Personal Data Processing Notice

Jane — Version 1.2, effective 15.06.2026

This document is set forth in two languages — Ukrainian and English. The Ukrainian version is the original and the sole source of truth. In the event of any discrepancies, ambiguities, or contradictions between the Ukrainian and English versions, the Ukrainian version shall prevail. The English version is provided for User convenience only and does not create independent rights or obligations.

In accordance with paragraphs 1 and 2 of part two of Article 8, and part two of Article 12 of the Law of Ukraine "On Personal Data Protection" of 01.06.2010 No. 2297-VI,

Individual Entrepreneur Anatolii Viktorovych Rohalskyi (Taxpayer Registration Number 3375607639) (hereinafter — the "Company")

Hereby notifies of the controller, processor, location, categories of data (composition) and purpose of collection of personal data being processed, as well as the legal grounds for processing personal data processed in the course of Users' use of the services, when using the Jane mobile application (hereinafter — Jane), the third parties to whom such personal data is transferred, and the rights of the personal data subject.

Information about the controllers, processors and personal data bases

The controller of the personal data processed when Users use Jane is: Individual Entrepreneur Anatolii Viktorovych Rohalskyi (Taxpayer Registration Number 3375607639). Personal data shall be included in the "Jane" personal data base (hereinafter — the Personal Data Base).

Purpose of personal data processing

The purpose of personal data processing is to provide Users with services of Interpretation, recommendation of dietary supplements based on the results of Interpretation, sale of goods, recommendation to obtain a doctor's consultation based on the results of Interpretation, performance of a Medical Quality Review of certain system-flagged Interpretation outputs (without communication with the User), and the provision of other informational services that are not related to medical services and may under no circumstances be considered as the provision of medical services, medical recommendations, diagnosis, etc., based on the results of Interpretation.

Procedure for collecting personal data

Data and information are collected during the Client's interaction with Jane services, in particular, when downloading the mobile application, registering and filling in registration data and the questionnaire, uploading laboratory test results, ordering goods, using the functionality, etc.

The User independently decides and gives consent regarding which data will be obtained by Jane from the User's device or applications/storage; for this, the User must grant the relevant permissions.

The User may refuse to provide information about themselves or contact the support service with a request to delete information already submitted.

Information provided by the User for the registration and maintenance of the User's Account:

• surname, first name, patronymic (where the User considers it necessary to provide such information);
• date of birth;
• sex;
• email address;
• telephone number (not mandatory, but may be indicated as an additional means of communication);
• health-related data;
• laboratory test results — uploaded solely with the User's permission;
• IP addresses;
• other data requested and provided by the User.

Access to certain data on the User's device is necessary for specific Jane functionality, in particular access to: location; internal device storage / camera in the case of uploading files or photographs, etc.

The User may deny Jane access to such data in the device settings; however, denying access means that the User will not be able to use the corresponding Jane functionality.

Transfer of personal data to third parties

Jane does not transfer Users' personal data to third parties, except in the cases specified below:

• Transfer of data to third parties that provide services to the Company, in particular, but not limited to, processing of User payments, parcel delivery (in the case of orders for goods), and other services chosen by the User in Jane;
• Transfer of laboratory test results in their original form to AI providers for the recognition and processing of texts and images. The transfer is carried out on a contractual basis with corresponding confidentiality obligations.
• Transfer for further storage in the Personal Data Base in a structured depersonalised form — as biomarkers linked to the Account.

Such data is transferred for the purpose of:

• recognition and processing of laboratory test results;
• generation of recommendations regarding dietary supplements;
• performance of a Medical Quality Review of flagged Interpretation outputs;
• categorisation of medical information.

Third parties may use Users' personal data only to the extent necessary for the provision of services.

For the purpose of mailings (both authorisation and informational), the User's subscriber phone number may be transferred to persons with whom the controller of personal data has concluded the relevant agreements and which are included in the register of providers of electronic communications networks and services.

In doing so, the User's subscriber phone number will not be matched against any other databases, regardless of their controller, which excludes any identification of the User.

Using the phone number and email address, the User may be provided with information (including advertising) in accordance with the terms and purpose set out in this Notice.

The User consents to the transfer of personal data to foreign entities of relations connected with the storage of the User's personal data within the framework of ensuring the operation of the Personal Data Base.

The transfer (dissemination) of personal data in the cases specified in this Notice is carried out without obtaining additional consent and without separate notification of the personal data subject.

Cookies

Cookies are used to ensure the operation of Jane, session security when receiving services, interface configuration, Jane usage statistics, etc. — they are small text files that are stored during the use of Jane. This data is anonymised and cannot be linked to individual Users.

The User may disable cookies at any time in the Account or configure them according to their needs.

Rights of the personal data subject

The personal data subject has the right to:

1. know about the sources of collection and location of their personal data, the purpose of its processing, the location or place of residence of the controller or processor of personal data, or to give a corresponding instruction to obtain this information to persons authorised by them, except in cases provided for by law;
2. receive information on the conditions of providing access to personal data, in particular information on third parties to whom their personal data is transferred;
3. access their personal data;
4. receive, no later than thirty calendar days from the day the request is received, except in cases provided for by law, a response as to whether their personal data is being processed, and to receive the content of such personal data;
5. submit a reasoned demand to the controller of personal data with an objection to the processing of their personal data;
6. submit a reasoned demand for the modification or destruction of their personal data by any controller and processor of personal data, if such data is being processed unlawfully or is inaccurate;
7. protection of their personal data against unlawful processing and accidental loss, destruction or damage in connection with intentional concealment, non-provision or untimely provision thereof, as well as protection against the provision of information that is inaccurate or discredits the honour, dignity and business reputation of the natural person;
8. submit complaints regarding the processing of their personal data to the Ukrainian Parliament Commissioner for Human Rights or to a court;
9. apply legal remedies in the case of breach of the legislation on personal data protection;
10. make reservations regarding the limitation of the right to process their personal data when giving consent;
11. withdraw consent to the processing of personal data;
12. know the mechanism of automatic processing of personal data;
13. protection against an automated decision that has legal consequences for them.

Consent of the personal data subject to the processing of personal data

The User gives unambiguous and informed consent to the processing of their personal data concerning health, sexual life as part of medical history, laboratory test results, lifestyle, nutrition, anthropometry, biometric or genetic data of the User.

Having reviewed this Personal Data Processing Notice, the User confirms that all provisions of this Notice are clear to them and gives consent to the processing of their personal data for the goals and purposes defined by this Notice and to the use of tracking identifiers, analytics SDKs, etc.

Personal data retention periods

The Company stores personal data for the following periods:

• Registration data (name, email, phone) — until the Account is deleted;
• Health data and biomarkers — until the Account is deleted;
• Files of laboratory test results (PDF/photo, etc.) — 6 months;
• Payment data — 3 years;
• Technical logs (IP, cookies) — no more than 12 months.

Contacts

On matters of personal data processing, exercise of the rights of the personal data subject, withdrawal of consent, etc., the User may contact the Company:

• via the feedback form in the Jane mobile application;
• by sending an email to: hello@janeapp.ai.