Cookie Policy

ORGO Inc. ("ORGO," "we," or "us") establishes this Cookie Policy (this "Policy") for the use of cookies and similar technologies on the MYoACT web application (app.myoact.com, the "Site") that we operate. This Policy applies to everyone who browses or uses the Site, whether before or after signing in ("visitors").

Our handling of personal information in general is set out in the Privacy Notice. This Policy supplements the Privacy Notice with respect to cookies and similar technologies.

The main terms used in this Policy are as follows.

• Cookie: a small text file stored in a visitor's browser when the visitor browses the Site.
• Similar technologies: technologies that perform a function similar to cookies, including local storage and other browser storage, web beacons and pixels, software development kits (SDKs), and scripts that cause information about a visitor to be sent from the visitor's device to servers operated by parties other than ORGO.
• Cookies and similar technologies: cookies and similar technologies collectively.
• Consent management tool: the mechanism on the Site (including the cookie consent banner and the cookie settings screen) that obtains and records visitors' choices about the use of cookies and similar technologies and controls the setting of cookies and similar technologies and the sending of information in accordance with those choices.
• External transmission: the sending of information about a visitor from the visitor's device to a server operated by a party other than ORGO.

We classify cookies and similar technologies into the following four categories according to the purpose of use. The category names are identical to those shown in the consent management tool.

• Necessary: cookies and similar technologies required to display the Site, for security, to keep visitors signed in, for load balancing, and to store visitors' choices about cookies and similar technologies. Because necessary cookies and similar technologies are indispensable to providing the Site, they cannot be switched off through the consent management tool.
• Preferences: cookies and similar technologies that store the display language and other display settings so that visitors can use the Site with the settings they have chosen.
• Analytics: cookies and similar technologies used to understand how the Site is used, to improve quality and operations, and to measure the effectiveness of advertising and user flows. Recordings of on-screen activity when an error occurs (session replay) are also included in this category.
• Advertising: cookies and similar technologies that send information to advertising measurement providers in order to measure the effectiveness of our advertising and to optimize its delivery.

The cookies and similar technologies used on the Site are listed below by category and provider. This list covers every cookie and similar technology that may be used on the Site, regardless of the visitor's consent status. The name and storage period of each individual cookie and similar technology can be viewed in the details screen of the consent management tool.

We do not load the tags of providers in the advertising category until the visitor consents to advertising. Cookies and similar technologies set by those providers are therefore classified as advertising, whatever their individual purpose.

Measurement information sent from our servers and error reports do not store cookies or similar technologies in the browser, so they are not included in this list and are described in "4. External transmissions."

The Site does not currently use any cookies or similar technologies in the preferences category.

For external transmissions that occur in connection with the use of the Site, we publish the following information in accordance with the Telecommunications Business Act of Japan: the recipient, the information sent, our purpose of use, and the recipient's purpose of use. The country in which each recipient is located, the basis for the transfer, and the safeguards applied are set out in the Cross-Border Transfer Statement and the Subprocessor List.

We do not send health-related data (data relating to the physical and mental condition of the persons analyzed), video, images, or the numeric series of analyses to any of the recipients above.

5.1 Display of the consent management tool

When a visitor first browses the Site, the consent management tool displays a cookie consent banner. The banner is displayed regardless of the region in which the visitor is located.

5.2 Treatment by category

• Necessary: no consent is required.
• Advertising: regardless of the region in which the visitor is located, we do not set cookies or similar technologies classified as advertising, and we do not send information to the advertising measurement providers listed in "4. External transmissions," until the visitor consents through the consent management tool.
• Preferences and analytics: for visitors located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we do not set these cookies and similar technologies and do not send the related information until the visitor consents. For visitors located in other regions, these categories are enabled by default on the basis of the publication of this Policy, and visitors may switch them off at any time through the consent management tool.

We pass the per-category consent status obtained by the consent management tool to Google's tags. Tags for a category for which consent has not been obtained are not loaded, and no measurement information relating to that category is sent.

5.3 What consent to advertising covers

If a visitor consents to advertising, we send the information listed in "4. External transmissions" to the recipients in the advertising category: Google LLC, Meta Platforms, Inc., LinkedIn Corporation, and X Corp. (all in the United States). Each of these companies matches the information it receives against its own user information and acquires it as personal data. Information about the personal information protection regime of the United States, where these companies are located, and about the safeguards each of them applies is available in the consent management tool before consent is given.

Consent to advertising is not a condition of using the Site or MYoACT. Visitors who do not consent may still use the Site and MYoACT.

5.4 Validity period and records of consent

A visitor's choices are stored for 12 months. When that period has elapsed, or when there is a material change to the categories of cookies and similar technologies we use or to the recipients, we ask the visitor to choose again. We keep records of consents given and withdrawn in the consent management tool in accordance with our internal standards.

Visitors may change or withdraw their choices at any time from "Cookie settings" in the footer of every page of the Site. After signing in, the same can be done from the settings screen. After a withdrawal, we stop setting new cookies and similar technologies in that category and stop sending the related information. If consent to analytics is withdrawn, we also stop using the analytics client identifier and stop sending measurement information from our servers. Cookies set before the withdrawal can be deleted from the browser's settings.

Visitors may also restrict or refuse cookies through their browser settings. If necessary cookies are refused, however, some or all of the Site may not be available.

We may update this Policy in response to changes in the cookies and similar technologies used on the Site, in the recipients, or in applicable laws. If a material change is made, we will inform visitors through a notice on the Site or another appropriate method and, where necessary, ask visitors to choose again.

Please send inquiries about this Policy or about the use of cookies and similar technologies on the Site to our contact point (support@myoact.com).

---

Last updated: September 1, 2026