Privacy Policy

1. Introduction

Houya, Co., operator of the Atlagene service ("Atlagene," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information, genetic data, and health information when you access or use our genomic health analysis platform, including our website, mobile applications, Helix AI Assistant, and related services (collectively, the "Services").

By using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with these practices, please do not use our Services.

This Privacy Policy should be read in conjunction with our Terms of Service, HIPAA Notice of Privacy Practices, and GINA Notice.

2. Information We Collect

We collect information in several categories to provide, maintain, and improve our Services.

2.1 Account Information

When you create an account, we collect your full name, email address, date of birth, sex assigned at birth (used for genetic analysis accuracy), an optional phone number, and a password (which is cryptographically hashed using Argon2id and never stored in plaintext). We may also collect your mailing address if you order a DNA swab kit.

2.2 Genetic Data

We collect raw genome files that you upload (e.g., from 23andMe, AncestryDNA, Nebula Genomics, or standard VCF/gVCF format). Through our analysis pipeline, we derive variant data, polygenic risk scores, carrier status assessments, pharmacogenomic profiles, and other health insights across 20 health categories. Your raw genome data is stored encrypted (AES-256) and in a database that is physically isolated from your personally identifiable information.

2.3 Health and Blood Test Data

If you choose to upload blood test results, we collect the biomarker values, reference ranges, lab provider name, and test dates. Blood test data can be submitted via photo (processed through OCR), PDF upload, or manual entry. We use this data to cross-reference with your genetic profile to provide precision health insights and to adjust supplement recommendations based on actual measured levels.

2.4 Helix Conversations

When you interact with Helix, our AI assistant (powered by Claude), we collect the questions you ask, the responses generated, and metadata about the conversation (timestamps, topics covered). Your conversations are stored to provide continuity across sessions and to improve the quality and safety of Helix. Conversations are associated with your account and are processed by our AI provider (Anthropic) under contractual restrictions solely to generate responses; they are never sold. See Section 5 for the service providers we use.

2.5 Device and Technical Information

We automatically collect certain technical information when you use our Services, including device type and model, operating system and version, browser type and version, IP address, unique device identifiers, screen resolution, language preferences, referring URLs, and general geographic location (city/state level, derived from IP address). We do not collect precise geolocation data.

2.6 Cookies and Tracking Technologies

We use strictly necessary cookies for session management and authentication. We use analytics cookies (only with your consent) to understand how our Services are used and to identify areas for improvement. We do not use third-party advertising cookies or cross-site tracking pixels on authenticated pages. You can control cookie preferences through your browser settings.

2.7 Communication Records

We retain records of notifications we send to you across all channels we operate (in-app, email, and browser push), including delivery status, opt-in/opt-out records, and timestamps. We do not currently send SMS or WhatsApp messages.

3. How We Use Your Information

We use the information we collect for the following purposes, each supported by one or more legal bases:

• Genomic Analysis and Health Insights — To process your genetic data through our 21-category analysis pipeline, generate risk assessments, carrier status reports, pharmacogenomic profiles, and personalized health insights. (Legal basis: performance of contract; your explicit consent for genetic data processing.)
• Physician Review — When you request an optional physician review, to share the relevant flagged results with licensed physicians in our partner network. All results are shown to you immediately with disclaimers; physician review is optional. (Legal basis: performance of contract; compliance with applicable healthcare regulations.)
• Helix AI Assistant — To power personalized, context-aware responses grounded in your genetic data and blood test results. (Legal basis: performance of contract; your explicit consent.)
• Supplement Recommendations — To generate personalized supplement recommendations with priority scoring, dosage guidance, contraindication checks, and adjustments based on blood test feedback. (Legal basis: performance of contract.)
• Blood Test Cross-Referencing — To correlate your uploaded blood test results with your genetic profile to provide precision insights about how your genetics may influence your biomarker levels. (Legal basis: performance of contract; your explicit consent.)
• Notifications and Reminders — To send health reminders (supplement schedules, blood test retest timelines, checkup reminders) and service notifications (results ready, physician review complete) through your preferred channels. (Legal basis: your explicit consent; legitimate interest for service-critical notifications.)
• Service Improvement — To improve the accuracy of our analysis algorithms, enhance the user experience, and develop new features. We use aggregated and de-identified data for this purpose whenever possible. (Legal basis: legitimate interest.)
• Legal Compliance — To comply with applicable laws, regulations, legal processes, or enforceable governmental requests — for users in Lebanon, that means Law No. 81/2018, Law No. 625, Consumer Protection Law No. 659/2005, and Penal Code Articles 579-581. (Legal basis: legal obligation.)
• De-Identified Research — If you provide separate, explicit consent, we may use de-identified genetic data (stripped of all identifiers per HIPAA Safe Harbor method) for internal research to improve our analysis models. We will never conduct research on identifiable genetic data without your separate written authorization. (Legal basis: your separate, explicit consent.)

4. Genetic Data Specific Disclosures

5. Data Sharing and Disclosure

We do not sell your personal information or genetic data. We share information only in the following circumstances:

5.1 Physician Partners

All of your results are shown to you directly, including findings flagged as clinically significant. We share results with a physician only when you request a physician review; we do not route your results to a physician automatically, and no physician sees them before you do. When you do request a review, the reviewing physician receives only the minimum information necessary to conduct it. Physicians in our network are licensed practitioners bound by a written confidentiality and data processing agreement with Atlagene and by the professional secrecy obligations of the jurisdiction in which they are registered.

5.2 Service Providers

The table below lists every third party that processes your data on our behalf, and states our contractual position with each one individually rather than making a blanket assurance. Where a provider that could reach health data is not yet covered by a Business Associate Agreement, we say so, and we name the compensating control we rely on in the meantime — either keeping the feature that would send it your data switched off, or stripping health data before anything is sent.

We do not currently use an SMS provider or a mobile push provider. Browser push notifications, if you enable them, are delivered through your own browser vendor's push service with the message contents encrypted end-to-end.

5.3 Legal Process

We may disclose your information if required by law, subpoena, court order, or other legal process, or if we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others. Where legally permitted, we will notify you of such requests before disclosure. We will challenge overly broad or legally questionable requests.

5.4 Business Transfers

If Atlagene is involved in a merger, acquisition, bankruptcy, or asset sale, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website of any change in ownership or uses of your personal information, and your choices regarding your information. The acquiring entity will be bound by the terms of this Privacy Policy with respect to any data collected prior to the transfer.

5.5 Aggregated and De-Identified Data

We may share aggregated, de-identified data that cannot reasonably be used to identify any individual. Such data may be used for scientific publications, industry benchmarking, or public health research. This data is stripped of all 18 HIPAA identifiers using the Safe Harbor method.

5.6 No Sale of Personal Information

We do not sell, rent, or lease your personal information or genetic data to any third party for any purpose. We do not share your personal information for cross-context behavioral advertising. This applies to all categories of personal information we collect, including genetic data, health data, and account information.

6. Your Rights

6.1 General Rights (All Users)

Regardless of where you live, all Atlagene users have the right to:

• Access — Request a copy of all personal and genetic data we hold about you, delivered in a portable, machine-readable format.
• Delete — Request deletion of your account and all associated personal data. Genetic data will be permanently destroyed within 30 days. Certain data may be retained as required by law (see Data Retention Schedule below).
• Correct — Request correction of inaccurate personal information in your account.
• Portability — Download your raw genome file, analysis results, and blood test data in standard formats at any time from your account settings.
• Withdraw Consent — Withdraw consent for optional data processing (such as research use or non-essential notifications) at any time without affecting the lawfulness of prior processing.
• Opt Out of Communications — Opt out of non-essential notifications through your notification settings or the unsubscribe link in any non-essential email.

6.2 Lebanon Residents (Law No. 81/2018)

The Services are currently offered only in Lebanon, so this is the section that applies to you. Under Law No. 81/2018 (Electronic Transactions and Personal Data), Articles 87-88, you have the right to be told what personal data we hold and why, to obtain a copy of it, to have inaccurate data corrected, to object to processing, and to request erasure. Because genetic data is processed on the basis of your explicit consent, you may withdraw that consent at any time; withdrawal does not affect processing that already took place, but it ends our ability to provide the Services to you. Under Law No. 625 (Genetic Testing), your consent to genetic analysis is separate and equally revocable. To exercise any of these rights, email privacy@atlagene.com; we verify your identity first and respond within 30 days. If you are not satisfied with our response, you may complain to the Lebanese Ministry of Public Health, which supervises the processing of health and genetic data under Article 97.

6.3 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected, the sources from which it was collected, the business or commercial purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete — You may request deletion of personal information we have collected, subject to certain exceptions (e.g., legal retention requirements).
• Right to Correct — You may request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing — We do not sell personal information or share it for cross-context behavioral advertising. However, you may still exercise this right by contacting us.
• Right to Limit Use of Sensitive Personal Information — Genetic data and health information are considered sensitive personal information under CPRA. We use this data only for the purposes disclosed in this Policy and as necessary to provide our Services.
• Non-Discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California rights, email privacy@atlagene.com with the subject line "CCPA Request." We will verify your identity before processing your request and respond within 45 days.

6.4 HIPAA Rights

To the extent your information constitutes Protected Health Information (PHI) under HIPAA, you have additional rights as described in our HIPAA Notice of Privacy Practices. These include the right to access, amend, and receive an accounting of disclosures of your PHI.

6.5 Genetic-Specific Rights

In Lebanon, Law No. 625 protects you against prejudice based on genotypic information. In the United States, GINA and various state genetic privacy laws provide protections against genetic discrimination by health insurers and employers. See our GINA Notice for detailed information. Additionally, in states such as Florida, your genetic test results are your exclusive property, and we honor this right for all users regardless of state.

7. Data Retention Schedule

We retain different categories of data for different periods based on legal requirements, regulatory obligations, and service needs:

When you delete your account, we will permanently delete or de-identify your data according to the schedule above. Data that must be retained for legal or regulatory purposes will be securely stored with restricted access and will not be used for any other purpose during the retention period.

8. Security

We implement administrative, physical, and technical safeguards to protect your information. These include AES-256 encryption at rest, encryption in transit (TLS) at our network edge, isolated database architecture (genetic data stored separately from PII), role-based access controls, audit logging of PHI access, and multi-factor authentication available for account access.

For detailed information about our security practices and HIPAA compliance, please see our HIPAA Notice of Privacy Practices.

While we use commercially reasonable measures to protect your information, no system is 100% secure. If you become aware of any unauthorized access to your account, please contact us immediately at security@atlagene.com.

9. Children's Privacy

Our Services are intended for individuals who are at least 18 years of age. We do not knowingly collect personal information, genetic data, or health information from anyone under the age of 18. If we learn that we have collected information from a person under 18, we will promptly delete that information and any associated genetic data.

If you are a parent or guardian and believe that your child has provided us with personal information or genetic data, please contact us at privacy@atlagene.com so that we can take appropriate action.

10. Do Not Sell / Do Not Share

As required by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), we disclose the following:

• We do not sell personal information. We have not sold personal information in the preceding 12 months and have no plans to do so.
• We do not share personal information for cross-context behavioral advertising. We do not participate in ad networks or share your data with advertisers.
• Opt-out mechanism: Although we do not sell or share your information, you may submit a "Do Not Sell or Share My Personal Information" request by emailing privacy@atlagene.com or through the opt-out link in your account settings. We will confirm receipt and process your request within 15 business days.

11. Where Your Data Is Processed

Our Services are currently offered only to residents of Lebanon. Atlagene does not operate servers in Lebanon: your account data, raw genome files, analysis results, and backups are stored and processed on Amazon Web Services infrastructure in Stockholm, Sweden (AWS region eu-north-1). Transactional email is sent through Amazon SES in the same account.

AI-generated explanations of your results are produced by Anthropic's Claude models. Depending on how the Service is configured at the time of processing, those calls run either through AWS Bedrock in Ireland (eu-west-1), under the same AWS agreement as the rest of our infrastructure, or through Anthropic's own API, which processes in the United States. Section 5.2 sets out what is sent in each case. Error monitoring (Sentry) may also process diagnostic data outside Lebanon.

Lebanon is not covered by an adequacy decision, and neither Sweden, Ireland, nor the United States has been recognised by Lebanese authorities as offering equivalent protection. Our legal basis for these transfers is therefore your explicit, informed consent under Lebanese Law No. 81/2018, which you give at registration through the data-transfer consent, together with contractual commitments from each processor and technical safeguards (AES-256 encryption at rest, TLS in transit, and databases that isolate genetic data from identifying information). You may withdraw that consent at any time, though doing so means we can no longer provide the Services and will delete your data in accordance with Section 7.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes:

• Non-material changes (e.g., clarifications, formatting): We will update the "Last Updated" date at the top of this page. Your continued use of the Services after such changes constitutes acceptance.
• Material changes (e.g., new data sharing, new purposes for genetic data, changes to retention periods): We will provide at least 30 days' advance notice via email to the address associated with your account and a prominent notice on our website. For changes that affect how we use your genetic data, we will seek your affirmative consent before applying the changes to your existing data.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact

If you have any questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

We will respond to all privacy-related inquiries within 30 days (or within the timeframe required by applicable law, if shorter).