Q: I created an account already, but where do I log in A: Click “Log In” on the ciitizen.com website and log in with your username and password, or go to http://app.ciitizen.com and log in directly. Q: Can I bring health records that are already in my possession onto the Ciitizen platform? A: Yes, you have the option to upload health records that you have in your possession already. To upload your records after you have created your profile choose “get records” and then choose “have records to upload click here.” Q: What type of technology do I need to use Ciitizen? A: All you need is an internet connection and an internet browser such as Firefox, Google Chrome, or Safari. You can then access your Ciitizen account using a desktop computer, a laptop, a tablet, or a phone. Q: What type of identification documents do I need to sign up for Ciitizen? A: When you sign up you will need a copy of your driver’s license (or official government-issued photo id), which is required to obtain records on your behalf from the providers you identify. Q. What type of identification documents do I need if I am signing up my child for Ciitizen? A: You have the right under the Health Insurance Portability and Accountability Act (HIPAA) to get copies of your child’s records, but you will need to submit a copy of your child’s birth certificate, and a copy of your driver’s license, in order for us to show your child’s medical providers that we are seeking these records on your behalf as a parent of your child. If you are the child’s guardian, you will need to submit proof of guardianship. Q. What type of identification documents do I need if I am signing up for Ciitizen on behalf of another adult? A: You have the right under HIPAA to get copies of another person’s medical records if you are the “personal representative” of that individual. In the case of a living adult, a personal representative is someone who has the legal authority to make medical decisions for that adult (for example, a health care proxy or power of attorney). You will need to submit a copy of the paperwork that shows you have this authority. In the case of an adult who is deceased, you can obtain these records if you have been named in the patient’s will as the executor of the estate, or a court has appointed you the administrator of the estate – or some states will allow you to obtain records if you are a surviving spouse or other next of kin. Our onboarding process (or customer service) will direct you to the types of documents you might need to upload in this situation. Q: How do I reset my password? A: If you ever need to reset your password, simply click “Forgot Password?” on the login page located at app.ciitizen.com and we will email you a link to reset your password; for security reasons, this link expires in 24 hours. If you have trouble resetting your password or do not receive a link, you can also reach out to support@ciitizen.com.

Q: How do you get my health records? A: The simplest way to receive your complete health records is to request that Ciitizen collect health records on your behalf directly from the healthcare providers you designate. Once your records are released by the provider, they are uploaded to your Ciitizen account. Subject to our policies and terms of use, only you have access to these records and no third parties have access to this information unless you consent to share it with them. Alternatively, you can upload your records into your account directly. Q: What do you do with my health records? A: Ciitizen is the technology service that allows you to request access to copies of your historical health information and records through the “right of access” granted under the Health Insurance Portability and Accountability Act (also known as “HIPAA”), as well as through online portal accounts made available to you by some health care providers or health plans. Ciitizen aggregates and standardizes your Health Records, transforms them into digital data and analyzes the information to offer you opportunities to share your information (for example, with caregivers, with your medical professionals, to find treatment, or to power research). Q: Who can see my information – who has access? A: The people who have access to your information are those that you share with specifically through your Ciitizen profile. In addition, select individuals who work for Ciitizen will have access to your health information on an as-needed basis and only for purposes of maintaining your account, improving our services, and determining which opportunities may be of interest to you. We will not commercialize or share your information with any third parties without your explicit consent. Only those individuals working for Ciitizen who have a need to access your information will be granted permission to do so. Q: How do I share my health information? A: You share your health information by granting someone access to your Ciitizen profile through the “Care Team” or “Share” features. You can grant access to anyone you choose simply by providing an email address for the person with whom you want to share your information. You can designate how long that person should have access to your account and you may revoke access at any time. Ciitizen will also notify you of opportunities for you to share your health information – and you can decide, either in advance or at the time you receive notice of each opportunity, whether or not you want to share your information. Q: Is it safe to keep my information on your platform? A: Ciitizen uses HIPAA-compliant cloud services to maintain your information. Additionally, we encrypt information locally and have stringent policies for staff regarding access to information aimed at ensuring your information is protected at all times. We train staff and contractors regularly on our company security policies and requirements. Although we take standard industry precautions to prevent breaches – we are also prepared if they happen. We are required by federal and state law to notify you (and in some cases, regulatory authorities) promptly if there has been a breach of your health information, and we act promptly to investigate breaches to determine the cause and do our best to ensure to mitigate and resolve. Subject to relevant laws and regulations, we never share your information with any third parties or access it for any other commercial purpose without your explicit consent. Q: What happens to my information if Ciitizen is sold or ceases to exist? A: You own the access to your information, so even if Ciitizen is sold, you maintain your right to close your Ciitizen account at any time (and you can either request that the information in your profile be securely destroyed, or you may download the data for your own use). Where possible, we will inform you in advance of a transfer of ownership so you can decide whether to continue your account with a new owner. Similarly, if Ciitizen ceases to exist, except where barred by law, we will provide you with advance notice and allow you to delete or transfer your account. We also are committed to returning to Ciitizen users a portion of the value gained from sharing their information with researchers, to the extent permitted by law (for example, in the form of direct payment, services, discounts, donations, or other value). Most importantly – it will always be your choice of whether or not to share your health data with anyone. You can always change your mind and choose not to share with researchers if that is your preference. Your profile is yours to use even if you decide not to share it with anyone else.

Q: What is a Ciitizen Research Summary? A: Ciitizen uses our patent pending machine learning (ML) engine to take the thousands of pages of documents found in a patient’s history and summarizes the most important elements of a patient’s disease. The elements in this summary are then matched with clinical terminology codes so that researchers can immediately make use of this information, such as in clinical trials or observational studies. Q: Who will my information be shared with if I decide to share my records for research? Who are your partners? A: Ciitizen works with partners that have a vision aligned to advance research for cancer and rare disease. These partners include physicians, academic institutions, drug companies and independent research organizations that support them. We will never disclose your information for insurance, advertising, or to 3rd parties not related to research without your express consent. Q: Why should I share my records for research? Will my information be identifiable? A: By agreeing to share your health information for research, you can help drug companies and research physicians to better understand the experience of patients like you, which can help lead to new treatments in the future. If you agree to your information being shared for observational research, we will share a summary of your profile with our research partners, for research purposes only. The information about you that we share with researchers will not contain information like your name, date of birth, phone number, address, or other information that can be easily used to identify you. In addition, we will contractually prohibit vetted partners from attempting to re-identify the information. Q: What does it mean that Ciitizen shares value with patients when their information is used in research? A: Should a patient’s information be included in a study, Ciitizen is committed to returning a portion of the value gained from this study with users to the extent permitted by law (for example, in the form of direct payment, services, discounts, donations, or other value) or to donate this value to an advocacy or research non-profit as directed by the patient.

Q: What is the record access process? A: You have the right under federal law (HIPAA) to get copies of all of your health records. Ciitizen helps you leverage this right by submitting your health records requests to your health care providers – and by educating providers about HIPAA compliance if necessary to help get these requests fulfilled. Q: How quickly will I get my records? A: HIPAA requires that providers send records to patients within 30 days of receiving the request except in a few select cases. Individual cases will vary on how quickly records will arrive. After a request is made, we follow up and urge providers to get them to us as soon as possible. In rare cases, providers won’t send records in a timely fashion. After 45 days and multiple follow-up communications, we will stop trying to collect these records and share the next steps on how you can approach getting these records into your profile. Q: How far back can you get my health records? A: Ciitizen will ask for records going back to the date of your disease diagnosis. Healthcare providers do not have to keep your records indefinitely – and how long they are required to keep them varies by state law. In general, we have found it difficult to get records that are older than 10 years, and, in some cases, providers may destroy them earlier than that. Q: Why do I need to provide my signature? A: The HIPAA right to copies of your records is YOUR right – so requests for your records need to come from you. We place your signature on a form letter we send to request your records. We only use your signature to sign records request letters, and these letters are ONLY sent to your medical providers. Q: Why do I need to provide a clear (not blurry) copy of my photo ID? A: Your medical requests are submitted to your medical providers by fax or by email – so the provider needs some way to prove identity and that you authorized the request letters to be sent. A clear copy of your photo ID is a way to remotely show that you are making the request. Q: Why do my signature and my signature on my ID need to match? A: Your medical provider needs some assurance that it is you who authorized the request for records. They will look for a decent match between your signature and the signature on the ID in order to prove your identity and make sure that the request for records is coming from you. Q: My provider has contacted me directly about my request – what should I do? A: Many providers, as a matter of company policy, will contact a patient about a records request just to confirm that the patient submitted the request. If your provider contacts you to confirm that you want your records to be sent to Ciitizen, you should confirm that you want your records sent to Ciitizen unless you have changed your mind. (After all, it is YOUR right to your records that Ciitizen is helping you to exercise—so it is not surprising that providers may want to make sure that you authorized the records request.) However, if the provider calls and wants to send your records directly to you instead of Ciitizen – or if they call to tell you they won’t honor the request, or if they send you a bill for the records or push back in any way – please contact us at records@ciitizen.com so we can help successfully resolve this. Q: Will my records be complete? A: Your right under HIPAA is to ALL of your health records maintained by your healthcare provider, and the request to your provider states this clearly. We review your records when they come in to make sure they contain information that is customary for a patient with your health history – however, we cannot know for sure whether your provider has sent us all of the health record information that they have about you. Please check your records and let us know if you think something is missing. Q: What if a provider is refusing to honor a records request or is charging too much for the records? A: On occasions, providers refuse to comply with the HIPAA right of access by refusing to send records or by charging too high a fee. This could happen for a variety of reasons, but we are seeing higher compliance. For example, see Ciitizen’s Patient Record Scorecard. We escalate your requests to higher-level officials at the provider in order to do all that we can to make sure your provider complies with HIPAA – but we don’t have the power to enforce the law against them. If we are unable to get one of your providers to comply with HIPAA after 45 days, we will cease following up on that record and let you know next steps on how you can pursue it with your provider directly. It’s possible in some cases that the records may need to be sent to you first – and then to us for population in your Ciitizen account; if that’s the case, we will provide you with assistance, including covering any costs involved in getting these records to you and then on to us. We can also advise you about how to file a complaint with federal regulators if you want to do that. Q: I have received a bill from my provider for the records Ciitizen requested. What should I do next? A: Ciitizen uses the HIPAA right for individuals to be able to get copies of their health information in order to populate your Ciitizen account. Because this is your right of access, and the requests are submitted on your behalf, occasionally a healthcare provider may send you a bill for your records. (HIPAA places limits on what fees can be charged to patients – and many providers give patients copies of their records for free; however, the law does permit a reasonable, cost-based fee to be charged.) Please promptly send the bill to records@ciitizen.com so we can make sure it is compliant with HIPAA and then Ciitizen will pay the bill on your behalf. Your Ciitizen profile is free for your use, and Ciitizen pays any HIPAA-compliant fees related to the release of your records from a provider. Q: Will the records sent to Ciitizen per my request include sensitive information? A: Your HIPAA rights extend to all information in the health record except for notes from psychotherapy sessions that are kept separate from other health records (which is not all mental health information – just the notes of a psychotherapy provider during a psychotherapy session, frequently maintained separately from other health records). However, state laws often require additional consent before sensitive information like HIV test results, mental health or genetic information can be released, even to the patient. As a result, when you put in your health records requests as part of onboarding to Ciitizen, you will need to specify whether you are comfortable with having this sensitive information shared with Ciitizen. Once this information is in your profile, you have the right to decide whether or not to share any of your health record information with any third parties. If you have any questions, please reach out to privacy@ciitizen.com. Q: I want to make sure the information in my Ciitizen profile is current – do I have to submit a new request every time I go back to my medical provider? A: To check the status of a pending records request or request an update to your existing records, sign in to your Ciitizen profile, select the provider you would like to view to see the status, and then, if you’ve been to that provider recently, you can choose “Yes, update my records” to request a records update.

Q: How much does it cost to join Ciitizen? A: Ciitizen does not charge users and the service is free for all patients. Q: What is your business model – how do you make money? A: Ciitizen is free to patients. If you choose to consent to share your records for research, Ciitizen uses our patent-pending machine learning (ML) engine to translate the thousands of pages of your health records and creates a research-ready summary of your information. We call this the Ciitizen Research Summary. When you consent to allow researchers to access your summary, Ciitizen will receive a fee from that research organization. The Ciitizen Research Summary creates efficiency for researchers, reducing their cost and labor to make patient information research-ready. Ciitizen will only ever grant researchers access to summaries of Ciitizen users who have consented to share their information.

Email Support: cii-support@invitae.com LIVE Phone Support: Monday - Friday, 9-5 PM ET, 1-855-CIITIZEN (1-855-244-8493) LIVE Support Office Hours: Wednesday, 1-4 PM ET Join Here [linking to https://invitae.zoom.us/j/91854018101?pwd=ZTdhNG00V1hDR2FKcGI2Slk4ZzNFdz09](https://invitae.zoom.us/j/91854018101?pwd=ZTdhNG00V1hDR2FKcGI2Slk4ZzNFdz09) LIVE Chat Support: Monday - Friday, 9:00 - 5:00 PM ET, http://www.ciitizen.com/description (http://www.ciitizen.com/description)