Privacy Policy

You provide: name, date of birth, contact info (email, phone, address), who is being tested and your relationship to them, health information you share (symptoms, uploaded results, test selections), and payment information (processed by our payment processor; we do not store full card numbers).

Automatically: device/browser data, IP address, cookies, usage analytics.

From testing: specimen and order data, and laboratory results generated by our CLIA-certified performing laboratory.

Certain information we handle may constitute protected health information (PHI). We handle health information in accordance with applicable law and our internal privacy practices.

To provide and authorize testing; process orders and payments; deliver and explain results; operate "Ask Marrow"; provide support; send transactional and (with consent) marketing messages; improve and secure our services; and comply with law.

Ask Marrow is powered by a third-party AI provider. Inputs you provide may be sent to that provider to generate responses. Ask Marrow is educational and does not diagnose. Do not upload lab documents or PHI to Ask Marrow.

With our performing laboratory; the licensed physician network that authorizes orders where required; service providers under contract; and as required by law. We do not sell, license, trade, or share your genetic data with any third party, for money or any other consideration.

Any customer may request deletion of their genetic data and account at any time, regardless of state of residence. We confirm deletion in writing. Depending on your state, you may also have rights to access, correct, or port your information, and to opt out of certain processing. California, Virginia, Colorado, Connecticut, Utah, Texas and other state residents have specific rights. Washington (My Health My Data Act) and Nevada residents have specific consumer-health-data rights. To exercise rights, contact privacy@marrowdx.com.

In the event of an acquisition, merger, insolvency, bankruptcy, or wind-down, genetic data and any remaining biological samples are destroyed and are not transferred to any successor entity.

Raw genotype files are deleted once reports are generated. Marrow retains the generated reports and standard business records only. Physical samples are destroyed by the performing laboratory after analysis.

We collect health data only to provide testing you request and related communications. Where required, we obtain consent before collecting or sharing consumer health data and honor withdrawal of consent.

We use necessary and, with consent where required, analytics/marketing cookies. We do not place personal or health data in URLs.

We use reasonable administrative, technical, and physical safeguards, and retain information as required by law and for legitimate business purposes.

Our services are for adults 18+. We do not knowingly collect data from children under 13.

We may update this Policy; material changes will be posted with a new date. Contact: privacy@marrowdx.com.