Your reports are yours.

What we never do

We do not sell your personal data. We do not share health data with advertisers, data brokers or marketing networks, and we do not use health data for advertising of any kind.

Optional research

With your separate, explicit consent, de-identified data may be used for research. Declining does not affect the services you receive, their quality or their price.

Each lab's data stays in its own deployment

Each partner's data is kept in its own deployment and is never pooled with another partner's data. History from another lab reaches your report only through reports you choose to share.

Health data of patients in India is processed and stored in India. Health data of patients in the United States is processed and stored in the United States.

Consent

Consent is asked for each purpose separately and recorded before processing begins. You can withdraw it as easily as you gave it.

Your rights

Access, correction, completion and erasure of your data, withdrawal of consent, and nominating someone to act for you. If a complaint is not resolved, you can take it to the Data Protection Board of India.

Write to privacy@mutanex.com, or to our Grievance Officer:

Grievance Officer

Saiful Khan, Chief Executive Officer

Email

saiful@mutanex.com

Post

Mutanex Genomics Private Limited, Shop No. 7, First Floor, Bhargav Estate, Changodar, Changodar Police Station, Sanand, Ahmedabad - 382213, Gujarat, India

Security

Encryption in transit and at rest, role-based access, logging and monitoring, and secure development practices.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

Retention

Waitlist

Until we invite you, or 12 months, whichever comes first.

Founding spot: what you share for your analysis

12 months after your analysis, or sooner if you ask us to delete it.

Founding spot: payment records

As long as tax and accounting law requires. Stripe keeps its own records under its own policy.

Contact, partner and demo enquiries

24 months after our last exchange.

Newsletter

Until you unsubscribe. Your address is deleted within 30 days, and we keep only a record that you unsubscribed.

Job applications and CVs

12 months after the role closes. Longer only with your consent.

Lab reports in the services

As the partner's agreement and your consent set out. Deleted within 30 days of a deletion request or of withdrawing consent, and within 90 days after the partner's agreement ends. Backups are cleared within a further 90 days. Uploads never linked to a patient are deleted after 30 days.

Clinic records, including scribe audio

As the clinic's agreement sets out, and for as long as the law requires the clinic to keep medical records.

Processing logs

1 year.

Google Analytics data

14 months.

Eligibility

To book, you must be 18 or over. Booking for a family member requires their consent or your legal authority to act for them; for a child, that is a parent or lawful guardian.

Who is responsible for what

Testing: the partner lab

Collecting samples and running the tests. Mutanex does neither.

Analysis: Mutanex

Reading the results, calculating, connecting, citing and drafting the report.

Sign-off: the lab's registered pathologist

Reviewing, editing and signing every report. The pathologist is the provider of record.

Clinical decision: your own doctor

Diagnosis and treatment.

Standards and certifications

ISO

ISO 9001:2015 and ISO/IEC 27001:2022 certified

HIPAA

HIPAA-ready

Data protection

The data protection law of each market we operate in, applied by design

SOC 2

SOC 2 planned

Medical software

Software-as-a-medical-device pathway planned in each market we enter

Lab standards

Reports carry the lab's ISO 15189 identity; critical results are communicated as the lab's accreditation body requires

Sign-off

Signed by the lab's registered pathologist