Privacy Policy

Lumagen (Helix Reserve LLC, “we,” “us”) is the provider of a free service that helps you record your family health history and, optionally, a hereditary-cancer genetic test result you already have, and produce a document you may choose to share with your own healthcare providers. This policy explains what information we collect, how we use and share it, and the choices you have.

• We collect only what we need to operate the Service: account identity, the gene and variant you optionally enter, basic demographics that sharpen interpretation, and the family health history you build.
• Identifiable Protected Health Information (PHI) and identifiable genetic information are not sold and not licensed to third parties for their independent use.
• You can access, correct, export, or delete your information at any time by writing to hello@lumagen.me.

You provide

• Account identity. Email address (used for sign-in via single-use magic link and for communications).
• No payment information. The Service is free. We do not collect or store payment card numbers, billing addresses, or any other payment instrument, and we do not use a payment processor.
• Profile demographics. Sex assigned at birth, race (self-identified, multi-select), ethnicity, and date of birth. These are clinical inputs that sharpen interpretation, not marketing fields.
• Your result. The gene and variant you enter (including any Variant of Uncertain Significance entered as free text), the classification source, and ClinVar identifiers when applicable.
• Family health history. A name-free graph of relatives, their lineage, sex, living status, age, and any recorded cancer diagnoses (controlled vocabulary). The graph is snapshotted on material change for auditability.
• Questions for your doctor. Notes you keep to discuss at a clinical visit.

We generate

• Criteria evaluation. When your family health history changes, we evaluate it against clinical criteria and store the outcome - which criteria matched, and the relatives and diagnoses that satisfied them. This is kept so the result is explicable later; it is not shown to you in detail, and it is not shared outside Lumagen.
• Notifications. In-app and email notifications, their status, and a small payload describing the channel result (for example, the Paubox delivery identifier).
• Documents. The PDF prepared for your clinician, stored in private object storage and accessible to you via short-lived signed URLs.
• Audit logs. References (actor, action, resource id, timestamp) describing every read and write of clinical data. Audit logs never contain the underlying PHI values.

We collect from your device and use

• Standard server logs (IP address, user agent, request path) used to operate the Service, detect abuse, and meet security obligations. We do not run advertising trackers.
• Standard authentication cookies set by Supabase Auth.

• To provide the Service: record what you enter, build your family health history, read it against published criteria, prepare the document you can take to a clinician, and route notifications about your account.
• To communicate with you about your account and material updates to these policies. We do not send notifications about your result, because we do not monitor it.
• To secure the Service, detect and prevent abuse, and satisfy legal obligations.
• To improve the Service in a manner consistent with this policy, including the uses described in Section 13.

Where the EU or UK GDPR applies, we process personal data on the following bases: performance of our contract with you; your explicit consent (for special-category data, including genetic and health data); our legitimate interests in operating and securing the Service; and compliance with legal obligations.

We share personal information only with the following categories of recipients:

• Lumagen staff. Staff can view account records - including your family health history and any result you record - through an internal admin console, for support and quality purposes. Access is logged. No review by staff is required for you to use any part of the Service.
• HIPAA-eligible service providers under Business Associate Agreements: our hosted database (Supabase, HIPAA-eligible tier), our HIPAA email provider (Paubox), and our hosting (Vercel). Each provider is limited to its stated function.
• No AI providers. The Service sends nothing to any artificial-intelligence provider. Criteria evaluation is deterministic and runs entirely on our own systems.
• ClinVar / NCBI. We query ClinVar to populate the variant picker and the educational content it backs. These calls reference variant identifiers only, not your identity.
• As required by law, in response to lawful requests, subpoenas, or court orders, or to protect rights, property, or safety where permitted by law.
• Successors in a business transaction (merger, acquisition, financing, sale of assets), in which case we will require recipients to honor commitments at least as protective as this policy.

We do not sell or rent identifiable personal information, identifiable PHI, or identifiable genetic information for monetary or other valuable consideration.

You can generate a document at any time. It states what you entered, which published criteria your family health history matches, and the guideline those criteria come from, with a link to it. No clinician reviews it before you receive it. We do not send it to your clinician for you; it is yours, to share when and how you choose.

We follow the HIPAA Security Rule for PHI we hold. Practices include row-level security on every clinical table, owner-scoped access policies, service-role boundaries audited at the application layer, encrypted transit and at-rest storage, short-lived signed URLs for private documents, and HIPAA email delivery via Paubox. No security program is perfect, and we cannot guarantee absolute security; we will notify affected individuals and regulators of any reportable incident as required by law.

We retain personal information for as long as your account is active and for a period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Family-history snapshots and audit logs are retained for as long as the underlying account exists, or as required by law. On account deletion, we delete or de-identify your information within a reasonable period, subject to legal retention requirements.

Depending on where you live, you may have the right to access, correct, export, delete, or restrict the processing of your personal information; to withdraw a consent you previously gave us; and to lodge a complaint with a supervisory authority. To exercise these rights, write to hello@lumagen.me from the email address associated with your account.

California residents have additional rights under the California Consumer Privacy Act (CCPA / CPRA), including the right to know, the right to delete, the right to correct, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights. We do not sell personal information for monetary consideration; for purposes of the “sharing” concept under CCPA, we do not share personal information for cross-context behavioral advertising.

For EU/UK residents, you have rights under the GDPR including access, rectification, erasure, restriction, portability, and objection.

Genetic information is sensitive. We treat it with extra care: it is encrypted, access is owner-scoped, Lumagen staff can see it only inside an audited internal console, and we do not provide it to insurers, employers, schools, advertisers, or data brokers. We support your ability to delete or export your genetic information at any time. We comply with the federal Genetic Information Nondiscrimination Act (GINA) and applicable state laws.

The Service is for adults. Creating an account requires you to be 18 or older, and the date of birth you give is checked against that. We do not knowingly collect personal information from anyone under 18.

The Service also does not hold health information about minors belonging to anyone else. You may record an adult son or daughter as part of your family health history, and the Service will not accept an age under 18 for them. You should not enter a minor’s information by any other means.

If you believe a child has provided us information, or that a minor’s information has been entered, please write to hello@lumagen.me and we will delete it.

Lumagen is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and other countries where our service providers operate. Where required by law, we implement appropriate safeguards (such as the EU Standard Contractual Clauses) for cross-border transfers.

Information that has been de-identified is no longer information about you. Once the identifiers are removed in accordance with the standard described below, the resulting data cannot reasonably be linked back to any individual, and it is treated as Lumagen’s data rather than yours.

Subject to that standard, Lumagen may create, retain, use, disclose, and license de-identified and aggregated datasets derived from information processed through the Service, including in arrangements with third parties for consideration, and may combine such datasets with information from other users and from other sources. Typical purposes include operating and improving the Service, statistical and scientific research, and the development of clinical and research products.

De-identification is performed to the HIPAA standard at 45 C.F.R. § 164.514(b), by the Safe Harbor method or by expert determination. Lumagen does not attempt to re-identify de-identified information, and recipients are contractually prohibited from doing so or from attempting to contact any individual.

This Section does not authorise, and nothing in this policy permits, the sale or licensing of identifiable Protected Health Information or identifiable genetic information; the use of your information for advertising or ad targeting; or the disclosure of your identifiable information to data brokers, advertisers, employers, or insurers.

Your choice. You may withdraw your information from the uses described in this Section at any time by written request to legal@helix-reserve.com. Withdrawal takes effect prospectively from the date we action your request. Datasets already created cannot be amended, because de-identified data contains no link back to the individual it came from.

We may update this Privacy Policy from time to time. When we make a material change, we will give you reasonable advance notice (for example, by email or in-product notice) and update the “Effective” date above.

Privacy questions? Reach us at hello@lumagen.me. For HIPAA matters, please mark your message Attn: Privacy Officer.