Contact Us
If you’d like to chat about Genoox in more detail, complete this form
and we’ll get back to you.
If you’d like to chat about Genoox in more detail, complete this form
and we’ll get back to you.
GNX Data Systems Privacy Policy
Last updated: August, 28 2024
We at Genoox, along with our related, affiliated, parent, and/or subsidiary companies (“Genoox”, “GNX Data Systems Inc.”, “we”, “our” or “us”) welcome you to utilize our products and services which are available to you through our website and other platforms. Our products and services include our analytic tools and platforms that allow you to conduct end to end genetic data analysis including variant calling, automated variant classification based on professional standards guidelines, variant prioritization and clinical reporting as well as data insights on the cohort level.
This Privacy Policy describes how we collect, store, use and disclose personal data regarding individuals (“you”) who: (i) visit or otherwise interact with our website available at genoox.com, or any other website, webpage, platforms or public forms generated through our Services, e-mail, text message or digital ad under our control (collectively – “Sites”); and/or (ii) use or otherwise interact with the Franklin Platform (available at franklin.genoox.com) – our cloud-based analytic tools and applications that allow you to conduct end to end genetic data analysis (“Platform” and “Users” respectively; and together with the Sites – the “Services”). We also process certain personal data on behalf of our customers (such as geneticists, physicians, variant scientists and other scientists and health care professionals; collectively “Customers”), as part of the services provided via the Platform.
Please read this Privacy Policy carefully and make sure that you fully understand it. You are not legally required to provide us with any of your personal data, and may do so (or avoid doing so) at your own free will. If you do not wish to provide us with your data, or to have it processed by us or any of our service providers, please simply do not enter or interact with our Sites, nor use our Services.
You may also choose not to provide us with “optional” personal data, but please keep in mind that without it we may not be able to provide you with the full range of our Services or with the best user experience when using our Services.
Our Services are designed for businesses and are not intended for personal or household use. Accordingly, we treat all personal data covered by this Privacy Policy, including information about any visitors to our Sites, as pertaining to individuals acting as business representatives, rather than in their personal capacity.
Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in our Terms and Conditions (“Terms”).
Specifically, this Privacy Policy describes our practices regarding –
The categories of data relating to identified or identifiable individuals (“personal data” or “personal information”) we collect, store, use and disclose include the following:
With respect to the Submitted Data, the Customer assumes the role of a ‘data controller’ and Genoox that of a ‘data processor’. We process such Submitted Data on behalf of and under the instruction of the respective Customer, in accordance with our Data Processing Addendum with them. Accordingly, this Privacy Policy does not apply to such processing done on its Customers’ behalf. To learn about the Privacy Policy and practices of our Customers, please contact them directly;
We collect and process various types of personal data regarding our Users and Prospects. Specifically, this includes the following types of data:
Name, workplace and position, contact details (such as e-mail, phone and address), account login details (e-mail address and passwords which are automatically hashed), contractual and billing details, and any other data you choose to provide when you use our Services, create an individual profile (“User Profile”), or interact with others via our Services. For example, you may provide us with your affiliations, professional background, general location, and activity logs and data; as well as your preferences for using the Services.
Connectivity, technical and aggregated usage data, such as user agent, IP addresses and approximate location based upon such IP addresses, digital identifiers, device data (like type, OS, device id, browser version, locale and language settings used), activity logs, the cookies and pixels installed or utilized on their device (which collect data such as how often Prospects visit or use the Sites, which pages they visit and when, and which website ad or email message brought them there), and inferred or presumed data on or generated from their use of the Services.
Personal data contained in any forms and inquiries you may submit to us, including support requests, interactions through social media channels, posting or participation in any of our online public forums or communities; responses to surveys or promotions, feedback, reviews, and testimonials received; sensory information including phone call and video conference recordings and transcriptions and analyses thereof; written correspondences, screen recordings, screenshots, documentation and related information; and expressed, presumed or identified needs, preferences, attributes and insights relevant to our potential or existing engagement.
Personal data provided by our Customers or processed on their behalf and under their instruction and in accordance with the data processing addendum with them. Specifically, the Platform provides our Customers with analyses and insights based on Submitted Data provided to the Platform by a Customer and which can be used as part of the genetic interpretation process. Our Customers are solely responsible for determining whether and how they wish to use our Services and for ensuring that the appropriate legal bases for the processing of Submitted Data have been established by the Customer prior to using the Services, including providing all necessary notices, and collection all consents, as required under privacy and data protection laws.
For the purposes of the California Consumer Privacy Act (“CCPA“), in the last 12 months, we have collected the following categories of personal information, as defined in the CCPA: identifiers; customer record information; internet or other electronic network activity information; professional or employment-related information; geolocation data; commercial information; audio, electronic, and visual information; and inferences. Genoox does not collect, use or disclose sensitive personal information under this Privacy Policy.
Categories of sources from which personal data is collected. We obtain personal data from the following categories of sources:
We use personal data for the following business and commercial purposes (and in reliance on the legal bases for processing noted next to them, as appropriate):
If you reside or are using the Services in a territory governed by privacy laws which determine that “consent” is the only or most appropriate legal basis for processing personal data (in general, or specifically with respect to the types of personal data you choose to share via the Services), your acceptance of our Terms and of this Privacy Policy will be deemed as your consent to the processing of your personal data for all purposes detailed in this Privacy Policy, to the extent permitted under law in such territory. If you wish to revoke such consent, please contact us by email at [email protected].
We and our authorized Service Providers (defined below) maintain, store and process personal data in the United States, Canada, the European Union, Israel, Australia, Japan and other locations as reasonably necessary for the proper performance and delivery of our Service, or as may be required by law.
While privacy laws between jurisdictions may vary, Genoox is committed to protect personal data in accordance with this Privacy Policy, customary and reasonable industry standards, and such appropriate lawful mechanisms and contractual terms requiring adequate data protection, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.
For data transfers from the European Economic Area, the UK and Switzerland, we will transfer your personal data only to such countries approved by the European Commission, FDPIC and UK Information Commissioner’s Office (ICO) respectively, as providing adequate level of data protection, or enter into Standard Contractual Clauses as approved by the relevant data protection authority. You can obtain a copy of these clauses by contacting us as indicated in Section 12 below.
We may retain your personal data for as long as it is reasonably needed in order to maintain and expand our relationship and provide our Services and offerings; in order to comply with our legal and contractual obligations; and to protect ourselves from any potential disputes (i.e., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with our data retention policy and at our reasonable discretion.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and the applicable legal requirements.
If you have any questions about our data retention policy, please contact us by e-mail at [email protected].
Disclosure of Derived Data or other anonymized information to third parties: We may disclose Derived Data to third parties for research or commercial activities. Third parties may include academic researchers or commercial entities. Recipients of such Derived Data are contractually prohibited from attempting to re-identify an individual relating to it. For the avoidance of doubt, Genoox does not share any identifiable personal data of Service Recipients with third parties for the purposes mentioned in this section.
Franklin Community: Some of the Genoox Services enable a User to connect and share information with other Users. Any information you may submit for this purpose – including your User Profile – may be visible to other Users of the Platform. Due to the public nature of such forums, your posts and certain profile information may remain available even after you terminate your User Profile.
Service Providers: We engage selected third-party companies and individuals to perform services complementary to our own. Such service providers include providers of hosting and server co-location services, communications and content delivery networks (CDNs), data and cyber security services, billing and payment processing services, fraud detection, investigation and prevention services, web and mobile analytics, e-mail and communication distribution and monitoring services, session or activity recording services, remote access services, performance measurement, data optimization and marketing services, social and advertising networks, content providers, e-mail, voicemails, support and customer relation management systems, and our legal, compliance and financial advisors (collectively, “Service Providers”). These Service Providers may have access to your personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services, and may only use it for such limited purposes as determined in our agreements with them.
Customers and other Users: Your personal data may be disclosed to the Customer to which you are subscribed as a User (including data and communications concerning your User Profile).
Protecting Rights and Safety: We may disclose your personal data to others if we believe in good faith that this will help protect the rights, property or personal safety of Genoox, any of our Users or Customers, or any members of the general public.
Legal Compliance: We may disclose or allow government and law enforcement officials access to your personal data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect the security or integrity of our products and services.
Genoox Subsidiaries and Affiliated Companies: We disclose personal data internally within our group of companies, for the purposes described in this Privacy Policy. In addition, should Genoox or any of its subsidiaries or affiliates undergo any change in control, including by means of merger, acquisition or purchase of substantially all of its assets, your personal data may be shared with the parties involved in such an event. If we believe that such change in control might materially affect your personal data then stored with us, we will notify you of this event and the choices you may have via e-mail or prominent notice on our Services.
Additional Disclosures: For the avoidance of doubt, if we are legally obligated to do so, Genoox may disclose your personal data in accordance with such legal obligations. Additionally, we may also disclose your personal data subject to your consent (where applicable). Notwithstanding the above, if we have successfully de-identified or anonymized such data so that is no longer identifiable, we may transfer, share or otherwise use such data at our sole discretion and without the need for further approval.
For the purposes of the CCPA, in the past 12 months, we may have disclosed identifiers; customer record information; internet or other electronic network activity information; professional or employment-related information; geolocation data; commercial information; audio, electronic, and visual information; and inferences to Service Providers, for Legal Compliance, to our Customers and other Users, to Protect Rights and Safety or to Genoox Subsidiaries and Affiliated Companies.
Based on your engagement with the Platform, we may have disclosed identifiers, customer record information, professional or employment-related information, geolocation data, internet or other electronic network activity information, and inferences to the Franklin Community. We did so in pursuit of the business and commercial purposes described in Section 2 above.
We and our Service Providers use cookies and other similar technologies to enable and improve the Services we provide, to track the performance of our Sites, perform analytics and gain insights on the use of our Services and the performance of our activities, and for personalization purposes including personalization of ads if we have obtained your consent, where required. To learn more about our practices concerning cookies and tracking, please contact us at [email protected].
Cookies are packets of information sent to your web browser and then sent back by the browser each time it accesses the server that sent the cookie. Some cookies are removed when you close your browser session. These are the “Session Cookies”. Some last for longer periods and are called “Persistent Cookies”. We use both types.
Some cookies are necessary for the Services to function properly, and cannot be declined or disabled unless you delete and block them through your web browser settings. Other cookies, which are used for functional, performance, analytics and marketing purposes, are optional. You may opt in to or opt out from the use of optional cookies through the “Your Privacy Choices” feature available on our website, depending on your location and activity on our Services, as applicable. If you choose to opt out of certain cookies, this will typically generate a new cookie which will preserve your choice, and indicate it to our Services in your next visit so that the cookies you opted out of will not be utilized. You can also manage your cookies preferences, and accept, remove or entirely block cookies, through your browser settings..
Please note that we do not change our practices in response to a “Do Not Track” signal in the HTTP header from a browser or mobile application, however, most browsers allow you to control cookies, including whether or not to accept them and how to remove them. You may set most browsers to notify you if you receive a cookie, or to block or remove cookies altogether.
We also use the web analytics tool Google Analytics. This tool helps us understand users’ behavior on our Services, including by tracking page content, and click/touch, movements, scrolls and keystroke activities. Further information about the privacy practices of our analytics service provider is available at: www.google.com/policies/privacy/partners. Further information about your option to opt out of this analytics service is available at: https://tools.google.com/dlpage/gaoptout.
Please note that if you get a new device, install a new browser, erase or otherwise alter your browser’s cookie file (including upgrading certain browsers), you may also clear the opt-out cookies installed once you opt out, so an additional opt-out will be necessary to prevent additional tracking.
Service Communications: We may contact you with important information regarding our Services. For example, we may send you notifications (through any of the means available to us) of changes or updates to our Services, billing issues, service changes, log-in attempts or password reset notices, etc. You can control your communications and notifications settings from your User Profile settings. However, please note that you will not be able to opt-out of receiving certain service communications which are integral to your use (like password resets or billing notices).
Promotional Communications: We may also notify you about new features, additional offerings, events and special opportunities or any other information we think our Users will find valuable. We may provide such notices through any of the contact means available to us (e.g. phone, mobile or e-mail), through the Services, or through our marketing campaigns on any other sites or platforms. If you do not wish to receive such promotional communications, you may notify Genoox at any time by sending an e-mail to [email protected], changing your communications preferences in your User Profile settings, or by following the “unsubscribe”, “stop”, “opt-out” or “change e-mail preferences” instructions contained in the promotional communications you receive.
In order to protect your personal data held with us, we are using industry-standard physical, procedural and technical security measures, including data encryption, user authentication, monitoring and access permissions as appropriate. Our commitment to security is further supported by our ongoing, annually reviewed ISO 27001 certification and independent annual penetration testing. However, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any third parties as described in Section 5 above.
Individuals have rights concerning their personal data. Please contact us by e-mail at: [email protected] if you wish to exercise your privacy rights under any applicable law, including the EU or UK General Data Protection Regulation (“GDPR”), the CCPA, and other similar laws – to the extent applicable – the right to know/request access to (specific pieces of personal data collected; categories of personal data collected; categories of sources from whom the personal data was collected; purpose of collecting personal data; categories of third parties with whom we have shared personal data), to request correction or erasure of your personal data held with Genoox, or to restrict or object to such personal data’s processing (including the right to direct us not to sell or share your personal data to third parties now or in the future, as described below), or to port such personal data, or the right to equal services and prices (e.g. freedom from discrimination) (each to the extent available to you under the laws which apply to you). Under some regulatory frameworks, such as the GDPR, you may also have the right to lodge a complaint with the relevant supervisory authority, as applicable. These rights are also subject to various exclusions and exceptions under applicable laws. We will not charge a fee to process or respond to your verifiable privacy request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. Alternatively, we may refuse to comply with your request in such circumstances.
To the extent applicable to you, you may also designate an authorized agent, in writing or through a power of attorney, to request to exercise your privacy rights on your behalf. The authorized agent may submit a request to exercise these rights by emailing us.
When you or an authorized agent ask us to exercise any of your rights, we may need to ask you to provide us certain credentials to make sure that you are who you claim you are, to avoid disclosure to you of personal data related to others and to ask you to provide further information to better understand the nature and scope of data that you request to access. If your request relates to personal data contained in Submitted Data (i.e., personal data we process on our Customer’s behalf as its “data processor” or “business associate”, as further explained in Section 10 below), such Customer exclusively determines how the data may be processed, as well as if and how your request should be handled. In such circumstances, we advise that you submit your request directly to them.
We may redact from the data which we will make available to you, any personal data or confidential information related to others.
Certain data protection laws and regulations, such as the GDPR or HIPAA, typically distinguish between two main roles for parties processing personal data: the “data controller” (or under the HIPAA, “covered entity”), who determines the purposes and means of processing; and the “data processor” (or “business associate” where HIPAA applies), who processes the data on behalf of the data controller (or “covered entity” where HIPAA applies). Below we explain how these roles apply to our Services, to the extent that such laws and regulations apply.
Our role as a data controller: Genoox is the “data controller” of Sites, CRM & Prospect Data, and User Data. With respect to this data, Genoox assumes the responsibilities of data controller (solely to the extent applicable under law), as set forth in this Privacy Policy.
To the extent that Derived Data may be considered under Data Protection Laws as including personal data, Genoox will take the role as the controller. For the avoidance of doubt, given current technological developments, such information does not allow for the identification of specific Service Recipients, based on the data.
Our role as a data processor (or business associate where applicable): Genoox is the “data processor” of Submitted Data. Submitted Data will only be processed by Genoox on behalf of our Customer. Accordingly, our Customer shall be deemed the “Data Controller” of such data, and Genoox will process such data on the Customer’s behalf, as its “Data Processor”, in accordance with its reasonable instructions, subject to our Terms, our Data Processing Agreement or Business Associate Agreement (each, to the extent applicable) and other commercial agreements with such Customer. Genoox’s relevant Service Providers shall act as designated Sub-Processors in these instances. The Customer will be responsible for meeting any legal requirements applicable to Data Controllers (such as establishing a legal basis for processing, providing data subjects with sufficient information about their personal data, and responding to Data Subject Rights requests concerning the personal data they control).
If you would like to make any requests or queries regarding personal data we process as a Data Processor on our Customer’s behalf, including accessing, correcting or deleting your data, please contact the Customer directly.
Under some US data protection laws, like the CCPA, our disclosure of certain internet activity and device information to third parties through cookies may be considered a “sale” or “sharing” of personal information. We do so in pursuit of the business and commercial purposes described in Section 2 above.
For the purposes of the CCPA, in the last 12 months we have “sold” or “shared” internet or other electronic network activity information, geolocation data, and commercial information with our analytics and advertising partners. Genoox has not knowingly sold or shared the personal information of individuals under the age of 16.
You may opt out of all cookies that may result in a “sale” and/or “sharing” of your personal information in the following ways:
Please note: If you visit us from a different device or browser, or clear cookies, then you need to return to this screen to re-select your preferences.
Third Party Websites and Services: Our Services include links to third party websites, and integrations with Third Party Services (as defined in the Terms). Such websites and Third Party Services, and any information you process, submit, transmit or otherwise use with or to such websites and Third Party Services, are governed by such third party’s terms and privacy practices and policies, and not by this Privacy Policy. We encourage you to carefully read the terms and privacy policies of such website and Third Party Services.
Our Service is not directed to children under the age of 18: We do not knowingly collect personal data from children and do not wish to do so. If we learn that a person under the age of 18 is using the Services, we will attempt to prohibit and block such use and will make our best efforts to promptly delete any personal data stored with us with regard to such child. If you believe that we might have any such data, please contact us by e-mail at [email protected].
Data Protection Officer: Genoox has appointed PrivacyTeam Ltd. as our Data Protection Officer (DPO), for monitoring and advising on Genoox’s ongoing privacy compliance and serving as a point of contact on privacy matters for data subjects and supervisory authorities. If you have any comments or questions regarding our Privacy Policy, if you have any concerns regarding your privacy, or if you wish to make a complaint about how your personal data is being processed by Genoox, you can contact [email protected].
EU Representative: Genoox has appointed a representative in the European Union for data protection matters pursuant to Article 27 of the GDPR. Genoox’s EU Representative may be contacted only on matters related to the processing of personal data of EU residents, at [email protected].
Questions, concerns or complaints: If you have any comments or questions regarding our Privacy Policy, or if you have any concerns regarding your personal data held with us, please contact Genoox’s support at [email protected]. If you are a GDPR-protected individual, you also have the right to lodge a complaint with an EU or UK supervisory authority, as appropriate.
