Privacy Policy & Notice of Privacy Practices
Effective Date: June 13, 2026
1. Introduction
iXpressGenes, Inc. ("iXpressGenes," "we," "us," or "our") operates the website located at ixpressgenes.com (the "Site") and provides RNA-based clinical laboratory diagnostic services. This document serves as both our Privacy Policy and our Notice of Privacy Practices ("NPP") as required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH"). As a CLIA-certified clinical laboratory, iXpressGenes is a Covered Entity under HIPAA. This policy explains how we collect, use, protect, and disclose information—including Protected Health Information ("PHI")—when you or your authorized healthcare provider interacts with our Site or laboratory services. By using this Site or submitting samples or data to our laboratory, you agree to the practices described in this policy.
2. Our Responsibilities Under HIPAA
As a HIPAA Covered Entity, iXpressGenes is required by law to: • Maintain the privacy and security of your PHI; • Provide you with this Notice of Privacy Practices describing our legal duties and privacy practices with respect to your PHI; • Notify you in the event of a breach of your unsecured PHI, as required by HITECH; • Follow the terms of this notice currently in effect; and • Not use or disclose your PHI in ways that are not described in this notice without your written authorization, except as permitted or required by law. We reserve the right to change the terms of this notice and to make the new provisions effective for all PHI we maintain. If we revise this notice, we will post the updated version on this Site with a new effective date.
3. What Is Protected Health Information?
PHI is information that identifies you and relates to your past, present, or future physical or mental health or condition; the provision of health care to you; or the past, present, or future payment for health care. PHI includes, but is not limited to, your name, date of birth, contact information, test results, biomarker data, sample data, and any other information that could reasonably be used to identify you in connection with health care services.
4. Information We Collect
a. Protected Health Information (PHI)
In connection with our laboratory services, we may collect and process PHI including: • Patient identification information (name, date of birth, contact details); • Ordering provider information and test requisitions; • Biological samples and associated specimen data; • RNA biomarker data, assay results, and diagnostic reports; • Health history and clinical context submitted by ordering providers; and • Insurance and billing information where applicable.
b. Website Contact Form Data
When you submit our contact form, we collect your name, email address, and any message content you choose to include. This information is used solely to respond to your inquiry and is not used for marketing purposes.
c. Authentication Data
If you create an account or log in to any provider-facing area of the Site, we collect your email address and name. Passwords are securely hashed and are never stored in plain text.
d. Session and Storage Data
We use browser-based storage (localStorage/sessionStorage) to maintain your authentication session. This is a functional token required to keep you logged in and is not used for advertising or cross-site tracking. No third-party advertising cookies are set by iXpressGenes.
e. Research and Survey Data
Certain pages on the Site redirect to external survey instruments (currently administered via Microsoft Forms) in connection with authorized research or wellness programs, such as our YMCA study. All survey participants are adults (18 years of age or older). Any health-related data collected through these surveys is collected under iXpressGenes' authority as data controller, subject to this policy. Where a survey collects PHI, appropriate authorization or waiver of authorization is obtained in accordance with HIPAA requirements. Data submitted via Microsoft Forms is transmitted to and stored on Microsoft's infrastructure; however, iXpressGenes remains responsible for the data as data controller and retains it subject to this policy.
f. Usage Analytics
We may collect anonymized usage events (such as button clicks or page interactions) to improve the Site experience. This data does not include personally identifiable information and is not sold or shared with advertising networks.
5. How We Use and Disclose PHI
We may use and disclose your PHI for the following purposes without your written authorization, as permitted by HIPAA:
Treatment
We may use and disclose your PHI to provide, coordinate, or manage your health care and related services. This includes disclosing PHI to ordering providers, treating physicians, and other covered entities involved in your care.
Payment
We may use and disclose your PHI to obtain payment for laboratory services rendered, including submitting claims to health plans and verifying insurance eligibility.
Health Care Operations
We may use and disclose your PHI for our internal operations, including quality assessment, laboratory accreditation and CLIA compliance activities, training, legal services, and business management.
As Required by Law
We will disclose your PHI when required to do so by federal, state, or local law, including disclosures to public health authorities, law enforcement, and government oversight agencies.
Research
We may use or disclose PHI for research purposes only with your written authorization, or where an Institutional Review Board or Privacy Board has waived or altered the authorization requirement in accordance with 45 C.F.R. § 164.512(i). De-identified data (from which all HIPAA identifiers have been removed in accordance with 45 C.F.R. § 164.514) may be used for research, algorithm validation, product development, and internal analytics without restriction.
De-Identified and Aggregated Data
iXpressGenes may de-identify PHI in accordance with HIPAA Safe Harbor or Expert Determination standards (45 C.F.R. § 164.514(b)). Once de-identified, such data is no longer PHI and may be used for research, product development, quality improvement, and other lawful purposes. De-identified biomarker data may be retained indefinitely for these purposes.
Business Associates
We may disclose PHI to third-party vendors and service providers ("Business Associates") who perform functions on our behalf, provided we have entered into a HIPAA-compliant Business Associate Agreement ("BAA") with each such party. Current Business Associates include our laboratory information platform provider (Base44), our email delivery service (Resend), and such other vendors as may be engaged from time to time. We require all Business Associates to maintain appropriate safeguards for any PHI they access or process.
6. Uses and Disclosures Requiring Your Authorization
Except as described in Section 5, iXpressGenes will not use or disclose your PHI without your written authorization. In particular, we will not: • Sell your PHI; • Use your PHI for marketing purposes; or • Disclose psychotherapy notes, except as authorized by you or required by law. You may revoke your authorization at any time in writing. Revocation will not apply to uses or disclosures already made in reliance on your authorization.
7. Your Rights Regarding Your PHI
Right to Access
You have the right to inspect and obtain a copy of your PHI in our designated record set. Requests must be submitted in writing to info@ixpressgenes.com. We will respond within 30 days (or 60 days if we notify you of an extension).
Right to Amend
You have the right to request that we amend PHI you believe is incorrect or incomplete. We may deny the request in certain circumstances, but we will explain any denial in writing.
Right to Accounting of Disclosures
You have the right to request an accounting of certain disclosures of your PHI made by iXpressGenes for purposes other than treatment, payment, or health care operations.
Right to Request Restrictions
You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to a requested restriction except where you request we restrict disclosure to a health plan for a service you paid for out-of-pocket in full.
Right to Confidential Communications
You have the right to request that we communicate with you about your PHI in a specific way or at a specific location.
Right to a Paper Copy of This Notice
You have the right to receive a paper copy of this notice upon request, even if you have agreed to receive it electronically.
8. Third-Party Services and Infrastructure
Base44 (Platform Infrastructure)
This Site is built on the Base44 platform, which provides database, authentication, and hosting infrastructure. iXpressGenes has entered into a Business Associate Agreement with Base44 to the extent PHI is processed through their infrastructure. Data submitted through this Site may be stored on Base44 servers.
Resend (Email Delivery)
Contact form submissions are delivered via Resend, an email delivery service. Your name and email address are transmitted to Resend for the purpose of delivering your message to our team. Resend operates under a Business Associate Agreement with iXpressGenes where applicable. Resend does not retain this data for marketing purposes.
Google Fonts
This Site loads fonts from Google Fonts (fonts.googleapis.com). When your browser requests a font file, Google may log your IP address and browser information. No PHI or health data is transmitted to Google through this process. Please refer to Google's Privacy Policy for details.
Microsoft Forms (Survey Administration)
Certain pages on this Site link to survey instruments hosted on Microsoft Forms. iXpressGenes is the data controller for all data collected through these surveys. Survey data is transmitted to and stored on Microsoft's infrastructure subject to our data processing arrangement with Microsoft. Any PHI collected through surveys is governed by this policy and applicable HIPAA requirements. Participants should be aware that data entered into Microsoft Forms is also subject to Microsoft's Privacy Policy with respect to Microsoft's processing activities.
9. Security
iXpressGenes implements administrative, physical, and technical safeguards designed to protect your PHI and other personal information from unauthorized access, use, disclosure, alteration, or destruction, in accordance with the HIPAA Security Rule (45 C.F.R. Parts 160 and 164). These safeguards include: • Encryption of data in transit using TLS; • Hashing of all user passwords; no passwords stored in plain text; • Role-based access controls limiting PHI access to authorized personnel; • Audit logging of access to PHI; and • Business Associate Agreements with all vendors who may access PHI. In the event of a breach of unsecured PHI, iXpressGenes will notify affected individuals, the Secretary of Health and Human Services, and, where required, prominent media outlets, in accordance with the HITECH Breach Notification Rule (45 C.F.R. Part 164, Subpart D).
10. Data Retention
iXpressGenes retains records in accordance with applicable law: • Laboratory test reports and associated PHI are retained for a minimum of two (2) years from the date of report, or longer as required by CLIA regulations (42 C.F.R. § 493.1105) or applicable state law; • Contact form submissions are retained only as long as necessary to respond to your inquiry; • Account data is retained for as long as your account is active or as necessary to fulfill the purposes described in this policy; and • De-identified data may be retained indefinitely for research and product development purposes. You may request deletion of non-PHI personal data at any time by contacting us at info@ixpressgenes.com. Requests to delete PHI are governed by HIPAA and may be subject to legal retention requirements that limit our ability to delete such records.
11. Alabama Privacy Notice
Alabama Data Breach Notification Act (Ala. Code § 8-38-1 et seq.)
In the event of a security breach involving your sensitive personally identifying information, iXpressGenes will notify you in accordance with the Alabama Data Breach Notification Act. Notification will be provided in the most expedient time possible and without unreasonable delay, but no later than 45 days following determination that a breach has occurred, unless law enforcement requires a delay. Notification may be provided by mail, email, or substitute notice as permitted by law. "Sensitive personally identifying information" under Alabama law includes your first name or initial and last name in combination with one or more of the following: Social Security number; driver's license or state identification number; financial account numbers; medical information; health insurance policy number; or digital credentials such as usernames and passwords.
Alabama Health Records
To the extent Alabama law provides additional protections for health records beyond those required by federal law, iXpressGenes will comply with the more protective standard. Alabama does not currently have a comprehensive consumer health data privacy law separate from HIPAA, but iXpressGenes is committed to meeting or exceeding applicable state standards as they evolve.
12. Minor Patients
iXpressGenes may receive and process PHI relating to minor patients ages 16 and older in the State of Alabama, exclusively through authorized ordering providers. iXpressGenes does not accept test orders, samples, or data directly from minors. All laboratory services involving minor patients are initiated by a licensed healthcare provider, who serves as iXpressGenes' ordering client.
Provider Responsibility for Consent
The ordering provider is solely responsible for obtaining all necessary consents, authorizations, and parental or guardian approvals required under Alabama law prior to ordering laboratory services for a minor patient. This includes compliance with the Alabama Minors' Consent to Health Services Act (Ala. Code § 22-8-1 et seq.) and any applicable HIPAA authorizations. iXpressGenes does not independently verify or obtain consent from minor patients or their guardians; that obligation rests entirely with the ordering provider.
Handling of Minor PHI
PHI relating to minor patients is handled with the same HIPAA protections applicable to all PHI processed by iXpressGenes, as described in this policy. Laboratory reports for minor patients are returned exclusively to the ordering provider, not directly to the minor or their guardian, unless otherwise directed in writing by the provider in accordance with applicable law.
Alabama-Only Scope
iXpressGenes' laboratory services involving minor patients are currently limited to patients located in the State of Alabama. We do not knowingly process PHI for minor patients outside Alabama. If you believe PHI relating to a minor has been submitted outside this scope, please contact us immediately at info@ixpressgenes.com.
Direct Collection from Minors
iXpressGenes does not directly collect personal information or PHI from individuals under the age of 16 under any circumstances, and does not collect information directly from any minor (under 18) through this Site or our research and wellness programs. All survey participants and direct Site users must be 18 years of age or older.
13. Non-PHI Privacy Rights
For personal information that does not constitute PHI under HIPAA (such as contact form data or account credentials), and depending on your jurisdiction, you may have the right to: • Access the personal information we hold about you; • Request correction of inaccurate information; • Request deletion of your personal information, subject to legal retention obligations; and • Opt out of any future marketing communications (note: iXpressGenes does not currently conduct marketing to individuals). To exercise any of these rights, please contact us at info@ixpressgenes.com. We will respond to all requests within a reasonable timeframe and no later than 45 days.
14. Changes to This Policy and Notice
We reserve the right to change this Privacy Policy and Notice of Privacy Practices at any time. Changes will be posted on this page with an updated effective date. For material changes affecting your PHI rights under HIPAA, we will make the updated notice prominently available and will provide direct notice where required. Your continued use of the Site following any changes to non-PHI provisions constitutes your acceptance of the revised policy. Changes to our NPP apply to all PHI we currently maintain, not only PHI created or received after the change.
15. Complaints
If you believe your privacy rights have been violated, you may file a complaint with iXpressGenes or with the U.S. Department of Health and Human Services Office for Civil Rights ("OCR"). To file a complaint with OCR, visit www.hhs.gov/ocr/privacy/hipaa/complaints or call 1-800-368-1019. You will not be retaliated against for filing a complaint. To file a complaint directly with iXpressGenes, please contact our Privacy Officer, Aaron Caradonna, at info@ixpressgenes.com.
16. Contact Us
If you have any questions about this Privacy Policy, our Notice of Privacy Practices, or our data practices, please contact us: iXpressGenes, Inc. Privacy Officer: Aaron Caradonna Email: info@ixpressgenes.com Website: ixpressgenes.com This document serves as the official Notice of Privacy Practices of iXpressGenes, Inc. as required by 45 C.F.R. § 164.520.