PRIVACY POLICY
Ravel Genetics, Inc. ("Ravel Genetics," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services. Please read this policy carefully.
1. Information We Collect
1.1 Information You Provide Directly
We may collect the following categories of personal information that you voluntarily provide:
• Contact information: name, email address, phone number, mailing address
• Account credentials: username and password
• Payment information: billing address and payment card details (processed securely by third-party payment processors)
• Genetic and biological data: DNA samples, raw genomic data, variant information
• Health and medical information: health history, symptoms, medications, and related information you choose to share
• Research and survey responses
• Communications you send to us
1.2 Information Collected Automatically
When you use the Services, we may automatically collect:
• Device identifiers and technical data: IP address, browser type, operating system
• Usage data: pages visited, features used, time spent, click patterns
• Cookies and similar tracking technologies (see Section 6 below)
• Log data: server logs, error reports, performance data
1.3 Sensitive Personal Information
We collect and process certain categories of sensitive personal information, including genetic data and health-related information. We apply heightened protections to such data as described in this Policy and as required by applicable law, including the Genetic Information Nondiscrimination Act (GINA), HIPAA (where applicable), and applicable state laws.
2. How We Use Your Information
We use the information we collect for the following purposes:
2.1 Providing and Improving Services
• To create and manage your account
• To process and deliver genomic analysis and health insights
• To operate, maintain, and improve the Services
• To develop new products and features
• To personalize your experience
2.2 Research and Development
• To conduct scientific research and analysis (using de-identified or aggregated data)
• To advance the development of precision medicine and genomics
• To publish research findings (using only de-identified data)
You may opt out of having your de-identified data used for research purposes at any time by contacting us at privacy@ravelgenetics.com. Note that opting out will apply prospectively and may not affect data already incorporated into research.
2.3 Communications
• To respond to your inquiries and support requests
• To send service-related notices and updates
• To send promotional communications, if you have opted in
• To send important legal or policy updates
2.4 Legal and Safety
• To comply with applicable laws and regulations
• To enforce our Terms of Use
• To protect the rights, property, and safety of Ravel Genetics, our users, and the public
• To respond to lawful requests from governmental authorities
3. How We Share Your Information
We do not sell your personal information. We may share your information in the following limited circumstances:
3.1 Service Providers
We may share your information with trusted third-party service providers who assist us in operating the Services, subject to confidentiality obligations. These providers include cloud hosting services, payment processors, analytics providers, and customer support platforms.
3.2 Research Partners
With your explicit consent, we may share de-identified or aggregated genetic data with academic or research institutions for scientific research purposes. We will never share identifiable genetic data with research partners without your express written consent.
3.3 Business Transfers
In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you prior to your information being subject to a different privacy policy.
3.4 Legal Requirements
We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.
3.5 With Your Consent
We may share your information in any other manner with your explicit consent.
4. Special Protections for Genomic Data
We recognize that genetic information is uniquely sensitive. In addition to the protections described elsewhere in this Policy, we apply the following protections to genomic data:
• We will not share your identifiable genomic data with employers, insurance companies, or law enforcement without a valid legal process, such as a court order or subpoena, or your explicit written consent
• We will not use your genomic data for purposes unrelated to health, wellness, or scientific research without your explicit consent
• All genomic data is encrypted in transit and at rest using industry-standard encryption
• Access to raw genomic data is restricted to authorized personnel with a need-to-know basis
• We apply data minimization principles, collecting only the genomic data necessary for the services you request
• In the event of a data breach involving genomic data, we will notify affected individuals and regulators as required by applicable law
5. Data Retention
We retain your personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.
Genetic samples (physical), if provided, are retained for the period specified at the time of collection. You may request deletion of your genomic data by contacting us, subject to legal and operational retention requirements.
De-identified data used in research may be retained indefinitely in accordance with scientific best practices.
6. Cookies and Tracking Technologies
We use cookies and similar tracking technologies (such as web beacons and pixels) to operate and improve the Services and to understand how you interact with our content. Cookies are small text files placed on your device.
We use the following types of cookies:
• Essential cookies: necessary for the Services to function properly
• Analytics cookies: help us understand how visitors use the Services
• Preference cookies: remember your settings and personalization choices
• Marketing cookies: used to deliver relevant content and measure campaign effectiveness (only with your consent)
You may control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Services. We honor Do Not Track (DNT) browser signals where technically feasible.
7. Your Privacy Rights
Depending on your location, you may have the following rights regarding your personal information:
• Right to access: request a copy of the personal information we hold about you
• Right to correction: request correction of inaccurate or incomplete information
• Right to deletion: request deletion of your personal information, subject to legal obligations
• Right to portability: receive your data in a structured, machine-readable format
• Right to opt out of research use: as described in Section 2.2 above
• Right to withdraw consent: where processing is based on consent, withdraw it at any time
• Right to lodge a complaint: with your applicable data protection authority
California residents have additional rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), including the right to know, the right to delete, and the right to opt out of sale of personal information. We do not sell personal information.
To exercise your rights, contact us at info@ravelgenetics.com. We will respond within 30 days of receiving a verifiable request.
8. Data Security
We implement a comprehensive security program including administrative, technical, and physical safeguards designed to protect your information from unauthorized access, disclosure, alteration, or destruction. These measures include:
• Encryption of data in transit (TLS) and at rest (AES-256)
• Access controls and multi-factor authentication for internal systems
• Regular security assessments and penetration testing
• Employee training on data privacy and security practices
• Incident response procedures
While we take reasonable steps to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
9. Children's Privacy
The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will promptly delete it. If you believe we have collected such information, please contact us immediately at info@ravelgenetics.com.
10. International Data Transfers
Ravel Genetics is based in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to the transfer of your information to the United States.
For users in the European Economic Area (EEA) or United Kingdom, we rely on appropriate legal mechanisms (such as Standard Contractual Clauses) for international data transfers.
11. State-Specific Privacy Disclosures
11.1 California (CCPA/CPRA)
California residents may request disclosure of the categories of personal information collected, the purposes for which it is used, and any third parties with whom it is shared. We do not sell California residents' personal information. Submit requests to info@ravelgenetics.com.
11.2 Washington (My Health MY Data Act)
Ravel Genetics complies with the Washington My Health MY Data Act. Washington residents have specific rights regarding consumer health data, including the right to access, delete, and withdraw consent to the collection of consumer health data. To exercise these rights, contact info@ravelgenetics.com.
11.3 Other States
If you reside in a state with applicable privacy laws (including but not limited to Virginia, Colorado, Connecticut, Texas, or Nevada), you may have additional rights. We honor applicable state law rights. Please contact us to make a request.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy with a new effective date and, where required by law, by providing direct notice via email or in-app notification. Your continued use of the Services after any change constitutes your acceptance of the revised Policy.
13. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy, please contact our Privacy Team:
Ravel Genetics, Inc.
Attn: Privacy Team