Updated November 27, 2023
- TYPES OF INFORMATION WE COLLECT
1.1 Information You Provide Us Directly. We may collect information related to you, including, but not limited to your username, first and last name, e-mail, password, phone number, and mailing address, credit card information, when you create an account to log in to our network or at other times. If you provide us with feedback or contact us via email, we will collect your name and email address, as well as any other content included in the email, to send you a reply, and any information that you submit to us, such as a resume. For customers who engage us for our testing services, we may also collect basic information to perform the applicable service and/or test. This information may include but is not limited to date of birth, gender, blood transfusion and bone marrow transplant history, height and weight. This information is used to provide accurate and complete testing results applicable to the test requested by the client. We may also collect information that is necessary for our legitimate interests, which will be disclosed to you at the time of collection. DDC will use this information for the purposes of which it was collected.
- USE OF YOUR DATA
2.1 General Use. In general, information you submit to us is used either to respond to requests that you make, or to aid us in serving you better. DDC uses your information to facilitate the creation of and secure your account on our network; identify you as a user in our system; provide improved administration of our website and services; improve the quality of experience when you interact with our website and services; send you administrative e-mail notifications; respond to your inquiries related to employment opportunities or other requests; to enhance our website for optimal user experience; to monitor the usage and performance of our website and services; to facilitate transactions and process payments; to provide maintenance, support, and customer service for our site; to conduct research and analysis; and to fulfil other legitimate purposes permitted by applicable law.
2.2 Use of your Testing Information. We will only use your Testing Information in order to provide you the services you have requested, process your order, and respond to any order or billing related questions.
2.3 Creation of Anonymous Data. We may create anonymous data records from information (including without limitation, Testing Information) by excluding information (such as your name) that makes the data personally identifiable to you. We use this anonymous data to analyze request and usage patterns so that we may enhance the content of our services and improve site navigation. DDC reserves the right to use anonymous data for any purpose in its discretion.
- DISCLOSURE OF YOUR INFORMATION
3.2 Services Providers. We may share your information with agents to the extent necessary for them to provide their products and services to us, or to provide you with the products and services that you have requested. For example, if you engage us for testing services through a local laboratory, the laboratory is acting as our agent. Other examples include, database storage, file storage and file destruction, hosting services, marketing assistance, analyzing user data, processing payment card information, and for other legitimate purposes permitted by applicable law.
3.3 Business Partners. We may partner with other companies and individuals with respect to particular products or services. These third parties may be provided access to your information needed to perform their function. To restrict sharing of information with these third parties for their marketing purposes, please see the section below titles “Your Choices and Rights Regarding Your Information.”
3.4 Other Disclosures. Regardless of any choices you make regarding your information (as described below), DDC, may disclose information if it believes in good faith that such disclosure is necessary to (a) comply with relevant laws or to respond to subpoenas or warrants served on DDC; (b) protect or defend the rights or property of DDC, or users of our services; (c) to protect against fraud or for risk management purposes; or (d) or to honor a request that you have made to DDC.
- THIRD PARTY WEBSITES
- YOUR CHOICES REGARDING YOUR INFORMATION
5.2 Withdrawal of Consent You have the right to withdraw your consent to processing that is currently underway with your consent. Consent can be withdrawn by sending an email. Without your consent, DDC will use information, only insofar as such processing is permitted by applicable law (e.g., for the performance of an Agreement between DDC and you) or where such processing is necessary for compliance with a legal obligation to which DDC is subject.
5.3 Accessing, deleting and updating your information. At your request, we will inform you of what personal information we have on file. In accordance with applicable data protection laws, you may have the right to request: access to, rectification, and erasure of your personal information; restriction of processing of personal information; objecting to certain processing of personal information; and the right to data portability. To exercise your rights under these provisions, please contact us at the “Contact Information” details below. When we receive your requests, we will ask you to verify your identity before we can act on your request. We may withhold information where the search for that information would require disproportionate effort or have a disproportionate effect to, for example, the cost of providing the information, the time it would take to retrieve the data, or how difficult it may be to obtain the information requested. Please note that we may be required (by law, accrediting bodies, or otherwise) to keep this information and not delete it (or to keep this information for a certain time, in which case we will comply with your deletion request only after we have fulfilled such requirements). Please be advised that by deleting your personal information, it will limit or eliminate our ability to provide future communication or explanation regarding any products or services, test results or other offerings in connection with DNA Diagnostics Center. Please be further advised that after your personal information is deleted, residual copies may take a period of time before they are deleted from all latent and backup systems.
- RETENTION OF DATA
The data you provide to us may be necessary to carry out tasks prior to testing, such as verifying identity or payment details when signing in to use an account. We retain the required data based on testing regulatory requirements and other standards, such as meeting our financial obligations and to carry out our responsibilities and enforce our rights arising from service agreements entered into between you and us. The following summarizes the data retention timeframes based on two main categories of testing.
Legal/Chain of Custody/Accredited Tests-We store your samples for a minimum of six months or according to contractual and legal requirements, if longer. All accompanying data and records associated with these tests are maintained as required by accrediting bodies, which is a minimum of five years or longer in some instances as required by law. The New York Department of Health requires all testing records be maintained for a period of 7 years. All such accompanying data will be destroyed following the minimum timeframes at intervals annually thereafter.
Non-Legal/Non-Chain of Custody Tests-We store your samples for a period of 6-8 weeks or according to contractual and legal requirements if longer. All accompanying data and records associated with these tests are maintained for a minimum period of one year and will be destroyed at intervals annually thereafter.
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent: this information will not be shared with third parties.
- SECURITY OF YOUR INFORMATION
We are committed to protecting the security of your information. We use a variety of reasonable security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. Access to your personal information is limited and we take reasonable measures to ensure that your personal information is not accessible.
- DISPUTE RESOLUTION
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, DDC commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact DDC at:
1 DDC WAY
FAIRFIELD OH 45014
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, DDC commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.
- A NOTE TO USERS OUTSIDE OF THE UNITED STATES
- CONTACT INFORMATION
1 DDC WAY
FAIRFIELD OH 45014
If DDC needs, or is required, to contact you concerning any event that involves information about you, we may do so by email, telephone, or mail.
Revised November 27, 2023
EU-U.S. Data Privacy Framework (DPF) Policy
Updated November 27, 2023
Compliance & Principles
This EU-U.S. Data Privacy Framework Policy (“Policy”) outlines how DDC and its subsidiaries, branches, divisions, and business units in the United States, collect, use and disclose certain Personal Data that we receive in the United States from the European Economic Area (“EEA”), and the choices affected individuals have regarding DDC’s use of, and the individual’s ability to correct that information. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Protecting the privacy of its clients is important to DDC. DDC has elected to participate in the EU-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce regarding Personal Data transferred to the United States from European Economic Area member states. DDC has certified that it adheres to the EU-U.S. Data Privacy Framework Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability.
For the purposes of enforcing the EU-U.S. Data Privacy Framework, DDC is subject to the investigatory and enforcement powers of the Federal Trade Commission (“FTC”).
The following definitions apply throughout this Policy:
Any third party that uses Personal Data provided to DDC to perform tasks on behalf of and under the instruction of DDC.
DNA Diagnostics Center, its subsidiaries, branches, divisions, and business units in the United States.
Any information or set of information that identifies a living individual or could reasonably be used to identify a living individual (in each case, whether alone or in combination with any other information in the possession, or likely to come into the possession of DDC).
Sensitive Personal Data
Personal Data that reveals racial or ethnic origin, political opinions, religious beliefs (or beliefs of a similar nature), trade union membership, physical or mental health or condition, sexual life, the commission or alleged commission of any offence or any proceedings for any offence committed or alleged to have been committed. In addition, DDC will treat as Sensitive Personal Data genetic data and any information received from a third party where that third party treats and identifies such information as sensitive.
Legitimate interests refer to a legal basis for processing personal data that is recognized under data protection regulations, such as the General Data Protection Regulation (GDPR) in the European Union. It allows organizations to collect and use personal information without explicit consent if they have a legitimate and justifiable reason for doing so, and if the individual’s interests, rights, and freedoms are not overridden by these interests.
If DDC receives Personal Data from its subsidiaries, affiliates, or other entities in the EEA, it will use such information in accordance with the notices such entities provided, and the consents or choices made by the individual about whom such Personal Data relates.
DDC will offer individuals the opportunity to choose (“opt-out”) whether their Personal Data is (a) to be disclosed to a non-Agent third party (unless allowed or required by contract), or (b) to be used for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual.
For Sensitive Personal Data, DDC will give individuals the opportunity to affirmatively and explicitly consent (“opt-in”) to the disclosure of the information to a non-Agent third party or the use of the information for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual.
Accountability for Onward Transfer
Upon request, DDC will grant individuals reasonable access to Personal Data that it holds about them. In addition, DDC will take reasonable steps to permit individuals to correct, amend or delete that information where it is inaccurate, incomplete or has been processed in violation of the Principles. These access rights may not apply fully in some cases, including where providing access is unreasonably burdensome or expensive under the circumstances or where it would violate the rights of someone other than the individual requesting access.
If you would like to request access to, correction, amendment or deletion of your Personal Data, you can submit a written request to the contact information provided below or email [email protected]. We may request specific information from you to confirm your identity. We will provide a copy of your personal data, but for any further data requested we may charge a reasonable fee based upon administrative costs.
Recourse, Enforcement and Liability
DDC may conduct internal compliance reviews of its relevant privacy practices to verify adherence to this Policy. Any employee that DDC determines is in violation of this Policy will be subject to disciplinary action up to and including termination of employment.
Any questions or concerns regarding the use or disclosure of Personal Data should be directed to the DDC Privacy Department at the address given below or email [email protected]. DDC will investigate and attempt to resolve complaints and disputes regarding the use and disclosure of Personal Data in accordance with the Principles contained in this Policy.
For complaints that cannot be resolved between DDC and the complainant, DDC has agreed to participate in dispute resolution using JAMS International (located in the United States) as a third-party resolution provider to resolve disputes pursuant to the DPF Principles. You may submit, at no charge to you, your complaint to JAMS for mediation under the JAMS International Mediation Rules, which are accessible on the JAMS website.
You may have the option to select binding arbitration for the resolution of your complaint under certain circumstances, provided you have taken the following steps: (1) raised your compliant directly with DDC and provided us the opportunity to resolve the issue; (2) made use of the independent dispute resolution mechanism identified above; and (3) raised the issue through the relevant data protection authority and allowed the U.S. Department of Commerce an opportunity to resolve the complaint at no cost to you. For more information on binding arbitration, see the U.S. Department of Commerce’s DPF (Binding Arbitration).
Limitation on Application of Principles
Adherence by DDC to these DPF Principles may be limited (a) to the extent necessary to meet national security, public interest, or law enforcement requirements; (b) by statute, government regulation, or case law that creates conflicting obligations or explicit authorizations, provided that, in exercising any such authorization, an organization can demonstrate that its non-compliance with the Principles is limited to the extent necessary to meet the overriding legitimate interests furthered by such authorization; or (c) if the effect of the Directive or Member State law is to allow exceptions or derogations, provided such exceptions or derogations are applied in comparable contexts. Consistent with the goal of enhancing privacy protection, DDC strives to implement these Principles fully and transparently, including indicating in our privacy policies where exceptions to the Principles permitted by (b) above will apply on a regular basis. For the same reason, where the option is allowable under the Principles and/or U.S. law, DDC will opt for the higher protection where possible.
Questions or comments regarding this policy should be submitted to:
Attn: Privacy Department—Data Privacy Framework
1 DDC Way
Fairfield, OH 45014
Changes to this Policy
This Policy may be amended from time to time, consistent with the requirements of the DPF Principles. DDC will post appropriate notice about such changes and amendments, including by updating the effective date at the top of this Policy.