Your privacy — what you need to know
We provide genetic testing and counselling, which means we handle some of your most sensitive information. This policy explains — in plain terms — what we collect, why, where it goes, and the rights you have over it.
Introduction
This privacy policy applies between you, the user of our website and services, and us, Genotype Health Pty Ltd (ABN 25 685 701 302). This privacy policy applies to our use of any and all data collected by us or provided by you in relation to your use of the website and the provision of our services to you.
We take our privacy obligations seriously and we’ve created this privacy policy to explain how we collect and treat your personal information. Personal information is that information which is identifiable as being about you.
Genotype Health remains responsible for the services provided to you, even where laboratory testing is performed by a third-party laboratory partner.
Laws and standards we comply with
We comply with:
- the Australian Privacy Principles established by the Privacy Act 1988 (Cth); and
- to the extent the European Union’s General Data Protection Regulation 2016/679 (‘GDPR’) applies to us and our use of your information, the GDPR
Types of personal information we collect
The personal information we collect may include the following:
- name;
- mailing or street address;
- email address;
- social media information;
- telephone number and other contact details;
- age;
- date of birth;
- payment information (payments are processed by our third-party payment providers, currently Nuvei and Wise, and we do not store your full card details);
- information about your business or personal circumstances;
- information in connection with client surveys, questionnaires and promotions;
- your device identity and type, I.P. address, geo-location information, page view statistics, advertising data and standard web log information;
- records of your conversations with Tara, our AI assistant;
- information about third parties, including the health history of your family members and, for couple tests, information about your partner; and
- any other information provided by you to us via this website or our online presence, or otherwise required by us or provided by you.
Sensitive health and genetic information
Because we provide genetic testing and genetic counselling services, we collect and handle health information and genetic information. Under the Privacy Act 1988 (Cth), health information and genetic information are classified as sensitive information. We will only collect this information where it is reasonably necessary to provide our services and with your consent, except where otherwise permitted by law. We provide proactive genetic screening tests. As part of this, we collect sensitive health and genetic information, including your family medical history, diagnoses and symptoms, genetic disease history, health history, and genetic test results. For some tests we also collect Medicare details.
Data storage and cross border disclosure
All personal information we hold is stored in Australia.. To provide our services, we may disclose your personal, sensitive, health and genetic information to one or more third-party laboratory partners approved by us from time to time, including Blueprint Genetics Oy (located in Finland), for the purpose of performing genetic analysis, processing samples and preparing laboratory reports.
These laboratory partners may store, process or retain your information in the jurisdictions in which they operate, including Finland and any other country in which they or their service providers maintain systems or operations. The privacy and data protection laws in those jurisdictions may differ from the laws of Australia and may not provide the same level of protection.
We take reasonable steps to ensure that any overseas recipient handles your information in a manner consistent with the Australian Privacy Principles, and we remain accountable for how our overseas laboratory partners handle your information. Our current laboratory partners’ privacy policies are available here:
Blueprint Genetics: https://www.blueprintgenetics.com/privacy/
Our laboratory partners retain the DNA extracted from your sample for 12 months and then dispose of it. If your order is cancelled, your sample is disposed of after 30 days. Our laboratory partners retain test data and related records in line with our instructions and their legal, regulatory, accreditation and quality assurance obligations. Genotype Health retains your health records, including reports and Tara transcripts, for at least 7 years from your last contact with us, and for longer where required by law.
Raw genetic data requests
Upon request, we may provide you with access to your raw genetic data where this is available to us. Where raw data is held by our laboratory partner, we will request it from the laboratory on your behalf.
Tara, our AI tools and research
We use proprietary AI tools as part of our services. Our AI assistant, Tara, answers questions about our tests, delivers pre-test educations, takes your consent to testing and collects your medical and family history. We also use a proprietary “Letter Writing Tool” to help convert laboratory reports into plainer language, to generate draft plain-English summaries for human review, and to suggest general clinical action-plan steps for positive results in line with relevant research.
These tools do not provide personalised medical advice, diagnosis or treatment and do not replace consultation with a qualified clinician or genetic counsellor. Informed consent is built into the Tara workflow, and you may obtain a refund if you decline consent after counselling.
Your conversations with Tara are recorded and stored securely in Australia. If you order a test, your Tara transcripts form part of your health record with us. Our clinical team reviews Tara transcripts manually when reviewing orders and preparing for your consultation and follow-up.
If our clinical team notices Tara giving incorrect information, or another issue with how Tara is performing, a description of the issue may be used to correct the error or improve Tara. Tara is not automatically trained on your conversations, and our developers do not review your personal, health or genetic information.
If you tick the optional box when you give consent, our laboratory partners may include your anonymised data in summary findings, scientific publications and DNA variant databases. This helps improve the understanding, diagnosis and treatment of genetic conditions and increases the representation of global majority populations in genetic research. No identifying information is included. You can leave the box unticked, or ask us at any time to exclude your data in future, and this will not affect your testing with us. Your data is never sold by Genotype Health or our laboratory partners.
We do not use your information in our own research studies unless you have separately agreed to take part. If we invite you to join a research study, we will give you information about that study and ask for your separate consent.
Automated decision-making
Some steps in our service use computer programs that use your personal information. No decision about whether you can be tested, about your results or about your care is made by a computer program alone. Every approval is made by a member of our team.
- Order review: Tara uses the information you give in your medical and family history form (including your own health history, the health history of your family members, the ages and causes of death of relatives, and the test you have ordered) to check your order against our clinical team’s eligibility rules. If a rule applies, Tara flags your order and the order is held until a member of our clinical team has reviewed it and decided whether it can proceed to the laboratory.
- Results letters: our Letter Writing Tool uses your laboratory report and the information in your patient record to draft your results letter and suggest general next steps. A genetic counsellor reviews, edits and approves every letter before it is released to you.
Sharing your results with your partner and healthcare providers
If you order a Lineova Couple test, results are provided in a merged report that includes each partner’s results. This means your genetic information, including your results, will be disclosed to your partner and may be disclosed to your partner’s healthcare provider. We explain this to you before you give consent.
If a doctor referred you to us, we may share your results and relevant information with your referring doctor.
How we collect personal information
We endeavour to ensure that information we collect is complete, accurate, accessible and not subject to unauthorised access.
We may collect personal information either directly from you, or from third parties, including where you:
- contact us through our website;
- chat with Tara or complete your medical and family history form;
- receive goods or services from us;
- communicate with us via email, telephone, SMS, social media applications (such as LinkedIn or Facebook) or otherwise;
- use our automated referral system or manual referral service;
- interact with our website, social applications, services, content and advertising; and
- invest in our business or enquire as to a potential purchase in our business.
We may also collect personal information from you when you use or access our website or our social media pages. This may be done through use of web analytics tools, ‘cookies’ or other similar tracking technologies that allow us to track and analyse your website usage. Cookies are small files that store information on your computer, mobile phone or other device and enable and allow the creator of the cookie to identify when you visit different websites. We may use advertising cookies on the general pages of our website, but not on our test pages, Tara, checkout or the patient portal. We do not share information about the tests you view or order, or about your health, with advertisers. Our Cookies Policy explains the cookies we use and how to manage them.
You can choose whether we use non-essential cookies through the cookie settings on our website, and you can also disable cookies in your web browser.
We may use Google Analytics to collect and process data, including when you use third party websites or apps. To find out more see How Google uses data when you use our partners’ sites or apps.
Use of your personal information
We collect and use personal information for the following purposes:
- to provide services or information to you;
- for record keeping and administrative purposes;
- to provide information about you to our contractors, employees, consultants, agents or other third parties for the purpose of providing services to you;
- to improve and optimise our service offering and customer experience;
- to comply with our legal obligations, resolve disputes or enforce our agreements with third parties;
- to send you marketing and promotional messages and other information that may be of interest to you and for the purpose of direct marketing (in accordance with the Spam Act 2003 (Cth)). In this regard, we may use email, SMS, social media or mail to send you direct marketing communications. You can opt out of receiving marketing materials from us by using the opt-out facility provided (e.g. an unsubscribe link);
- to send you administrative messages, reminders, notices, updates, security alerts, and other information requested by you; and
- to consider an application of employment from you.
We may disclose your personal information to cloud-providers, contractors and other third parties located inside or outside of Australia. If we do so, we will take reasonable steps to ensure that any overseas recipient deals with such personal information in a manner consistent with how we deal with it.
We’ve endeavoured to ensure that our use and collection of your data is clear and as transparent as possible, but in the interests of keeping this policy concise it’s not possible to list every circumstance in which we will use your data.
We may use third party service providers for disaster recovery services. To the extent necessary to receive those disaster recovery services, we will provide your data to that third party service provider.
We may also use third party service providers to audit the infrastructure and applications we use to store your data. To the extent necessary to receive those audit services, we will provide your data to that third party service provider.
Security
We take reasonable technical and organisational steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, having regard to the nature of the information we hold and the requirements of applicable privacy laws, including the Australian Privacy Principles and, where applicable, the GDPR. However, we cannot guarantee the security of your personal information.
Links
Our website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites and we suggest you review the privacy policies of those websites before using them.
Requesting access or correcting your personal information
If you wish to request access to the personal information we hold about you, please contact us using the contact details set out below including your name and contact details. We may need to verify your identity before providing you with your personal information. In some cases, we may be unable to provide you with access to all your personal information and where this occurs, we will explain why. We will deal with all requests for access to personal information within a reasonable timeframe.
Where you are a resident of the European Union and the GDPR applies to your personal information, you have the right to ask for ‘subject access request’ or ‘SAR’ being a copy of your personal data held by us. Where we do hold such data about you we will provide you with a copy of the data we hold about you. This will be in a commonly used machine-readable file where you request us to e-mail the information to you. We will also give you a description of the data, tell you why we are holding it and tell you who we could have disclosed it to.
If you think that any personal information we hold about you is inaccurate, please contact us using the contact details set out below and we will take reasonable steps to ensure that it is corrected. We will also stop processing data on your request where required by applicable law and you may request that we delete data held about you. Any deletion or erasure request is subject to any legal, regulatory, clinical, accounting or reporting obligations that require us to retain information, including applicable health record retention requirements.
We reserve the right to refuse to provide you with information that we hold about you, in certain circumstances set out in the Privacy Act 1988 (Cth).
Change of control
If there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal information and non-personal information contained in those databases. This information may be disclosed to a potential purchaser under an agreement to maintain confidentiality. We would seek to only disclose information in good faith and where required by any of the above circumstances.
Transfers outside the European Economic Area (‘EEA’)
Information that we collect in the EEA may from time to time be stored, processed in or transferred between parties located in countries outside of the EEA which may not have as stringent data protection laws as found in the EEA.
Some of our third party service providers may be also located outside the EEA. If we transfer your data outside the EEA in this way (where you are a resident of the European Union and the GDPR applies to your personal information) we will ensure that the third party provider we use is compliant with the GDPR and that your privacy continues to be protected as outlined in this privacy policy.
If Article 27 of the GDPR applies to us, we will appoint a representative within the European Union in accordance with the GDPR. Please contact us and we will let you know the representative’s contact details.
Information security management system
We maintain information security practices that are proportionate to the sensitivity of the personal information we hold and our obligations under applicable privacy laws.
Our security practices may include password protection, role-based access restrictions, secure system configuration, and the use of reputable service providers and internal processes designed to reduce the risk of unauthorised access, use or disclosure.
We review and update our security settings and procedures from time to time and will take any steps required by applicable law in response to an eligible data breach or other security incident.
Our CEO is responsible for approving, releasing and implementing changes to the system and the software or relevant configurations. Changes that could introduce vulnerabilities, new security risks or increase security risks in a gateway are always appropriately considered and documented before being implemented. The security of the system is audited regularly to ensure its integrity.
You will be given a unique URL which will be password protected and authorise your access to the software. You are uniquely identifiable and authenticated on each occasion that access is granted to the software. Our databases have strong user identification and authentication processes in place to ensure that only the necessary personnel can access the information we store.
Complaints
If you wish to complain about how we handle your personal information held by us, please contact us using the details set out below including your name and contact details. We will investigate your complaint promptly and respond to you within a reasonable time.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.
For data which is subject to the GDPR, you have the right to lodge a complaint with the local regulator in your jurisdiction in Europe if you do not feel we have adequately upheld your rights under GDPR.
Contact us
For further information about our privacy policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below:
Talk to our privacy team
Questions, access requests or complaints about how we handle your data — we’ll respond within a reasonable timeframe.
privacy@genotypehealth.com.auWe may change this privacy policy from time to time by posting an updated copy on our website and we encourage you to check our website regularly to ensure that you are aware of our most current privacy policy.
