HIPAA Policy

3. How We Use and Disclose Information 

A. Treatment and consultations 

When HIPAA applies, we may use and disclose PHI to provide, coordinate, or manage your consultation and related health care. This may include reviewing your test report, preparing an interpretation, communicating with you, and, at your direction or as otherwise permitted by law, coordinating with a laboratory or another health care professional. 

B. Kit ordering, testing, and fulfillment 

We may disclose information needed to order, register, ship, process, and support a kit to the third-party laboratory, kit manufacturer, fulfillment provider, carrier, or other service provider involved in the service you requested. Genetic data or a biological sample will be transferred to a third party beyond service providers only with the separate express consent required by applicable law, unless a disclosure is otherwise required or expressly permitted by law. 

C. Payment 

When HIPAA applies, we may use and disclose PHI to bill and collect payment for covered services and to support payment activities. We may also provide transaction information to payment processors, accounting providers, or other vendors that help complete and document your purchase. We do not disclose genetic data to a health plan for payment unless the disclosure is permitted by applicable law and consistent with your instructions and consent. 

D. Health care and business operations 

When HIPAA applies, we may use and disclose PHI for lawful health care operations, such as quality assessment, training, credentialing, compliance, auditing, legal services, fraud prevention, security, and business management. We may use other personal information for corresponding business purposes that are reasonably necessary and proportionate to operate and improve the services. 

Vendors that handle PHI for us must enter into a HIPAA business associate agreement when required. Other service providers and contractors must be contractually limited to specified services and required to protect personal information as applicable. 

E. Communications about services 

We may contact you about orders, test status, consultations, privacy or security matters, and products or services that are part of your care or are reasonably related to the services you requested. Where required, we will obtain your consent before sending marketing communications. You may opt out of non-transactional marketing using the instructions in the communication or by contacting us. 

We will obtain your written HIPAA authorization for uses or disclosures of PHI for marketing when HIPAA requires one. We will obtain separate express consent before marketing to you based on your genetic data or facilitating marketing by a third party based on your purchase or use of a genetic testing product or service, as required by California law. 

F. Family, caregivers, and personal representatives 

With your agreement, at your direction, or when otherwise permitted by law, we may disclose relevant information to a family member, caregiver, personal representative, or another person involved in your care or payment. We verify authority as appropriate and limit the information disclosed to what is relevant. 

G. Legal, public-interest, and safety disclosures 

We may use or disclose information when permitted or required by applicable law, including for public health activities; health oversight; reports of abuse, neglect, or domestic violence; judicial or administrative proceedings; law enforcement; workers’ compensation; organ or tissue donation; coroners, medical examiners, or funeral directors; specialized government functions; or to avert a serious and imminent threat to health or safety. When HIPAA applies, we will meet the conditions and limits imposed by HIPAA. More protective genetic privacy laws may require your consent or a qualifying court order even when another rule would permit a disclosure. 

H. Research 

The DNA Company does not sell clients’ identifiable personal information, identifiable genetic data, or biological samples for research purposes. We will not use or disclose identifiable genetic data, identifiable health information, or a biological sample for research beyond the service you requested without obtaining any separate express consent or authorization required by applicable law or another legally valid basis. 

We may use genetic, phenotypic, health, demographic, and other information for research, scientific analysis, product development, validation, quality improvement, and related purposes when the information has been deidentified so that it does not reasonably identify you. Deidentified information may be analyzed individually or combined with deidentified information from other clients to identify patterns, associations, trends, or other research findings. 

We may also collaborate with qualified researchers, academic institutions, health care organizations, or other research partners using deidentified information, subject to applicable law and appropriate privacy and data-security safeguards. The DNA Company will not attempt to reidentify deidentified information, and we will require recipients not to attempt to reidentify you where required by law or agreement. 

Where applicable law requires notice, consent, authorization, or another legal basis for research involving deidentified genetic, health, phenotypic, demographic, or other information, The DNA Company will comply with those requirements. 

I. Sale and advertising 

The DNA Company does not sell clients’ identifiable personal information, identifiable genetic data, or biological samples. We do not disclose genetic data to an entity in its capacity as an employer or as a decision-maker or adviser concerning health, life, long-term-care, or disability insurance, except where a disclosure is expressly permitted by applicable law and all required conditions and consents are satisfied. 

We do not sell PHI. Most uses and disclosures of PHI for marketing, and any sale of PHI, require your written HIPAA authorization. If our general website practices constitute “sharing” of non-genetic personal information or targeted advertising under an applicable state privacy law, we will provide the required notice and opt-out mechanism. We will not use cross-context behavioral advertising technologies on pages or portals where genetic data or PHI is entered or displayed unless the practice has been specifically reviewed and is permitted by law. 

J. Other uses and disclosures 

Uses and disclosures of PHI not described in this Notice will be made only with your written authorization unless otherwise permitted by law. You may revoke an authorization in writing at any time. Revocation will not affect action already taken in reliance on the authorization.