Who we are and what this policy covers
"Mutanex", "we" and "us" mean Mutanex Genomics Private Limited, which runs this website and our services in India, and Mutanex Inc., which provides our services in the United States. This policy covers:
- This website, mutanex.com, and the forms on it
- The services we provide to partner labs, clinics and hospitals: the longevity program, the tools for doctors and clinics (including Clinic OS and the ambient scribe), and the Mutanex API
- Our communication with partners, candidates and anyone who writes to us
It does not cover other websites we link to. Your partner lab, clinic or hospital has its own privacy notice for the care it provides.
Our role
For this website and its forms, we decide why and how your data is used. Under the Digital Personal Data Protection Act, 2023 we are the data fiduciary.
For the services, the partner lab, clinic or hospital you visit decides why your data is used and holds the relationship with you. The partner is the data fiduciary. We process data on its behalf, under a written agreement and only on its instructions. Requests about that data go first to the partner; we help it answer them, and you can also write to us.
Our commitments
We do not sell your personal data. We do not share health data with advertisers, data brokers or marketing networks, and we do not use health data for advertising of any kind.
No training, by default
We do not use your identifiable health data, your uploaded documents, or any analysis generated for you to train, fine-tune, develop or improve any artificial intelligence or machine-learning model. We do not permit any third-party provider to do so. This is a default, not an option you must find and switch off.
Each partner's data is kept in its own deployment and is never pooled with another partner's data. History from another lab reaches your report only through reports you choose to share.
With your separate, explicit consent, de-identified data may be used for research. Declining does not affect the services you receive, their quality or their price.
What we collect on this website
- Waitlist
- Your name, your email address or phone number, and, if you add them, your city, a second phone number and a note.
- Partner inquiry
- Your name, organization and its type, city, typical footfall, email address, phone number, your message, and whether you asked for a walkthrough.
- Demo request
- Your name, email address, organization, phone number, specialty, preferred time, and your agreement to be contacted about the demo.
- Contact form
- Your name, email address, the category and subject you choose, and your message.
- Job application
- Your name, email address, phone number, location, the role, your LinkedIn and portfolio links if you add them, your answers, and the CV and cover letter you upload.
- Newsletter
- Your email address.
- Founding spot
- You pay on Stripe's own checkout page, so your card details never reach us. Stripe sends us your name, email address, the amount and whether the payment went through. For your initial analysis, the information and reports you choose to share with our clinical team.
- Every visit
- Your IP address, browser and device details, the pages you view and how you arrived. These come from our hosting and from the services described under Cookies and storage.
Please do not send health information, test reports or other people's details through these forms. They are not built for it.
What the services process
When a partner uses our services for your care, we process, on its behalf:
- Identity and contact details the partner records, such as your name, age, sex and phone number
- Laboratory reports and results, including earlier reports you choose to share
- Information you or your clinician add, such as symptoms, conditions, medicines, lifestyle and family history
- In clinics that use them, consultation notes and, where the clinic turns on the ambient scribe, the audio of a consultation, used to draft those notes and kept with the clinic's records
- The report we draft, the pathologist's changes and sign-off, and your retest schedule
Genetic and imaging data are not processed today. If they are offered later, they will need your separate consent.
Why we use it
- To answer you
- Replying to inquiries, arranging demos and walkthroughs, and telling waitlist members when a program opens near them.
- To consider your application
- Assessing job applications.
- To send the newsletter
- A few emails a year. Every email lets you unsubscribe.
- To provide the founding spot
- Taking payment and refunding it on request, booking your onboarding call, and preparing your initial analysis with our clinical team.
- To provide the services
- Reading reports, drafting reports for the pathologist, scheduling retests, and running the tools a clinic uses, as the partner instructs.
- To measure the website
- Counting visits and form submissions, to learn which pages help people.
- To keep the website secure
- Hosting it, and keeping spam and abuse out of the forms.
- To meet legal duties
- Keeping records the law requires, and answering lawful requests from authorities.
Legal basis and consent
We use website data with your consent, which you give when you send a form, and for the uses the law allows without consent, such as keeping the website secure and meeting legal duties. For the services, the partner obtains your consent, and we process data only for the purposes it covers.
Consent is asked for each purpose separately and recorded before processing begins. You can withdraw it as easily as you gave it.
Withdrawing consent stops further processing for that purpose. It does not undo processing that took place before.
How the engine uses your data
The engine applies published formulas and guideline thresholds to your results and drafts observations, each with its source. It makes no decision about you: the lab's registered pathologist reviews and signs every report, and your own doctor decides on care. You can ask your partner, or us, how a statement in your report was reached.
Who receives your data
- Amazon Web Services
- Hosts this website, runs our form backend in Mumbai, India, and stores the CVs and cover letters sent with job applications in Mumbai.
- Google Firebase
- Stores the submissions from the forms on this website.
- Google Analytics
- Counts visits, the main buttons clicked and form submissions using cookies. It receives the type of form sent, never what you wrote in it.
- Google reCAPTCHA
- Checks that forms are sent by people, not bots, using browser and device information.
- Stripe
- Takes payment for the founding spot and processes refunds, under its own privacy policy. It receives your card details; we do not.
- Calendly and Cal.com
- Book your onboarding call, if you book one. They receive your name, email address and the time you choose.
- Your partner
- The lab, clinic or hospital that provides your care receives the reports we prepare for it. No other partner does.
- Authorities
- Only when the law requires it, and only what it requires.
Our hosting and form providers process data only to provide their service to us. Google's services are also covered by Google's privacy policy.
Where your data is stored
Health data of patients in India is processed and stored in India. Health data of patients in the United States is processed and stored in the United States.
Our form backend and CV storage are in Mumbai, India. Google Firebase, Google Analytics and reCAPTCHA are global services and may process data outside India. We do not send health data to them.
What you share for a founding-spot analysis is stored and reviewed in the United States. Stripe, Calendly and Cal.com are global services and may process your payment and booking details outside your country.
Transfers outside India follow the DPDP Act and any restriction the Government of India notifies under it.
How long we keep it
- Waitlist
- Until we invite you, or 12 months, whichever comes first.
- Founding spot: what you share for your analysis
- 12 months after your analysis, or sooner if you ask us to delete it.
- Founding spot: payment records
- As long as tax and accounting law requires. Stripe keeps its own records under its own policy.
- Contact, partner and demo inquiries
- 24 months after our last exchange.
- Newsletter
- Until you unsubscribe. Your address is deleted within 30 days, and we keep only a record that you unsubscribed.
- Job applications and CVs
- 12 months after the role closes. Longer only with your consent.
- Lab reports in the services
- As the partner's agreement and your consent set out. Deleted within 30 days of a deletion request or of withdrawing consent, and within 90 days after the partner's agreement ends. Backups are cleared within a further 90 days. Uploads never linked to a patient are deleted after 30 days.
- Clinic records, including scribe audio
- As the clinic's agreement sets out, and for as long as the law requires the clinic to keep medical records.
- Processing logs
- 1 year.
- Google Analytics data
- 14 months.
We keep data longer only where a law requires it, and only for as long as it requires.
Your rights
- Access: a summary of the personal data we process about you, and how we use it
- Correction and completion of inaccurate or incomplete data
- Erasure of data we no longer need, unless the law requires us to keep it
- Withdrawal of consent at any time
- Nomination of a person to exercise your rights if you die or become unable to
- Grievance redressal: a complaint to our Grievance Officer, and then to the Data Protection Board of India
Write to privacy@mutanex.com. We may ask you to confirm your identity, and we answer within the time the law sets. For data a partner holds about you as its patient, you can write to the partner first; if you write to us, we pass your request to the partner and help it respond.
If you are in the United States, you may have further rights under the laws of your state. Write to us and we will tell you how they apply.
Grievance Officer
- Grievance Officer
- Saiful Khan, Chief Executive Officer
- saiful@mutanex.com
- Post
- Mutanex Genomics Private Limited, Shop No. 7, First Floor, Bhargav Estate, Changodar, Changodar Police Station, Sanand, Ahmedabad - 382213, Gujarat, India
If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Security
Encryption in transit and at rest, role-based access, logging and monitoring, and secure development practices.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.
Children
This website and its forms are for adults. We do not knowingly collect data from anyone under 18. A partner may use the services for a child only with verifiable consent from a parent or lawful guardian.
Changes to this policy
We publish every change on this page with a new effective date. If a change affects how we use data you have already given us, we will ask for your consent again where the law requires it.
Contact
Privacy requests: privacy@mutanex.com. Everything else: contact@mutanex.com.
- Mutanex Genomics Private Limited
- CIN U86900GJ2024PTC148970. Registered office: Shop No. 7, First Floor, Bhargav Estate, Changodar, Changodar Police Station, Sanand, Ahmedabad - 382213, Gujarat, India.
- Mutanex Inc.
- 300 Creek View Road, Suite 209, Newark, DE 19711, USA.