Privacy Policy — Haplotype Wallet

Effective date: July 31, 2026

This Privacy Policy explains how Haplotype Labs Inc. ("Haplotype," "we," "us," or "our") collects, uses, discloses, retains, and protects Personal Data when you use Haplotype Wallet, also called DNA Wallet, and the related websites, applications, uploads, analyses, reports, connected-service features, collection kits, consumer whole-genome sequencing, promotions, and support that link to this Policy (collectively, the "Services").

Haplotype Labs Inc., a Delaware corporation, is the controller of Personal Data covered by this Policy. The Services are offered only in the United States. Testing, shipping, reports, and particular features may not be available in every state or United States territory.

Please also read our Terms of Service, Cookie Policy, and any consent or notice presented for a particular upload, test, connection, research project, promotion, or optional use.

Privacy summary

Your data remains yours. We do not claim ownership of your uploaded genetic or biomarker data, raw sequencing data, genetic facts, or individualized results.
We do not sell Personal Data. We do not rent or license individual-level genetic or biomarker data, share Personal Data with advertising networks, or use Personal Data for cross-context behavioral advertising.
You control optional uses. Research, external research disclosure, personalized offers based on genetic or health information, third-party or general-purpose AI training, and optional sample storage require a separate affirmative consent.
Connections are user-directed. An application, AI service, agent, or other recipient does not receive your genetic or biomarker data unless you authorize the recipient and scope.
Samples are not banked. Haplotype does not currently keep or offer long-term storage of biological samples. A testing laboratory destroys residual samples after testing, quality control, and necessary reprocessing, subject to retention required by law.
Core rights apply to everyone whose data we process. You may request access, download, correction, or deletion; withdraw an optional consent; and appeal a denied privacy request, subject to lawful exceptions.

Scope and important distinctions

This Policy applies when you:

Visit or interact with a Haplotype website or application.
Create or use an account.
Upload DNA, genomic, laboratory, wearable, health, wellness, or other biomarker data.
Ask us to process, analyze, store, display, or export supported data.
Order, activate, or submit a direct-to-consumer testing kit.
Authorize an application, AI system, agent, healthcare professional, researcher, or other recipient to receive selected data.
Participate in a promotion, incentive program, survey, or research opportunity.
Contact us for support or otherwise communicate with us.

This Policy applies to all Personal Data we collect, including limited technical information from an incidental visitor outside the United States. It does not mean we offer the account, upload, analysis, connection, or testing Services outside the United States. You must reside in the United States and be located in the United States when you create an account, upload or analyze data, authorize a connection, activate or submit a Sample, or order or use a paid Service. Public pages may remain accessible from other countries.

This Policy does not govern a third-party service after data reaches that service at your direction. The recipient's privacy policy and terms then apply. This Policy also does not apply to Haplotype workforce or job-applicant data covered by a separate notice.

The consumer Services covered here are nonclinical informational, educational, research, and wellness services. Haplotype is not a healthcare provider or health plan merely because you use these Services, and Haplotype generally is not acting as a business associate under the Health Insurance Portability and Accountability Act ("HIPAA"). If we later offer a clinical service subject to HIPAA or another medical-privacy law, that service will have separate clinical terms, consents, and any required Notice of Privacy Practices.

The Services are for adults. We do not permit an account, upload, or sample for a person under 18. You may provide data or order a test for another adult only when that person has expressly consented and you have legal authority to act.

Key definitions

Personal Data means information that identifies, relates to, describes, could reasonably be linked with, or could reasonably be used to infer information about an individual or household. The term includes "personal information," "personal data," and "consumer health data" as those terms are defined by applicable law.

Genetic Data includes raw genotype and sequence data; DNA, RNA, genes, chromosomes, alleles, genomes, variants, and single nucleotide polymorphisms; information resulting from analysis of a biological sample or uploaded file; and genetic information inferred or derived from other information.

Biomarker and Health Data includes laboratory results, measurements, wearable and sensor data, physical and health characteristics, medical and family history, symptoms, conditions, medications, lifestyle information, and health-related inferences. Genetic Data, Biomarker and Health Data, and related inferences may be Sensitive Personal Data under applicable law.

Sample means saliva, cells, extracted DNA, or other biological material submitted for testing.

Deidentified Data means data that cannot reasonably be used to infer information about, or otherwise be linked to, a particular individual or household when the safeguards described in this Policy are maintained. Aggregate Data means information combined and reported at a group level so that it does not reasonably identify an individual.

Personal Data we collect

The Personal Data we collect depends on the Services you use.

Account and identity information

We may collect your name, email address, display name, profile image, authentication identifier, account and consent settings, age or date of birth, and information used to verify your identity or authority. Our identity provider processes authentication credentials and session information.

Orders, payments, shipping, and promotions

We may collect products considered or purchased, kit and order identifiers, billing and shipping addresses, contact details, transaction status, discounts, referrals, promotion enrollment, subscription status, tax information, and customer-service history.

A payment processor may collect your payment card or bank information directly. Haplotype generally receives a payment token, status, and limited transaction details rather than full payment-card credentials.

Uploaded genetic and biomarker information

We collect the files and information you choose to upload, which may include raw genotype files, VCF files, whole-genome or exome sequence data, laboratory results, health records, wearable exports, and other biomarker information. We also collect file metadata such as filename, type, size, source, genome build, upload status, timestamps, processing tasks, validation results, and error information.

Uploaded genetic and biomarker files may pass directly from your browser to HaploHub, Haplotype's controlled processing platform, using a secured upload link. Haplotype Wallet keeps account, upload, and processing metadata and uses HaploHub to validate, process, store, and query supported genetic and biomarker data.

Testing and Sample information

If you order a test, we may collect kit registration and activation information, a coded Sample identifier, collection and receipt status, test specifications, Sample quality and processing information, raw laboratory output, quality metrics, test results, and related reports. We may also collect the minimum demographic or identity information a laboratory needs to perform the test, interpret results, or comply with law.

Self-reported and inferred information

You may choose to provide demographic information, ancestry, traits, family history, health history, symptoms, diagnoses, medications, lifestyle, preferences, goals, survey responses, and other information.

We may generate individualized analyses, annotations, scores, recommendations, reports, familial or ancestry inferences, health-related inferences, and other derived information from data you provide.

We collect the identity of a connected application, AI system, agent, model provider, researcher, healthcare professional, or other recipient; the permissions and data categories you authorize; authorization and revocation times; connection activity; and records needed to carry out and audit your instructions.

Communications and referrals

We collect messages, support requests, survey responses, feedback, call or chat records, and information you include in communications. If you make a referral, we may collect the recipient's name and contact information and your referral relationship. You must have permission before asking us to contact another person.

Device, usage, and security information

We automatically collect limited technical information needed to operate and secure the Services, such as IP address, device and browser type, operating system, language, referring page, pages or features used, timestamps, session and authentication events, diagnostic information, and security or fraud signals.

We do not permit advertising networks to collect information through the Services. Our use of cookies and similar technologies is described in the Cookie Policy.

Browser privacy signals

We do not sell Personal Data, share Personal Data for cross-context behavioral advertising, use targeted advertising, or permit advertising networks to track visitors across unrelated services. Because of those practices, a browser Do Not Track (DNT) setting does not cause an additional change to our current processing. DNT does not disable essential authentication, security, error reporting, or performance diagnostics.

We recognize a supported Global Privacy Control (GPC) signal as a request to opt out of sale, sharing for cross-context behavioral advertising, and targeted advertising where applicable law requires. We do not currently conduct those activities, so there is nothing additional to opt out of. GPC does not disable essential WorkOS authentication or our narrowly configured Sentry error and performance monitoring. If our practices change, we will honor GPC as required and update our notices. See our Cookie Policy for the current technology inventory and controls.

Sources of Personal Data

We obtain Personal Data:

Directly from you or an adult who is legally authorized to act for you.
From files, Samples, devices, or services you choose to provide or connect.
From a contracted laboratory, carrier, payment processor, identity provider, or other service provider acting for us.
From an application, AI service, healthcare professional, researcher, or other recipient when you authorize the exchange.
From another person who makes a referral or is authorized to provide your information.
Automatically from your device and use of the Services.
By generating analyses, inferences, results, and operational records from the information above.

How we use Personal Data

We use Personal Data for the following purposes.

Provide and administer the Services

We use Personal Data to:

Create, authenticate, maintain, and support accounts.
Accept, validate, process, store, analyze, display, and export uploads.
Generate requested results, reports, computations, and explanations.
Process orders, payments, subscriptions, discounts, shipments, returns, and refunds.
Register kits; coordinate collection, transport, laboratory testing, quality control, and necessary reprocessing; and return results.
Carry out a download, connection, disclosure, or other instruction from you.
Provide support and respond to questions, complaints, and privacy requests.
Maintain service availability, compatibility, and performance.

Personalize Haplotype Services and offers

We may personalize the Wallet experience and recommend Haplotype products, tests, reports, or features based on ordinary account and service information. For example, we may offer whole-genome sequencing to a person whose account contains only microarray data.

We will obtain a separate, off-by-default, revocable Personalized Health Recommendations consent before using Genetic Data, Biomarker and Health Data, or health-related inferences to select a personalized offer. For example, with that consent we may recommend a cholesterol test based on relevant demographics, biomarkers, or genetics.

These are first-party Haplotype recommendations. We do not disclose Personal Data to advertising networks or use it for cross-context behavioral advertising. You may withdraw the consent without affecting access to the core Services you purchased.

Communicate with you

We use contact information to send transaction, security, account, testing, support, privacy, and legal notices. We may send Haplotype product or promotional communications as permitted by law. You may unsubscribe from promotional email using the link in the message or your available account settings. Unsubscribing does not stop nonpromotional communications needed for your account, order, safety, or legal obligations.

Protect people and the Services

We use Personal Data to authenticate users, enforce permissions, detect and prevent fraud or abuse, investigate security incidents, protect rights and safety, maintain audit records, enforce agreements, and comply with law.

Internal product development

We may use Deidentified Genetic Data, Deidentified Biomarker and Health Data, and Aggregate Data to develop, validate, secure, and improve Haplotype products. This includes Wallet features, reports, algorithms, analytical methods, quality controls, and models specific to Haplotype products. Improvements may be used in commercial Haplotype products and Services.

We may use ordinary non-genetic operational telemetry to improve reliability, usability, fraud prevention, and security.

We do not use identifiable or coded individual-level Genetic Data or Biomarker and Health Data for a secondary product-development purpose unless the use is covered by the service you requested or we obtain separate express consent where required.

Deidentified and Aggregate Data

When we maintain information as Deidentified Data, we:

Take reasonable measures to prevent association with an individual or household.
Publicly commit to maintain and use it only in deidentified form.
Do not attempt to reidentify it, except solely to test whether our deidentification process satisfies applicable requirements.
Do not use or disclose information reidentified during such a test and destroy the reidentified information after the test.
Contractually require any service provider receiving it to maintain it in deidentified form, take reasonable measures against association, and not attempt reidentification.

We use Deidentified Genetic Data and Deidentified Biomarker and Health Data for Haplotype's internal product-development purposes. We do not provide individual-level deidentified genetic or biomarker data to an external researcher or other third party for its independent purposes without the separate consent required for that activity.

We may use and disclose Aggregate Data that does not reasonably identify a person for lawful business purposes, including describing general service usage and performance.

Acceptance of the Terms or this Policy does not replace a separate consent required by genetic, biometric, or consumer-health privacy law.

Before collecting and using Genetic Data or other Sensitive Personal Data, we provide a clear notice of the data, purpose, access, disclosure, retention, and choices involved and obtain affirmative authorization where required. Consent is not inferred from silence, inactivity, or a dark pattern.

We obtain separate affirmative consent, as applicable, for:

The primary collection, analysis, storage, and disclosure needed to provide an upload, testing, or analysis Service.
Keeping a Sample after requested testing is complete. Haplotype does not currently offer Sample storage.
Each secondary use of Genetic Data or a Sample beyond the primary service and its inherent contextual uses.
A transfer of Genetic Data or a Sample to a third party other than a contracted service provider, including the named recipient where required.
Marketing or facilitating marketing based on Genetic Data.
Personalized Health Recommendations based on genetics, biomarkers, health information, or health-related inferences.
Scientific research, an external research collaboration, or recruitment based on Sensitive Personal Data.
Training a third party's or general-purpose AI model with Genetic Data or Biomarker and Health Data.
An optional connection or sharing feature that discloses Genetic Data or Biomarker and Health Data to a recipient you select.

You may withdraw consent using the method presented with the consent, available account controls, or by contacting us. Withdrawal stops future processing based on that consent after we have a reasonable opportunity to act. We honor revocation within the period required by law and, for a revocation governed by the California Genetic Information Privacy Act, no later than 30 days. Withdrawal does not affect processing already lawfully completed or records we must retain.

Research and AI

Participation in scientific research is optional. We require a separate affirmative consent before enrolling your Genetic Data or Biomarker and Health Data in research or disclosing it to an external research collaborator. The consent will describe the research purpose, information involved, recipient or recipient categories, commercial involvement, reasonably anticipated risks, withdrawal process, and other information required by law.

Research may involve nonprofit, academic, government, healthcare, or commercial organizations and may contribute to publications, products, diagnostics, therapeutics, or other commercial developments only as described in the applicable consent. Unless separate terms expressly say otherwise, you should not expect compensation or ownership in discoveries resulting from research.

Haplotype may use Deidentified Data to develop models specific to Haplotype products as described above. We do not use Genetic Data or Biomarker and Health Data to train a third party's or general-purpose AI model without separate affirmative consent.

If you choose to use an AI-powered feature or connect an AI service, the connection provisions below apply.

Connected applications, AI systems, and recipients

No connected application, AI system, agent, model provider, researcher, healthcare professional, or other recipient receives Genetic Data or Biomarker and Health Data by default.

Before the first disclosure through a connection, we ask you to authorize:

The named recipient.
The data categories, functions, or scope available.
The intended purpose and duration, where applicable.
Any additional use requiring separate consent.

You direct disclosures made within an active authorization. Permissions are designed to be granular and revocable. Revoking a connection stops future access through DNA Wallet but does not retrieve copies already received or require the recipient to delete them. Exercise deletion rights directly with the recipient when necessary.

Once data reaches a recipient you selected, that recipient's terms and privacy practices govern its copy. Review those terms carefully, particularly the recipient's retention, deletion, security, advertising, research, and AI training practices.

Direct-to-consumer testing and Samples

Consumer testing is offered only within the United States and may be available only in states and territories supported by checkout, shipping providers, the contracted laboratory, and applicable law.

Haplotype uses a coded kit or Sample identifier and discloses only the information reasonably necessary for the recipient's role:

A carrier receives delivery or return-shipping information.
A payment processor receives transaction and payment information.
A laboratory receives the coded identifier, test instructions, Sample, necessary demographic or identity fields, and information needed to perform and validate the test or comply with law.
Haplotype maintains the relationship between the account, order, kit, and results.

We may provide identifiable information to a laboratory when legally or operationally necessary. Laboratory and other service-provider contracts restrict use, retention, combination, and disclosure to the contracted services and legal obligations.

Haplotype does not currently keep or offer long-term storage of biological Samples. Subject to retention required by law, the laboratory destroys residual Samples and extracted DNA after requested testing, quality control, and any necessary reprocessing are complete. Laboratories may retain limited records when legally required.

If we later offer optional Sample storage, additional testing, or another use, we will provide a separate notice and obtain separate affirmative consent before enrollment. A person who has consented to storage may request destruction, and we will honor the request within the period required by law.

When we disclose Personal Data

We disclose Personal Data only for the purposes described below.

Haplotype-controlled systems and personnel

Authorized Haplotype personnel and Haplotype-controlled systems, including HaploHub, may access Personal Data when reasonably necessary for their role and the purposes in this Policy.

Service providers

We use contracted providers for cloud infrastructure, authentication, laboratory processing, payment processing, kit fulfillment, shipping, communications, support, security, and error monitoring. They may process only the data needed to provide contracted services to Haplotype and must protect it under contractual and legal obligations.

Our public Service Provider List identifies core providers, their functions, the data categories they may handle, and processing locations. We update that list as providers change.

Recipients you authorize

We disclose Personal Data to a person, application, AI system, agent, model provider, healthcare professional, researcher, or other recipient when you direct or authorize the disclosure. Separate express consent applies where required.

Research collaborators

We disclose Genetic Data or Biomarker and Health Data to an external research collaborator only under a separate affirmative research consent and applicable research safeguards.

Legal, security, and safety purposes

We may preserve or disclose Personal Data when required by applicable law or valid and binding legal process, or when reasonably necessary to investigate fraud or unlawful activity, protect the Services, enforce agreements, establish or defend legal claims, or address a genuine emergency involving imminent death or serious physical harm.

We do not voluntarily provide Genetic Data or Biomarker and Health Data to law enforcement, government agencies, forensic services, or public databases. We review the validity and scope of legal demands and seek to narrow or object to overbroad requests where reasonably and legally appropriate. We do not promise to notify a user of a request. Emergency disclosures are limited to information reasonably necessary to address the emergency.

We do not disclose Genetic Data directly to an employer or to an entity making health, life, disability, or long-term-care insurance decisions, except to the limited extent a disclosure is legally required and cannot be prohibited.

Haplotype may publish aggregate statistics about government and law-enforcement requests but does not commit to a recurring transparency report.

Corporate transactions

If Haplotype is involved in a merger, financing, reorganization, acquisition, sale of equity, sale of assets, or similar transaction, Personal Data may be transferred as part of that transaction. We will provide notice before Personal Data is transferred or becomes subject to a different privacy policy.

If the transaction would cause your data to become subject to a materially different privacy policy, the notice will provide a reasonable opportunity to export or delete your data before the new privacy policy takes effect. A transaction does not authorize a use or disclosure that requires consent under applicable law without obtaining that consent.

No sale or advertising-network disclosure

Haplotype does not:

Sell Personal Data for money or other valuable consideration.
Rent or license individual-level Genetic Data or Biomarker and Health Data.
Disclose Personal Data to advertising networks.
Permit third-party advertising pixels or cross-context behavioral advertising through the Services.
Use Genetic Data or Biomarker and Health Data to advertise a third party's products.
Provide Personal Data to public genetic databases.

Applicable privacy laws sometimes define "sell," "share," and "targeted advertising" differently from ordinary language. We do not engage in those activities as defined by the California Consumer Privacy Act or comparable US state privacy laws. Disclosures to contracted service providers, laboratories, or recipients you direct are not sales and are limited as described in this Policy.

Promotions and financial incentives

We may offer voluntary programs that provide a financial incentive, price difference, free product, enhanced service, or other benefit in connection with Personal Data. Examples may include:

Free or subsidized genetic testing kits.
Free reports for uploading supported genetic or biomarker data.
Referral credits or rewards.
A discount on whole-genome sequencing after uploading existing raw DNA data.
Loyalty, trial, subscription, or engagement benefits.

Participation is optional. Promotional and paying customers receive the same privacy protections. Joining a promotion does not authorize research, third-party AI training, Personalized Health Recommendations, Sample storage, or another optional use unless that use is presented separately and you affirmatively consent.

Before you enroll, the program terms or a just-in-time notice will describe:

The benefit and material eligibility terms.
The categories of Personal Data collected, retained, or used.
How to opt in and how to withdraw.
The effect of withdrawal on unearned or ongoing benefits.
A good-faith estimate of the value of the Personal Data and how that estimate relates to the benefit.

We estimate value using one or more reasonable factors, which may include the cost and value of the benefit, the expense of collecting and processing the data, customer-acquisition costs, expected engagement or loyalty, and the program's operational expenses. The calculation and value may vary by program and participant and will be described in the applicable notice.

You may withdraw from a program through the method in its terms or by contacting us. We do not discriminate against you for exercising a privacy right, and no incentive may be unjust, unreasonable, coercive, or usurious.

Retention and deletion

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Policy, the period you maintain an account or use a Service, and applicable legal, security, fraud-prevention, dispute, and recordkeeping requirements.

When you delete supported Genetic Data or Biomarker and Health Data, deletion propagates to Haplotype's processing platform and removes stored data and individualized derived results from active systems. We complete deletion within the period required by law and target completion from active systems within 30 days.

Encrypted backup copies may remain inaccessible until overwritten through ordinary backup rotation, targeted within 90 days. Deleted data in a backup is not restored to active use except for disaster recovery and remains subject to the deletion process after restoration.

Deleting a Sample or its Genetic Data does not necessarily delete the account or all upload and transaction history. We may retain limited records such as filenames, file sizes, upload status, error details, Sample or order identifiers, task history, timestamps, consent records, transaction records, support history, security events, fraud records, audit records, disputes, and legal-compliance records for as long as reasonably necessary for those purposes.

Laboratories may retain limited records when legally required. We cannot delete copies previously sent to a recipient you authorized; contact that recipient directly.

Subscription cancellation does not delete an account or data. Where available, use the separate account or data-deletion control or contact us.

Your privacy rights

We provide the following core rights to every individual whose Personal Data we process, although eligibility to use the Services remains limited to the United States. Rights are subject to identity verification and lawful exceptions:

Access and know. Ask whether we process your Personal Data and receive a copy and information about its sources, purposes, and recipients.
Download and portability. Download supported uploaded files, raw data, and available reports in an available portable format without a separate access fee while retained.
Correction. Correct inaccurate account or self-reported information, or ask us to address a file or result associated with the wrong person. A technically accurate genetic observation cannot be changed merely because you disagree with its implications.
Deletion. Delete supported data, or delete your account and its associated Genetic Data and Biomarker and Health Data yourself from Account settings. Deleting an account removes your uploaded files, the samples produced from them, and results computed from those samples, and propagates that deletion to our processing partner. Backup copies may persist in storage for up to 30 days before they expire, and we retain limited operational records as described in "Retention and deletion".
Withdraw consent. Revoke an optional consent and stop future processing based on it.
Sample destruction. Request destruction if a laboratory or a future optional storage program still retains your Sample, subject to testing status and law.
Appeal. Appeal our refusal to act on a privacy request.
Nondiscrimination. Exercise privacy rights without unlawful discrimination or retaliation.

Submit a request or appeal to privacy@haplotype-labs.com. We may ask for information reasonably necessary to verify identity, authority, and account ownership. An authorized agent may submit a request where permitted by law, but we may verify the agent's authority and the individual's identity.

We respond within the period required by applicable law. We generally do not charge a fee, but may charge a legally permitted reasonable fee or decline an excessive, repetitive, technically infeasible, or manifestly unfounded request. If we deny a request, we will explain the basis and available appeal or complaint route where required.

US state privacy disclosures

This section supplements the rest of this Policy for residents of US states with applicable comprehensive, genetic, biometric, or consumer-health privacy laws.

During the preceding 12 months, we may have collected the categories of Personal Data described in Personal Data we collect, including identifiers; customer and transaction records; protected characteristics; commercial, internet, device, geolocation, and communications information; inferences; Genetic Data; Biomarker and Health Data; and other Sensitive Personal Data. Some categories are collected only if you use the corresponding Service.

We collect those categories from the sources and for the purposes described in this Policy. We may disclose them for a business purpose to the recipient categories described in When we disclose Personal Data. The specific service providers we use are listed on our Service Provider List.

We have not sold Personal Data or shared Personal Data for cross-context behavioral advertising during the preceding 12 months. We do not knowingly sell or share Personal Data of people under 18. We use and disclose Sensitive Personal Data only for the Services and purposes described here, including optional uses to which you separately consent.

Depending on your state, you may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale or targeted advertising, limit certain uses of Sensitive Personal Data, withdraw consent, appeal, or use an authorized agent. Our baseline rights and no-sale practices provide these protections without requiring you to opt out of a sale or advertising practice we do not perform.

California genetic privacy

California residents have the genetic-data rights and protections described throughout this Policy, including clear notice, separate express consent, consent revocation, access, deletion, Sample destruction, reasonable security, and nondiscrimination.

If you separately consent to research, your deidentified genetic or phenotypic information may be disclosed to third parties for research under the applicable consent and legally required human-subject protections, including 45 C.F.R. Part 46 where applicable.

To make a complaint about our genetic-data practices, contact us first at privacy@haplotype-labs.com. You may also file a complaint as permitted by the California Genetic Information Privacy Act with the California Attorney General, an authorized district attorney, county counsel, city attorney, or city prosecutor.

Consumer health data

For purposes of Washington's My Health My Data Act, Nevada's consumer-health privacy law, and similar laws, Consumer Health Data may include Genetic Data, Biomarker and Health Data, health-related demographics and identifiers, testing and Sample information, information about health services or products sought or received, and inferences concerning health.

We collect Consumer Health Data from you, your uploads or Sample, devices or services you connect, contracted laboratories and service providers, recipients you authorize, and analyses we perform. We collect and use it to provide the Service you request, fulfill orders and testing, authenticate and secure the Services, comply with law, and perform the other uses described in this Policy with consent where required.

We disclose Consumer Health Data only to Haplotype-controlled systems, contracted service providers and laboratories, recipients you authorize, research collaborators covered by separate consent, and legal or transaction recipients described in this Policy. We do not currently disclose Consumer Health Data to a separately operated Haplotype affiliate. Any affiliate or processor receiving Consumer Health Data will be identified on the Service Provider List where required.

We do not sell Consumer Health Data. We obtain consent before collecting or disclosing Consumer Health Data unless the processing is necessary to provide a product or Service you requested or another legal exception applies. A consent to disclose is separate when required by law.

You may ask to confirm, access, correct, or delete Consumer Health Data; withdraw consent; receive a list of recipients where required; or appeal a decision by contacting us. If a Washington appeal is denied, you may contact the Washington State Attorney General. Nevada residents may contact the Nevada Attorney General.

United States availability and processing

Haplotype is based in the United States, and the Services are offered only in the United States. While held by Haplotype or processed on Haplotype's behalf, Genetic Data and Biomarker and Health Data covered by this Policy are stored and processed in the United States.

This commitment does not prevent a transfer to a recipient outside the United States when you expressly direct us to make that transfer. Once data reaches that recipient, its privacy practices and the laws applicable to it govern its copy. Other Personal Data may be processed in locations where a provider on our Service Provider List operates.

The Services are not directed to people outside the United States, and we do not knowingly accept international accounts, uploads, connections, Samples, or orders. If we learn that an ineligible person has provided Personal Data, we may restrict the account and delete or return the data, subject to legal retention requirements and available privacy rights.

Haplotype's personalized recommendations do not make decisions that produce legal or similarly significant effects. We do not make solely automated decisions about employment, insurance, credit, housing, healthcare eligibility, or other similarly significant matters using your Genetic Data or Biomarker and Health Data.

Security

We maintain technical, administrative, and organizational safeguards designed to protect Personal Data against unauthorized access, acquisition, destruction, loss, alteration, use, or disclosure. Measures may include encryption in transit and at rest, access controls, least-privilege permissions, authentication controls, environment separation, logging, monitoring, secure development practices, service-provider review, and incident-response procedures.

Access to Genetic Data and Biomarker and Health Data is limited to authorized personnel and systems with a legitimate need. Our error-monitoring configuration is designed to exclude genetic content, biomarker query contents, credentials, cookies, and authorization headers.

No system or transmission method is completely secure. Protect your account credentials, use a secure device and network, review connection permissions, and contact us promptly if you suspect unauthorized access.

Changes to this Policy

We may update this Policy to reflect changes in law, technology, risk, the Services, or our practices. We will post the revised Policy and update the "last updated" date. For a material change, we will provide advance notice where reasonably practicable by email, through the Services, or by prominent website notice and state when the change takes effect.

Continued use after an ordinary change takes effect constitutes acknowledgment where permitted by law. A Policy update does not replace a separate consent required for a materially broader use of Genetic Data, Biomarker and Health Data, or a Sample.

For a corporate transaction that would subject your data to a materially different privacy policy, we will provide a reasonable opportunity to export or delete your data before the new policy takes effect.

Contact, requests, and complaints

For privacy questions, complaints, consent withdrawals, rights requests, or appeals, contact:

privacy@haplotype-labs.com

Haplotype Labs Inc.
3515 Mt. Diablo Blvd
Lafayette, CA 94549
United States

Please describe your request and provide the account email and information reasonably necessary for us to verify and respond. Do not email raw Genetic Data, Biomarker and Health Data, government identification, or payment-card information unless we specifically request it through a secure method.