This Privacy Notice for California Residents supplements the information contained in Helix’s Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California (“consumers” or “you”).

This supplemental notice addresses the obligations set forth in the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020 (collectively, the “CCPA”), and any terms defined in the CCPA have the same meaning when used in this notice.

Please note that as with Helix’s Privacy Policy, Helix reserves the right to amend this notice at its discretion and at any time. When we make changes to this notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes

Information We Collect

Helix, through the Website and from other sources, collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer or device (“personal information”). Specifically, Helix collects, and has collected within the last twelve (12) months, the following categories of personal information from its consumers: (1) identifiers (e.g., real names, aliases, addresses, personal identifiers, online identifiers, IP addresses, email addresses, account names, etc.); (2) internet or other similar network activity (e.g., browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement); and (3) professional or employment-related information, to the extent you apply for positions on our website.

For purposes of this Privacy Notice, personal information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.

The CCPA also excludes health information covered by HIPAA, and personal information covered by federal statutes like the FCRA, GLBA, and the DPPA from within its scope.

Helix obtains these categories of personal information from you in the manner described in our Privacy Policy.

Use of Personal Information

Helix does not sell your personal information. We may, however, use or disclose the personal information you share with us to fulfill or satisfy the purpose for which you provided the information in the first place, as described in our Privacy Policy.

For example, if you provide personal information to us directly online, or through email messages, relating to inquiries about products, ordering products, requests for support or services, or downloading products, we will use the information to engage in and process transactions with you, to respond to your inquiries and requests, to provide information on Helix products and services, to provide information on Helix's partners offering Helix's services and products, and to provide customer support activities.

Additional information about how we may use your personal information is described in detail in our Privacy Policy. But please note that Helix will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

Our Privacy Policy contains detailed information about the different ways in which we may share your personal information. However, for purposes of the CCPA, Helix has not sold personal information within the preceding twelve (12) month period.

Helix does disclose the following categories of personal information to its service providers, distributors, resellers, and other partners for a business purposes and has done so within the last twelve (12) months: (1) Identifiers; (2) Commercial information; (3) Internet or other similar network activity; and (4) Professional or employment-related information.

Your Rights and Choices

Access Rights

You have the right to request that Helix disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose the following information to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).
• If we disclosed your personal information for a business purpose, a list disclosing:
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

Deletion Request Rights

You also have the right to request that Helix delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to fulfil the terms of our contract with you or if we’re entitled to retain the information under one of the applicable exceptions under the CCPA.

Correction Rights

You have the right to request that we correct inaccurate personal information that we maintain about you. Upon receipt of a verifiable consumer request, we will use commercially reasonable efforts to correct the information as required by law.

Right to Opt Out of Automated Decision-Making

If we engage in automated decision-making, including profiling, that has legal or similarly significant effects on you, you may have the right to opt out. We will provide meaningful information about the logic involved, as well as the significance and the expected consequences of such processing, upon request.

Exercising Your Rights

To exercise any of the rights described in this Notice, please submit a verifiable consumer request to us by either:

• Calling us at 1-844-811-7740
• Sending us an email to: privacy@helixops.ai

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination / No Retaliation

Helix will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not deny you goods or services; charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; provide you a different level or quality of goods or services; or suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services, nor will we retaliate in any way for the exercise of such rights.

Rev. 2026-03-17