Privacy Policy

Full Privacy Policy

This Privacy Policy applies to all services and websites owned and operated by CVMC Clinics And Surgicenter, Inc., including www.cvmcgenomics.com and any other websites, pages, features, or content we own or operate, and to your use of the CVMC Genomics platform and any related Services. Our Privacy Policy is designed to help you better understand how we collect, use, store, process, and transfer your information when using our Services.

Please carefully review this Privacy Policy and our Terms of Service. By using our Services, you acknowledge all of the policies and procedures described in the foregoing documents. If you do not agree with or you are not comfortable with any aspect of this Privacy Policy or our Terms of Service you should immediately discontinue use of our Services.

1. Key Definitions

1. Aggregate Information: information that has been combined with that of other users and analyzed or evaluated as a whole, such that no specific individual may be reasonably identified.

2. De-identified Information: information that has been stripped of your Registration Information (e.g., your name and contact information), Personal Information, and other identifying data such that you cannot reasonably be identified as an individual, also known as pseudonymized information.

3. Individual-level Information: information about a single individual's genotypes, diseases or other traits/characteristics, but which is not necessarily tied to Registration Information.

4. Personal Information: information that can be used to identify you, either alone or in combination with other information. CVMC Genomics collects and stores the following types of Personal Information:

a. Registration Information: information you provide about yourself when registering for and/or purchasing our Services (e.g. name, email, address, user ID and password, and payment information).

b. Genetic Information: information regarding your genotypes (i.e. the As, Ts, Cs, and Gs at particular locations in your genome), generated through processing of your Specimen Sample by CVMC Genomics or by its partners, contractors, successors, or assignees; or otherwise processed by and/or contributed to CVMC Genomics.

c. Self-Reported Information: information you provide directly to us, including your disease conditions, other health-related information, personal traits, ethnicity, family history, and other information that you enter into surveys, forms, or features while signed in to your CVMC Genomics account.

d. Sensitive Information: information about your health, Genetic Information, and certain Self-Reported Information such as racial and ethnic origin, sexual orientation, and political affiliation.

e. Bio-informatic Correlation or Genetic Analysis Report: information and analysis of your Genetic Information, or a bio-nformatic correlation between your Genetic Information and a disease condition or health-related information.

f. User Content: all information, data, text, software, music, audio, photographs, graphics, video, messages, or other materials - other than Genetic Information and Self-Reported Information-generated by users of CVMC Genomics Services and transmitted, whether publicly or privately, to or through CVMC Genomics.

g. Web-Behavior Information: information on how you use CVMC Genomics' Services collected through log files, cookies, web beacons, and similar technologies, (e.g., browser type, domains, page views).

2. Information we collect

a. Information you provide directly to us

i. Registration Information. When you purchase our Services or create a CVMC Genomics account, or when we extract, collect and send your Specimen Sample, or when you complete research surveys, post on our Forums or use other messaging features, and when you contact Customer Care, we collect Personal Information, such as your name, date of birth, billing and shipping address, payment information (e.g., credit card) and contact information (e.g. email, phone number and license number).

ii. Self-Reported Information. You have the option to provide us with additional information about yourself through surveys, forms, features and applications. For example, you may provide us with information about your personal traits (e.g., eye color, height), ethnicity, disease conditions (e.g. Type 2 Diabetes), other health-related information (e.g. pulse rate, cholesterol levels, visual acuity), and family history information (e.g. information similar to the foregoing about your family members). Before you disclose information about a family member, you should make sure you have permission from the family member to do so.

iii. User Content. Some of our Services allow you to create and post or upload content, such as data, text, software, music, audio, photographs, graphics, video, messages, or other materials that you create or provide to us through either a public or private transmission ("User Content"). For example, User Content includes any discussions, posts, or messages you send on CVMC Genomics' Forums.

iv. Blogs and Forums. Our website may offer publicly accessible blogs. Additionally, CVMC Genomics users may participate in our online Forums. You should be aware that any information you provide or post in these areas may be read, collected, and used by others who access them. To request that we remove or de-identify your Personal Information from our blog or Forums, contact us through Customer Care. Please note that whenever you post something publicly, it may sometimes be impossible to remove all instances of the posted information, for example, if someone has taken a screenshot of your posting. Please exercise caution before choosing to share Personal Information publicly on our blogs, Forums or in any other posting. You may be required to register with a third party application to post a comment. To learn how the third party application uses your information, please review the third party's Privacy Policy.

v. Social media features and widgets. Our Services include Social Media Features, such as the Facebook "Like" or "Share" button and widgets ("Features"). These Features may collect your IP address, which page you are visiting on our site, and may set a cookie to enable the Feature to function properly. They may also allow third-party social media services to provide us information about you, including your name, email address, and other contact information. The information we receive is dependent upon your privacy settings with the social network. Features are either hosted by a third-party or hosted directly on our site. Your interactions with these Features are governed by the Privacy Policies of the third party companies providing them. You should always review and, if necessary, adjust your privacy settings on third party websites and services before linking or connecting them to our website or Service.

vi. Third party services (e.g., social media). If you use a third party site, such as Facebook or Twitter, in connection with our Services to communicate with another person (e.g., to make or post referrals or to request that we communicate with another person), then in addition to that person's name and contact information, we may also collect other information (e.g., your profile picture, network, gender, username, user ID, age range, language, country, friends lists or followers) depending on your privacy settings on the third party site. We do not control the third party site's information practices, so please review the third party's Privacy Policy and your settings on the third party's site carefully.

vii. Referral information and sharing. There may be instances when you refer a person to CVMC Genomics or choose to ask us to share your CVMC Genomics results with another person. In these instances, CVMC Genomics may ask for that person's email address from you. We will use their email address solely, as applicable, to make the referral or to communicate your sharing request to them, and we will let your contact know that you requested the communication. By participating in a referral program or by choosing to share information with another person, you confirm that the person has given you consent for CVMC Genomics to communicate (e.g., via email) with him or her. The person you referred may contact us through Customer Care to request that we remove this information from our database. For more information on our referral program, see here.

viii. Gifts. If you provide us with Personal Information about others, or if others give us your information, for the purpose of ordering the Service as a gift, we will only use that information for the specific reason for which it was provided to us. Once a gift recipient registers for his or her Services and agrees to our Privacy Policy, our Terms of Service, and if applicable, certain Consent Documents, his or her Personal Information will be used in manners consistent with this Privacy Policy, and will not be shared with the purchaser, unless they independently choose to share their own Personal Information through the Services with the purchaser.

ix. Customer service. When you contact Customer Care or correspond with us about our Service, we collect information to: track and respond to your inquiry; investigate any breach of our Terms of Service, Privacy Policy or applicable laws or regulations; and analyze and improve our Services.

b. Information related to our genetic testing services

i. Specimen Sample and biobanking. To use our genetic testing services, you must purchase, or receive as a gift, a CVMC Genomics Genetic Service, create an online account and register as a patient, read, understand and accept the Informed Consents, Terms Of Service, and this Privacy Policy, allow CVMC Genomics or one of its partners, contractors, successors or assigns, to extract, collect and ship your Specimen Sample to our partner or contractor third party laboratories. These laboratories will extract your DNA from your Specimen Sample for analysis. Your Specimen Sample may be stored ("Biobanking") by CVMC Genomics or our partners, contractors, successors or assigns for future additional analyses that you may request, and after a period of time as provided for in the Terms of Service, your Specimen Sample and DNA are destroyed after the laboratory completes its work, subject to the laboratory's legal and regulatory requirements.

ii. Genetic Information. Information regarding your genotype (e.g. the As, Ts, Cs, and Gs at particular locations in your genome), your Genetic Information, is generated when we analyze and process your Specimen Sample, or when you otherwise contribute or access your Genetic Information through our Services. Genetic Information includes the CVMC Genomics Bio-informatic Correlation or Genetic Analysis Reports and results reported to you as part of our Services, and may be used for other purposes, as outlined in Section 3 below.

c. Web-Behavior Information collected through tracking technology (e.g. from cookies and similar technologies)

We and our third party service providers use cookies and similar technologies (such as web beacons, tags, scripts and device identifiers) to:

i. help us recognize you when you use our Services;

ii. customize and improve your experience;

iii. provide security;

iv. analyze usage of our Services (such as to analyze your interactions with the results, reports, and other features of the Service);

v. gather demographic information about our user base;

vi. offer our Services to you;

vii. monitor the success of marketing programs; and

viii. serve targeted advertising on our site and on other sites around the Internet.

d. If you reject cookies, you may still use our site, but your ability to use some features or areas of our site may be limited. For more information, including the types of cookies found on CVMC Genomics and how to control cookies, please read our Cookie Policy.
We may receive reports based on the use of these technologies from third party service providers as de-identified, Individual-level Information or as Aggregate Information (as described in section 4.c). We and our third party service providers do not use your Sensitive Information, such as Genetic Information and Self-Reported Information, for targeted advertising.

Google Analytics. Google Analytics is used to perform many of the tasks listed above. We use the User-ID feature of Google Analytics to combine behavioral information across devices and sessions (including authenticated and unauthenticated sessions). We have enabled the following Google Analytics Advertising features: Remarketing, Google Display Network Impression Reporting, Google Analytics Demographics and Interest Reporting, and DoubleClick Campaign Manager integration. We do not merge information collected through any Google advertising product with individual-level information collected elsewhere by our Service. Learn more about how Google collects and uses data here. To opt out of Google Analytics Advertising Features please use Google Ad Settings. To opt out of Google Analytics entirely please use this link.

e. Other Types of Information

We continuously work to enhance our Services with new products, applications and features that may result in the collection of new and different types of information. We will update our Privacy Policy and/or obtain your prior consent to new processing, as needed.

3. How we use your information

CVMC Genomics will use and share your Personal Information with third parties only in the ways that are described in this Privacy Policy.

a. To provide you with Services and analyze and improve our Services

We use the information described above in Section 2 to operate, provide, analyze and improve our Services. These activities may include, among other things, using your information in a manner consistent with this Privacy Policy to:

i. open your account, enable purchases and process payments, communicate with you, and implement your requests (e.g., referrals);

ii. enable and enhance your use of our website and mobile application(s), including authenticating your visits, providing personalized content and information, and tracking your usage of our Services;

iii. contact you about your account, and any relevant information about our Services (e.g. policy changes, security updates or issues, etc.);

iv. enforce our Terms of Service and other agreements;

v. monitor, detect, investigate and prevent prohibited or illegal behaviors on our Services, to combat spam and other security risks; and

vi. perform research & development activities, which may include, for example, conducting data analysis and research in order to develop new or improve existing products and services, and performing quality control activities.

b. To process, analyze and deliver your genetic testing results

As described above, to receive results through the Personal Genetic Service, you must create a CVMC Genomics account and register as a patient, read, understand and accept the Informed Consent/s, Terms Of Service, and this Privacy Policy, allow CVMC Genomics or one of its partners, contractors, successors or assigns, to extract, collect and ship your Specimen Sample to our partner or contractor third party laboratories your Sample Specimen, and submit your Specimen Sample to our partner or contracted third party laboratory, which processes and analyzes your sample to provide us with your raw Genetic Information, as well as Bio-informatic Correlation or Genetic Analysis Reports, dependent on the Service purchased. CVMC Genomics continuously works to improve the Services based on our research and product development, and genetic associations identified in scientific literature. If you are eligible to receive additional reports or updates in the future, you may be notified of or may directly access these updates.

c. To allow you to share your Personal Information for Research and Scientific Progress

When you become a customer of CVMC Genomics and by using its Services you participate in research and Scientific progress, and CVMC Genomics, its researchers, and its partners, contractors, successors and assignees can include your de-identified Genetic Information and Self-Reported Information in a large pool of customer data for analyses aimed at making scientific discoveries ("CVMC Genomics Research"). CVMC Genomics Research may be sponsored by, conducted on behalf of, or in collaboration with third parties, such as non-profit foundations, academic institutions or pharmaceutical companies. CVMC Genomics Research may study a specific group or population, identify potential areas or targets for therapeutics development, conduct or support the development of drugs, diagnostics or devices to diagnose, predict or treat medical or other health conditions, work with public, private and/or non-profit entities on genetic research initiatives, or otherwise create, commercialize, and apply this new knowledge to improve health care. CVMC Genomics Research uses Aggregate and/or Individual-level Genetic Information and Self-Reported Information as specified in the appropriate Consent Document(s), as explained in greater detail below.

Your De-identified Genetic and Self-Reported Information may be used for CVMC Genomics Research only if you have consented to this use by completing an Informed Consent Document. If you have completed the Scientific Research Consent Document:

i. Your Genetic Information and/or Self-Reported Information will be used for research purposes, but it will be de-identified and will not be linked to your Registration Information.

ii. CVMC Genomics may use individual-level Genetic Information and Self-Reported Information internally at CVMC Genomics for research purposes.

iii. CVMC Genomics may share summary statistics, which do not identify any particular individual or contain individual-level information, with our qualified research collaborators.

d. To provide customer support

When you contact Customer Care, we may use or request Personal Information, including Sensitive Information, as necessary to answer your questions, resolve disputes, and/or investigate and troubleshoot problems or complaints. In some instances, we may be required to process one customer's Personal Information to resolve another customer's dispute or request. For example, if a customer reports behavior that violates our Terms of Service, we will separately process both customers' Personal Information and respond separately to each individual as appropriate. We will not share your Personal Information with another customer without your consent.

e. To conduct surveys or polls, and obtain testimonials

We value your feedback and may send you surveys, polls, or requests for testimonials to improve and optimize our Services. You are in control of the information you would like to share with us. If you do not wish to receive these requests, you can manage them in your Account Settings

f. To provide you with marketing communications

By creating a CVMC Genomics account, you are agreeing that we may send you product and promotional emails or notifications about our Services, and offers on new products, services, promotions or contests. You can unsubscribe from receiving these marketing communications at any time. To unsubscribe, click the email footer "unsubscribe" link or go to the "Preferences" section of your Account Settings to edit your email notification preferences. You may not opt-out of receiving non-promotional messages regarding your account, such as technical notices, purchase confirmations, or Service-related emails.

4. Information we share with third parties

a. General service providers.

We share the information described above in Section 2 with our third party service providers, partners and contractors ("Service Providers") as necessary for them to provide their services to us and help us perform our contract with you. Service providers are third parties (other companies or individuals) that help us to provide, analyze and improve our Services. CVMC Genomics engages third party service providers to assist in supporting and allowing us to provide our Services, including in the following areas:

i. Payment Processing. Our payment processor processes certain Registration Information, such as your billing address and credit card information, as necessary to enable you to purchase a CVMC Genomics Services from the www.cvmcgenomics.com online store.

ii. Specimen Sample extraction, collection, preparation and packaging. Our Specimen Sample collection, extraction preparation and packaging partners provides licensed service to assist you in making sure that your Specimen Sample is properly extracted, collected, prepared and packaged prior to shipment so it can safely arrive to our third party laboratory for processing. They may require Personal Information in order to perform their contractual duties and identify your Specimen Sample prior to anonymization for sending.

iii. Shipping and Logistics. Your Specimen Sample is shipped by our logistics partners to ensure that they arrive safely and in a timely manner to our third party laboratory for processing. They may require Personal Information in order to perform their contractual duties.

iv. Our CLIA-certified genotyping lab. Once your Sample Specimen is delivered, receiving personnel at the laboratory remove and discard the packaging, logging in the receipt of the Sample Specimen, before testing personnel receive the samples for processing. Receiving personnel do not perform testing, and testing personnel handle Specimen Samples that are only identified by a unique barcode. When the laboratory has completed their analysis, they securely send the resulting Genetic Information and Bioinformatic Correlation or Genetic Analysis Reports to us through secure digital networks identified by your unique barcode.

v. Customer Care support. Our Customer Care team uses a number of tools to help organize and manage the requests we receive. These tools help to ensure we provide timely, high quality support.

vi. Cloud storage, IT, and Security. Our cloud storage providers provide secure storage for information in CVMC Genomics databases, ensure that our infrastructure can support continued use of our Services by CVMC Genomics customers, and protect data in the event of a natural disaster or other disruption to the Service. Our IT and security providers assist with intrusion detection and prevention measures to stop any potential attacks against our networks.

vii. Marketing and analytics. When you use our Services, including our website, our third party service providers may collect Web-Behavior Information about your visit, such as the links you clicked on, the duration of your visit, and the URLs you visited. This information can help us improve site navigability and assess our Marketing campaigns. Per applicable data protection regulations, we present visitors with a cookie opt in to allow the processing described above via Functionality and Advertising Cookies.

NOTE: Our service providers act on CVMC Genomics' behalf. We implement procedures and maintain contractual terms with each service provider to protect the confidentiality and security of your information. However, we cannot guarantee the confidentiality and security of your information due to the inherent risks associated with storing and transmitting data electronically.

b. "Targeted advertising" service providers

We permit third party advertising networks and providers to collect Web-Behavior Information regarding the use of our Services to help us to deliver targeted online advertisements ("ads") to you. They use cookies and similar technologies, to gather information about your browser's or device's visits and usage patterns on our Services and on other websites over time, which helps to better personalize ads to match your interests, and to measure the effectiveness of ad campaigns. For more information about our marketing practices, please review our Cookie Policy.

c. Aggregate information

We may share Aggregate Information, which is information that has been stripped of your name and contact information and combined with information of others so that you cannot reasonably be identified as an individual, with third parties. This Information is different from "Individual-level" information and is not Personal Information because it does not identify any particular individual or disclose any particular individual's data. In contrast, Individual-level Genetic Information or Self-Reported Information consists of data about a single individual's genotypes, diseases or other traits/characteristics information and could reveal whether a specific user has a particular genetic trait, or consist of all of the Genetic Information about that user. CVMC Genomics will always ask for your informed and explicit consent to share Individual-level Genetic Information or Self-Reported Information with any third party, other than within CVMC Genomics and our service providers as necessary for us to provide the Services to you, and as indicated in this Privacy Policy, and in the Consent Documents you agree to.

d. Information we share with commonly owned entities

We may share some or all of your Personal Information with other companies under common ownership or control of CVMC Genomics, which may include our subsidiaries, our corporate parent, or any other subsidiaries owned by our corporate parent in order to provide you better service and improve user experience. Generally, sharing such information is necessary for us to perform on our contract with you. We may provide additional notice and ask for your prior consent if we wish to share your Personal Information with our commonly owned entities in a materially different way than discussed in this Privacy Policy.

e. As required by law

Under certain circumstances your Personal Information may be subject to processing pursuant to laws, regulations, judicial or other government subpoenas, warrants, or orders. For example, we may be required to disclose Personal Information in coordination with regulatory authorities in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. CVMC Genomics will preserve and disclose any and all information to law enforcement agencies or others if required to do so by law or in the good faith belief that such preservation or disclosure is reasonably necessary to: (a) comply with legal or regulatory process (such as a judicial proceeding, court order, or government inquiry) or obligations that CVMC Genomics may owe pursuant to ethical and other professional rules, laws, and regulations; (b) enforce the CVMC Genomics Terms of Service and other policies; (c) respond to claims that any content violates the rights of third parties; or (d) protect the rights, property, or personal safety of CVMC Genomics, its employees, its users, its clients, and the public.

f. Business transactions

In the event that CVMC Genomics goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets your Personal Information will likely be among the assets transferred. In such a case, your information would remain subject to the promises made in any pre-existing Privacy Policy.

5. Your choices

a. Access to your account

We provide access to your CVMC Genomics data within your CVMC Genomics account. You can access and download data processed by CVMC Genomics within your Account Settings and within applicable Reports, Tools, and features. If you lose access to your CVMC Genomics account or account email address, please contact Customer Care for assistance. If you lose access to your CVMC Genomics account, in certain circumstances, we may require that you submit additional information sufficient to verify your identity before providing access or otherwise releasing information to you. If you choose not to submit the required documentation, or the information provided is not sufficient for the purposes sought, CVMC Genomics will not be able to sufficiently verify your identity in order to complete your request.

You may access, correct or update most of your Registration Information on your own within your Account Settings. You may be able to correct Self-Reported Information entered into a survey, form, or feature within your account, such as on the surveys page, by clicking "Edit your answers here." Please note that you may not be able to delete User Content that has been shared with others through the Service and that you may not be able to delete information that has been shared with third parties.

b. Marketing communications

As noted in Section 3 you may be asked to opt-in to receive product and promotional emails or notifications when creating your CVMC Genomics account depending on where you are located. Otherwise, you may view or update your email notification preferences by contacting our Privacy Administrator at [email protected]. You can also click the "unsubscribe" button at the bottom of promotional email communications.

c. Sharing outside of the CVMC Genomics Services

You may decide to share your Personal Information with friends and/or family members, doctors or other health care professionals, and/or other individuals outside of our Services, including through third party services such as social networks and third party apps that connect to our website and mobile apps through our application programming interface ("API"). These third parties may use your Personal Information differently than we do under this Privacy Policy. Please make such choices carefully and review the Privacy Policys of all other third parties involved in the transaction. CVMC Genomics does not endorse or sponsor any API applications, and does not affirm the accuracy or validity of any interpretations made by third party API applications.

In general, it can be difficult to contain or retrieve Personal Information once it has been shared or disclosed. CVMC Genomics will have no responsibility or liability for any consequences that may result because you have released or shared Personal Information with others. Likewise, if you are reading this because you have access to the Personal Information of a CVMC Genomics customer through a multi-profile account, we urge you to recognize your responsibility to protect the privacy of each person within that account.

d. Account deletion

If you no longer wish to participate in our Services, or no longer wish to have your Personal Information be processed, you may delete your CVMC Genomics account and Personal Information within your Account Settings. Once you submit your request, we will send an email to the email address linked to your CVMC Genomics account detailing our account deletion policy and requesting that you to confirm your deletion request. Once you confirm your request to delete your account and data, your account will no longer be accessible while we process your request. Once you confirm your request, this process cannot be cancelled, undone, withdrawn, or reversed. When your account is deleted, all associated Personal Information is deleted and any stored samples are discarded, subject to the following limitations:

i. Information previously included in CVMC Genomics Research. As stated in any applicable Consent Document, Genetic Information and/or Self-Reported Information that you have previously provided and for which you have given consent to use in CVMC Genomics Research cannot be removed from completed studies that use that information, and your de-identified data may still be, used in future CVMC Genomics Research.

ii. Legal Retention Requirements. CVMC Genomics and our third party genotyping laboratory will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations, including the federal Clinical Laboratory Improvement Amendments of 1988 (CLIA) and CA Business and Professional Code Section 1265 and CAP accreditation requirements. CVMC Genomics will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, and record of legal agreements for a limited period of time as required by contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes.

6. Security measures

CVMC Genomics takes serious care of the trust you place in us. CVMC Genomics implements physical, technical, and administrative measures to prevent unauthorized access to or disclosure of your information, to maintain data accuracy, to ensure the appropriate use of information, and otherwise safeguard your Personal Information.

• CVMC Genomics produces secure applications by design. CVMC Genomics incorporates explicit security reviews in the software development lifecycle, quality assurance testing and operational deployment.

• De-identification/Pseudonymization. Registration Information is stripped from Sensitive Information, including Genetic and Self-Reported Information. This data is then assigned a randomly generated ID so an individual cannot reasonably be identified.

• Encryption. CVMC Genomics uses industry standard security measures to encrypt Sensitive Information both at rest and in transit.

• Separation of Environments. CVMC Genomics ensures processing, production, and research environments are separated and access is restricted. Data, including Registration Information, Genetic Information, and Self-Reported Information are segmented across logical database systems to further prevent re-identifiability.

• Limiting access to essential personnel. We limit access to Personal Information to authorized personnel, based on job function and role. CVMC Genomics access controls include multi-factor authentication, single sign-on, and strict least-privileged authorization policy.

• Detecting threats and managing vulnerabilities. CVMC Genomics uses digital technology for intrusion detection and prevention measures to stop any potential attacks against its networks.

• Incident Management. CVMC Genomics maintains a formal incident management program designed to ensure the secure, continuous delivery of its Services, and complies with the data breach reporting standards required under the Data Privacy Act of 2012 (RA 10173). CVMC Genomics has also implemented an incident management program using industry best practices.

• Managing third party service providers. CVMC Genomics requires service providers to implement and maintain accepted industry standard administrative, physical and technical safeguards to protect Personal Information.

Your Responsibility. Please recognize that protecting your Personal Information is also your responsibility. We ask you to be responsible for safeguarding your password, secret questions and answers, and other authentication information you use to access our Services. You should not disclose your authentication information to any third party and should immediately notify CVMC Genomics of any unauthorized use of your password. CVMC Genomics cannot secure Personal Information that you release on your own or that you request us to release.

Your information collected through the Service may be stored and processed in the Philippines, United States or any other country in which CVMC Genomics or its partners, contractors subsidiaries, affiliates or service providers maintain facilities and, therefore, your information may be subject to the laws of those other jurisdictions which may be different from the laws of your country of residence.

7. Children's privacy

CVMC Genomics is committed to protecting the privacy of children as well as adults. Neither CVMC Genomics nor any of its Services are designed for, intended to attract, or directed toward children under the age of 18. A parent or guardian, however, may collect a Specimen Sample from, create an account for, and provide information related to, his or her child who is under the age of 18. The parent or guardian assumes full responsibility for ensuring that the information that he/she provides to CVMC Genomics about his or her child is kept secure and that the information submitted is accurate.

8. Linked websites

CVMC Genomics provides links to third party websites operated by organizations not affiliated with CVMC Genomics. CVMC Genomics does not disclose your information to organizations operating such linked third party websites. CVMC Genomics does not review or endorse, and is not responsible for the privacy practices of these organizations. We encourage you to read the Privacy Policies of each and every website that you visit. This Privacy Policy applies solely to information collected by CVMC Genomics and our service providers on our behalf.

9. Information on Data Privacy Rights under the Data Privacy Act of 2012 (RA 10173)

a. Our relationship with you

We are the "controller" with respect to your Personal Information because we determine the means and purposes of processing your information when using our Services.

b. Legal bases for processing Personal Information from the Philippines

We describe how we process your Personal Information in Sections 2 through 4 of this Privacy Policy. We may process your Personal Information if you consent to the processing, to satisfy our legal obligations, if it is necessary to carry out our obligations arising from any contracts we entered with you or to take steps at your request prior to entering into a contract with you, or for our legitimate interests to protect our property, rights or safety of CVMC Genomics, our customers or others.

c. Direct Marketing

We will obtain your consent where required to send you marketing communications using electronic means. You may withdraw your consent at any time by notifying us through our contact information and Customer Care. We will only contact you by electronic means (email, push notification, SMS, etc.) with information about our Services that are similar to those which were the subject of a previous sale or negotiations of a sale to you.

We will only share your Personal Information with third parties for marketing purposes with your explicit consent. If you do not want us to use your Personal Information in this way, please contact us through Customer Care. You may raise such objection with regard to initial or further processing for purposes of direct marketing at any time and free of charge. The withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal.

Other marketing activities will happen based on the legitimate interests of CVMC Genomics. E.g., where we tailor marketing communications or send targeted marketing messages via post, phone or social media and other third party platforms; and in providing existing customers with information (via email or other channels) about similar products and services.

d. Privacy Rights

You can exercise your privacy rights by following the instructions below or contacting us at [email protected]. We will handle your request under applicable law. When you make a request, we may verify your identity to protect your privacy and security.

• Right to withdraw consent. To the extent CVMC Genomics requests and you provide your consent to the processing of your Personal Information, you can withdraw your consent at any time. Your withdrawal will not affect the lawfulness of our processing based on consent before your withdrawal.

• Right of access to and rectification of your Personal Information. Our site allows you to access and rectify certain Registration Information within your Account Settings, and your Self-Reported Information by going to the surveys page. If you would like to access or rectify any other information, contact Customer Care and we will do our best to assist you without undue delay. We may reject part or all of your request if responding to your request could adversely affect the rights and freedoms of others.

• Right to erasure (or, "Right to be Forgotten"). As explained under Section 5 ("Account Deletion"), we allow our customers to delete their accounts at any time. You can request erasure of Personal Information that: (a) is no longer necessary in relation to the purposes for which it was collected or otherwise processed; (b) was collected in relation to processing to which you previously consented, but later withdrew such consent; or (c) was collected in relation to processing activities to which you object, and there are no overriding legitimate grounds for our processing. If we have made your Personal Information public and we are required to erase such Personal Information, we will take reasonable steps, including technical measures, to inform controllers that are processing any links to or copies or replications of your Personal Information of your erasure request. Our assistance with your request for erasure is subject to limitations by relevant data protection laws, available technology and the cost of implementation.

• Right to data portability. If we process your Personal Information based on a contract with you or based on your consent, or the processing is carried out by automated means, you may request to receive your Personal Information in a structured, commonly used and machine-readable format, and to have us transfer your Personal Information directly to another controller, where technically feasible, unless exercise of this right adversely affects the rights and freedoms of others. A "controller" is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of your Personal Information.

• Right to restriction of our processing. You can restrict our processing of your Personal Information where one of the following applies: (a) you dispute the accuracy of Personal Information processed by CVMC Genomics (for a period enabling us to verify its accuracy); (b) the processing is unlawful and you oppose the erasure of the Personal Information and request the restriction of its use instead; (c) CVMC Genomics no longer needs the Personal Information for the purposes of the processing, but it is required by you for the establishment, exercise or defense of legal claims; and (d) you have objected to certain processing relying on legitimate interest, pending the verification whether CVMC Genomics' legitimate grounds override your rights. Restricted Personal Information shall only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. We will notify you if the restriction is lifted.

• Notification of erasure, rectification and restriction. We will provide notice to each recipient that we disclosed your Personal Information to regarding any rectification or erasure of Personal Information or restriction of processing, unless you initiated the disclosure, we have previously made a statement that we will not provide prior notice, or providing notice proves impossible or involves disproportionate effort. Upon your request, we will share the list of recipients with you.

• Right to object to processing. Where the processing of your Personal Information is based on consent, contract, or legitimate interests described under the Legal Bases for Processing heading above, you may restrict or object, at any time, to the processing of your Personal Information as permitted by applicable law. We may continue to process your Personal Information if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law.

• Automated individual decision-making, including profiling. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you, except as allowed under applicable data protection laws.

• Retention of your Personal Information. Unless you make a request for us to delete your account or delete certain Personal Information (i.e., User Content, etc.), or unless we have indicated and previously agreed to a different data retention period, we will store your Personal Information as long as your account is open. If you request to delete your account, we will take the steps described under "Your Choices – Account Deletion" and delete all your Personal Information, unless a longer retention period is required or permitted by law.

e. The rights described above may be limited by local laws depending on the applicable jurisdiction. Further, your right of access and deletion is not absolute and may not be available if fulfillment of such right would, among other things:

• cause interference with execution and enforcement of the law and legal private rights (such as in the case of the investigation or detection of legal claims or the right to a fair trial);

• breach or prejudice the rights of confidentiality and security of others;

• prejudice security or grievance investigations, corporate reorganizations, future and ongoing negotiations with third parties, the compliance with regulatory requirements relating to economic and financial management; or

• otherwise violate the interests of others or where the burden or cost of providing access would be disproportionate.

f. Complaints

If you believe that we have infringed your rights, we encourage you to contact us so that we can try to address your concerns or dispute informally. Our contact information is:

Atty. Neil Energyte G. Baldonado
Chief Legal Officer
Benitez Salem Baldonado Law
3rd and 5th Floors, GC Corporate Plaza, 150 Legaspi St., Legaspi Village, Makati City, Philippines
[email protected]

10. Changes to this Privacy Policy

Whenever this Privacy Policy is changed in a material way, a notice will be posted as part of this Privacy Policy and on our website for 30 days. After 30 days the changes will become effective. In addition, all customers will receive an email with notification of the changes prior to the change becoming effective. CVMC Genomics may provide additional "just-in-time" disclosures or additional information about the data collection, use and sharing practices of specific Services. Such notices may supplement or clarify CVMC Genomics' privacy practices or may provide you with additional choices about how CVMC Genomics processes your Personal Information.

11. Contact Information

If you have questions about this Privacy Policy, or wish to submit a complaint, please email CVMC Genomics at [email protected].