Privacy Policy

01Information We Collect

Information You Provide Directly

When you register for an account, request access to our data catalog, request a dataset, submit an inquiry, schedule a demonstration, enter into an agreement with us, participate in an event, or communicate with our team, we may collect:

• Name
• Job title and professional role
• Organizational affiliation
• Business email address
• Phone number
• Mailing or business address
• Login and account credentials
• Billing and transaction information, where applicable
• Dataset and service requests
• Communications and correspondence with us
• Any other information you voluntarily provide through forms, email, telephone, or other communications

When you interact with us in a professional or business capacity, we may also collect professional information, such as your company, department, professional interests, areas of research, and information relevant to evaluating or fulfilling your organization's requirements.

Where required by applicable law, we will provide appropriate notice and/or obtain consent before using personal information for direct marketing or other purposes requiring consent.

Information Collected Automatically

When you visit the Platform, our servers and third-party analytics providers may automatically collect technical information including IP address, browser type and version, operating system, device type and identifiers, referring URLs, pages viewed, time spent on pages, click patterns, approximate geographic information derived from technical data, date and time of access, and other technical and usage information.

We may collect this information through cookies, web beacons, server logs, pixels, and similar technologies.

Information from Third Parties

We may receive information about you from business partners, data providers, research organizations, professional networking platforms, publicly available sources, event organizers, marketing and business-information providers, and third-party platforms such as LinkedIn, where you have made your professional information publicly accessible.

Information obtained from such sources may be used for legitimate business purposes, including business development, account management, relationship management, customer support, service delivery, and communications, subject to applicable law and your rights and preferences.

02How We Use Your Information

We use the information we collect to operate, maintain, and improve the Platform and our services; process registrations, data access requests, and transactions; respond to inquiries; facilitate demonstrations; communicate service updates; send permitted marketing; analyze usage; maintain security; detect fraud and misuse; comply with legal obligations; enforce agreements; and protect our rights, property, systems, employees, customers, and users.

Where permitted by applicable law, we may also use aggregated, statistical, anonymized, or otherwise appropriately de-identified information to understand trends, improve our products and services, conduct research, develop analytics, and support business and scientific activities.

We do not sell your personal information to third parties.

03Genomic, Clinical, and Health-Related Data

Rohtek Solutions provides access to genomic and associated datasets for permitted research, scientific, commercial, and other authorized purposes.

Depending on the dataset, information may include genomic variants, sequencing information, molecular profiles, biomarkers, phenotypic characteristics, demographic attributes, clinical characteristics, pathology information, disease type or subtype, disease stage, treatment-related information, laboratory information, outcomes, geographic attributes, and other research-related variables.

Not every dataset contains every category of information. The specific attributes available in a dataset will be described through applicable dataset documentation, metadata, data dictionaries, catalog information, or contractual documentation.

Certain genomic, health, and clinical information may constitute sensitive or special-category personal data under applicable laws. Rohtek applies appropriate technical, organizational, and contractual safeguards to such information and processes it only where permitted under applicable law, contractual arrangements, data-provider requirements, and other applicable safeguards.

04Data Provenance and Lawful Sourcing

Rohtek Solutions obtains genomic and associated datasets from authorized data providers, research organizations, laboratories, biobanks, healthcare organizations, sequencing organizations, academic institutions, and other legitimate sources.

We seek to ensure that data made available through the Platform is collected, processed, transferred, and licensed in accordance with applicable legal, regulatory, ethical, institutional, contractual, and data-provider requirements.

Depending on the source and intended use, datasets may be subject to informed consent requirements, ethics committee or institutional approvals, authorization requirements, contractual limitations, research use restrictions, geographic restrictions, or other applicable safeguards.

Where applicable, such requirements and restrictions are reflected in the relevant Data Use Agreement, data license, dataset documentation, or other contractual documentation governing access to and use of the dataset.

05De-identification, Anonymization, and Re-identification Risk

Rohtek Solutions seeks to provide datasets that are appropriately de-identified, anonymized, pseudonymized, aggregated, or otherwise processed according to the nature of the dataset and applicable legal and contractual requirements.

Rohtek applies appropriate technical, organizational, and contractual safeguards designed to reduce the risk of identification or re-identification of individuals represented in datasets.

Because genomic information may have unique and persistent characteristics, residual identification or re-identification risks may exist depending on the nature of the dataset, available auxiliary information, technological developments, and other circumstances. No de-identification or anonymization methodology can guarantee that identification will never occur under all circumstances.

Accordingly, Rohtek does not represent that genomic or health-related datasets are absolutely incapable of being re-identified.

06Prohibited Uses of Genomic Data

Customers and authorized users are required to comply with the applicable DUA, license agreement, and all applicable laws and regulations governing the use of datasets.

Unless expressly permitted by the applicable agreement and applicable law, users may not:

• Attempt to identify or re-identify an individual represented in a dataset
• Attempt to identify relatives or family members of individuals represented in a dataset
• Combine genomic or associated information with other information for the purpose of identifying an individual
• Contact or attempt to contact individuals represented in a dataset
• Use datasets for purposes prohibited by the applicable DUA or license
• Redistribute, resell, or otherwise provide datasets to unauthorized third parties
• Remove or circumvent data-use restrictions or security controls
• Use datasets for unlawful discrimination or other unlawful purposes
• Use data outside the geographic, research, commercial, or other permitted scope specified in the applicable agreement

Additional restrictions may apply to individual datasets based on their source, consent framework, jurisdiction, intended use, and contractual requirements.

07Permitted Research and Commercial Use

Subject to applicable law and dataset-specific terms, datasets may be made available for drug discovery and development, translational research, biomarker discovery, precision medicine research, population health research, genomic research, diagnostics research and development, computational biology, artificial intelligence and machine learning development, algorithm development and validation, clinical research, academic research, and other scientific or commercial research purposes expressly permitted by the applicable agreement.

The availability of a dataset through the Platform itself does not grant unrestricted rights to use that dataset for any particular purpose. Permitted uses are determined by applicable dataset terms, DUAs, licenses, and other contractual or legal requirements.

08Artificial Intelligence and Machine Learning

Where expressly permitted by applicable dataset terms, genomic and associated datasets may be used for artificial intelligence, machine learning, predictive modeling, algorithm development, biomarker discovery, diagnostics development, computational research, and other data-science applications.

Any such use remains subject to applicable laws, dataset-specific restrictions, intellectual property rights, contractual obligations, and restrictions relating to identification or re-identification of individuals.

09Data Controller, Processor, and Other Roles

Depending on the nature of the service, dataset, transaction, and applicable jurisdiction, Rohtek Solutions may act as a data controller, data processor, service provider, data recipient, data custodian, or another legally recognized role.

The respective responsibilities of Rohtek, its data providers, and its customers may be further defined in applicable Data Processing Agreements, Data Use Agreements, data licenses, or other contractual arrangements.

10Cookies and Tracking Technologies

We use cookies and similar technologies to enhance Platform functionality, analyze traffic, understand user behavior, and personalize your experience.

• Essential Cookies: Required for the Platform to function correctly.
• Analytics Cookies: Help us understand how visitors interact with the Platform. We may use third-party analytics services such as Google Analytics.
• Functional Cookies: Enable enhanced features and personalization.
• Marketing Cookies: Used to deliver relevant content and measure communication effectiveness. These are deployed only with consent where required by applicable law.

You can manage cookie preferences through your browser settings or through the cookie-consent mechanism available on the Platform. Disabling certain cookies may limit access to some Platform features.

11Data Sharing and Disclosure

We do not sell, rent, or trade your personal information.

Service Providers: We engage trusted third-party vendors for hosting, analytics, email delivery, customer relationship management, security, payment processing, technical support, and other business functions.

Business Partners: Where you have expressed interest in specific data products or services, we may share relevant information with partners involved in fulfilling those services, subject to appropriate agreements and applicable law.

Data Providers: Where necessary to administer, provide, validate, or support access to a dataset or service, we may share relevant information with the applicable data provider, research organization, laboratory, biobank, or other authorized data source, subject to contractual and legal requirements.

Legal Requirements: We may disclose information when required by law, regulation, legal process, governmental request, or court order, or when we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers: In the event of a merger, acquisition, reorganization, financing, sale of assets, or similar corporate transactions, information may be transferred as part of that transaction.

12Subprocessors and Third-Party Service Providers

Rohtek Solutions may use third-party service providers and subprocessors to support the operation of its Platform and services, including cloud infrastructure, hosting, analytics, communications, customer relationship management, security, data processing, and other technology services.

Where required by applicable law or contractual obligations, Rohtek will implement appropriate contractual safeguards governing such third-party processing. A list of material subprocessors may be made available to customers where required under applicable contractual or regulatory requirements.

13Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law.

Account information is generally retained for the duration of the active relationship with Rohtek and for a reasonable period thereafter to satisfy legal, accounting, contractual, security, dispute-resolution, or reporting requirements.

Retention periods for genomic and research datasets may differ from retention periods applicable to ordinary website or account information. Such periods may be determined by applicable data-provider requirements, consent restrictions, research protocols, DUAs, licenses, customer agreements, legal requirements, or scientific and regulatory considerations.

Where information is no longer required, Rohtek will take reasonable steps to delete, anonymize, aggregate, or otherwise dispose of the information in accordance with applicable law and our data-retention procedures.

14Data Security

We implement commercially reasonable technical and organizational measures designed to protect information against unauthorized access, alteration, disclosure, loss, misuse, or destruction.

These measures may include encryption in transit and at rest, role-based access controls, authentication and authorization mechanisms, access monitoring and logging, network and infrastructure security controls, regular security assessments, vulnerability management, backup and recovery procedures, incident response procedures, employee and contractor security training, and contractual confidentiality obligations.

Security controls may vary depending on the nature and sensitivity of the information, the applicable service, the dataset, and contractual or regulatory requirements. While we take data security seriously, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

15Security Incidents and Data Breaches

In the event of a suspected or confirmed security incident involving personal information or protected data, Rohtek Solutions will take appropriate measures to investigate, contain, mitigate, remediate, and document the incident.

Where notification is required by applicable law or contractual obligations, Rohtek will provide notifications to affected individuals, customers, data providers, regulators, or other relevant parties within the applicable legally or contractually prescribed timeframe.

16Data Residency and International Data Transfers

Rohtek Solutions operates and works with organizations across multiple jurisdictions. Your information may be transferred to, stored in, or processed in countries other than your country of residence.

The location where information is stored or processed may depend on the applicable service, dataset, customer requirements, cloud infrastructure, service providers, data provider requirements, and applicable law.

Where personal information is transferred across jurisdictions, we implement appropriate safeguards as required by applicable law. Depending on the circumstances, these safeguards may include standard contractual clauses, contractual data-transfer mechanisms, adequacy decisions, consent, or other legally recognized transfer mechanisms.

17Your Rights and Choices

Depending on your jurisdiction and applicable law, you may have rights regarding your personal information, including access, correction, deletion, restriction, portability, objection, and withdrawal of consent.

Additional rights may apply depending on your jurisdiction, including rights relating to automated decision-making, profiling, appeals, or complaints to a data protection or privacy regulator.

To exercise applicable rights, contact us using the information provided in the Contact Us section below. We will respond to requests within the timeframe required by applicable law.

You may opt out of marketing communications at any time by clicking the unsubscribe link in an email or by contacting us directly.

18Sensitive and Special-Category Information

Certain information processed in connection with Rohtek Solutions' services, including genetic, genomic, health, clinical, and biometric information, may be considered sensitive personal information or special-category personal data under applicable laws.

Where such information is processed as personal data, Rohtek will apply safeguards appropriate to the nature and sensitivity of the information and will process such information only where a valid legal, contractual, regulatory, research, or other permitted basis exists.

19Aggregated, Anonymized, and Derived Information

Rohtek Solutions may create aggregated, statistical, anonymized, de-identified, or otherwise derived information from information processed through its services, subject to applicable law and contractual restrictions.

Such information may be used for analytics, benchmarking, service improvement, research, product development, quality assessment, and business intelligence, provided that such use is permitted by applicable law and contractual obligations.

Rohtek will not intentionally use derived or aggregated information to identify individuals where such identification is prohibited by applicable law or contractual restrictions.

20Data Quality and Fitness for Purpose

Genomic and associated datasets may originate from different sources and may vary in completeness, coverage, quality, accuracy, representation, methodology, and availability.

Dataset-specific information, including available metadata, sample characteristics, data quality measures, limitations, and other relevant attributes, may be provided through the Platform or applicable dataset documentation.

Customers are responsible for evaluating whether a particular dataset is appropriate and sufficient for their intended research, scientific, commercial, regulatory, or other permitted purpose.

21No Medical Advice or Individualized Clinical Services

Rohtek Solutions is a genomic data and research services company and is not a healthcare provider. Unless expressly stated otherwise, the Platform and datasets are not intended to provide medical advice, diagnosis, treatment recommendations, or individualized clinical decision-making.

Information made available through the Platform should not be used as a substitute for professional medical judgment or clinical evaluation.

22Children's Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information directly from children.

If we become aware that we have inadvertently collected personal information from a child in circumstances where such collection is prohibited by applicable law, we will take reasonable steps to delete the information.

23Third-Party Links

The Platform may contain links to third-party websites, services, applications, or resources that are not operated or controlled by Rohtek Data. We are not responsible for the privacy practices, security, content, or policies of these external services.

24Legal Basis for Processing

Where required by applicable law, Rohtek Solutions processes personal information on one or more lawful grounds, including consent, performance of a contract, compliance with legal obligations, legitimate interests, protection of rights and interests, or other legally recognized grounds.

The applicable legal basis may depend on the nature of the information, the purpose of processing, the jurisdiction, and the relationship between Rohtek and the relevant individual or organization.

25Business and Marketing Communications

We may use professional contact information obtained directly from you, your organization, business partners, events, or publicly available professional sources to communicate with you regarding Rohtek's services, products, research capabilities, events, datasets, and business opportunities, subject to applicable law.

You may opt out of marketing communications at any time. Opting out of marketing communications will not necessarily prevent us from sending transactional, service-related, security-related, contractual, or other non-marketing communications.

26Data Processing Agreements and Data Use Agreements

Certain Rohtek Solutions customers, data providers, and partners may enter into additional agreements governing the processing, licensing, security, access, use, transfer, retention, or disclosure of information.

These agreements may include Data Processing Agreements ("DPAs"), Data Use Agreements ("DUAs"), data licenses, confidentiality agreements, security addenda, research agreements, or other contractual instruments. Such agreements may impose requirements that are more restrictive than those described in this Privacy Policy.

27Your Responsibilities

Users of the Platform are responsible for maintaining the confidentiality of their account credentials and for using the Platform and datasets in accordance with applicable law, this Privacy Policy, the Platform's Terms of Use, applicable DUAs, licenses, and other contractual requirements.

Users must promptly notify Rohtek of any suspected unauthorized access to their account or any suspected misuse of datasets or Platform services.

28Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, services, or business operations. When we make material changes, we will post the updated policy on the Platform and revise the Last Updated date.

Where required by applicable law, we may also provide additional notice or obtain consent for material changes affecting the processing of personal information.

Your continued use of the Platform after the effective date of an updated Privacy Policy will be subject to the updated policy to the extent permitted by applicable law. We encourage you to review this Privacy Policy periodically.

30Governing Law and Jurisdiction

The interpretation and application of this Privacy Policy will be subject to applicable privacy and data-protection laws. Where appropriate, the governing law and jurisdiction applicable to a particular customer, dataset, service, or transaction will be specified in the relevant contractual agreement.

Nothing in this Privacy Policy is intended to limit or exclude rights or protections that cannot lawfully be limited or excluded under applicable data-protection or privacy legislation.