Withdrawal & Sample-Destruction Request

DRAFT — pending legal review. Not legal advice.

This page explains your right to withdraw the consent you gave us, how to ask us to

stop processing your personal data, and how to request destruction of any residual

biological sample. It also tells you what to expect after you send a request, and how

to escalate if you are not satisfied.

Withdrawing consent is free. You will not be penalised for asking, and you do not have

to give a reason.

Your right to withdraw consent

When you placed your order, we asked for your consent in a granular, unbundled way —

separately for the service you purchased and, individually, for any optional uses

(for example, product marketing, longitudinal profiling, algorithm development,

commercial research, biobank retention, sharing with research collaborators, or future

research). You could purchase the core service without agreeing to any optional use.

Consistent with India's Digital Personal Data Protection Act, 2023, **you may withdraw

your consent at any time.** The ease of withdrawing consent is intended to be comparable

to the ease with which it was given. You can withdraw:

Consent for one or more optional uses — while continuing to use the core service.

For example, you can withdraw consent for marketing or research retention but still

receive your report.

Consent for the core service itself — which is a request to stop processing your

personal data for the service you purchased. Please read "Practical consequences"

below, because withdrawing core-service consent generally means the service cannot

continue.

Withdrawal is forward-looking. It does not, by itself, make unlawful any processing we

lawfully carried out before you withdrew.

What you can ask us to do

In a single request you may ask us to do any or all of the following. Tell us which ones

apply to you:

Stop future processing based on the consent you are withdrawing — for the specific

optional use(s) you name, or for the core service.

Destroy your residual biological sample, where any sample material remains and

destruction is feasible (see "What happens next").

Delete or anonymise your personal data, subject to any data we are required or

permitted to retain under applicable law (see "What we may need to keep").

You can also combine this with your other data rights — access, correction, and

nomination — which are described in our Privacy Notice.

How to submit a request

Send your request to either of the following:

General contact: legal@vamsbiome.com

Data protection / privacy contact: privacy@vamsbiome.com

Please use the subject line "Withdrawal / Sample-Destruction Request" so we can route

it quickly. If you are writing on behalf of someone else, tell us your relationship and

your authority to act (for example, as a nominated person or authorised representative).

We may ask you to verify your identity before we act, so that we do not disclose or

destroy data on the wrong person's instructions. We will keep verification proportionate

and will not use it to delay a genuine request.

Request details to include (checklist)

To help us find your records and act quickly, please include:

[ ] Your full name (as used on the order)

[ ] Order reference (and, if known, your kit or sample ID)

[ ] Email/phone associated with the order

[ ] What you want to withdraw — name the specific optional use(s), or state

"the core service"

[ ] Sample destruction: yes / no — do you want any residual sample destroyed where

feasible?

[ ] Data: delete / anonymise / no change — what should happen to your personal data

[ ] Confirmation — a clear statement that you are withdrawing consent and, if

applicable, requesting destruction

Missing details are not a reason for us to ignore your request; if something is unclear we

will contact you to confirm before acting.

What happens next

Once we have received your request and (where needed) verified your identity, we will:

Stop future processing for the consent you have withdrawn. Where you withdraw

consent for an optional use, we stop that use going forward. Where you withdraw

core-service consent, we stop processing your data to deliver the service.

Destroy your residual sample where feasible. If any of your biological sample

remains and has not already been consumed by processing, we will arrange for its

secure destruction and instruct any relevant sub-processor to do the same, subject to

the technical and operational constraints of the location holding it

(Samples may be processed by qualified third-party laboratories in India or another location disclosed to the customer before sample submission or processing. The specific processing laboratory and country will be identified in the order documentation or test report where applicable.). If no sample remains, or if it was already destroyed in

the ordinary course after analysis, we will tell you that instead.

Delete or anonymise your personal data, according to your instruction, except for

data we are required or permitted to retain (see below). Where full deletion is not

possible, we will where feasible anonymise the data so it can no longer identify you.

Confirm in writing what we have done, and explain anything we could not do and why.

What we may need to keep (legal retention)

Even after you withdraw consent, we may retain limited information where the law requires

or permits it, or where we need it to establish, exercise or defend legal claims. This may

include, for example, transaction and tax records, records evidencing that consent was

given and later withdrawn, and information needed to comply with statutory obligations.

Any retained data is kept only for as long as necessary and is protected accordingly. Our

standard retention periods are Unless a different period is disclosed and consented to, residual biological samples will normally be destroyed within 30 days after the final report is issued. Samples may be retained longer only for necessary repeat testing, quality investigation, legal requirements or separately consented research. for sample material and

Retention depends on the record type and purpose. Generally: order, invoice and statutory business records for up to 8 years; identifiable microbiome test data and reports for up to 3 years after report delivery or account closure; raw sequencing files for up to 12 months after report delivery; support records for up to 3 years; and consent records for as long as necessary to demonstrate compliance. Data may be retained longer where required by law, litigation hold or explicit research consent, and may be deleted or anonymised earlier when no longer necessary. for personal data, subject to these legal exceptions.

Practical consequences (please read)

Work already completed may not be reversible. If analysis has already been performed,

we cannot "un-process" it. Withdrawal stops future processing; it does not undo results

already generated. Where feasible we will delete or anonymise the outputs at your request.

Withdrawing core-service consent means the service cannot continue. The core service

depends on processing your sample and personal data. If you withdraw that consent before

the service is complete, we will stop, and we may be unable to deliver — or complete — your

report. Refund eligibility for work already performed is governed by our Terms and

Refund/Return Policy.

Sample destruction is permanent. Once a residual sample is destroyed it cannot be

recovered, and any analysis that had not yet been carried out will no longer be possible.

Some downstream copies may take time to remove. Where your data has been shared with a

sub-processor under the optional consent you are withdrawing, we will instruct them to stop

and, where applicable, delete; propagation of that instruction may take a short period.

Withdrawing an optional use does not cancel your order. You can, for instance, withdraw

marketing or research consent and still keep your report.

Timelines

Acknowledgement: we aim to acknowledge your request promptly, ordinarily within a few

business days of receipt.

Action: we aim to give effect to withdrawal, and to complete deletion, anonymisation or

sample-destruction where feasible, within a reasonable period after your request is received

and your identity (where needed) is verified. Some steps, such as instructing a sub-processor

or a processing location to destroy residual material, depend on that party's own operational

cycles and may take longer.

If we need more time for a specific step, we will tell you and explain why.

Indicative timelines above do not limit any right or remedy you have under applicable law.

Grievance redressal and escalation

If you are unhappy with how we handled your request:

Raise a grievance with us first. Contact our data protection / privacy contact at

privacy@vamsbiome.com describing the problem. We will look into it and respond.

Escalate to the regulator. If you remain dissatisfied, you may complain to the

Data Protection Board of India in accordance with the Digital Personal Data Protection

Act, 2023, and you may approach other competent authorities or regulators

(Ministry of Corporate Affairs; Ministry of Electronics and Information Technology; Data Protection Board of India; Department of Consumer Affairs and Central Consumer Protection Authority; and, depending on the product or claim, CDSCO, FSSAI, relevant State authorities and other competent regulators.) where relevant.

Consumer remedies are preserved. Nothing on this page limits your access to the

Consumer Commissions or other statutory consumer remedies available to you under Indian law.

Contracting entity: VAMS BioInnovation Private Limited, Plot No. 59, A-12-4-1, Near Matha Towers, K P Nagar, Benz Circle, Vijayawada, Andhra Pradesh 520008, India. Governing law:

Laws of India, including applicable laws of the State of Andhra Pradesh.

Version and Change History

Document name: Withdrawal & Sample-Destruction Request

Version: 1.0

Effective date: 10 July 2026

Change history: v1.0 (10 July 2026) — Initial publication.