription product launches, registered users will additionally provide or generate the following information. This data is not currently being collected.

• Account credentials (name, password)
• Payment information (collected and processed by our payment processor; we do not store full card details)
• At-home and lab test results, including sperm concentration, motility, progressive motility, and motile sperm count; testosterone (total and free), other hormone panel results (e.g., LH, FSH, estradiol, SHBG, prolactin, DHEA-S, TSH), and any related biomarkers offered through the service
• Photos, videos, or screenshots of test results, kits, or related materials that you upload for processing
• Daily check-in data (sleep, stress, exercise, alcohol, heat exposure, and other lifestyle factors that affect sperm and hormone health)
• Conversations with our AI coach feature
• Optional health and demographic information you choose to share (age, weight, existing health conditions, medications, supplements)
• Wearable device data (such as Oura, Whoop, or Apple Health), only if you explicitly connect those services and authorize the integration

We refer to the categories above that relate to your past, present, or future physical or mental health, including reproductive, hormonal, and biometric measurements, collectively as "Sensitive Health Information." Sensitive Health Information receives the additional protections described in Section 8.

2.3 Information We Receive from Lab and Testing Partners

Once integrated, our lab and at-home testing partners may provide us with information necessary to deliver your results, such as the test type, the results themselves, the date of collection or processing, and identifiers needed to match results to your account. Where you order a clinical lab test through Solium, the ordering provider, the laboratory, and Solium each handle a portion of your information; the lab and ordering provider operate under their own legal frameworks (which may include HIPAA) and have their own privacy notices, which we will link to or surface at the point of testing.

Some at-home test products (for example, the YO Sperm Test) include their own software and may collect device-level data subject to that product's own privacy policy. Where you use such a product through Solium, we receive only the test results and metadata you choose to share with us.

2.4 Information Collected Automatically

When you visit our website or use our services, we automatically collect limited technical information through standard web technologies:

• IP address (used for general location, security, and abuse prevention)
• Browser type, device type, and operating system
• Pages visited, time spent on pages, and referring website
• Device identifiers and analytics events (e.g., button clicks, page views)
• Application crash and performance data

2.5 Cookies and Similar Technologies

Our website currently uses minimal cookies necessary for the site to function. As our product launches, we may use additional cookies for authentication, analytics, and feature functionality. We do not use third-party advertising cookies and we do not use cookies, pixels, or similar technologies to share your Sensitive Health Information with advertisers. Where required by law, we will request your consent before setting non-essential cookies, and you can withdraw that consent at any time using your browser settings or the cookie controls we provide.

We currently do not respond to "Do Not Track" browser signals because there is no industry standard for them. We do honor the Global Privacy Control (GPC) signal as described in Section 7.4.

We use the information we collect for the following purposes:

• To respond to waitlist signups and notify you when our subscription launches
• To create and manage your account, authenticate you, and secure access
• To provide and improve our services, including processing test results, generating personalized recommendations, powering the AI coach, and supporting integrations you have connected
• To communicate with you about service updates, product launches, billing, and account matters
• To provide customer support and respond to your inquiries
• To detect, prevent, and respond to fraud, abuse, and security threats
• To comply with legal obligations and enforce our terms
• To analyze aggregate, de-identified usage patterns to improve our website and product
• For research and product development conducted on de-identified or aggregated data, as described in Section 11

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising or targeted advertising. We do not use Sensitive Health Information for advertising of any kind. We do not use your Sensitive Health Information to train artificial intelligence or machine-learning models for any purpose other than providing or improving the service to you, and only then in accordance with Section 9.

We share your information only with the parties described below, and only as necessary to operate our service. We do not sell your personal information to anyone. We do not share Sensitive Health Information with employers, insurers, wellness program sponsors, advertisers, data brokers, or any other party for their own marketing or commercial purposes.

4.1 Service Providers ("Data Processors")

We rely on third-party service providers to operate our website and (in the future) our subscription service. These providers process your information only on our behalf, only for the purposes we direct, and are bound by written confidentiality and data protection obligations. We require service providers to use reasonable safeguards and to delete or return your information when their work for us ends.

Current and planned providers include:

• Hosting and database: Lovable Cloud (which uses Supabase and Amazon Web Services in the United States) for website hosting, application infrastructure, and secure database storage
• Email delivery: Resend, for transactional and notification emails
• Artificial intelligence: AI providers (which may include Anthropic, Google, or others) for the AI coach feature, photo extraction of test results, and similar functionality. AI providers receive only the information needed to perform their function and are contractually prohibited from using your data to train models or for any purpose other than serving Solium
• Payment processing (planned): Stripe, for secure payment processing once our subscription launches. We do not store full credit card numbers; this information is held by Stripe under PCI-DSS-compliant security
• Analytics and product telemetry (planned): privacy-respecting analytics tools used to understand how our website and product are used in aggregate; these tools do not receive Sensitive Health Information

We will update this section as we sign or change service provider relationships. As of the effective date of this policy, payment processing and AI features are not yet operational.

4.2 Affiliated Providers (Labs, Clinicians, and Pharmacies)

To deliver clinical services, lab testing, or prescriptions, we work with independent third-party providers — including clinical laboratories, ordering physicians or other licensed clinicians, telehealth platforms, and pharmacies — collectively, "Affiliated Providers." Affiliated Providers are not Solium employees, and many of them are subject to HIPAA or other healthcare laws.

When you use a service that involves an Affiliated Provider:

• We share with that Affiliated Provider only the information needed to provide the service to you (for example, the information needed to order a test, fulfill a prescription, or return your results).
• The Affiliated Provider may collect additional information directly from you and will handle that information under its own Notice of Privacy Practices or privacy policy. We will surface the relevant notice at the point of service or upon your request.
• Where Solium acts as a "business associate" of an Affiliated Provider under HIPAA, we will handle the relevant information in accordance with HIPAA and the applicable Business Associate Agreement, in addition to this policy.

Testing partner (planned): YO Sperm Test (Medical Electronic Systems) provides at-home sperm testing technology that may be used through our service. If you use the YO testing technology, the YO platform may collect device-level data subject to YO's own privacy policy.

4.3 Sharing You Initiate (e.g., with a Partner, Doctor, or Coach)

You may choose to share your test results, scores, or progress with another person — for example, your partner, a clinician, or a coach. We will only share information at your direction. Once your information is delivered to a recipient at your direction, that recipient becomes responsible for how they use and protect it. You can stop future sharing at any time, but you may not be able to recover information that has already been delivered or downloaded.

4.4 Legal and Safety Disclosures

We may disclose your information if required to do so by law, court order, subpoena, or valid government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, prevent fraud, or address security issues.

We treat overbroad, suspect, or unduly burdensome legal requests skeptically. Where legally permissible, we will challenge requests we believe are improper or that target Sensitive Health Information for surveillance, prosecution, or commercial use, and we will notify you before disclosure so that you have an opportunity to object. If a gag order or other legal restriction prevents us from notifying you in advance, we will notify you as soon as we are legally permitted to do so.

4.5 Business Transfers

If Solium is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will require any successor to honor the commitments in this policy with respect to information collected before the transfer, and will notify you of any material changes that result.

4.6 With Your Consent

We will share your information for purposes not described above only with your explicit consent.

We take reasonable and appropriate technical, administrative, and physical measures to protect your information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using industry-standard TLS
• Encryption of data at rest in our database
• Row-level security policies that restrict each user's data access to their own records
• Strict access controls; internal access to Sensitive Health Information is limited to personnel who require it to do their jobs and who are bound by confidentiality obligations
• Regular security reviews, vulnerability monitoring, and code review
• Secure authentication for user accounts (once available), including support for strong passwords and, where offered, multi-factor authentication

Security Incidents. No security measure is perfect. If we become aware of a confirmed security incident affecting your information, we will (i) promptly investigate the incident, identify the root cause, and take reasonable steps to remediate any vulnerabilities within our control; (ii) document the actions we take in response; (iii) cooperate with affected users, partners, and regulators as required; and (iv) notify you and any required regulators in accordance with applicable law.

We retain your information only for as long as necessary to provide our services, to fulfill the purposes described in this policy, or as required by law. In deciding how long to retain a particular item of information, we may consider factors such as: the length and nature of our relationship with you; the sensitivity of the information; the potential risk of harm from unauthorized use or disclosure; the purposes for which we are processing the information; whether we have a legal, accounting, audit, or contractual obligation to retain it; and whether we can achieve the same purpose with de-identified or aggregated information.

When we no longer need information for the purposes for which we collected it, we will delete it, anonymize it, de-identify it, or isolate it from further processing.

Indicative retention timelines:

• Waitlist information: retained until you unsubscribe or until we determine that the waitlist purpose has been fulfilled
• Account and Sensitive Health Information (once available): retained for the duration of your subscription and for a reasonable period afterward to facilitate reactivation, dispute resolution, and legal compliance; you may request deletion at any time as described in Section 7
• Photos or videos of test results: processed for the time needed to extract and verify results, and then either retained in your account at your option or deleted
• Payment records: retained as required by tax, accounting, and consumer-protection laws (typically up to seven years)
• Backups, logs, and security records: retained for limited periods for security, audit, and disaster recovery purposes; copies in disaster-recovery backups will roll off in the ordinary course

Depending on where you live, you may have certain rights regarding your personal information. We honor the rights below for any user, regardless of where you live, except where doing so would conflict with applicable law or our legal obligations.

• Access: You can request a copy of the personal information we hold about you, including the categories of information, the categories of sources, the purposes of processing, and the categories of recipients.
• Correction: You can request that we correct inaccurate or incomplete information.
• Deletion: You can request that we delete your information, subject to certain legal exceptions (such as records we are required to retain).
• Portability: You can request a copy of your information in a structured, commonly used, machine-readable format.
• Restriction or objection: You can request that we limit or stop certain processing of your information.
• Opt out of "sale," "sharing," or targeted advertising: As described in Section 3, we do not sell your personal information and do not share it for cross-context behavioral advertising. You can confirm and exercise this opt-out at any time, including by sending the GPC signal as described in Section 7.4.
• Limit use of Sensitive Health Information: You can ask us to limit our use and disclosure of your Sensitive Health Information to what is necessary to provide the service to you.
• Withdraw consent: Where we rely on your consent, you can withdraw that consent at any time. Withdrawing consent does not affect processing that occurred before the withdrawal.
• Appeal: If we deny your request in whole or in part, you can appeal that decision by replying to our response or by contacting us as described below; we will respond within the timeframe required by applicable law.
• Non-discrimination and non-retaliation: We will not deny you services, charge you a different price, provide a lower quality of service, or otherwise discriminate or retaliate against you for exercising any of these rights.

How to make a request. To exercise any of these rights, contact us at hello@soliumhealth.com. To exercise a right specifically related to Sensitive Health Information (for example, to ask us to stop processing it), please use the subject line "Healthcare Data Opt-Out."

We will respond within the timeframes required by applicable law (typically within 45 days, with a single 45-day extension where reasonably necessary). We may need to verify your identity before fulfilling your request, and we may decline a request that we cannot reasonably verify or that is excessive or repetitive. Authorized agents may submit requests on your behalf with appropriate written authorization and proof of identity, as permitted by law.

7.1 State Privacy Laws (United States)

Some U.S. states grant their residents specific privacy rights. Except as otherwise provided in this Section 7, the rights described above apply to residents of any U.S. state with a comprehensive consumer privacy law (which currently includes, among others, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia). New states are added to this list as their laws come into effect. Not every right is granted by every state, and where your state does not afford a particular right, that right may not apply to you.

California (CCPA / CPRA). California residents have additional rights, including the right to know what personal information we collect and disclose, the right to request deletion, the right to correct inaccurate information, the right to limit the use and disclosure of "sensitive personal information," and the right to opt out of the "sale" or "sharing" of personal information. We do not sell personal information for monetary or other valuable consideration, and we do not share personal information for cross-context behavioral advertising. California residents may also designate an authorized agent to make a request on their behalf, and may request the categories of personal information we have collected, sold, or shared in the prior 12 months. Under California's "Shine the Light" law (Cal. Civ. Code §1798.83), California residents may request information about disclosures of personal information to third parties for those parties' direct marketing purposes; we do not currently make such disclosures.

Nevada. Nevada residents have the right to opt out of the sale, as defined under Nevada law, of certain personal information for monetary consideration. We do not currently engage in such sales. If you are a Nevada resident and would like to make a request to opt out of any potential future sales, please email hello@soliumhealth.com.

EEA, UK, and Switzerland Residents. If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal information is processed under the General Data Protection Regulation (GDPR) or equivalent law. Our legal bases for processing include your consent, the necessity of processing to provide our services to you, our legitimate interests in operating and improving our business, and compliance with legal obligations. You have the right to lodge a complaint with your local data protection authority. Because Solium is a United States-based company, your information will be transferred to and processed in the United States; we rely on appropriate safeguards (including Standard Contractual Clauses where applicable) for international data transfers. Please note that the United States may not provide the same level of data protection as your home country.

7.2 Consumer Health Data (Washington, Nevada, Connecticut, and Similar Laws)

Some states — including Washington (My Health My Data Act), Nevada (SB 370), and Connecticut (as amended) — provide additional rights for "consumer health data." "Consumer health data" generally means information that identifies a person's past, present, or future physical or mental health status. Most of the Sensitive Health Information described in Section 8 is consumer health data under these laws.

Where these laws apply to you, you have the right to (i) confirm whether we are processing your consumer health data; (ii) access your consumer health data, including a list of the third parties and affiliates with which we have shared it; (iii) withdraw your consent to processing; and (iv) request deletion of your consumer health data. We do not "sell" consumer health data, and we will not sell it without your separate, specific written authorization. To exercise these rights, contact us at hello@soliumhealth.com using the subject line "Healthcare Data Opt-Out." If we deny your request, you may appeal by replying to our response.

7.3 Other State Laws

We will continue to expand and update these state-specific sections as new laws come into effect. The umbrella rights in this Section 7 are intended to honor the substance of comprehensive state privacy laws across the United States, including state consumer health data laws, regardless of whether a particular state is named here.

7.4 Global Privacy Control and "Do Not Sell or Share My Information"

You can communicate your opt-out preference for the "sale" or "sharing" of your personal information by configuring your browser to send the Global Privacy Control (GPC) signal. We will treat a GPC signal received from your browser as a valid opt-out request for that browser or device, and — if you are logged in — for your Solium account profile. You can learn more about GPC at globalprivacycontrol.org. We will also provide a "Do Not Sell or Share My Information" link in our website footer and in our mobile app settings once those products are live.

The information we collect about your reproductive and hormonal health is sensitive, and we treat it accordingly. This Section 8 supplements (and does not limit) the rest of this policy.

8.1 What Counts as Sensitive Health Information

For the purposes of this policy, "Sensitive Health Information" includes:

• Reproductive and fertility data (such as sperm test results)
• Hormonal data (such as testosterone and other hormone panel results)
• Other biomarkers, lab results, and clinical metrics offered through the service
• Photos, videos, or screenshots of tests, kits, or related materials
• Self-reported health conditions, medications, supplements, and symptoms
• Information about you that is generated from any of the above (including scores, trends, and recommendations)

Some of this information may also be considered biometric, consumer health data, or — in limited cases — genetic information under applicable law. Where it is, the additional protections of those laws apply.

8.2 Our Commitments

We make the following commitments about Sensitive Health Information:

• We will never sell it. Not for money, not for "other valuable consideration," and not under any rebrand of the same.
• We will never use it for advertising. We do not use Sensitive Health Information for targeted, contextual, behavioral, or any other form of advertising — to you or to anyone else.
• We will never share it with employers, insurers, wellness program sponsors, or data brokers for their own purposes. If Solium is ever offered through an employer or insurance benefit, your individual results will not be shared back with the sponsor; the sponsor will at most receive aggregate, de-identified usage information.
• We will not use it to train AI or machine-learning models outside of providing or improving the service to you, and only as described in Section 9.
• We will limit internal access to personnel who require it to do their jobs.
• We will resist surveillance and prosecution requests. We will challenge legal requests we believe are improper or that target Sensitive Health Information for surveillance or prosecution, and we will notify you of such requests where legally permissible (see Section 4.4).
• We will not retaliate against you for exercising any of your rights or for declining to provide Sensitive Health Information.

8.3 HIPAA and Our Status

Solium is not currently a HIPAA-covered entity. HIPAA generally applies to healthcare providers, health plans, and healthcare clearinghouses, and we do not currently fall within those categories. Even where HIPAA does not apply to us, we follow industry best practices for safeguarding health information and we honor the substance of the protections this policy provides.

In some cases, Solium may operate as a HIPAA "business associate" to one of our Affiliated Providers — for example, where we provide technology that supports a clinician's or laboratory's delivery of services to you. In those cases, we handle the relevant information in accordance with HIPAA and the applicable Business Associate Agreement, in addition to this policy. If you are receiving services from an Affiliated Provider through Solium, that Affiliated Provider's Notice of Privacy Practices governs the Affiliated Provider's own use of your protected health information.

If our service model changes such that HIPAA applies to Solium directly, we will update this policy and our practices accordingly.

8.4 Anonymous-by-Default Test Processing

Where technically possible, we process test photos, videos, and certain biomarker data so that the personnel and systems performing the processing do not need to know which user the data belongs to. We retain identifiers only where they are necessary to return your results to you, to support the AI coach, or to operate the service.

We use artificial intelligence (AI) features to support certain parts of the service, such as the AI coach, photo extraction of test results, summarization of your trends, and personalized non-clinical recommendations. This Section 9 explains how we treat your information in those features.

• No model training on your data. AI providers we use are contractually prohibited from using your information — including your Sensitive Health Information and your AI coach conversations — to train, fine-tune, or improve their general models. They process your information solely on Solium's behalf, only for the purposes we direct, and delete it when no longer needed.
• Human oversight. We do not use AI to make decisions that have a legal or similarly significant effect on you (such as decisions about credit, insurance, employment, or healthcare access) without meaningful human review. Our AI coach provides educational content and personalized lifestyle recommendations; it does not provide medical advice, diagnosis, or treatment.
• You can opt out. You can ask us to stop processing your Sensitive Health Information through AI features by using the "Healthcare Data Opt-Out" subject line described in Section 7. Some features that depend on AI processing may not be available if you opt out.

Our services are intended for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us at hello@soliumhealth.com and we will promptly delete the information. We do not have actual knowledge that we have collected, sold, or shared the personal information of any user under 18.

We may de-identify or aggregate your information so that it can no longer reasonably be used to identify you, and we may use that de-identified or aggregated data to operate, evaluate, and improve our service, conduct research, and produce industry-level insights. Except as required or permitted by applicable law, we will not attempt to re-identify any data that has been de-identified or aggregated, and we will require recipients of de-identified data to make the same commitment. We do not sell de-identified Sensitive Health Information.

Our website may contain links to third-party websites or services that are not operated by Solium. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party site or service you visit, including those of any wearable platform, lab, or testing partner you connect to your Solium account.

We will update this Privacy Policy as our business evolves, particularly as we move from pre-launch to a live subscription product. When we make material changes, we will update the "Last Updated" date at the top of this policy and provide notice through our website or by email to active users. Where required by law, we will obtain your consent before applying material changes to information we have already collected. We will not make retroactive changes that reduce your privacy rights with respect to information we have already collected unless we are legally required to do so or you give us your separate consent.

If you have questions about this Privacy Policy, want to exercise any of your privacy rights, or want to report a privacy concern, please contact us:

• Email: hello@soliumhealth.com
• Healthcare-data requests: use the subject line "Healthcare Data Opt-Out"
• Mailing address: to be provided upon incorporation

Solium is committed to honest, transparent communication about how we handle your information. Thank you for trusting us with your reproductive and hormonal health journey.