HIPAA Notice

1. About This Notice

Houya, Co., operator of the Atlagene service ("Atlagene," "we," "us," or "our"), provides genomic analysis and reporting services to diagnostic laboratories. This notice describes how we handle Protected Health Information (PHI) that we receive, create, maintain, or transmit on a laboratory's behalf, including genotype and sequencing files uploaded through the Lab Portal, analysis results, and laboratory reports.

Where a laboratory is subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act), the laboratory is responsible for its patients' PHI, and we process that PHI on its behalf. The terms that govern our handling of a laboratory's PHI, including any Business Associate Agreement, are set out in our agreement with that laboratory; this notice summarizes our practices.

We abide by the terms of this notice currently in effect.

2. How We Use and Disclose PHI

We use and disclose PHI only as described below, as permitted by our agreement with the laboratory, or as required by law:

2.1 To Provide the Services to the Laboratory

We use PHI to analyse the files a laboratory uploads and to produce its reports, and we make results and reports available to that laboratory and its authorized users through the Lab Portal. The laboratory decides whether and how to share a report with the patient or the patient's healthcare providers.

2.2 Service Providers

We use service providers to host and operate the Services. Each one, the data it receives, and our contractual position with it are listed in Section 5.2 of our Privacy Policy.

2.3 Billing

We bill laboratories directly through our payment processor; we do not submit claims to health insurance plans. No genetic or health data is sent to our payment processor.

2.4 Quality, Security, and Compliance

We may use PHI for quality assessment and improvement, compliance, and auditing activities related to the Services, as permitted by our agreement with the laboratory.

2.5 Required by Law and Legal Proceedings

We may disclose PHI when required to do so by federal, state, or local law, including in response to a court order, subpoena, or other lawful process. The disclosure will be limited to the requirements of the law. Where possible, we will notify the laboratory of such requests before disclosure and will make reasonable efforts to obtain a protective order or assurance that the receiving party will maintain the confidentiality of the PHI.

2.6 Research

We will never use identifiable genetic data for research without the patient's separate, written authorization. Any use of information that has been de-identified in accordance with HIPAA requirements (Safe Harbor method, removing all 18 categories of identifiers) is limited to what our agreement with the laboratory permits.

3. Uses and Disclosures We Do Not Make

• Marketing: We do not use or disclose PHI for marketing purposes.
• Sale of PHI: We will never sell PHI. HIPAA prohibits the sale of PHI without authorization, and Atlagene has no intention of ever selling health information or genetic data.
• Underwriting: We do not use or disclose genetic information for underwriting purposes (as required by GINA and HIPAA).
• Any other use not described in this notice: Any other use or disclosure of PHI is made only as permitted by our agreement with the laboratory or as required by law.

4. Patient Rights

Patients' rights under HIPAA — including the rights to access and obtain a copy of their PHI, to request amendments, to receive an accounting of disclosures, to request restrictions, and to request confidential communications — are exercised through the laboratory or healthcare provider that ordered their test. If you are a patient, please send your request to that organization. We support laboratories in responding to these requests as set out in the agreement with each laboratory. You may also contact us at hipaa@atlagene.com.

5. Safeguards and Minimum Necessary Standard

We maintain the privacy and security of the PHI we process. The security measures we apply are described in Section 8 of our Privacy Policy.

When using or disclosing PHI, or when requesting PHI from another entity, we make reasonable efforts to limit the information to the minimum amount necessary to accomplish the intended purpose.

6. Breach Notification

In the event of a breach of unsecured PHI that we process for a laboratory, we will notify that laboratory:

• Timeline: We will notify the laboratory without unreasonable delay and no later than 60 days after discovery of the breach.
• Content of Notice: The notification will include: a description of the breach and the types of information involved; what we are doing to investigate, mitigate harm, and prevent future breaches; and contact information for questions or additional information.
• Notifying Patients and Regulators: Responsibility for notifying affected patients, the U.S. Department of Health and Human Services (HHS), and any other regulator is set out in the agreement with each laboratory.

7. Complaints

If you believe your privacy rights have been violated, you may file a complaint:

You will not be penalized or retaliated against for filing a complaint. All complaints will be investigated, and you will receive a written response.

8. Effective Date and Changes

This notice is a draft. It takes effect when it is published without the draft notice above. We reserve the right to change this notice at any time and to make the revised notice effective for all PHI we already maintain, as well as any PHI we receive in the future. If we make material changes, we will:

• Post the revised notice on our website with a new effective date.
• Make the revised notice available upon request.
• Notify our laboratory customers of the change by email.

You may obtain a copy of the current notice at any time by visiting this page or contacting us at hipaa@atlagene.com.

Contact Information