Privacy Policy

This privacy policy (the "Policy") applies exclusively to arxusmethod.com (the "Site"), the patient-facing website operated by Arxus LLC ("we" or "us") for the acquisition and enrollment of individuals in the Performance Intelligence Profile and related clinical services. This Policy does not apply to any other website operated by Arxus LLC, including runarxus.com, which serves our business-to-business services and is governed by its own separate privacy policy. This Policy is intended to inform you of the types of information we collect, as well as our policies and practices regarding the collection, use, and disclosure of that information through the web pages at https://arxusmethod.com (the "Site").

Please read this Policy carefully, because by using the Site, you are acknowledging that you understand and agree to the terms of this Policy, and consent to the manner in which we may collect, use and disclose the foregoing information. If you do not agree to the terms of this Policy, please do not use the Site.

We encourage you to check this Site periodically for any changes. Your continued use of the Site, our products and services following the posting of changes to these terms will mean you accept those changes. We reserve the right to change the provisions of this Policy at any time.

This Policy applies solely to information collected by the Site. It will notify you of the following:

Scope — Protected Health Information (PHI)

Arxus LLC is a technology and marketing services company. Arxus is not a health care provider and is not itself a HIPAA covered entity. Clinical services referenced on the Site are delivered by Advanced Functional Medicine ("AFM"), a licensed clinical provider and the covered entity responsible for your care. Protected health information ("PHI") created during clinical intake, laboratory testing, diagnosis, treatment, or consultation is held by AFM and governed by AFM's HIPAA Notice of Privacy Practices, which is provided to you separately. Information you submit through the Site for the purpose of enrollment or scheduling a clinical consultation is transmitted to AFM for clinical use, and once held by AFM, is governed by AFM's privacy practices rather than this Policy. Arxus itself maintains administrative records relating to account creation, billing, Site analytics, and marketing communications, and those records are governed by this Policy. If Arxus and AFM later enter into a business associate arrangement, any PHI accessed by Arxus on AFM's behalf will be handled in accordance with HIPAA and a written Business Associate Agreement.

What Information Do We Collect?

This website stores data such as cookies to enable essential site functionality, as well as marketing, personalization, and analytics. By remaining on this website, you indicate your consent.

Personal Information You Provide to Us

We only have access to and collect personal information (for example your name, date of birth, social security number, credit card number, mailing or billing address, telephone number, or email address, and email preferences – collectively, "Personal Information") that you voluntarily give us via email or other direct contact from you.

Information Collected by Automated Means

Whenever you use the Site, we, as well as any of our third-party advertisers and/or service providers, may use a variety of technologies that automatically collect information about how the Site is accessed and used ("Usage Information"). Usage Information may include, in part, browser type, operating system, the page served, the time, how many users visited the Site, and the website you visited immediately before the Site. This statistical data provides us with information about the use of the Site, such as how many visitors visit a specific page on the Site, how long they stay on that page, and which hyperlinks, if any, they "click" on. Usage Information helps us to keep the Site fresh and interesting to our visitors and to tailor content to a visitor's interests. Usage Information is generally non-identifying, but if we associate it with you as a specific and identifiable person, we treat it as Personal Information.

Device Identifiers

Usage Information we may collect include your IP address, MAC Address or other unique identifier (each a "Device Identifier") for the computer, mobile device, Wi-Fi card, or other technology (collectively, "Device") you use to access the Site. A Device Identifier is a number that is automatically assigned to your Device when you access a website or its servers. Our computers identify your Device by its Device Identifier. When you visit the Sites, we may view your Device Identifier. We use this information to identify repeat visitors to our Site. We also may use this information to send you targeted advertisements and to enhance the Site.

We may associate your Device Identifier with your Personal Information.

The technologies used on the Site, including Device Identifiers, to collect Usage Information may include, without limitation:

Cookies

Cookies are data files placed on a Device when it is used to visit the Site. We may use cookies to collect and store certain information about you. We may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer until you delete them).

Web Beacons

We may also include web beacons (also known as web bugs, Internet tags, pixel tags, tracking pixels and clear GIFs) with the content and ads that we deliver to you, which we will use to collect information regarding your interaction with our content and ads. A web beacon is a transparent graphic image placed on a web page or in an email, which indicates that a page or email has been viewed or that an email has been forwarded. In addition, a web beacon allows third parties to obtain information such as the IP address of the computer that downloaded the page on which the beacon appears, the URL of the page on which the beacon appears, the time the page containing the beacon was viewed, the type of browser used to view the page, and the information in cookies set by the third party. A web beacon may also tell your browser to get content from another server.

Cookies and web beacons (together, "Site Cookies") may enable us to track and target the interests of our users to enhance the experience on our Site, track user actions/behavior on our Site and track the effectiveness of ads.

Analytics

We use products to analyze activity on our site. We use the Meta Pixel (operated by Meta Platforms, Inc.) and Google Analytics to understand how users use our site and to measure the performance of our advertising.

Meta Platforms, Inc. is a service provider which assists us in advertising our products and services on Facebook, Instagram, and the broader Meta advertising network. The Meta Pixel enables Meta to show you advertisements for our Site when you visit Facebook, Instagram, or other sites in the Meta network. Meta does this through the use of cookies and similar technologies ("Advertising Cookies").

Google Analytics is a platform that collects data from the Site and create reports that provide insights about visitors and their interactions with the Site.

How Do We Use Your Information?

We use your information to respond to you regarding the reason you contacted us. We will also use your information as follows:

Enrollment in the Performance Intelligence Profile

When you enroll in the Performance Intelligence Profile, we collect the information needed to process your order and coordinate your clinical services. This typically includes your name, email address, mobile number, mailing address, and date of birth. After purchase, you will be asked to complete a clinical intake questionnaire, which collects information about your health history, goals, and current state for review by the treating clinician. Information you provide in the intake questionnaire is transmitted to Advanced Functional Medicine ("AFM") for clinical use and, once held by AFM, is governed by AFM's HIPAA Notice of Privacy Practices rather than this Policy. Arxus retains a limited administrative record of your enrollment for billing, communication, and Site operation purposes.

Payment Processing

To purchase the Performance Intelligence Profile, you must provide contact information (such as name, email address, mobile number, and billing address) and payment information (such as credit or debit card number and expiration date). Payment is processed by Stripe, Inc., our third-party payment processor, through a merchant account maintained by Advanced Functional Medicine, the clinical partner that delivers your care. As a result, your charge will appear on your statement as "AFM PROFILE." Arxus does not store your full payment card number on its systems. Card data is collected and processed directly by Stripe under its own privacy and security practices. We use your contact information for billing, order fulfillment, and to reach you if we have trouble processing your order.

Lab Coordination and Clinical Consultation

As part of the Performance Intelligence Profile, we coordinate laboratory testing and scheduling of your clinical results consultation on your behalf. Laboratory testing is ordered through LabCorp, which operates under its own privacy and security practices and receives information needed to process your order, including your name, date of birth, contact information, and the laboratory orders authorized by the treating clinician. If you choose to upgrade to mobile laboratory collection, your name, address, phone number, and appointment window are shared with Getlabs, our mobile phlebotomy partner, solely for the purpose of scheduling and completing the blood draw at the location you specify. Getlabs operates under its own privacy and security practices. After your results are reviewed, we contact you by text message, typically three to five days after your results are available, to schedule your clinical results consultation with AFM. Scheduling information (including your appointment date, time, and confirmation status) is maintained for the purpose of delivering your care and sending appointment reminders.

Customer Service

Unless you ask us not to, we may contact you via email in the future to tell you about specials, new products or services, or changes to this Policy.

Communications About Your Care

Once you have enrolled in the Performance Intelligence Profile, we will send you transactional communications by email and text message regarding your order, the status of your laboratory testing, the availability of your results, the scheduling of your clinical results consultation, and appointment reminders. These communications are considered part of the service you have requested and are sent whether or not you have opted in to marketing communications. You may still opt out of non-essential or promotional messages at any time as described elsewhere in this Policy.

Do We Share Your Information?

We may share your personal information and with trusted third-party service providers as necessary for them to perform services on our behalf, such as:

• Processing credit card payments.
• Serving advertisements.
• Conducting contests or surveys.
• Performing analysis of our services, customer demographics, and sentiment.
• Communicating with you, such as by way of email or survey delivery.
• Customer relationship management.
• Security, risk management, and compliance.
• Recruiting support and related services.

These third parties (and any subcontractors they may be permitted to use) have agreed not to share, use or retain your personal information for any purpose other than as necessary for the provision of Services.

We may also share your Personal Information for marketing and advertising purposes, including sending you promotional material or special offers on our behalf or on behalf of our marketing partners and other third parties, provided that you have not already opted-out of receiving such communications. We will not share your mobile information with third parties for marketing and advertising purposes. Mobile Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We may share aggregated demographic information with our partners and advertisers. This is not linked to any Personal Information that can identify any individual person.

We will disclose Personal Information when we believe in good faith that such disclosures (a) are required by law, including, for example, to comply with a court order or subpoena, or (b) will help to: enforce our policies; enforce contest, sweepstakes, promotions, and/or game rules; protect your safety or security, including the safety and security of property that belongs to you; and/or, protect the safety and security of our Site or third parties. In addition, if Arxus LLC or all of its assets are acquired, all of the data collected by us through the Site and through other means and services provided by us would be among the transferred assets.

Your Privacy Rights — Access to and Control Over Information

We offer you choices regarding the collection, use, and sharing of your Personal Information. If you receive promotional communications from us, you may indicate a preference to stop receiving further promotional communications from us and you will have the opportunity to "opt-out" by following the unsubscribe instructions provided in the promotional email you receive or by contacting us directly at the email address or phone number given on our Site. We do not charge for this service, and your opt-out request will be processed within 30 days of the date on which we receive it.

You can do the following at any time by contacting us via the email address or phone number given on our Site:

• See what data we have about you; if any.
• Change/correct any data we have about you.
• Have us delete any data we have about you.
• Notify us if you do not want us to share your Personal Information for marketing and promotional purposes.

How to Opt-Out of Targeted Advertising

You can set most web browsers to notify you if you receive a cookie, or you may choose to block cookies, though either of those actions may affect the use of our Site. If you prefer to not receive targeted advertising, you can opt out of some network advertising programs that use your information.

To do so please visit the Digital Advertising Alliance (DAA) Opt-Out Page: https://www.aboutads.info/choices/. Please note that even if you choose to remove your information (via opting out), you will still see advertisements while you are browsing online. However, the advertisements you see may be less relevant to you and your interests. Additionally, many network advertising programs allow you to view and manage the interest categories they have compiled from your online browsing activities. These interest categories help determine the types of targeted advertisements you may receive. The DAA Opt-Out Page provides a tool that identifies its member companies that have cookies on your browser and provides links to those companies' pages where you can opt out of receiving targeted advertisements from companies.

You may manage Meta advertising preferences or opt out of Meta-based targeted advertising by visiting: https://www.facebook.com/adpreferences.

You may opt out of Google Analytics by visiting https://tools.google.com/dlpage/gaoptout.

You can also find out more about your "Do Not Track" options by visiting https://www.allaboutDNT.com.

Does This Policy Apply to Other Websites Linked To Or From the Site?

The Site may contain links to other websites, including websites operated by Arxus LLC for purposes other than the Performance Intelligence Profile. This Policy applies only to arxusmethod.com. Other Arxus LLC properties, including runarxus.com (which serves our business-to-business services), are governed by their own privacy policies. Any Personal Information you provide on linked pages or third-party sites is provided directly to that party and is subject to that party's privacy policy. We are not responsible for the content or privacy and security practices and policies of any website linked to or from the Site. We encourage you to review those practices before providing Personal Information.

Do We Collect Information From Children Under the Age of 16?

The Site is not intended for use by children under the age of 16, and Arxus LLC does not knowingly collect or use any Personal Information from such children. If we become aware that we have unknowingly collected Personal Information from a child under the age of 16, we will make commercially reasonable efforts to delete such Personal Information from our database.

What Steps Do We Take To Protect Your Information?

We take measures designed to protect your Personal Information in an effort to prevent loss, misuse, and unauthorized access, disclosure, alteration, and destruction. We provide physical, electronic, and procedural safeguards to protect Personal Information we process and maintain. Please be aware, however, that despite our efforts, no security measures are perfect or impenetrable and no method of data transmission can be guaranteed against any interception or other types of misuse. To protect the confidentiality of Personal Information maintained in your account, you must keep your password confidential and not disclose it to any other person. You are responsible for all uses of the Site by any person using your password. Please advise us immediately if you believe your password has been misused.

Notice to California Residents (CCPA/CPRA)

This section applies to California residents and supplements the disclosures elsewhere in this Policy. It is provided pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA"). For purposes of this section, "Personal Information" has the meaning given to it in the CCPA. This section does not apply to information that is regulated as protected health information under HIPAA or California's Confidentiality of Medical Information Act, which is held by AFM and governed by AFM's Notice of Privacy Practices.

Categories of Personal Information We Collect

In the preceding twelve (12) months we have collected the following categories of Personal Information: identifiers (such as name, email address, mailing address, telephone number, and IP address); customer records (such as billing information and payment card details processed by our payment processor); commercial information (products or services purchased or considered); internet or other network activity information (such as browsing history on the Site, interactions with our advertisements, and Site analytics data); geolocation data (approximate location derived from IP address); inferences drawn from the above to create a profile reflecting preferences and behavior; and, where voluntarily provided through enrollment or intake questionnaires, limited health-related information that may qualify as sensitive personal information. We do not collect biometric information, genetic data, precise geolocation, racial or ethnic origin, religious beliefs, union membership, or contents of mail, email, or text messages not directed to us.

Sources of Personal Information

We collect Personal Information directly from you (for example, when you complete a form, enroll in a program, or contact us); automatically from your device and browser when you use the Site; and from third parties such as advertising platforms, analytics providers, and payment processors that support our services.

Purposes for Collection and Use

We use Personal Information to operate the Site, respond to inquiries, process transactions, schedule consultations, deliver services, communicate with you about your account, personalize and measure our marketing, prevent fraud and security incidents, comply with legal obligations, and for other purposes described in this Policy. We do not use or disclose sensitive personal information for purposes beyond those permitted under CCPA Section 1798.121.

Categories of Third Parties We Disclose To

We disclose Personal Information to service providers and contractors that perform functions on our behalf (including payment processing, hosting, customer support, SMS delivery, email delivery, analytics, and marketing operations); to advertising partners and platforms (including Meta and Google) for measurement and targeted advertising; to Advanced Functional Medicine in connection with clinical services you have requested; to professional advisors and auditors; and to government authorities or other parties when required by law or to protect rights, safety, or property.

Sale and Sharing of Personal Information

We do not "sell" Personal Information for monetary consideration. However, our use of advertising cookies and pixels (including the Meta Pixel and Google advertising tags) may qualify as "sharing" Personal Information for cross-context behavioral advertising under the CCPA. The categories of Personal Information that may be shared in this manner are identifiers, internet or network activity information, commercial information, and inferences. We do not knowingly sell or share the Personal Information of consumers under 16 years of age. We do not sell or share protected health information, and we do not sell or share SMS opt-in data or the content of text messages. You may opt out of this sharing by following the instructions in the section titled "Your Right to Opt Out of Sale or Sharing" below. We honor Global Privacy Control (GPC) browser signals where technically feasible and, when received, will treat the signal as a request to opt out of sharing for that browser or device.

Retention

We retain each category of Personal Information for as long as necessary to fulfill the purposes described in this Policy, comply with our legal, accounting, and tax obligations, resolve disputes, and enforce our agreements. When Personal Information is no longer required, we delete or de-identify it.

Your California Privacy Rights

Subject to certain exceptions, California residents have the right to: (1) know the categories and specific pieces of Personal Information we have collected about them, the sources, the purposes for collection, and the categories of third parties with whom we disclose it; (2) request deletion of their Personal Information; (3) request correction of inaccurate Personal Information; (4) opt out of the sale or sharing of their Personal Information; (5) limit the use and disclosure of sensitive personal information to uses permitted under the CCPA; and (6) not receive discriminatory treatment for exercising any of these rights.

How to Exercise Your Rights

To exercise any of these rights, submit a verifiable request by emailing contact@arxusmethod.com or calling 888-460-0056. We will need sufficient information to verify your identity and the scope of your request, which may include confirming information we already hold about you. We will respond within the timeframes required by law. Only you, or an authorized agent acting on your behalf, may make a verifiable request related to your Personal Information. An authorized agent must provide written permission from you to act on your behalf, and we may require you to verify your identity directly with us. You may also opt out of sharing for cross-context behavioral advertising by enabling the Global Privacy Control signal in your browser or by using the advertising opt-out tools described in the section "How to Opt-Out of Targeted Advertising."

Your Right to Opt Out of Sale or Sharing

You have the right to direct us not to share your Personal Information for cross-context behavioral advertising. To exercise this right, use the "Do Not Sell or Share My Personal Information" link on our Site, enable Global Privacy Control in your browser, or contact us at contact@arxusmethod.com. We will not discriminate against you for exercising this right.

Shine the Light

California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please contact us at contact@arxusmethod.com.

SMS and Text Message Communications

By providing your mobile number and opting in, you consent to receive text messages from Arxus LLC and Advanced Functional Medicine related to your account, lab results, appointment scheduling, clinical consultations, service updates, and, where separately authorized, marketing communications. Message frequency varies. Message and data rates may apply. You may opt out of text messages at any time by replying STOP to any message, and you may request help by replying HELP. Opting out of text messages will not affect any other communications you have authorized. Consent to receive text messages is not a condition of purchase. We do not sell or share mobile information or SMS opt-in data with third parties for their marketing purposes. Mobile information may be shared with service providers (such as SMS delivery platforms and customer service vendors) solely to the extent necessary to operate the messaging program.

Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, UNDER NO CIRCUMSTANCES, INCLUDING, BUT NOT LIMITED TO, NEGLIGENCE, WILL WE BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES THAT RESULT FROM OUR PROCESSING OR USE OF PERSONAL INFORMATION, EVEN IF WE ARE ADVISED BEFOREHAND OF THE POSSIBILITY OF SUCH DAMAGES. THE MAXIMUM AMOUNT OF DAMAGES FOR WHICH WE WILL BE LIABLE UNDER THIS AGREEMENT WILL BE THE GREATER OF THE FEES YOU PAID FOR ANY PRODUCT IN CONNECTION WITH WHICH YOU PROVIDED YOUR PERSONAL INFORMATION, OR $100.

Miscellaneous

This Policy and the privacy practices of Arxus LLC will be governed by and construed in accordance with the laws of California in the United States.

Questions?

If you have any questions about this Policy, please email us at contact@arxusmethod.com, write to us at 222 North City Drive, San Marcos, CA 92078, or call us at 888-460-0056.