LONGSAL GUT MICROBIOME TEST PRIVACY POLICY

1. General principles

This Privacy Policy applies to the processing of personal data in connection with the provision of the LONGSAL gut microbiome test and related services.

Within the scope of the LONGSAL gut microbiome test service, the client’s identification information, the data provided in the questionnaire, health data, microbiome test results, as well as LONGSAL’s prepared interpretation of the results, recommendations, and information related to the consultation are processed.

To perform laboratory analyses, LONGSAL cooperates with a specialized partner laboratory.

LONGSAL and the partner laboratory process personal data only to the extent necessary to provide the gut microbiome test and related services.

2. What data are processed?

Within the scope of the gut microbiome test service, the following may be processed:

• first name, last name and contact information;
• date of birth, age and other basic information necessary for interpreting the test;
• test activation and sample identification information;
• information provided in the questionnaire about diet, lifestyle, well-being, the digestive system, symptoms, health condition, use of medicines, antibiotics, dietary supplements and other products;
• physical or externally observable characteristics indicated by the client, if they may be significant for interpreting the results;
• laboratory analysis data;
• microbiome test results;
• information provided during the consultation;
• LONGSAL’s prepared interpretation of the test results;
• personalized recommendations on diet, lifestyle, dietary supplements and other recommendations.

Questionnaire responses and microbiome analysis results may be considered health data and therefore a special category of personal data within the meaning of the GDPR.

3. Why are data collected?

Personal data are processed in order to:

• register and fulfill the client’s order;
• organize the laboratory analysis of the biological sample;
• link the sample to the specific test;
• receive the laboratory analysis results;
• evaluate the test results in the client’s individual context;
• prepare an interpretation of the results;
• prepare personalized recommendations;
• provide consultation and further communication with the client;
• ensure availability of results and traceability of the service;
• fulfill applicable legal obligations.

The questionnaire information is used so that microbiome results can be assessed in the context of the client’s diet, lifestyle, health condition and other factors.

4. Where are data stored?

Personal and health data related to the LONGSAL gut microbiome test are stored both in LONGSAL’s and in the partner’s information systems involved in providing the service, in accordance with the data processing carried out by each party.

LONGSAL stores:

• the client’s identification and contact information;
• information provided in the questionnaire;
• microbiome test results;
• information provided by the laboratory;
• LONGSAL’s prepared interpretation of the results;
• recommendations prepared for the client;
• information and communication related to consultations and customer service.

In the partner’s information systems, the data necessary for performing the test and preparing the results are stored, including questionnaire information, sample identification information, laboratory analysis data and microbiome analysis results.

Some of the information stored in LONGSAL’s and the partner’s systems may overlap, as this is necessary for performing the test, transferring results, interpretation and providing the service.

5. Physical biological sample

The client-submitted fecal sample and the DNA material obtained from it during the laboratory analysis process are processed and stored in the laboratory.

The physical sample and the DNA material obtained from it are stored in the laboratory for no longer than one year and then properly destroyed in accordance with the laboratory’s applicable procedures.

LONGSAL does not store the physical biological sample.

6. Storage of health and microbiome data

Health data related to the gut microbiome test, including:

• questionnaire responses;
• laboratory analysis results;
• microbiome test results,

are stored for up to 10 years, unless the data are deleted earlier at the client’s request or upon withdrawal of consent and there is no other legal basis for their continued storage.

The retention period is intended to ensure long-term availability of results, traceability of the service, the ability to assess previous or repeat tests and, if necessary, to protect legal claims.

After the end of the relevant retention period, personal data are deleted if they are no longer necessary for providing the service, complying with regulatory requirements, or for the establishment, exercise or defense of legal claims.

7. Deletion of personal data

The client has the right, in the cases provided for by the GDPR, to request the deletion of their personal data.

The client may submit a request for deletion of data directly to LONGSAL.

Upon receiving such a request, LONGSAL:

1. identifies the personal data to which the client’s request applies;
2. assesses whether there is no legal obligation or other legal basis for continued storage of the specific data;
3. deletes the relevant personal data from LONGSAL’s systems or takes other actions compliant with GDPR requirements;
4. if the relevant personal data have been transferred and are also stored by the partner involved in providing the test service, provides the partner with information about the client’s deletion request and asks the partner to take the relevant actions regarding the data in its possession;
5. coordinates fulfillment of the request with the partner to the extent necessary;
6. informs the client about the outcome of the review of the request and the actions taken.

If personal data are processed only on the basis of the client’s consent and the client withdraws this consent, the relevant data are deleted unless there is another legal basis for their continued processing or storage.

The right to erasure is not absolute. Certain data may be retained if required by applicable laws or if their storage is necessary for the establishment, exercise or defense of legal claims.

If data are irreversibly anonymized so that they can no longer be linked to a specific person, they are no longer considered personal data and cannot be deleted as that person’s data.

8. Withdrawal of consent

If the processing of health data is based on the client’s explicit consent, the client may withdraw this consent at any time with regard to future data processing.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

If, after withdrawal of consent, there is no other legal basis for processing or storing the relevant personal data:

• LONGSAL stops further processing of the relevant data;
• LONGSAL deletes the relevant personal data in its possession;
• LONGSAL informs the partner involved in providing the service about the withdrawal of consent and the need to take appropriate actions regarding the personal data in the partner’s possession.

If consent is withdrawn before the laboratory analysis or completion of the service, it may not be possible to continue providing the gut microbiome test or the related service.

9. Use of data in research

Identified or pseudonymized microbiome and questionnaire data are used for research purposes only if there is an appropriate legal basis and, if necessary, separate client consent has been obtained.

Consent to the use of data in research is voluntary and is not a prerequisite for receiving the gut microbiome test.

The client may withdraw such consent with regard to future use of the data.

If, before withdrawal of consent, the data have already been irreversibly anonymized and can no longer be linked to a specific person, they can no longer be identified or deleted as a specific person’s data.

10. Transfer of data to third parties

Personal data are not transferred to third parties, except in cases where:

• it is necessary to provide the gut microbiome test or the related service;
• the client has given the relevant consent;
• the transfer of data is provided for by laws and regulations;
• there is another legal basis provided for by the GDPR.

Only the data and information necessary for laboratory analysis, preparation of results and provision of the service are transferred to the partner laboratory.

11. Transfer of results to a doctor or other specialist

LONGSAL may send the test results to a doctor or other healthcare specialist indicated by the client only at the client’s request or with separate consent, if there is no other legal basis.

Such consent is voluntary and does not affect the client’s ability to receive the gut microbiome test service.

12. Client rights

In accordance with the GDPR, the client has the right to:

• receive information about the processing of their personal data;
• request access to their personal data;
• receive a copy of their personal data;
• request correction of inaccurate data;
• in certain cases, request deletion of data;
• request restriction of processing, where applicable;
• exercise the right to data portability, where applicable;
• withdraw their consent;
• object to data processing, where the GDPR provides such rights in the relevant situation;
• submit a complaint to the competent data protection supervisory authority.

13. Submitting requests

The client may submit questions and requests regarding the processing of personal data to LONGSAL.

This also applies to requests for:

• receiving a copy of the data;
• correction of data;
• deletion of data;
• restriction of processing;
• withdrawal of consent.

If the relevant client information is also stored in the partner laboratory’s systems, LONGSAL, if necessary, forwards the client’s request to the partner laboratory and coordinates its fulfillment.

LONGSAL informs the client about the actions taken within the time limits set by the GDPR.

14. Deletion or destruction of the physical sample

If, at the time of the client’s request for deletion of data or withdrawal of consent, the client’s physical sample or the DNA material obtained from it is still located in the laboratory, LONGSAL, at the client’s request, provides the relevant information to the partner laboratory and coordinates the issue of further storage or destruction of the sample to the extent possible and legally applicable.

Regardless of an individual deletion request, in the partner laboratory the physical sample/DNA material is stored for no longer than one year and then properly destroyed.

15. Data security

LONGSAL applies appropriate technical and organizational security measures to protect personal data against:

• unauthorized access;
• unauthorized disclosure;
• loss;
• unlawful use;
• unauthorized alteration;
• destruction.

Access to health and microbiome data is provided only to persons who need it to provide the specific service.

The partner laboratory also applies technical and organizational measures to protect the data and biological samples in its possession.

16. Relationship with LONGSAL’s general Privacy Policy

This policy supplements LONGSAL’s general Privacy Policy and specifically regulates, within the scope of the gut microbiome test, the following:

• processing of questionnaire data;
• processing of health data;
• processing of microbiome test data;
• processing of laboratory analysis results;
• processing of the biological sample;
• involvement of the partner laboratory;
• interpretation of results and preparation of recommendations;
• data storage;
• data deletion;
• exercise of client rights.

In matters not separately regulated in this policy, LONGSAL’s general Privacy Policy applies.