Policies and Notices

Last updated: September 5th, 2023

Ambry Genetics Corporation (“Ambry,” “we,” “us,” and “our”) is committed to protecting your privacy. This Privacy Notice (the “Privacy Notice”) explains our practices and guidelines to protect the security and confidentiality of your Personal Information that we collect when you use our website, ambrygen.com, (“Website”) and any Ambry application or services that link to this Privacy Notice (“Services”).

OUR TERMS OF USE

Your use of our Website and Services is governed under our Terms of Use.

CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time (see “Revisions to Our Privacy Notice” below). Please check the “Last Updated” legend at the top of this page to see when this Privacy Notice was last revised. Any changes to this Privacy Notice will become effective when we post the revised Privacy Notice on our Website. Your continued use of our Website or Services after we have posted our changes is your acceptance of those changes, so please check this Privacy Notice periodically for updates. IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY NOTICE, THEN PLEASE DO NOT USE OUR WEBSITE OR SERVICES.

WHAT PERSONAL INFORMATION DO WE COLLECT?

When you visit and interact with our Website, we collect information about you, including Personal Information. “Personal Information” means information that specifically identifies you or, when combined with other information we have, can be used to identify, locate, or contact you. The Personal Information we collect depends on the context of your interactions with our Website and the choices you make, the services and features you use, your location, and applicable laws, but can include the following:

• Personal information you provide to us. We collect your name, phone number, physical address, and email address when you voluntarily provide it to us, such as when you subscribe to our blog, Ambry updates, or webinars; order a test kit; apply for a job; or contact us.
• Registration information to use AmbryPort®. AmbryPort® is only offered to clinicians. When a clinician registers at AmbryPort®, we collect the clinician’s name, position, specialty, email address, phone number, fax number, professional degree, organization, and business address.
• Registration information to use CARE. When you register on the CARE platform for any of our CARE-related services, we collect your name, email address, and phone number.
• Registration information to use CARE Digital. If you are a CARE customer, you may access CARE Digital by providing your name, email address, company or institution name, position or title, and password.
• Communication Information. We retain records and copies of your correspondence (including e-mail addresses) if you contact us, such as when you submit a comment or question.
• Event Information. When you register to attend one of our webinars or attend a tradeshow or conference where we are in attendance, we may collect contact information such as your name, e-mail address, job title and organization and similar personal identifiers you provide.
• Other Information. We may collect other Personal Information we specifically request or you voluntarily provide.

You are not required to provide us with any Personal Information that we request from you. However, failure to provide such information may limit what we are able to do for you. For example, refusing to provide your e-mail address may prevent us from providing you with important information about our Website or Services.

WHAT PERSONAL INFORMATION DO WE COLLECT AUTOMATICALLY?

As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions and patterns, including:

• Information about your use of our Website. When you browse our Website, we automatically collect information, such as your Internet Protocol (“IP”) address, browser type, browser language, domain names, web requests, platform type, pages viewed and the order the pages were viewed, amount of time spent on a particular page, date and time of your request, and one or more cookies that my uniquely identify your browser. We collect this information through our third-party analytics service providers (see “How Do We Use Tracking Technologies?” ).
• Device information. When you use a computer or mobile device to access our Website or Services, we collect basic information about your browser and operating system, such as model number.

HOW DO WE USE TRACKING TECHNOLOGIES?

When you use our Website, our third-party service providers may collect information from you through the following ways:

• Cookies. When you use our Website or Services, we may collect information about your browsing session through the use of cookies. See our Cookie Notice for more information. Our third-party analytics service providers may also use cookies to perform services for us. Their Cookie Notice can be found by clicking on their name below:
  • Google Analytics
  • Hotjar
• Website Analytics. We use third-party web analytics services on our Website such as Google Analytics and Hotjar. These service providers help us analyze how visitors use our Website. The information obtained for this purpose (including your IP address and other information collected by automated means) may be disclosed to or collected directly by these service providers. To provide this service, Google Analytics may collect certain information about you from your computer, including through the use of cookies. Such information may include information regarding your visit (such as the pages you visit and the length of your visit), information about your device (such as your IP address), how you got to our Website, and other information about you. You can learn more about Google Analytics and how it collects and processes data (including how to control the information sent to Google) by visiting: www.google.com/policies/privacy/partners/. You can opt-out of Google Analytics by using the Google Analytics opt-out browser add-on, available here.
• Social Media Plug-ins. We may use social media plug-ins on our Website to enable you to easily share information with others. We use the information collected from the plug-ins to learn about your interests and to help us better understand how to serve you. This information may include your preferences about how to contact you or further develop a business or professional relationship with you, your product preferences, languages, marketing preferences, and some demographic data. These plug-ins may include those from companies like Facebook, LinkedIn, YouTube, and Twitter. The social media plug-ins may allow these companies to receive directly identifiable Personal Information about you and your visit to our Website. When you visit our Website, the operators of the social media plug-ins on our Website place cookies on your computer that enable them to recognize you on websites belonging to them and their affiliates and partners after you have visited our Website, or that enable them to add the information collected from your visit to our Website with your prior activity on those websites. The social media plug-ins collect this information about users whether they specifically interact with the plug-in or not, and it may enable social media companies to share information about your web-browsing navigational information with some of their other users. Ambry does not control what information is collected by the social media plug-ins or the information practices adopted by those social media companies. For more information about social plug-ins from social media websites, you should refer to those companies’ privacy and data sharing statements.
• Widgets. We use third party widgets on our Website. A “widget” is a code added to a website to grab content from another website. These other websites may be tracking users. You can find their Privacy Notice by clicking on their name below:
  • Google Analytics
  • HubSpot
  • Hotjar

HOW DO WE USE YOUR PERSONAL INFORMATION?

We may use Personal Information or non-personally identifiable information collected from you in the following ways:

• To provide you with services and products.
• For marketing and analytics purposes.
• To provide safety and security features.
• To maintain, improve, and develop services and products.
• To sign you up for our newsletters or other communications, or subscribe or unsubscribe you to our mailing list upon your request.
• To provide you with support and to respond to your inquiries and complaints, including to investigate and address your concerns and monitor and improve our responses.
• To detect and remove spammers, detect and remove non-compliant images, etc.
• To evaluate you as a qualified candidate for employment or to provide services to us.
• To investigate and respond to suspected illegal activities or fraud.
• To comply with applicable federal, state, and other laws and regulations and respond to law enforcement requests or other valid legal requests and as required by applicable law, court order or governmental regulations.
• As described to you when collecting your Personal Information.
• For any other purpose with your consent or authorization (where legally required).

HOW DO WE SHARE YOUR PERSONAL INFORMATION?

• Limitations on Sharing Personal Information. Ambry will not sell, rent, or otherwise disclose any of your Personal Information to any third party except as set forth in this Privacy Notice.
• Internally. We may disclose your Personal Information to our corporate parent, affiliates, subsidiaries, and other parties who require such information to assist us with establishing, maintaining, and managing our business relationship with you, including contacting you directly.
• Third Parties. We may disclose your Personal Information to our third-party service providers who need access to your Personal Information to perform their work on our behalf, including third party auditors, consultants and professional organizations. These service providers have agreed not to sell or distribute your Personal Information to any other party. In addition, Ambry may share non-personal, anonymous, summary, or aggregate user data with its membership and other third parties.
• Successors. In the event of a sale, merger, consolidation, change in control, transfer of substantial assets, reorganization, or liquidation, we may transfer, sell, or assign to third parties information concerning your relationship with us, including, without limitation, Personal Information that you provide and other information concerning your relationship with us. We also may disclose this information in connection with the due diligence for any such transaction. Any acquirer or successor of Ambry may continue to use your data as set forth in this Privacy Notice.
• Legal or Government Requests. We may disclose your Personal Information if permitted or required by law or in response to a law enforcement or other legal request and/or to comply with a judicial proceeding, court order, or legal process.
• Protection of Rights and Interests. We also may disclose your Personal Information if we believe such disclosure is reasonably necessary to protect or defend our interests or the interests of our users or necessary to protect the public from harm.
• Other Purposes. We may use your information for any other purpose disclosed by us when you provide the information or with your consent.

We may disclose aggregated information about our users and information that does not identify an individual, without restriction.

• Marketing Communication Opt-out. You can opt out of receiving one of our e-mail marketing communications by following the instructions for unsubscribing contained in the e-mails. Please allow us ten (10) business days from when the request was received to complete the removal.
• Accessing Your Personal Information. You may review and request changes to your contact information or other Personal Information that we collect and hold about you by contacting our Privacy Office by one of the methods listed underContact Us.

DO WE RESPOND TO DO-NOT-TRACK SIGNALS?

“Do-not-track” is a web browser setting that requests that a website disable its tracking of a user. Like many other websites, our Website does not currently respond to these “do-not-track” signals because they are controlled by our third-party analytics service providers.

HOW DO WE PROTECT YOUR INFORMATION?

Ambry takes reasonable precautions so that your information is treated securely and in accordance with this Privacy Notice. Information that you provide to Ambry through our Website is encrypted using industry standard Secure Sockets Layer (“SSL”) technology. Your information is processed and stored on controlled servers with restricted access. Transmission of information via the Internet is not completely secure. Although we will do our best to protect your Personal Information, we cannot guarantee the security of your data transmitted to Ambry. Any transmission of Personal Information is at your own risk.

HOW LONG DO WE STORE YOUR PERSONAL INFORMATION?

Ambry will retain Personal Information collected from you only as long as we need it to fulfill the purposes for which we have initially collected it, unless otherwise required by law. Because these needs can vary for different data types in the context of different services, actual retention periods can vary.

DO WE COLLECT PERSONAL INFORMATION OF MINORS?

In all events, Ambry does not intend that any portion of its Website will be accessed or used by persons under the age of thirteen, and such use is prohibited. By using our Website, you confirm that you are not under the age of 13. Ambry will not knowingly collect or use any Personal Information from any child under the age of 13 without the prior consent of the parent or legal guardian. If you believe we may have information about a child under the age of 13, please contact our Privacy Office by one of the methods listed underContact Us

WHAT ABOUT THE HIPAA NOTICE OF PRIVACY PRACTICES?

This Privacy Notice is in addition to, and does not replace, our HIPAA Notice of Privacy Practices, which explains how we use and disclose protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). If there is a conflict between the terms of this Privacy Notice and the HIPAA Notice of Privacy Practices with respect to PHI, the HIPAA Notice of Privacy Practices will control how we use and disclose your PHI.

DO I HAVE CERTAIN PRIVACY RIGHTS AS A CALIFORNIA RESIDENT?

Under the California Consumer Protection Act, as amended by the California Privacy Rights Act, (“CCPA”), California residents are entitled to the following additional privacy rights:

• To access and know what Personal Information we collect about you, and how we use or disclose it.
• To delete your Personal Information that you provided to use, subject to certain exceptions where we are not required to deleted it.
• To correct any inaccurate Personal Information we hold about you.

Personal Information does not include: (1) publicly available information from federal, state, or local government records, (2) information that has been deidentified or aggregated as defined in CCPA, or (3) patient information covered under the Healthcare Insurance Portability and Accountability Act of 1996 (“HIPAA”) (see our HIPAA Notice of Privacy Practices).

If you want to exercise any of these rights listed above, you can submit a request to us by: (1) using the Contact Uspage, (2) emailing privacy@realmidx.com, (3) calling 1-866-262-7943, or (4) mailing Attn: Privacy Office, Ambry Genetics Corporation, 1 Enterprise, Aliso Viejo, California 92656. We will not discriminate against you for exercising any of your rights under CCPA.

Please note that we will need to verify your identity and state of residency, such as matching the Personal Information you give us to our records, whenever possible, or ask for a copy of your driver’s license or identification card, before processing your request. If you are acting on behalf of another individual, we will need proof that you are authorized to make a request on that individual's behalf, such as a valid power of attorney or comparable documentation. Absent such proof, we reserve the right to refuse to comply with your request. We aim to respond within 45 days of receipt. If additional time is needed, we may take up to 45 more days (i.e., a maximum total of 90 days) to comply with your request, and we will inform you of the reason(s) why the extension is necessary within the initial 45 days of receiving your request.

In the previous 12 months, we may have sold Personal Information relating to clinicians who have ordered genetic tests. We have not sold other Personal Information, and will not do so in the future without providing you with notice and an opportunity to opt-out of such sale. We also do not knowingly Personal Information of individuals under the age of 16.

REVISIONS TO OUR PRIVACY NOTICE

We reserve the right to amend this Privacy Notice from time to time and for any reason, in our sole discretion, without notice, by updating this Privacy Notice. Accordingly, users are strongly encouraged to review our Privacy Notice regularly. If we decide to change our Privacy Notice, the revised version will be effective the date it is posted, which is identified at the top of the page. Your continued access or use of our Website following the posting of changes to this Privacy Notice means that you accept such revisions, changes and/or amendments. If you object to any of the changes to this Privacy Notice, please stop accessing our Website. Please check this page frequently and review any changes to this Privacy Notice carefully so you are aware of any changes, as they are binding on you.

HOW TO CONTACT US?

If you have any questions about this Cookie Notice, you can contact us at privacy@realmidx.com, by using the Contact Us page, or by regular mail at: