Privacy Policy

This Privacy Policy explains how NextGen PGx (“we,” “us,” or “our”) collects, uses, discloses, and protects your personal information when you use our website, purchase a pharmacogenomic (PGx) testing kit, activate a kit, use our patient portal, or otherwise interact with our services.

Because our services involve health-related information, some of your data is also protected under the Health Insurance Portability and Accountability Act (HIPAA). Where this Policy and our HIPAA Notice of Privacy Practices overlap, the HIPAA Notice controls with respect to protected health information (PHI).

• Identity and contact information: your name, email address, mobile phone number, and shipping/billing address.
• Order and payment information: product purchased, transaction amount, and the last four digits of your payment method (we never store full card numbers; they are handled by our payment processor).
• Health information (PHI): date of birth, ordering/referring provider details, kit activation details, specimen status, and your pharmacogenomic test results.
• Genetic data: the genetic variants analyzed by our laboratory partners in connection with your test, which are derived from the saliva (or other) sample you return to us.
• Technical information: IP address (captured for security and consent verification), device and browser type, pages visited, and referral or marketing attribution parameters (e.g., UTM tags).
• Communications: messages you send to our support team and support tickets you create in the patient portal.

• To process your order, payment, and any refunds.
• To manufacture, assign, ship, and track your testing kit.
• To verify your identity at kit activation and to record your consent (including the IP address and timestamp of consent acceptance).
• To route your specimen to a certified laboratory and return your results through the patient portal.
• To provide customer and clinical support, including replacement kits and recollections.
• To maintain an audit trail of who accessed or changed patient records, as required for HIPAA compliance.
• To comply with legal and regulatory obligations and to enforce our Terms of Service.

Your genetic data and health information receive heightened protection. They are stored separately from marketing data, access is restricted to the minimum necessary staff under role-based permissions, and every access is recorded in a tamper-resistant audit log.

We will not sell your genetic data, and we will not use your genetic data for marketing purposes. Your genetic data is analyzed only for the PGx variants needed to produce your report, unless you separately provide informed consent for any additional research use.

Genetic information may be protected from certain forms of misuse under federal and state laws, including the Genetic Information Nondiscrimination Act (GINA), which restricts the use of genetic information by employers and health insurers.

• Laboratory partners: certified laboratories that process your specimen and generate your results.
• Your healthcare provider: if you authorize us to share your results with a provider you designate.
• Service providers: payment processors, shipping carriers, and hosting/software vendors who help us operate the service, bound to protect your data and use it only on our behalf.
• De-identified or aggregate data: we may analyze de-identified data to improve our tests and services; such data is not reasonably linked back to you.
• Legal purposes: when disclosure is required by law, court order, or to protect the rights and safety of you or others.
• Business transfers: in the event of a merger or acquisition, we will require the receiving party to honor this Privacy Policy.

We retain your records as required by applicable clinical laboratory and state record-retention laws (typically several years from the date of your result). After the retention period, we securely delete or anonymize your personal information.

You may request earlier deletion of your data, except where we are legally required to retain clinical records; in that case we will restrict its use to compliance purposes only.

We use encryption in transit and at rest, role-based access controls, server-side audit logging, and strict data isolation between accounts. Only authorized personnel can access patient data, and each role sees only the minimum information necessary to perform their job (for example, shipping staff never see test results).

Depending on your state of residence, you may have additional rights under state privacy laws. To exercise any right, contact us using the details in the Contact section below.

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate information.
• Deletion: request deletion of your personal information, subject to legal retention requirements.
• Portability: request an electronic copy of your data in a structured format.
• Consent withdrawal: withdraw consent for optional uses of your data at any time (this does not affect processing already completed).
• Non-discrimination: we will not discriminate against you for exercising any of these rights.

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how our site is used (for example, marketing attribution parameters that tell us which campaigns brought you to us). You can control cookies through your browser settings; disabling them may affect portal functionality such as staying logged in.

Our services are intended for adults aged 18 and older. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify patients of material changes by email or portal notice and post the updated version with a new “Last updated” date. Continued use of our services after changes take effect constitutes acceptance of the updated policy.

NextGen PGx Privacy Office · Email: privacy@nextgenpgx.com · Or write to us through the Support section of your patient portal.

For HIPAA-related questions or complaints, see our HIPAA Notice of Privacy Practices.