Legal & Policies

1. Privacy at a glance

We use genetic information to deliver the testing and analysis you request. We do not sell genetic information or provide it to advertisers, employers or insurers. Research requires a separate choice. You may request access, correction, a copy or deletion through Contact Us, subject to records that law requires us to keep.

2. Who is responsible

Kepler Genomics Technology Limited is the company responsible for this Policy. Its business address is 香港香港仔黃竹坑道25–27號甄沾記大廈22樓23室. Laboratories and other providers may also have their own legal duties for information they process. Send privacy requests through Contact Us.

3. Information we collect

Depending on the service, we collect account and contact details; orders, payment status, sample identifiers and shipping records; information you provide to support; genetic data from a kit or a supported upload; report selections, consent records and information you choose to tell us about your health or family history. We also collect device and website activity through logs, cookies and similar technologies, as explained in our Cookie Policy.

Genetic and health information is especially sensitive. A person may sometimes be identified from genetic data even after direct identifiers are removed. We therefore do not treat removal of a name alone as full anonymization.

4. Why we use information

We use information to create and secure accounts, process orders and payments, coordinate sample handling, deliver the tests and reports you choose, answer requests, prevent fraud, maintain service quality and comply with law. Where European data-protection law applies, the legal basis depends on the purpose: performance of our contract, compliance with law, our legitimate interests in security and reliable service, or your consent for optional activities. Processing genetic or health data also requires an applicable special-category condition, such as explicit consent where required.

Research involving your identifiable genetic information requires a separate, specific choice. We do not make research consent a condition of receiving the service you ordered. If an optional feature uses AI to process your information, we show a separate notice before you choose to use it.

5. Who receives information

We provide only information needed for the relevant task to laboratories, shipping providers, payment processors, hosting and security providers, customer-support tools and providers you authorize to run a Marketplace service. We may also disclose information when a valid legal obligation requires it or when necessary to protect rights and safety. We do not provide genetic information to advertising or data-broker companies, public genetic databases, employers or insurers.

Website analytics or advertising partners may receive device identifiers or browsing activity. Under some U.S. state laws, this may count as a sale, sharing or targeted advertising even if no money changes hands. We do not use genetic information for that purpose. See our Do Not Sell or Share page for the available opt-out route.

6. Retention, samples and deletion

The laboratory discards the physical sample after sequencing. Identifiable raw sequencing files held for delivery are ordinarily deleted within 30 days after sequencing, unless a particular record must be retained by law. For the Mainland China service, identifiable sequencing data are stored on servers in Mainland China for up to 30 days after sequencing; you may request earlier deletion. Please download any file you want to keep before its stated deadline.

Account and order information may be needed for the life of the account or a transaction. The laboratory may retain the minimum test, quality and identifying records required by laws that apply to that test, for the required period. Kepler may keep limited deletion-request, transaction and legal records to document compliance or resolve claims. A deletion request does not erase records during a mandatory retention period; we restrict their use and delete or de-identify them when retention is no longer necessary.

7. Your choices and how to request them

Through Contact Us, you may request access to your personal information, correction, a copy or deletion, withdraw a consent or exercise an applicable opt-out right. We may ask for information reasonably needed to verify your identity, and an authorized representative may act for you where law permits. We respond within the period required by applicable law. If we deny a request or an appeal right applies, we explain the available next step where required.

Withdrawing consent does not affect processing already lawfully completed. Some data cannot be deleted immediately because of a legal obligation or another lawful exception. We will not unlawfully discriminate against you for exercising privacy rights.

8. European Economic Area

Where the EU General Data Protection Regulation (GDPR) applies, Kepler acts as a controller for the processing described in this Policy. The purpose and legal basis for each use are described in Section 4. Genetic and health information receive the additional protection required for special-category data; where explicit consent is the applicable condition, you may withdraw it without affecting earlier lawful processing.

You may request access, rectification, erasure, restriction and portability; object to processing based on legitimate interests; and object to direct marketing at any time. You may complain to a data-protection authority in the EEA. These rights are subject to the conditions and exceptions in the GDPR.

9. United Kingdom

Where the UK GDPR and Data Protection Act 2018 apply, the purposes, legal bases and special-category safeguards described above also apply under UK law. You may request access, rectification, erasure, restriction and portability, object to eligible processing, withdraw consent and complain to the UK Information Commissioner's Office. UK statutory conditions and exceptions apply.

10. Switzerland

Where Switzerland's Federal Act on Data Protection applies, you may request information about our processing, correction or deletion of inaccurate or unlawfully processed data, and data portability where the Act provides it. You may object to processing and contact the Swiss Federal Data Protection and Information Commissioner. Swiss statutory conditions and exceptions apply.

11. United States: California and other states

Where applicable, we honor the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable state privacy laws. These include the Colorado Privacy Act, Connecticut Data Privacy Act, Florida Digital Bill of Rights, Indiana Consumer Data Protection Act, Iowa Consumer Data Protection Act, Montana Consumer Data Privacy Act, Oregon Consumer Privacy Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act and Virginia Consumer Data Protection Act. Washington residents may also have rights under the My Health My Data Act. This list does not limit rights under other applicable state laws.

Depending on the law that applies, you may request to know or access personal information, correct or delete it, obtain a portable copy, opt out of covered sale, sharing or targeted advertising, limit certain uses of sensitive information, and appeal a denied request. California residents may also submit a request through our Do Not Sell or Share page. We do not sell genetic information or penalize you for exercising an applicable privacy right.

California's Genetic Information Privacy Act and Virginia's Genetic Data Privacy law provide additional protections for direct-to-consumer genetic data, including rights concerning consent, access and deletion where applicable. Nevada residents may direct an eligible website operator not to sell covered personal information under Nevada law. Contact Us to exercise these rights or raise a genetic-data privacy concern.

Device and browsing information disclosed for analytics or advertising may be treated as a sale or sharing under some state laws even if no money changes hands. We do not use genetic information for that purpose. An opt-out does not prevent processing needed to deliver a requested service, maintain security or comply with law.

12. Mainland China

For our Mainland China service, we treat genetic and health information as sensitive personal information. We explain the purpose and necessity of processing and obtain separate consent where required by the Personal Information Protection Law. You may ask to access, copy, correct or delete personal information, withdraw consent and ask us to explain our processing rules. Sequencing data for this service are held on servers in Mainland China for up to 30 days after sequencing and are not sent to our Hong Kong laboratory.

Account, payment and support information may have different processing locations. Before transferring any such information outside Mainland China, we provide the required notice and take the legal steps applicable to that transfer, including separate consent where required.

13. Hong Kong and Singapore

In Hong Kong, you may request access to and correction of personal data under the Personal Data (Privacy) Ordinance. We do not retain personal data longer than needed for its purpose unless law requires or permits continued retention. In Singapore, where the Personal Data Protection Act applies, you may request access or correction and withdraw consent subject to that Act. Use Contact Us for either request.

14. International processing

Transfers from the EEA, UK or Switzerland that require additional protection use a transfer mechanism recognized by the law of the originating region, such as an adequacy decision or appropriate contractual safeguards. We assess the transfer before it occurs and can explain the mechanism relevant to your information on request.

The location of processing depends on the service. Samples routed to our Hong Kong laboratory are processed in Hong Kong. Sequencing data for our Mainland China service remain on servers in Mainland China as described above. Account, payment, support, security and website providers may operate in other locations. We limit transfers to what is needed and apply the notice, consent and transfer safeguards required for the particular transfer. Contact Us to ask which locations and safeguards apply to your service.

15. Security and genetic risks

We use administrative, technical and organizational safeguards suited to genetic information, including restricted access and protections for information in transit and at rest. No system can guarantee absolute security. Genetic results may reveal unexpected facts about you or relatives; unlike a password, genetic information cannot be changed after a breach. Please protect downloaded files and share results only with people you trust.

16. Children, updates and contact

Our services are not directed to children who cannot lawfully consent. A parent or guardian must provide any authorization required for a minor. We identify the revision date when this Policy changes and provide additional notice for material changes where required. Submit privacy requests through Contact Us or write to Kepler Genomics Technology Limited at 香港香港仔黃竹坑道25–27號甄沾記大廈22樓23室.