Privacy Notice

This summary outlines the latest updates to this Notice:

• This Notice has been updated to reflect changes in Helix’s services and product offerings. Helix no longer operates the Helix store and does not currently offer direct-to-consumer DNA Products. If you previously purchased a product from Helix or its DNA Product Partners through the Helix store, your existing data will continue to be governed by the Privacy Notice in effect at the time your data was collected.
• This Notice has been updated to provide more specific and streamlined language to help you understand our practices. It has also been updated with more detailed descriptions of how we collect and use data, in accordance with the requirements of applicable law.

This Privacy Notice does not apply to our processing of:

• Protected Health Information (“PHI”), which is governed by the Health Insurance Portability and Accountability Act (“HIPAA”). For information about how we collect, use, and disclose your PHI, please refer to our Notice of Privacy Practices.
• Information that we process through the Helix Hosted Consent Platform in connection with your enrollment or participation in the Helix Research Network.
• Information in connection with your use of our genetic testing products and services subject to separate testing arrangements, consents or authorizations (“Service Specific Agreements”). Please refer to those Service Specific Agreements for more information on our processing of your information in connection with your use of our genetic testing products and services.
• Consumer health data, which is subject to a separate notice where required under applicable law. For information regarding our processing of your consumer health data under such laws, please refer to our Consumer Heath Data Privacy Policy.

The information we collect depends on how you interact with us, the Services you use, and the choices you make. We may collect information from different sources and in various ways when you use our Services, including collecting information from you directly, through automatic means, and from third-party data sources.

Information You Provide To Us Directly

Depending on your interaction with us, we may collect the following categories of information directly from you:

• Identifiers, such as your name, email address, date of birth, mailing address, telephone number, and other similar identifiers. For example, we may collect identifiers directly from you when you register with Helix, create a user account to access our Services, or apply for a job.
• Demographic Information, such as your age, sex assigned at birth, and similar demographic details.
• Audio, electronic, visual, or similar information, such as voice recordings collected when you contact us by phone.
• Commercial Information, such as records of genetics testing products and services that you obtain or consider through your use of our Services, as well as records relating to your Service usage history.
• Professional or employment-related information, such as your employment history, practice affiliation and field of medical expertise, National Provider Identifier (NPI) and medical license numbers, education history, and other professional or job-related information. For example, we may collect certain professional or employment-related information when you register for Helix’s provider portal.
• Financial Information, such as your income and other financial information. For example, we may collect financial information from you to determine your eligibility to participate in one of our financial assistance programs.
• Sensitive Data, as defined under applicable law, such as certain characteristics of protected classifications, account login credentials and passwords, genetic information, and information regarding your health.

We may also collect information that you choose to voluntarily provide to us, including when you engage with us through your Helix account, as part of your participation in a research program, when you contact us or complete a survey, or through other means.

Information Collected Automatically

We, and our third-party business partners, may automatically collect the following categories of information as you interact with our Site and Services:

• Identifiers, such as your Internet Protocol (IP) address, device identifiers (such as MAC address), and other unique online identifiers.
• Internet and other electronic network activity, such as your browser type and operating system, the URL of the website from which you came to our Site, pages you viewed, your search history on the Site, how long you spent on a page, access times, and other details about your use of and actions on our Site and Services.
• Inferences, such as those drawn to create a profile reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.

For more information, refer to the section below on “Our Use of Cookies and Similar Technologies.”

Information Collected from Third Party Sources

We may also obtain the categories of information described above from third parties. These third-party sources include:

• Third-party partners. Third-party applications and services, including research partners, healthcare providers, advertising networks, data analytics providers, social networks, and lead generation services.
• Co-branding/marketing partners. Partners with which we offer co-branded services or engage in joint marketing activities.
• Service providers. Third parties that collect or provide data in connection with work they do on our behalf.
• Publicly available sources. Public sources of information such as open government databases.

Depending on your interaction with us, we may use the categories of information described above for the following business purposes:

• To Provide Services. To provide and deliver our Services.
• Business operations. To operate our business, such as billing, accounting, administering your account, improving our internal operations, securing our systems, detecting fraudulent or illegal activity, verifying your identity and meeting our legal obligations.
• Product improvement, development and internal research. To improve our Site and Services and to develop and provide new products and services. Additionally, to identify, create and test new services, products or features, including to perform quality control and quality improvement activities, to conduct data analysis about users of our Site or Services, our audience size and usage trends, to improve and optimize our genomic sequencing, lab, processes and services, and for internal research.
• Personalization. To understand you and your preferences to enhance your experience and enjoyment using our Site and Services.
• Customer support. To provide customer support and respond to your questions.
• Communications. To send you information, including confirmations, invoices, technical notices, updates, security alerts, and support and administrative messages.
• Marketing. To communicate with you about new services, offers, upcoming events, and other information about our Services.
• Advertising. To display advertising to you (see the “Our Use of Cookies and Similar Technologies” section of this Notice for information about personalized advertising and your advertising choices).

Combining Information. We, and our third party business partners, may combine the information we collect from different sources in furtherance of the purposes described above, including to give you a more seamless, consistent, and personalized experience.

De-identified Data. We may de-identify, anonymize, or aggregate your information in such a way that you may not reasonably be re-identified by us or another party, and we may use this de-identified data for any purpose permitted under applicable law. To the extent we de-identify data originally based on your personal information, we will maintain and use such data in de-identified form and will not attempt to re-identify the data, except as otherwise permitted under applicable law.

Consent. We may use your information with prior notice to you and your consent for any purpose permitted under applicable law.

Depending on your interaction with us, we may disclose the categories of information we collect about you for the business purposes described above as follows:

• Research Partners. With your consent, we may share your information with our research partners for use in their research program and as otherwise described in the consent.
• Service providers. We may share your information with service providers, contractors, and agents who perform functions and business operations on our behalf, such as service providers that help us with technical maintenance, database management, fraud prevention, market research, our products and product recommendations, and other data analytics functions.
• Third Parties. We may disclose your information to our third-party business partners, such as our advertising and analytics partners, social networks, lead generation services, data optimization services, companies that help us with our products and product recommendations, and partners with which we offer co-branded services or engage in joint marketing activities.
• Corporate transactions. We may disclose your information to an interested party or their service providers as part of a potential or bona fide corporate transaction or proceeding, such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.
• Legal and law enforcement. We may disclose your information when we believe that doing so is necessary to comply with applicable law, a valid court order, a judicial proceeding, subpoena, warrant, regulatory investigation, or in connection with any legal process. If we are required to disclose your information, we will make an effort to provide you with notice in advance, unless we are prohibited by law from doing so.
• Security, safety, and protecting rights. We may disclose your information if we believe it is necessary to:
  • protect our customers and others, for example to prevent spam or attempts to commit fraud, or to help prevent the loss of life or serious injury of anyone;
  • operate and maintain the security of our Services, including to prevent or stop an attack on our computer systems or networks; or
  • protect the rights or property of ourselves or others, including enforcing our agreements, terms, and policies
• Death or Incapacitation. In the event of your death or incapacitation, access to your Helix account, including your genetic information, may be granted to a verified executor or legally authorized representative. Such access will only be provided upon receipt and verification of appropriate supporting documentation that confirms the individual’s legal authority to act on your behalf. Individuals seeking such access must contact Helix Customer Support and provide the necessary documentation for review and verification by Helix’s Privacy Team.

Aggregated Statistics and Findings. We may publish, use and/or share with third parties aggregated, anonymized, or de-identified information about our users and their usage of our Site and Services for any purpose permitted under applicable law, including for research and promotional or other purposes. This could include describing users of our Services in general terms (e.g., “10% of our users have a variant in this gene”)

We, and our third party advertising and analytics partners, use cookies, web beacons, and similar technologies to automatically track information about your use of our Site and Services. We may use this information to better understand, customize, and improve user experiences with the Site and Services, to operate and maintain our Services, and for advertising purposes. We, and our third-party business partners, may combine this information with other information that we collect about you.

• What are cookies? Cookies are small text files placed by a website and stored by your browser on your device. The text in a cookie contains a string of numbers and letters that may uniquely identify your device and can contain other information as well. We may use both session cookies and persistent cookies. A session cookie disappears after you close your web browser. A persistent cookie remains after you close your web browser and may be used by your browser on subsequent visits to our Site and Services. Most web browsers are set to accept cookies by default. If you prefer, you can go to your browser settings to learn how to delete or reject cookies. If you choose to delete or reject cookies, this could affect certain features or services of our Site and Services. If you choose to delete cookies, settings and preferences controlled by those cookies, including advertising preferences, may be deleted and may need to be recreated. To learn more about cookies, please visit http://www.allaboutcookies.org.
• What are web beacons? Web beacons are transparent electronic images (also called pixel tags or clear GIFs) that may be embedded within a website, email, advertisement, video, or other online resource. When your browser open a webpage, email, or other online resource that contains a web beacon, your browser may automatically transmit certain information directly to the web server that hosts the web beacon (typically operated by a third party). This may allow that web server to collect information about your device and interactions with the online resource, and to set and read cookies. We, and our third-party business partners, may use web beacons and similar technologies on our Site and Services to collect information, such as your IP address; unique online identifiers; clickstream data; the URL of webpages you visit, and the referring URL or webpage that led you to our Site or Services; your search terms, form field submissions, and button click information on the Site or Services; the time that the page containing the web beacon was viewed; your browser and device type, operating system, and language preferences; your geographic location; and information in cookies set by the server. We may use this information to, among other things, track the activities of visitors to our Site and Services, help us manage content, generate leads, and compile statistics about usage of our Site and Services. We, and our third-party business partners, may also include web beacons and similar technologies in our email messages or newsletters to tell us if you open and act on them.
• Email web beacons. Some email clients may offer settings that allow you to prevent the automatic downloading of images, including web beacons, which prevents the automatic connection to the web servers that host those images.
• Analytics. We may use third-party analytics tools to help us understand user behavior on our Site and Services. We may use third-party analytics tools, such as Google Analytics, on certain parts of our Site and Services to help us understand how users interact with our Site and Services. You can learn how Google collects and uses information at www.google.com/policies/privacy/partners, and opt-out of them by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.
• Advertising. In certain instances, we may set tracking tools (e.g., cookies, web beacons) provided by third-party advertising partners to collect information regarding your activities on our Site and Services (e.g., your IP address, page(s) visited, time of day) for advertising purposes. We may also share such information with third-party advertising partners. These advertising partners may use this information (and similar information collected from other websites) for purposes of delivering targeted advertisements to you when you visit unaffiliated websites or applications within their networks. This practice is commonly referred to as “interest-based advertising” or “online behavioral advertising.” If you do not want interest-based advertising, you may be able to opt-out by visiting www.networkadvertising.org/managing/opt_out.asp and www.aboutads.info/‌choices/. You can also use the controls available through our website Cookie Preferences to decline advertising-related cookies and similar technologies on our Site.
• Global Privacy Control. Some browsers and browser extensions support the “Global Privacy Control” (GPC) or similar controls that can send a signal to the websites you visit indicating your choice to opt-out from certain types of data processing, as specified by applicable law. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting or similar control that is recognized by regulation or otherwise widely acknowledged as a valid opt-out preference signal. Please note that this signal will be linked to your browser only. For more information on the GPC and how to use a browser or browser extension that incorporates the GPC signal, please visit https://globalprivacycontrol.org/.
• Do Not Track. Some browsers include a "Do Not Track" (DNT) setting that can send a signal to the websites you visit indicating you do not wish to be tracked. Unlike the GPC described above, there is not a common understanding of how to interpret the DNT signal; therefore, our Site and Services do not respond to browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including the GPC, cookie controls, and advertising controls described above.

The choices you make to opt-out of or decline cookies or similar technologies (as described above) may be specific to the device or browser you are using. If you access our Site or Services from other devices or browsers, take these actions from those devices or browsers so that your choices apply to the data collected when you use those systems.

Third-Party Links

Please note that certain services we offer may include integrations, links or references to services from other companies, and these external services have their own privacy policies. When you share your information with these third-party services, or if you permit us to share your information with them, their own privacy policies will apply to your data.

Depending on your interaction with us, you may have certain rights regarding our processing of your personal information under applicable law. If our processing of your personal information is governed by such laws, this section provides you with additional information regarding your rights and our processing of your information under applicable law.

Our processing of your personal information

Depending on the Site and Services you use, we may disclose your personal information in ways that may be considered “sales” or “shares” under applicable law. We use and disclose your sensitive data only for purposes authorized under applicable law.

The information below describes the categories of third parties to whom we may disclose, “sell,” or “share” each category of information that we collect (as described above) for the business purposes described in this Notice.

Identifiers

• Third parties to whom we may disclose information for our business purposes:
  • Research partners
  • Service providers
  • Government entities
• Third parties to whom we may "sell" or "share" information:
  • Advertising networks
  • Analytics providers

Demographic Information

• Third parties to whom we may disclose information for our business purposes:
  • Research partners
  • Service providers
  • Government entities
• Third parties to whom we may "sell" or "share" information:
  • None

Commercial Information

• Third parties to whom we may disclose information for our business purposes:
  • Research partners
  • Service providers
  • Government entities
• Third parties to whom we may "sell" or "share" information:
  • Advertising networks
  • Analytics providers

Professional or Employment-Related Information

• Third parties to whom we may disclose information for our business purposes:
  • Research partners
  • Service providers
  • Government entities
• Third parties to whom we may "sell" or "share" information:
  • None

Financial Information

• Third parties to whom we may disclose information for our business purposes:
  • Research partners
  • Service providers
  • Government entities
• Third parties to whom we may "sell" or "share" information:
  • None

Internet or Other Electronic Network Activity

• Third parties to whom we may disclose information for our business purposes:
  • Research partners
  • Service providers
  • Government entities
• Third parties to whom we may "sell" or "share" information:
  • Advertising networks
  • Analytics providers

Inferences

• Third parties to whom we may disclose information for our business purposes:
  • Research partners
  • Service providers
  • Government entities
• Third parties to whom we may "sell" or "share" information:
  • Advertising networks
  • Analytics providers

Sensitive Data

• Third parties to whom we may disclose information for our business purposes:
  • Research partners
  • Service providers
  • Government entities
• Third parties to whom we may "sell" or "share" information:
  • None

Data Retention

Your personal information will be held for only so long as it is necessary for the purposes for which it was originally collected, and in accordance with applicable law. We will retain your personal information for the period necessary to fulfill the purposes outlined in this Notice, including to deliver the Site and Services, comply with legal requirements, or to meet our business needs.

Your Privacy Choices and Rights Under Applicable Law

We may provide a variety of ways for you to control the personal information we hold about you, including choices about how we use that data. In some jurisdictions, these controls and choices may be enforceable as rights under applicable law.

Depending on the jurisdiction in which you live, you may have the following rights under applicable law. These rights may be limited or denied in some circumstances. For example, we may retain your personal information where required or permitted under applicable law.

• Right to Access. You may have a right to request that we disclose to you the specific pieces of your personal information that we have collected about you in a portable and, to the extent technically feasible, readily usable format.
• Right to Know. You may have the right to request confirmation that we have collected personal information about you and know what personal information we have collected about you, including, as applicable, the categories of personal information we have collected, the sources from which we collected that personal information, the business or commercial purposes for which we collected, sold, and shared that personal information, the categories of personal information that we sold, shared, or disclosed to third parties for business purposes and the categories of third parties to whom we sold, shared or disclosed personal information .
• Right to Deletion. You may have a right to request that we delete the personal information that we have collected about you. We will use commercially reasonable efforts to honor your request, in compliance with applicable laws. Please note, however, that we may need or be required to keep such information, such as for our legitimate business purposes or to comply with applicable law.
• Right to Correct. You may have a right to request that we correct or update the personal information that we hold about you.
• Right to Opt-Out of “Sales” and “Sharing.” You may have a right to opt-out of our “sale” of your personal information or “sharing” of your personal information for cross-context behavioral advertising (as these terms are defined under applicable law).
• Right to Opt-Out of Targeted Advertising. You may have a right to opt-out of our use of your information for targeted advertising purposes. 
• Right to Non-Discrimination. You have the right not to receive discriminatory treatment if you exercise the rights conferred to you by applicable privacy law.

Submitting Requests. Requests related to your privacy rights under applicable law can be submitted by you or by agents you authorize to act on your behalf by using the following links or by emailing us at privacyofficer@helix.com. You or your authorized agent may be asked to provide information such as your name, email address, or phone number to verify your identity. Authorized agents must also provide a copy of your signed permission authorizing the agent to submit requests on your behalf.

• Access My Personal Information
• Delete My Personal Information
• Correct My Personal Information
• Do Not Sell or Share My Personal Information

You may also opt-out of our “sale” or “sharing” of your personal information (as those terms are defined under applicable law) through privacy preference signals recognized under applicable local law. Please review the section above on “Our Use of Cookies and Similar Technologies” for additional information regarding GPC signals.

Appeals. If you receive a response from us informing you that we have declined your request, in whole or in part, you may have the right to appeal that decision by submitting your appeal to our Privacy Officer using the contact method described at the bottom of this Privacy Notice.

Additional Privacy Choices

Account Closure. You may close your Helix Account through your Account Settings. If you close your Helix Account, you will no longer have access through the Services to your genetic information. Helix will retain certain account information and genetic information in accordance with our data retention policies unless you request to delete your personal information, in which case, we may retain your genetic information if required or permitted under applicable law.

Communications preferences. You can choose whether to receive promotional communications from us by email. If you receive promotional email messages from us and would like to stop, you can do so by following the directions in that message, by changing your Account Settings, or by contacting us as described in the “Contact Us” section below. These choices do not apply to certain informational, transactional or non-promotional communications.

We implement physical, technical, and organizational security measures designed to safeguard personal information. These measures are aimed to protect the personal information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our efforts, no data security measures can guarantee security.

Our Site and Services are not directed at or intended for use by anyone under 18. We do not knowingly collect or maintain personal information relating to any person under 18. If you are under 18, do not register on our Site, use our Services, or provide any information about yourself to us. If we learn that we have collected or received personal information from someone under 18, we will take reasonable action to remove that information and user account from our systems. We do not knowingly “sell” or “share” (as those terms are defined under applicable law) the personal information of minors under the age of 16. If you believe we might have any information relating to anyone under 18, please contact us.

Helix collaborates with researchers to advance knowledge of how genetics impacts human health and to accelerate the development of new diagnostic tests and treatments. By creating a Helix account, you agree that Helix may contact you about opportunities to participate in research that may be relevant to your test results or health conditions. Helix will not share your information with third-party researchers without your consent. You can opt out of being re-contacted about opportunities to participate in research by using the opt-out link in the communication you receive or contacting Customer Support using the information at the end of this Notice.

Helix may update this Notice from time to time for various purposes, including when necessary to reflect changes in our Site or Services, changes to the types of information we collect, how we use information, and how it will be shared, or to comply with applicable law. We will post any changes to this Notice on our Site, so please be sure to check back periodically.

If we make changes to our Notice that materially affect our practices with regard to the information we have previously collected about you, we will endeavor to take reasonable steps to notify you, such as by sending an email to the email address specified in your account or posting a prominent notice on our website.

You are responsible for ensuring we have an up-to-date, active and deliverable email address for you. You are also responsible for reviewing this Notice from time to time to check for any changes. All changes are effective immediately when we post them, and they apply to all access to and use of the Services from that point onward unless otherwise specified. If you use our Site or Services after we make changes to our Notice, you acknowledge and agree to the current version of the Notice.

Helix may also provide additional notices or information about our data collection, use, and sharing practices in relation to specific Services, on an as-needed basis.

If you have any questions about this Notice or Helix’s privacy practices, or need assistance accessing this Notice in an alternative format, you may contact Customer Support or call 1-844-211-2070. If you have a privacy concern or complaint, please contact Helix’s Privacy Officer at privacyofficer@helix.com or call 1-844-211-2070. You may also write to us at:

Attn: Privacy Officer
Helix, Inc.
400 S El Camino Real, Suite 300
San Mateo, CA 94402