MyHappyGenes Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy (“Consumer Health Policy”) explains how MyHappyGenes, Inc. (“MyHappyGenes®,” “Company,” “we,” “our,” or “us”) collects, uses, discloses, retains, and protects Consumer Health Data in connection with our website, mobile applications, genetic testing services, reports, and related products and services (collectively, the “Services”).

This Consumer Health Policy supplements our Privacy Policy. If there is any conflict between this Consumer Health Policy and our Privacy Policy regarding Consumer Health Data, this Consumer Health Policy governs to the extent required by applicable law.

Because several states have enacted laws governing Consumer Health Data—including Washington’s My Health My Data Act, Nevada Senate Bill 370, Connecticut law, and other similar laws that may become effective—MyHappyGenes® provides this Consumer Health Policy for all users as a baseline while recognizing that additional rights may apply depending upon your state of residence.

Nothing in this Consumer Health Policy alters the Company’s obligations under applicable federal or state law governing genetic information or protected health information.

This Consumer Health Policy applies to Consumer Health Data collected through the Services, whether provided directly by you, generated through your use of the Services, obtained from a laboratory performing genetic analysis on our behalf, or otherwise collected in connection with providing the Services.

This Consumer Health Policy applies only to Consumer Health Data as defined under applicable law. It does not replace or modify our Privacy Policy, Terms of Use and Disclaimers, Consent & Release (also referred to as the Practitioner Agreement), or any other agreement governing your use of the Services.

For purposes of this Consumer Health Policy, “Consumer Health Data” means information that identifies your past, present, or future physical or mental health status and that is linked or reasonably linkable to you, as defined under applicable Consumer Health Data laws.

Depending upon applicable law and the Services you use, Consumer Health Data may include:

• Genetic information, including genetic variants, genotypes, laboratory results, raw genetic data, and genetic reports;

• DNA samples and biological specimens submitted for analysis;

• Health history, symptoms, diagnoses, medications, allergies, dietary preferences, nutritional information, lifestyle information, wellness goals, and health questionnaires;

• Information regarding nutritional deficiencies, wellness characteristics, or other health-related traits generated through your reports;

• Information provided by your authorized healthcare or wellness practitioner;

• Information that may identify your health status, treatment decisions, or healthcare interactions; and

• Other information that constitutes Consumer Health Data under applicable law.

Consumer Health Data does not include information that has been de-identified or aggregated so that it can no longer reasonably be linked to an identifiable individual, except to the extent applicable law provides otherwise.

Depending on the Services you use and the information you choose to provide, MyHappyGenes® may collect the following categories of Consumer Health Data:

Genetic and Biological Information

• DNA samples or biological specimens submitted for testing;

• Raw genetic data, genotype information, chromosome locations, genetic variants, laboratory results, and genetic reports;

• Genetic traits, nutrigenomic information, and health or wellness characteristics inferred from your genetic data.

Technical Information

• Information concerning your use of the Services that may be associated with your health status, including account activity, report access, device identifiers, IP address, and similar information where such information constitutes Consumer Health Data under applicable law.

We collect only the Consumer Health Data reasonably necessary to provide the Services you request, comply with applicable law, improve the quality and security of the Services, or for other purposes described in this Consumer Health Policy and our Privacy Policy.

We may collect Consumer Health Data from the following sources:

• Directly from you when you create an account, complete questionnaires, upload genetic information, purchase Services, communicate with us, or otherwise use the Services;

• From biological samples or genetic material that you voluntarily submit for laboratory analysis;

• From independent laboratories that perform genetic analysis on our behalf;

• From service providers who assist us in providing, maintaining, securing, or supporting the Services; and

• Automatically through your interactions with the Services where permitted by applicable law.

We do not knowingly collect Consumer Health Data from third parties without your authorization except as permitted or required by applicable law.

We use Consumer Health Data solely for legitimate business purposes consistent with this Consumer Health Policy, our Privacy Policy, your consent, and applicable law. Depending on the Services you request, we may use Consumer Health Data to:

• Generate, deliver, maintain, and update your genetic and wellness reports;

• Provide educational information regarding genetic variants, nutrigenomics, wellness, and related scientific research;

• Create and administer your account;

• Authenticate your identity and protect the security of the Services;

• Process orders and communicate with you regarding your account or requested Services;

• Respond to customer service requests;

• Detect, investigate, and prevent fraud, unauthorized access, security incidents, or misuse of the Services;

• Comply with legal obligations or respond to lawful governmental requests;

• Improve, maintain, troubleshoot, and secure the Services; and

• Conduct internal quality assurance and performance evaluation.

We do not use Consumer Health Data for research or product development.

We do not use Consumer Health Data to make decisions regarding employment, insurance eligibility, credit, housing, lending, or other eligibility determinations.

We do not use Consumer Health Data for targeted advertising or cross-context behavioral advertising.

MyHappyGenes® does not sell Consumer Health Data.

We disclose Consumer Health Data only as described in this Consumer Health Policy, our Privacy Policy, with your consent, or as otherwise permitted or required by law.

Depending upon the Services you request, we may disclose Consumer Health Data to:

Service Providers. Companies that provide services on our behalf, including laboratories, cloud hosting providers, payment processors, customer support providers, data storage providers, security providers, and other vendors that assist us in operating the Services. These providers are contractually required to protect Consumer Health Data and may use it only to perform services for MyHappyGenes®.

Authorized Practitioners. Healthcare or wellness practitioners whom you authorize to review your reports or provide services to you.

Business Transactions. A successor entity in connection with a merger, acquisition, financing, reorganization, or sale of all or substantially all of our assets. In the event of a change of control or a sale of all or substantially all of our assets, we will notify you — for example, by email or through the Services — and give you the opportunity to delete your account and Consumer Health Data before it is transferred. Any successor will be required to honor the commitments in this Consumer Health Policy.

Legal Compliance. Government authorities, courts, regulators, or law enforcement agencies where disclosure is required by applicable law or reasonably necessary to protect the rights, safety, or property of MyHappyGenes®, our users, or others.

Except where expressly authorized by you or required by law, MyHappyGenes® does not disclose identifiable Consumer Health Data to third parties for their own marketing purposes.

Because genetic information is among the most sensitive categories of Consumer Health Data, MyHappyGenes® applies heightened protections to DNA samples, genetic information, laboratory results, and genetic reports.

We use genetic information only to provide the Services you request, maintain your account, generate updated reports, and for other purposes expressly described in this Consumer Health Policy or our Privacy Policy.

We do not use your genetic information or biological samples for research or product development.

We do not sell identifiable genetic information or biological samples.

Biological samples are retained only as long as reasonably necessary to provide the requested Services and are destroyed by our laboratory within 90 days of receipt, in accordance with our laboratory procedures and applicable law. Electronic genetic data may be retained to maintain your account, generate updated reports as scientific knowledge evolves, comply with legal obligations, resolve disputes, enforce our agreements, or until you request deletion, subject to applicable legal retention requirements.

Because genetic science, nutrigenomics, and the interpretation of genetic variants continue to evolve, updated reports generated through the Services may reflect changes in scientific knowledge that occur after your original report was prepared.

MyHappyGenes® collects, uses, and discloses Consumer Health Data only as permitted by applicable law and, where required, with your affirmative, voluntary consent. By requesting our Services, creating an account, submitting a DNA sample or genetic data, completing health questionnaires, or otherwise providing Consumer Health Data, you consent to our processing of such information as described in this Consumer Health Data Privacy Policy, our Privacy Policy, and any additional consent you provide.

You may withdraw your consent to the processing of Consumer Health Data at any time by contacting us or exercising any available account settings. Withdrawal of consent will not affect processing that occurred before the withdrawal became effective and may limit our ability to continue providing certain Services.

MyHappyGenes® does not sell Consumer Health Data.

We will not sell, license, rent, or otherwise disclose Consumer Health Data in exchange for monetary or other valuable consideration except with your separate authorization where required by applicable law or as otherwise permitted by law. If our practices change in the future, we will obtain any consent required by applicable law before engaging in such activities.

MyHappyGenes® does not use Consumer Health Data for targeted advertising or cross-context behavioral advertising.

We do not establish or use a geofence around healthcare facilities or other locations for the purpose of identifying consumers, collecting Consumer Health Data, or delivering advertisements based upon a consumer’s presence at or near such facilities.

Depending on your state of residence and applicable law—including, where applicable, Washington’s My Health My Data Act, Nevada consumer health privacy law, Connecticut law, and other substantially similar state laws—you may have one or more of the following rights with respect to your Consumer Health Data:

• Confirm whether we collect, use, disclose, or process Consumer Health Data relating to you;

• Access or obtain a copy of your Consumer Health Data;

• Request correction of inaccurate Consumer Health Data, where required by applicable law;

• Request deletion of your Consumer Health Data, subject to applicable legal exceptions;

• Withdraw any consent previously provided for the collection, use, or disclosure of your Consumer Health Data;

• Obtain information regarding the categories of Consumer Health Data collected, the sources from which it was collected, the purposes for processing, and the categories of third parties with whom it has been disclosed;

• Obtain, where required by applicable law, a list of third parties and affiliates with whom your Consumer Health Data has been shared;

• Appeal our denial of a privacy request in accordance with applicable law; and

• Exercise your rights without unlawful discrimination or retaliation for exercising your privacy rights.

Because privacy laws continue to evolve, the rights available to you may vary depending upon your state of residence and applicable law. MyHappyGenes® will honor the rights afforded to you under the laws that apply to your Consumer Health Data and will provide additional information upon request regarding the rights available in your jurisdiction.

You may exercise your Consumer Health Data rights by contacting MyHappyGenes® using the contact information provided at the end of this Policy.

To protect your privacy and security, we may request information reasonably necessary to verify your identity before fulfilling your request.

If we deny your request, in whole or in part, and applicable law provides an appeal process, you may submit a written appeal within thirty (30) days after receiving our decision. We will review your appeal and respond within the time required by applicable law. Where required, we will also provide information regarding any additional rights you may have to contact your state Attorney General or other regulatory authority.

Where permitted by applicable law, you may designate an authorized agent to submit a request on your behalf. We may require reasonable documentation demonstrating the agent’s authority to act for you and may also require you to verify your identity directly before fulfilling the request.

MyHappyGenes® maintains administrative, technical, and physical safeguards designed to protect Consumer Health Data against unauthorized access, acquisition, disclosure, alteration, or destruction. These safeguards include, as appropriate, encryption of sensitive information in transit and at rest, role-based access controls, authentication procedures, vendor oversight, employee training, and incident response procedures.

Your raw DNA data files are stored with Amazon Web Services (AWS), a leading cloud-infrastructure provider whose data centers maintain recognized industry security certifications and physical, network, and environmental controls. Consumer Health Data is encrypted in transit and at rest, and access is restricted to authorized personnel using multi-factor authentication. As described in this Consumer Health Policy, your data is stored under a coded barcode rather than your name, which provides an additional layer of protection.

Although we employ commercially reasonable safeguards, no method of electronic transmission or storage is completely secure. Accordingly, we cannot guarantee absolute security.

We retain Consumer Health Data only for as long as reasonably necessary to provide the Services requested, comply with legal obligations, resolve disputes, enforce our agreements, protect the security and integrity of the Services, and satisfy other legitimate business purposes.

Biological samples are retained only for the period necessary to complete the requested testing and are destroyed by our laboratory within 90 days of receipt, in accordance with our laboratory procedures and applicable law.

Electronic genetic data and reports may be retained to maintain your account, permit future report updates as scientific knowledge evolves, respond to your requests, and comply with applicable legal obligations unless you request deletion and applicable law requires or permits continued retention.

Where Consumer Health Data is no longer required, we will securely delete, de-identify, or otherwise dispose of such information in accordance with applicable law and our records retention practices.

Your genetic and other Consumer Health Data are stored under a coded barcode that is linked to your account. Because we are able to re-associate that information with you, it is pseudonymized — not de-identified — and it remains fully protected as Consumer Health Data under this Consumer Health Policy. The fact that our laboratory does not receive your identifying information does not remove these protections.

Separately, MyHappyGenes® may create or use genuinely de-identified or aggregated information derived from Consumer Health Data. We treat information as de-identified only where (i) it cannot reasonably be used to identify or be linked back to you; (ii) we maintain reasonable technical and organizational measures to prevent re-identification; (iii) we publicly commit to maintain and use the information only in de-identified form; and (iv) we contractually require any recipient to do the same. Only information meeting this standard is excluded from the definition of Consumer Health Data, and only to the extent applicable law allows.

Because genetic information carries an inherent risk of re-identification, we apply heightened protections to it even when it has been de-identified.

Certain reports generated through the Services may incorporate automated processing, computational analysis, or algorithms designed to organize and present genetic and wellness information based upon publicly available scientific literature.

These technologies are intended to support educational reporting and do not constitute medical diagnosis, treatment, or clinical decision-making. Any interpretation or recommendation provided by an independent healthcare or wellness practitioner reflects that practitioner’s independent professional judgment.

Because scientific understanding of genetics, nutrigenomics, and wellness continues to evolve, genetic interpretations, scientific conclusions, and educational content may change over time as new research becomes available. MyHappyGenes® may update reports or educational content to reflect advances in scientific knowledge but does not guarantee that any particular interpretation or scientific conclusion will remain unchanged indefinitely.

We may update this Consumer Health Data Privacy Policy from time to time to reflect changes in our practices, applicable law, or the Services. Material changes will be posted on our Website with an updated effective date and, where required by applicable law, we will provide additional notice or obtain your consent before applying material changes to previously collected Consumer Health Data.

Your genetic and health information is protected under this Consumer Health Data Privacy Policy and under state consumer-health-data and genetic-privacy laws — including Washington’s My Health My Data Act, Nevada Senate Bill 370, and Connecticut law — which in several respects provide protections that meet or exceed those of the federal HIPAA rules (for example, opt-in consent, restrictions on selling health data, and prohibitions on geofencing).

HIPAA generally applies to health plans, healthcare clearinghouses, and healthcare providers that conduct certain electronic transactions, together with their business associates. As a technology and educational platform that provides genetic wellness reports directly to consumers, MyHappyGenes® is not a healthcare provider, does not practice medicine, and — except where expressly stated or required by applicable law — does not act as a HIPAA-covered entity solely by providing the Services. This does not lessen our commitment to protecting your information; it means your information is governed by the framework described above rather than by HIPAA.

Certain independent healthcare providers, licensed practitioners, laboratories, or other professionals who use or access the Services may themselves be subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), state healthcare privacy laws, or professional confidentiality obligations. Those practitioners and entities are independently responsible for complying with the privacy and security laws applicable to their own practices and for providing any notices or obtaining any consents required by law.

This Consumer Health Data Privacy Policy governs MyHappyGenes®’ collection, use, disclosure, and protection of Consumer Health Data. It does not govern the privacy practices of independent practitioners, laboratories, healthcare providers, or other third parties, each of whom may maintain separate privacy policies and legal obligations governing the information they collect, use, or disclose.

Where Consumer Health Data is shared with an independent practitioner or laboratory at your direction or with your authorization, the collection, use, and disclosure of that information by the receiving party will be governed by that party’s own privacy practices and applicable law.

If you have questions regarding this Consumer Health Data Privacy Policy, regarding your rights under the consumer health privacy laws applicable to your state of residence, or wish to exercise your Consumer Health Data rights, please contact:

MyHappyGenes, Inc. — Attn: Privacy Officer
Stuart, Florida
Email: [email protected]   |   Phone: 678-771-5682

If applicable law provides additional rights to contact your state Attorney General or another regulatory authority following our response to your request, information regarding those rights will be provided as part of our response.