Privacy Notice

This notice explains what MaxGen Labs ("we", "us") collects when you use the portal at https://portal.maxgenlabs.com, why, who can see it, how long we keep it, and the choices you have. It applies to patients, to practitioners and their staff, and to our own workforce. It sits beside our Notice of Privacy Practices, which describes your rights under HIPAA for health information we hold as a laboratory. Where the two overlap, the Notice of Privacy Practices governs health information.

What we collect

From patients. Your name, date of birth and email address, as given on the requisition or by the practice that ordered your test; your genotype results and the reports built from them; the symptoms you choose to record in the explorers; kits you link to your account and the family members they are for; the practices you choose to share reports with, and the exact text of each authorization and agreement you accept; messages and feedback you send us; and the record of your sign-ins and what you viewed, with the date, time and network (IP) address.

From practitioners and their staff. Your name, email address, practice, the names of the people on your practice's roster, your practice's logo and contact details if you upload them for printed summaries; the orders, kits, invoices and payments for your practice; the patients you open and what you view, download, print, invite and share, with the date, time and network address; the symptoms you record for a patient; the agreements you accept; and messages and feedback you send.

From our workforce. Your identity and role, and every action you take in the operations console, including previews of another person's portal.

Automatically. Your browser sends its type and version and your network address with every request. We use a session cookie to keep you signed in, a signed marker to log you out after fifteen minutes of inactivity, and, for staff using "View as", a cookie that records the preview. We do not use advertising cookies, third-party analytics, or tracking pixels.

Why we collect it

To deliver laboratory results and reports to the people entitled to them; to let practitioners manage orders, kits and invoices; to run the educational explorers; to keep the portal secure and to detect misuse; to meet our obligations under HIPAA, CLIA and state law, including the audit trail; to support you when you ask; and, in counts only, to see which features are used so we can improve them. We do not use your information for advertising, and we never sell it.

Who can see it

Patients' results are visible to the patient (through the email address on the account), to the practice that ordered the test, to MaxGen Labs staff who support the account, and in our audit record. If you share reports with another practice, that practice can see what you shared until you revoke it.

Service providers. The portal runs on Microsoft's Azure cloud, sign-in is handled by Microsoft Entra, and email is sent through our email delivery provider; each is bound by a written agreement to protect the information and to use it only to provide the service to us. Practitioner invoicing uses our accounting provider; it receives practice billing details, never patient results. We do not send genetic information to any of these providers beyond what hosting and delivery require.

When the law requires. We disclose information when a law, a court order or a public-health or health-oversight authority requires it, as the Notice of Privacy Practices describes.

Staff previews. To support you, a member of our staff may open a practitioner's or a patient's portal as that person would see it. Those previews are read-only, never save anything or accept anything on your behalf, and are recorded as the staff member's own actions.

How long we keep it

Access and audit records, including sign-in times and network addresses, are kept for at least six years. Technical request logs at our cloud provider are kept for ninety days. Genotype results and reports are kept so that you and your practitioner can use them, and until you ask us to delete them. Laboratory records that the law that governs clinical laboratories requires us to keep are kept for the time it requires. Feedback and messages are kept with the account they belong to.

Deleting your data

A patient can ask us to delete their genetic data, reports and account from Settings. There is a thirty-day grace period during which the request can be cancelled; after it we permanently delete the genotype results, reports, saved symptoms, kit claims, invitations, sign-in history, sharing links and preferences for that person. We keep a minimal record that a deletion occurred and the record of the agreements the person accepted; neither contains genetic data. Family members with their own sign-in control their own data.

Your choices and rights

You can see and download your own laboratory reports at any time. You can share reports with a practice and revoke that sharing. You can ask for a paper copy of any notice. You can ask us to delete your data. Your rights to access, amend and receive an accounting of health information, and to complain, are described in the Notice of Privacy Practices. Write to the Privacy Officer at help@maxgenlabs.com.

Children

Results for a person under 18 are held on a parent's or guardian's account, and the parent or guardian confirms their authority before those results open in the explorers. We do not knowingly let a minor open an account of their own.

Security

We protect information with encryption in transit and at rest, multi-factor sign-in, role-based access, a private network for our database, automatic sign-out after inactivity, a web application firewall, and an audit trail that is reviewed. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you as the law requires.

Changes

We will post the new version here with a new date at the top, and we will tell you in the portal when a change matters to you.

Contact

MaxGen Labs, the Privacy Officer: help@maxgenlabs.com.