California Privacy Notice
This California Privacy Notice (the “Notice”) applies to California residents and describes how Ambry Genetics Corporation (“Ambry,” “we,” or “us”) collects, uses, and discloses “personal information” covered by the California Consumer Privacy Act (“CCPA”). “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
The CCPA provides California residents with specific rights with respect to their personal information as described below.
The CCPA does not apply to our collection and use of your protected health information under HIPAA.
As a healthcare provider, Ambry is subject to the federal medical privacy law called the “Health Insurance Portability and Accountability Act” (“HIPAA”), which includes strict protections for medical information of identifiable individuals, called “protected health information” (“PHI”). You can find information about how Ambry collects, uses, and discloses PHI of all its patients in accordance with HIPAA, and the rights to your PHI that may be available to you under HIPAA, in our Notice of Privacy Practices.
The CCPA does not apply to PHI or patient information that Ambry maintains in the same manner as PHI.
Examples of PHI that are covered by HIPAA—and therefore not covered by the CCPA—include the information we receive about you from the healthcare provider ordering a test from us, your test result we provide to the provider, and the data we disclose to your health insurer for payment purposes. The CCPA privacy rights described below do not apply to PHI or patient information maintained in the same manner as PHI.
Examples of personal information covered by the CCPA include the professional contact information of our ordering physicians.
When we collect, use or disclose information not covered by the CCPA, we do so as described in this Privacy Policy (governing data collected on our applications and online services) and our Notice of Privacy Practices (governing our collection and use of your PHI), each of which is in addition to but does not supplant this Notice.
The CCPA does not apply to our use of de-identified or publicly available data
The CCPA does not apply to:
What personal information about you do we collect?
Depending on your relationship with us, we may collect any combination of the categories of personal information for the purposes identified in this Notice. We provide an individualized information about collection and disclosure to California residents who exercise their “Right to Know,” as described in the “Your rights under the CCPA” section below.
In the preceding twelve (12) months, Ambry generally collects the following categories of personal information.
Identifiers such as your name, email address, postal code, phone number, unique personal identifiers (e.g., such as a device identifier, cookie, beacon, pixel tag or similar technology), online identifier internet protocol address, or similar identifiers.
Commercial information including products or services purchased, obtained, or considered, or other purchasing histories.
Internet or electronic network activity information including, but not limited to, browsing history, search history, and information regarding your interaction with our internet website, applications, or advertisement.
Audio, electronic, visual, or similar information including voicemails you may leave.
Professional information such as names, titles, affiliation, office location, contact details, for our ordering physicians.
Employment information such as your resume and contact details in your applying for a position with us.
How have we collected personal information about you?
We have collected and continue to collect the categories of personal information identified above:
Directly from you, such as when you enter such data on our website or through applications such as the Ambry Portal, complete forms or applications in connection with utilizing or requesting our products or services, or otherwise contact us;
From third parties providing us with professional contact information, such as your colleagues or professional service organizations; or
From your devices, such as when you visit our website or mobile applications. Please see our Cookie Policy for more information about our automated collection and advertising practices.
For what purposes do we use your personal information?
We may use the categories of personal information identified above for the following purposes:
To provide you with information relevant to you and to respond to your requests when you contact us;
To measure and assess use of our website;
To detect and repair errors on our website(s) and its technical operations;
For marketing and analytics purposes;
To improve our services;
To protect against and detect security incidents;
To debug to identify and repair errors that impair the existing functionality of our website
To comply with legal requests from law enforcement authorities or for other legal purposes; and
To consider you as a qualified candidate for employment or to provide services to us.
Does Ambry disclose my information to third parties?
We may have shared your personal information with the following categories of third parties.
Categories of Personal Information |
Categories of Third Parties |
|---|---|
Identifiers |
|
Commercial information |
|
Internet or electronic network activity information |
|
Audio, electronic, visual, or similar information |
|
Employment or other professional information |
|
Does Ambry sell my information?
Ambry is prohibited by federal law (HIPAA) to sell medical information of identifiable individuals (PHI) without your permission. Where we share the professional contact information of healthcare providers to third parties, we only do so with the required provider’s consent.
Ambry may sell de-identified information, whereas the data has been de-identified using the method described in Section 164.514(b)(2) of Title 45 of the Code of Federal Regulations (known as the HIPAA safe harbor method).
Your rights under the CCPA
If you are a California resident, you have the following rights regarding your personal information covered by the CCPA, in addition to any rights with respect to your PHI described in our Notice of Privacy Practices:
Right to Know: When you exercise your “right to know” you may request:
Individualized information about collection and disclosure: We will disclose the categories of personal information that we collect about you, the categories of sources from which the personal information was collected, the business or commercial purposes for which the personal information is used, disclosed, or sold, and the categories of third parties with whom we share the Personal Information. Our response to your request will only cover the twelve (12) month period preceding the request.
Access to specific pieces of personal information: We will disclose the specific pieces of Personal Information we have collected about you over the twelve (12) months preceding the request.
Right to Delete: You may request that we delete the personal information we have collected about you in the twelve (12) months preceding your request.
Right to Opt-out of Sales: We have not sold any personal information in the preceding twelve (12) months.
We will not discriminate against you for exercising any of those rights, e.g., we will not charge you a different price or refuse to do business with you.
How can I exercise my rights under the CCPA?
If you wish to exercise any of these rights, please either
Send an email to privacy@ambrygen.com; or
Call us at +1 (866) 262-7943
Send a letter to Ambry at the following address
Ambry Genetics
One Enterprise
Aliso Viejo, CA 92656
ATTN: Privacy Officer
We must verify your identity before processing your request. During the verification process, depending on the nature of your request, we will verify your identity against known information in our databases, such as your name, e-mail address, physical address, and telephone number. Where you request access to the specific pieces of personal information we hold about you, we may ask you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
We aim to respond to a verifiable consumer request within forty-five (45) days of its receipt. When additional time is needed, we may take up to an additional forty-five (45) days (for a maximum total of 90 days) to comply with the request, and we will inform you of the reason(s) why the extension is necessary within the first forty-five (45) days of receiving your request.
How can I exercise CCPA rights on behalf of another individual?
If you are acting on behalf of another individual we will collect proof that you are authorized to make a request on that individual's behalf through a signed written authorization, proof that you have power of attorney or are otherwise registered with the California Secretary of State. Absent such proof, we reserve the right to refuse to comply with your request.