Privacy Policy

Key terms used in this privacy policy

These plain-language definitions explain how we use a few words throughout this policy.

• Personal information means information that identifies you, relates to you, or could reasonably be linked to you, such as your name, contact details, order history, or device identifiers.
• Genetic information means your biological sample, the raw genetic data we generate from it, and the results and interpretation in your test report.
• Pharmacogenomic (PGx) testing means laboratory analysis of specific genes that influence how your body absorbs, processes, and responds to certain medications.
• Protected health information (PHI) means individually identifiable health information that is protected by HIPAA when we act as a covered health care provider.
• Biological sample means the saliva or cheek-swab specimen you collect with our kit and send to our laboratory.
• De-identified data means information stripped of the details that identify you, so it cannot reasonably be linked back to you.
• Service provider means a company that handles information on our behalf under a written contract that limits how it may use that information.
• Express consent means a clear, affirmative permission you give for a specific use of your information, separate from our general terms.

1. Who we are and what this privacy policy covers

RPh Labs (“RPh Labs,” “we,” “us”) provides pharmacogenomic testing that analyzes how your genes may affect your response to certain medications. Laboratory testing is performed in our CLIA-licensed, COLA-accredited laboratory in Dallas, Texas.

This privacy policy applies to information we collect through rphlabs.com, our ordering and results portals, sample collection kits, and communications with us. It does not cover third-party websites we link to.

2. Information we collect

Information you give us

• Identity and contact details: name, date of birth, sex assigned at birth, address, email, and phone number.
• Account information: login credentials and communication preferences.
• Health information: current and past medications, relevant medical history, and the name of your healthcare provider.
• Insurance and billing details: insurer, member ID, and payment information (card payments are handled by our payment processor; we do not store full card numbers).
• Consent and authorization records, and anything you send us through support requests or forms.

Your sample and genetic information

When you provide a saliva or cheek-swab sample, we extract DNA and analyze specific genetic variants related to drug metabolism and response. This produces your genetic data and test report. See how the test works.

Information from others

If a healthcare provider orders your test, we receive the information on the test requisition. We may also receive eligibility and claims information from your health insurer.

Information collected automatically

When you visit our website we collect standard technical data such as IP address, browser type, device information, pages viewed, and referring URLs, through cookies and similar technologies described in Section 7.

3. How we use your information

• To process your order, perform your test, and deliver results to you and your ordering provider.
• To verify your identity and match your sample to your account.
• To bill you or your insurer and process payments.
• To respond to questions and provide customer and genetic-counseling support.
• To maintain laboratory quality control, accuracy, and accreditation as required by CLIA and state law.
• To operate, secure, and improve our website and services.
• To send service messages such as kit shipping updates and result notifications.
• To send marketing emails, only where permitted and never using your genetic or health information. You can unsubscribe at any time.
• To comply with legal obligations and protect our rights.

4. How this privacy policy protects your genetic information

We give genetic data and biological samples a higher standard of protection than other information. Pharmacogenomic testing looks at a targeted set of genes rather than your whole genome, but DNA is still uniquely yours: it cannot be changed like a password, and parts of it are shared with your blood relatives. That is why the commitments below apply to every sample and every report, whether you ordered the test yourself or your provider ordered it for you.

• No sale. We do not sell, rent, or trade your genetic data or sample to anyone.
• Limited purpose. We use your sample only for the testing you authorized. We do not perform whole-genome sequencing or test for conditions outside the ordered panel.
• Consent for disclosure. Other than to your ordering provider, our service providers acting on our behalf, or as required by law, we will not disclose your genetic data without your express consent.
• Research is opt-in. We use de-identified genetic data or samples for research or product development only if you give separate, express consent. Declining has no effect on your test. You can withdraw consent at any time, and we will stop future use.
• Employers and insurers. We never share your genetic results with an employer or with a life, disability, or long-term care insurer. The federal Genetic Information Nondiscrimination Act (GINA) also restricts how health insurers and employers can use genetic information.
• Law enforcement. We do not voluntarily share genetic data with law enforcement. We disclose it only in response to a valid court order, warrant, or subpoena, and we will try to notify you first unless legally prohibited.

5. Health information and HIPAA

When we provide testing ordered by a healthcare provider or billed to insurance, the health information we handle is protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). For that information, our HIPAA Notice of Privacy Practices describes how we may use and disclose PHI and your rights under HIPAA. If this privacy policy and the Notice conflict for PHI, the Notice governs.

6. How we share information

We share personal information only as described here:

• Your healthcare provider, who ordered or is reviewing your test.
• People you authorize, such as a family member or another clinician you ask us to send results to.
• Service providers that help us operate, including laboratory partners, sample shipping carriers, cloud hosting, billing, and customer support. They may use information only to provide services to us and are bound by confidentiality obligations, including HIPAA business associate agreements where required.
• Health insurers, only as needed to bill for your test when you choose to use insurance.
• Legal and safety: when required by law, regulation, or valid legal process, or to protect the rights and safety of patients, RPh Labs, or others.
• Business transfers: if RPh Labs is involved in a merger, acquisition, or sale of assets, information may transfer to the successor, which must honor this privacy policy. Genetic data will not transfer without your consent where state law requires it.

We do not sell personal information or share it for cross-context behavioral advertising.

7. Cookies and tracking

We use cookies and similar technologies that are necessary for our website to work, to keep you signed in, and to understand site performance in aggregate. In practice they fall into three groups:

• Strictly necessary cookies run the shopping cart, checkout, and account login, and protect forms from spam. The site cannot work without them.
• Preference cookies remember choices such as a signed-in session, so you do not have to repeat them on every page.
• Analytics cookies tell us, in aggregate, which pages are visited and how the site performs, so we can fix problems and improve content.

We do not place advertising pixels or third-party tracking tools on pages where you order tests, log in, or view results. Any analytics we use on public pages is configured so it does not receive health or genetic information.

You can manage cookies through your browser settings. We honor Global Privacy Control (GPC) signals as a request to opt out of any non-essential tracking.

8. Samples and data retention

• Samples: We destroy your biological sample once your report is issued and any quality-control hold required by laboratory regulations has ended, unless you consented to storage for research or re-testing. You can ask us to destroy it sooner.
• Test records and reports: We keep these for the periods required by CLIA, accreditation bodies, and state law (CLIA requires at least two years), after which we securely delete them.
• Other information: We keep account and billing information only as long as needed for the purposes in this privacy policy, or as required for tax, accounting, and legal reasons.

If you request deletion, we will delete what we are legally allowed to. Some laboratory records must be kept by law; we will tell you if that applies.

9. How we protect your information

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls limited to staff who need it, de-identified sample labeling in the lab, audit logging, and staff privacy training. No system is completely secure. If a breach affects your information, we will notify you as required by law.

What you can do

You play a part in keeping your results private. Use a strong password that you do not reuse on other sites, sign out of your account on shared devices, and be careful about forwarding your report by email. We will never ask for your password by phone or email. If you think someone has accessed your account without permission, contact us right away.

10. Your privacy rights

Depending on where you live, you may have the right to:

• Know what personal information we have about you and get a copy in a portable format.
• Correct information that is inaccurate.
• Delete your account and personal information, subject to legal retention requirements.
• Have your biological sample destroyed.
• Withdraw any consent you’ve given, including research consent.
• Opt out of marketing communications.
• Appeal our decision if we deny your request.

How to make a request

Email privacy@rphlabs.com or call (888) 383-2181. We will verify your identity before acting on a request, which may include confirming details from your account or order, so it helps to have your order number or kit ID ready. You may use an authorized agent; we will ask for proof of their authority.

We respond within the time required by applicable law, typically 45 days. We will not discriminate against you for exercising your rights.

11. State-specific privacy rights

California

California residents have rights under the California Consumer Privacy Act (as amended by the CPRA) and the Genetic Information Privacy Act, including the rights described in Section 10 and the right to limit the use of sensitive personal information. We use sensitive personal information only for purposes permitted by law, such as providing the services you requested.

In the past 12 months we have not sold or shared personal information for cross-context behavioral advertising. The categories of information we collect, their sources, and their purposes are described in Sections 2 through 6.

Washington, Nevada, and Connecticut consumer health data

Residents of states with consumer health data laws, such as Washington’s My Health My Data Act, have additional rights over consumer health data, including the right to confirm whether we collect it, to access and delete it, and to withdraw consent to its collection or sharing. Contact us as described in Section 10 to exercise them.

Other states

Residents of states with comprehensive privacy or genetic privacy laws, including Colorado, Virginia, Texas, Florida, Illinois, and others, may exercise the rights available under those laws by contacting us as described above. See also the privacy answers in our FAQ.

12. Children

Our website is not directed to children under 13, and we do not knowingly collect information from them online. Testing for anyone under 18 requires authorization from a parent or legal guardian and must be ordered through a healthcare provider.

13. Changes to this privacy policy

We may update this privacy policy as our services or the law change. We will post the updated version here with a new “last updated” date. If we make a material change to how we use genetic information, we will ask for your consent before applying it to data we already hold.

14. Contact us about privacy

Questions about this privacy policy or your information? Reach our Privacy Officer, or use our contact page.

RPh Labs results are intended to be interpreted with a licensed healthcare provider.