Privacy Policy

1. Introduction

Houya, Co., operator of the Atlagene service ("Atlagene," "we," "us," or "our"), is committed to protecting your privacy. Atlagene provides genomic analysis and reporting services to diagnostic laboratories. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information, genetic data, and health information in connection with our website, the Atlagene Lab Portal, and related services (collectively, the "Services").

Atlagene does not offer consumer services: individuals cannot create accounts with us or upload their own genetic data. This Privacy Policy therefore covers three groups of people: visitors to our website; staff whom a laboratory customer has authorized to use the Lab Portal; and patients whose genomic data a laboratory sends to us for analysis. We process patient data on the laboratory's behalf under our agreement with that laboratory. The laboratory remains responsible for obtaining patient consent and for the clinical use of results.

By using our website or the Lab Portal, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with these practices, please do not use our Services.

This Privacy Policy should be read in conjunction with our Terms of Service and HIPAA Notice.

2. Information We Collect

We collect information in several categories to provide, maintain, and improve our Services.

2.1 Laboratory Account Information

When a laboratory account is set up, we collect the laboratory's name, address, and business contact details. For each person the laboratory authorizes to use the Lab Portal, we collect their full name, the phone number to which we send one-time sign-in codes, their email address if provided, and their role in the account. To invoice a laboratory, we use its name, billing email address, and the number of tests performed. We also keep records of sign-in activity and of access to patient data (see Section 8).

2.2 Patient Genomic Data Processed for Laboratories

Laboratories upload their patients' genotype or sequencing files (for example, genotyping-array exports or VCF files) through the Lab Portal, each labelled with a patient identifier that the laboratory assigns. Through our analysis pipeline, we derive variant data, polygenic risk scores, carrier status assessments, pharmacogenomic profiles, and other findings across 21 analysis categories, and we produce a laboratory-branded PDF report. Raw genome files are stored in Amazon S3 with server-side encryption (AES-256), and derived genetic data is kept in a database separate from personally identifiable information. We process this data on the laboratory's behalf, as described in Section 3 and in our agreement with each laboratory.

2.3 Contact Enquiries

If you contact us, for example by email, we receive the information you choose to send, such as your name, email address, and message, and we use it to respond to you. Please do not include patient names, raw genetic data, or medical records in an enquiry.

2.4 Device and Technical Information

We automatically collect certain technical information when you visit our website or use the Lab Portal, including device type and model, operating system and version, browser type and version, IP address, unique device identifiers, screen resolution, language preferences, referring URLs, and general geographic location (city/state level, derived from IP address). We do not collect precise geolocation data.

2.5 Cookies and Tracking Technologies

We use only strictly necessary cookies, for sign-in sessions and security. The Lab Portal cannot sign you in without them.

We do not use analytics or advertising cookies, and neither the website nor the Lab Portal loads any analytics or advertising script, so no page URL describing a patient's results is ever sent to an analytics or advertising provider. You can clear or block cookies through your browser settings.

3. How We Use Information

We use the information we collect for the following purposes, each supported by one or more legal bases:

• Laboratory Analysis and Reports — To process patient genomic data that a laboratory uploads through our analysis pipeline across 21 analysis categories, and to produce that laboratory's reports. We do this on the laboratory's behalf. (Legal basis: our agreement with the laboratory. The laboratory is responsible for the legal basis for the processing and for any patient consent it requires.)
• Laboratory Accounts and Sign-In — To set up and administer laboratory accounts, verify authorized users with one-time sign-in codes, keep accounts secure, and communicate with laboratories about their accounts and the Services. (Legal basis: performance of contract; legitimate interest in keeping accounts secure.)
• Billing — To invoice laboratories, which pay per test. (Legal basis: performance of contract.)
• Website and Enquiries — To operate our website, remember your cookie choice, and respond to enquiries. (Legal basis: legitimate interest.)
• Service Improvement — To improve the accuracy of our analysis algorithms and the Services. We use aggregated and de-identified data for this purpose whenever possible, and we use patient data only as permitted by our agreement with the laboratory that submitted it. (Legal basis: legitimate interest.)
• Legal Compliance — To comply with applicable laws, regulations, legal processes, or enforceable governmental requests, including, where they apply, Lebanese Law No. 81/2018, Law No. 625, and Penal Code Articles 579-581. (Legal basis: legal obligation.)
• Research — We will never use identifiable genetic data for research without the patient's separate written authorization. Any research use of de-identified genetic data (stripped of all identifiers per the HIPAA Safe Harbor method) derived from patient data is limited to what our agreement with the laboratory permits. (Legal basis: our agreement with the laboratory; the patient's separate authorization where required.)

4. Genetic Data Specific Disclosures

5. Data Sharing and Disclosure

We do not sell personal information or genetic data. We share information only in the following circumstances:

5.1 Laboratories

We make analysis results and reports available to the laboratory that submitted the patient data, and to that laboratory's authorized users, through the Lab Portal. The laboratory decides whether and how to share a report with the patient or the patient's healthcare providers.

5.2 Service Providers

The table below lists every third party that processes data on our behalf, and states our contractual position with each one individually rather than making a blanket assurance. Where a provider that could reach health data is not yet covered by a Business Associate Agreement, we say so, and we name the compensating control we rely on in the meantime — either keeping the feature that would send it that data switched off, or removing data before anything is sent.

5.3 Legal Process

We may disclose information if required by law, subpoena, court order, or other legal process, or if we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others. Where legally permitted, we will notify the affected laboratory or person of such requests before disclosure. We will challenge overly broad or legally questionable requests.

5.4 Business Transfers

If Atlagene is involved in a merger, acquisition, bankruptcy, or asset sale, information we hold may be transferred as part of that transaction. We will notify affected laboratories via email and/or prominent notice on our website of any change in ownership or uses of personal information, and of the choices available. The acquiring entity will be bound by the terms of this Privacy Policy with respect to any data collected prior to the transfer.

5.5 Aggregated and De-Identified Data

We may share aggregated, de-identified data that cannot reasonably be used to identify any individual. Such data may be used for scientific publications, industry benchmarking, or public health research. This data is stripped of all 18 HIPAA identifiers using the Safe Harbor method. Where such data is derived from patient data, we create and share it only as permitted by our agreement with the laboratory that submitted the data.

5.6 No Sale of Personal Information

We do not sell, rent, or lease personal information or genetic data to any third party for any purpose. We do not share personal information for cross-context behavioral advertising. This applies to all categories of personal information we collect, including genetic data, health data, and account information.

6. Your Rights

6.1 Website Visitors and Laboratory Users

Regardless of where you live, if you visit our website or use the Lab Portal, you have the right to:

• Access — Request a copy of the personal data we hold about you, delivered in a portable, machine-readable format.
• Delete — Request deletion of your personal data. Certain data may be retained as required by law (see Section 7).
• Correct — Request correction of inaccurate personal information.
• Withdraw Consent — Withdraw consent for any optional processing at any time without affecting the lawfulness of prior processing.
• Opt Out of Communications — Opt out of non-essential emails through the unsubscribe link in any non-essential email.

To exercise these rights, email privacy@atlagene.com.

6.2 Patients

If a laboratory sent us your genomic data, that laboratory is responsible for it and is your first point of contact. Please send requests to access, correct, or delete that data, or to withdraw consent, to the laboratory. You may also write to privacy@atlagene.com; because we process this data on the laboratory's behalf, we will work with the laboratory to respond, as set out in our agreement with it.

6.3 Lebanon Residents (Law No. 81/2018)

If you are in Lebanon, Law No. 81/2018 (Electronic Transactions and Personal Data), Articles 87-88, gives you the right to be told what personal data we hold and why, to obtain a copy of it, to have inaccurate data corrected, to object to processing, and to request erasure. To exercise any of these rights, email privacy@atlagene.com; we verify your identity first and respond within 30 days. If a laboratory sent us your data, Section 6.2 also applies. If you are not satisfied with our response, you may complain to the Lebanese Ministry of Public Health, which supervises the processing of health and genetic data under Article 97.

6.4 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected, the sources from which it was collected, the business or commercial purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete — You may request deletion of personal information we have collected, subject to certain exceptions (e.g., legal retention requirements).
• Right to Correct — You may request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing — We do not sell personal information or share it for cross-context behavioral advertising. However, you may still exercise this right by contacting us.
• Right to Limit Use of Sensitive Personal Information — Genetic data and health information are considered sensitive personal information under CPRA. We use this data only for the purposes disclosed in this Policy and as necessary to provide our Services.
• Non-Discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California rights, email privacy@atlagene.com with the subject line "CCPA Request." We will verify your identity before processing your request and respond within 45 days. If a laboratory sent us your data, we process it on that laboratory's behalf; please also see Section 6.2.

6.5 HIPAA Rights

To the extent your information is Protected Health Information (PHI) that a laboratory subject to HIPAA sent to us, you exercise your HIPAA rights — including the rights to access, amend, and receive an accounting of disclosures of your PHI — through that laboratory. Our HIPAA Notice describes how we handle PHI on a laboratory's behalf.

6.6 Genetic-Specific Protections

In Lebanon, Law No. 625 protects individuals against prejudice based on genotypic information. In the United States, the Genetic Information Nondiscrimination Act (GINA) and various state genetic privacy laws provide protections against genetic discrimination by health insurers and employers; GINA does not extend to life insurance, disability insurance, or long-term care insurance. In some states, such as Florida, genetic test results are the exclusive property of the person tested.

7. Data Retention Schedule

We retain different categories of data for different periods based on legal requirements, regulatory obligations, and service needs. For patient data processed for a laboratory, the periods below apply unless our agreement with that laboratory sets different periods:

When a laboratory account is closed, or a laboratory asks us to delete patient data, we will permanently delete the data or, where our agreement with the laboratory permits, de-identify it, according to the schedule above and that agreement. Data that must be retained for legal or regulatory purposes will be securely stored with restricted access and will not be used for any other purpose during the retention period.

8. Security

We implement administrative, physical, and technical safeguards to protect the information we hold. These include AES-256 server-side encryption for stored genome files, encryption in transit (TLS) at our network edge, isolated database architecture (genetic data stored separately from PII), role-based access controls, audit logging of PHI access, and multi-factor authentication available for account access.

For how we handle PHI on a laboratory's behalf, see our HIPAA Notice.

While we use commercially reasonable measures to protect information, no system is 100% secure. If you become aware of any unauthorized access to a Lab Portal account, please contact us immediately at security@atlagene.com.

9. Do Not Sell / Do Not Share

As required by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), we disclose the following:

• We do not sell personal information. We have not sold personal information in the preceding 12 months and have no plans to do so.
• We do not share personal information for cross-context behavioral advertising. We do not participate in ad networks or share your data with advertisers.
• Opt-out mechanism: Although we do not sell or share your information, you may submit a "Do Not Sell or Share My Personal Information" request by emailing privacy@atlagene.com. We will confirm receipt and process your request within 15 business days.

10. Where Your Data Is Processed

Laboratory account data, raw genome files, analysis results, and backups are stored and processed on Amazon Web Services infrastructure in Stockholm, Sweden (AWS region eu-north-1). Transactional email is sent through Amazon SES in the same account.

No AI model processes laboratory data: analysis results and report text come from reviewed variant definitions and fixed templates. Error monitoring (Sentry) may process diagnostic data in other countries.

A laboratory that sends us patient data is responsible for having a lawful basis, under the law that applies to it, for transferring that data to these locations, including any patient consent that law requires. We support these transfers with contractual commitments from each processor and with technical safeguards (AES-256 encryption of stored genome files, TLS in transit, and databases that keep genetic data apart from identifying information). Details are set out in the agreement with each laboratory.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes:

• Non-material changes (e.g., clarifications, formatting): We will update the "Last Updated" date at the top of this page. Your continued use of the Services after such changes constitutes acceptance.
• Material changes (e.g., new data sharing, new purposes for genetic data, changes to retention periods): We will provide at least 30 days' advance notice via email to our laboratory customers and a prominent notice on our website. Changes that affect how we process patient data on a laboratory's behalf will be made in accordance with our agreement with that laboratory.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Contact

If you have any questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

We will respond to all privacy-related inquiries within 30 days (or within the timeframe required by applicable law, if shorter).