Policies and Notices

Ambry Genetics Corporation (“Ambry,” “we,” “us,” and “our”) is committed to protecting your privacy. This Privacy Notice (the “Privacy Notice”) explains our practices and guidelines to protect the security and confidentiality of your Personal Information that we collect when you use our website, ambrygen.com, (“Website”) and any Ambry application or services that link to this Privacy Notice (“Services”).

OUR TERMS OF USE

Your use of our Website and Services is governed under our Terms of Use.

CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time (see “Revisions to Our Privacy Notice” below). Please check the “Last Updated” legend at the top of this page to see when this Privacy Notice was last revised. Any changes to this Privacy Notice will become effective when we post the revised Privacy Notice on our Website. Your continued use of our Website or Services after we have posted our changes is your acceptance of those changes, so please check this Privacy Notice periodically for updates. IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY NOTICE, THEN PLEASE DO NOT USE OUR WEBSITE OR SERVICES.

WHAT PERSONAL INFORMATION DO WE COLLECT?

When you visit and interact with our Website or use our Services, we collect information about you, including Personal Information. “Personal Information” means information that specifically identifies you or, when combined with other information we have, can be used to identify, locate, or contact you. The Personal Information we collect depends on the context of your interactions with our Website and the choices you make, the services and features you use, your location, and applicable laws, but can include the following:

Personal information you provide to us. We may collect your name, organization name, email address, phone number, and physical address when you voluntarily provide it to us, such as when you subscribe to our blog, Ambry updates, or webinars; order a test kit; apply for a job; or contact us.
Registration information to use AmbryPort®. AmbryPort® is only offered to clinicians. When a clinician registers at AmbryPort®, we collect the clinician’s name, position, specialty, professional degree, organization name, phone number, fax number, physical address, email address, and password.
Registration information to use the CARE Program®. When you register on the CARE platform for any of our CARE-related services, we may collect your name, position, organization name, phone number, fax number, email address, and password.
Registration information to use CARE Digital. If you are a CARE customer, you may access CARE Digital by providing your name, position, organization name, email address, and password.
Communication Information. We retain records and copies of your correspondence (including e-mail addresses) if you contact us, such as when you submit a comment or question.
Event Information. When you register to attend one of our webinars or attend a tradeshow or conference where we are in attendance, we may collect contact information such as your name, position, organization name, email address, and similar personal identifiers you provide.
Other Information. We may collect other Personal Information we specifically request or you voluntarily provide.

You are not required to provide us with any Personal Information that we request from you. However, failure to provide such information may limit what we are able to do for you. For example, refusing to provide your e-mail address may prevent us from providing you with valuable information about our Website or Services.

WHAT PERSONAL INFORMATION DO WE COLLECT AUTOMATICALLY?

As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions and patterns, including:

Information about your use of our Website and Services. When you browse our Website or use our Services, we automatically collect information, such as your Internet Protocol (“IP”) address, browser type, browser language, domain names, web requests, platform type, pages viewed and the order the pages were viewed, amount of time spent on a particular page, date and time of your request, and one or more cookies that my uniquely identify your browser. We collect this information through our third-party analytics service providers (see How Do We Use Tracking Technologies? below).
Device information. When you use a computer or mobile device to access our Website or Services, we collect basic information about your browser and operating system, such as model number.

HOW DO WE USE TRACKING TECHNOLOGIES?

When you use our Website or Service, our third-party service providers may collect information from you through the following ways:

Cookies. When you use our Website or Services, we may collect information about your browsing session through the use of cookies. See our Cookie Notice for more information. Our third-party analytics service providers may also use cookies to perform services for us. Their cookie notice can be found by clicking on their name below:
Website Analytics. We may use third-party web analytics services on our Website such as Google Analytics, and Hotjar. These service providers help us analyze how visitors use our Website. The information obtained for this purpose (including your IP address and other information collected by automated means) may be disclosed to or collected directly by these service providers. To provide this service, Google Analytics may collect certain information about you from your computer, including through the use of cookies. Such information may include information regarding your visit (such as the pages you visit and the length of your visit), information about your device (such as your IP address), how you got to our Website, and other information about you. You can learn more about Google Analytics and how it collects and processes data (including how to control the information sent to Google) by visiting: www.google.com/policies/privacy/partners/. You can opt-out of Google Analytics by using the Google Analytics opt-out browser add-on, available here.
Tag Management. Our Website uses Google Tag Manager, a tool that allows us to manage website tags through a single interface. It is a tag management system that does not collect any Personal Information but facilitates the deployment of other tags that might collect data, such as Google Analytics or marketing pixels. These tags are used to understand website usage, improve user experience, and enhance the effectiveness of our marketing efforts. All data collected via tags deployed through Google Tag Manager is handled in accordance with our Privacy Notice and applicable laws. You can learn more about Google Tag Manager here.
Social Media Plug-ins. We may use social media plug-ins on our Website to enable you to easily share information with others. We use the information collected from the plug-ins to learn about your interests and to help us better understand how to serve you. This information may include your preferences about how to contact you or further develop a business or professional relationship with you, your product preferences, languages, marketing preferences, and some demographic data. These plug-ins may include those from companies like Facebook, LinkedIn, YouTube, and X (formerly Twitter). The social media plug-ins may allow these companies to receive directly identifiable Personal Information about you and your visit to our Website. When you visit our Website, the operators of the social media plug-ins on our Website place cookies on your computer that enable them to recognize you on websites belonging to them and their affiliates and partners after you have visited our Website, or that enable them to add the information collected from your visit to our Website with your prior activity on those websites. The social media plug-ins collect this information about users whether they specifically interact with the plug-in or not, and it may enable social media companies to share information about your web-browsing navigational information with some of their other users. Ambry does not control what information is collected by the social media plug-ins or the information practices adopted by those social media companies. For more information about social plug-ins from social media websites, you should refer to those companies’ privacy and data sharing statements.
Widgets. We may use third party widgets on our Website. A “widget” is a code added to a website to grab content from another website. These other websites may be tracking users. You can find their privacy notice by clicking on their name below:

HOW DO WE USE YOUR PERSONAL INFORMATION?

We may use Personal Information or non-personally identifiable information collected from you in the following ways:

To provide you with services and products.
For marketing, analytics, or performance management purposes.
To provide safety and security features.
To maintain, improve, and develop services and products.
To sign you up for our newsletters or other communications, or subscribe or unsubscribe you to our mailing list upon your request.
To provide you with support and to respond to your inquiries and complaints, including to investigate and address your concerns and monitor and improve our responses.
To detect and remove spammers, detect and remove non-compliant images, etc.
To evaluate you as a qualified candidate for employment or to provide services to us.
To investigate and respond to suspected illegal activities or fraud.
To comply with applicable federal, state, and other laws and regulations and respond to law enforcement requests or other valid legal requests and as required by applicable law, court order or governmental regulations.
As described to you when collecting your Personal Information.
For any other purpose with your consent, if required. You may choose to opt-out of such use.

Limitations on Sharing Personal Information. Ambry will not sell, rent, or otherwise disclose any of your Personal Information to any third party except as set forth in this Privacy Notice.
Internally. We may disclose your Personal Information to our corporate parent, affiliates, subsidiaries, and other parties who require such information to assist us with establishing, maintaining, and managing our business relationship with you, including contacting you directly.
Third Parties. We may disclose your Personal Information to our third-party service providers who need access to your Personal Information to perform their work on our behalf, including third party auditors, consultants, and professional organizations. These service providers have agreed not to sell or distribute your Personal Information to any other party. In addition, Ambry may share non-personal, anonymous, summary, or aggregate user data with its membership and other third parties.
Successors. In the event of a sale, merger, consolidation, change in control, transfer of substantial assets, reorganization, or liquidation, we may transfer, sell, or assign to third parties information concerning your relationship with us, including, without limitation, Personal Information that you provide and other information concerning your relationship with us. We also may disclose this information in connection with the due diligence for any such transaction. Any acquirer or successor of Ambry may continue to use your data as set forth in this Privacy Notice.
Legal or Government Requests. We may disclose your Personal Information if permitted or required by law or in response to a law enforcement or other legal request and/or to comply with a judicial proceeding, court order, or legal process.
Protection of Rights and Interests. We also may disclose your Personal Information if we believe such disclosure is reasonably necessary to protect or defend our interests or the interests of our users, or is necessary to protect the public from harm.
Other Purposes. We may use your information for any other purpose disclosed by us when you provide the information or with your consent.

We may disclose aggregated information about our users and information that does not identify an individual, without restriction.

Marketing Communication Opt-out. You can opt-out of receiving one of our e-mail marketing communications by following the instructions for unsubscribing contained in the e-mails, which will instantly unsubscribe you. If you have any issues, you can contact the Privacy Office by one of the methods listed below.
Accessing Your Personal Information. You may review and request changes to your contact information or other Personal Information that we collect and hold about you by contacting our Privacy Office by one of the methods listed below.

DO WE RESPOND TO DO-NOT-TRACK SIGNALS?

“Do-not-track” is a web browser setting that requests that a website disable its tracking of a user. Like many other websites, our Website does not currently respond to these “do-not-track” signals because they are controlled by our third-party analytics service providers.

HOW DO WE PROTECT YOUR INFORMATION?

Ambry takes reasonable precautions so that your information is treated securely and in accordance with this Privacy Notice. Information that you provide to Ambry through our Website is encrypted using industry standard Secure Sockets Layer (“SSL”) technology. Your information is processed and stored on controlled servers with restricted access. Transmission of information via the Internet is not completely secure. Although we will do our best to protect your Personal Information, we cannot guarantee the security of your data transmitted to Ambry. Any transmission of Personal Information is at your own risk.

HOW LONG DO WE STORE YOUR PERSONAL INFORMATION?

Ambry will retain Personal Information collected from you only as long as we need it to fulfill the purposes for which we have initially collected it, unless otherwise required by law. Because these needs can vary for different data types in the context of different services, actual retention periods can vary. When determining the retention period, we take into account criteria, such as the type of Services requested by or provided to you, the nature and length of our relationship with you, use of our Website and Services, and the impact on the Website functionality or Services if we delete your Personal Information.

DO WE COLLECT PERSONAL INFORMATION OF MINORS?

In all events, Ambry does not intend that any portion of its Website will be accessed or used by persons under the age of 13, and such use is prohibited. By using our Website, you confirm that you are not under the age of 18. Ambry will not knowingly collect or use any Personal Information from any child under the age of 18 without the prior consent of the parent or legal guardian. If you believe we may have information about a child under the age of 18, please contact our Privacy Office by one of the methods listed below.

WHAT ABOUT THE HIPAA NOTICE OF PRIVACY PRACTICES?

This Privacy Notice is in addition to, and does not replace, our HIPAA Notice of Privacy Practices, which explains how we use and disclose protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). If there is a conflict between the terms of this Privacy Notice and the HIPAA Notice of Privacy Practices with respect to PHI, the HIPAA Notice of Privacy Practices will control how we use and disclose your PHI.

CALIFORNIA AND TEXAS RESIDENTS

This section of the Privacy Notice applies solely to California and Texas residents and provides information in compliance with California law and Texas law, to the extent not already provided in this Privacy Notice.

In the previous 12 months, we have collected Personal Information as described below of certain healthcare professionals. We collect the following categories of information depending on the particular business purpose (set forth in the How Do We Use Your Personal Information above) for certain time periods (set forth in the How Long Do We Store Your Personal Information above).

Category	Personal Information We May Collect
A. Identifiers.	Name, institution, email, address, phone number, fax number, National Provider Identifier (NPI) number, and password.
B. Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	None
C. Protected classification characteristics under California or federal law.	None
D. Commercial information.	None
E. Biometric information.	None
F. Internet or other similar network activity information. This includes information we automatically collect as you browse, search, and interact with the Website, including through the use of first and third party cookies.	See What Information Do We Collect Automatically? and How Do We Use Tracking Technologies?
G. Geolocation data.	None
H. Sensory data.	Audio recordings
I. Professional or employment-related information.	None
J. Education information, as defined by the Family Educational Rights and Privacy Act	None
K. Inferences drawn from other Personal Information.	None

Personal Information does not include: (1) publicly available information from federal, state, or local government records, (2) information that has been deidentified or aggregated (as defined by state law), or (3) patient information covered under HIPAA (see our HIPAA Notice of Privacy Practices).

Categories of Sources of Personal Information
We collect Personal Information:
- Directly from you or your authorized agent.
- Indirectly from you or your authorized agent through use of our Services (e.g., AmbryPort®, our CARE platform, and CARE Digital) and our Website.
- From our third-party service providers.
Purpose for Use of Personal Information
We may use or process Personal Information for purposes set forth in our the How Do We Use Your Personal Information section above. We also may sell your information to certain pharmaceutical companies as it relates to their clinical trials.
Categories of Third Parties to Whom We Disclose Personal Information
We may disclose Personal Information to those third parties listed in the How Do We Share Your Personal Information section above, along with certain pharmaceutical companies as it relates to their clinical trials.
Categories of Personal Information Sold or Shared
We may have sold some of the categories of Personal Information listed above under Notice of Categories of Personal Information Collected within the last 12 months. We may have sold such information to certain pharmaceutical companies as it relates to their clinical trials.
Categories of Personal Information Disclosed for a Business Purpose
We may have disclosed the categories of Personal Information listed above under Notice of Categories of Personal Information Collected for a business purpose within the last 12 months. We may have sold such information to certain pharmaceutical companies as it relates to their clinical trials.
Collection of Personal Information of Minors Under 16
In all events, Ambry does not intend that any portion of its Website will be accessed or used by persons under the age of 16 and such use is prohibited. Ambry does not knowingly collect or use any Personal Information from any child under the age of 16 without the prior consent of the parent or legal guardian. If you believe we may have information about a child under the age of 16, please contact our Privacy Office by one of the methods listed below.
Sensitive Personal Information
We collect and process, use, and disclose sensitive personal information, including gender and ethnicity, for the legal purpose of reporting to the Equal Employment Opportunity Commission (EEOC). We do not collect, process, use, or disclose sensitive personal information for the purpose of inferring characteristics or for any purpose other than those set for in CPRA Regulations, Section 7027(m).
Consumer Rights
- Right to know
  You can request that we disclose to you, and/or request a copy or access to your Personal Information regarding: (1) the categories and/or specific pieces of Personal Information that we have collected about you, (2) the categories of sources for that information, (3) the purposes for which we use that information, (4) the categories of third parties with whom we disclose the information, and (5) the categories of information that we sell or disclose to third parties.
- Right to delete
  You can request that we delete Personal Information that we collected from you and request us to tell our service providers to do the same, subject to certain exceptions.
- Right to opt-out of sale or sharing
  You can request that we stop selling or sharing your Personal Information (“opt-out”). You have the right to opt-out of such sale at any time by contacting the Privacy Office by one of the methods listed below.
- Right to correct inaccuracies
  You can request that we correct inaccurate information you believe we have about you.
- Right to non-discrimination
  You have a right to non-discrimination to protect against denial of goods or services, charging you a different price, or providing a different level or quality of goods or services just because you exercised your rights under the CCPA.
If you want to exercise any of these rights listed above, you can submit a request to the Privacy Office by one of the methods listed below. We will not discriminate against you for exercising any of your rights.
Verification of You or Your Authorized Agent
Please note that we will need to verify your identity and state of residency, such as matching the Personal Information you give us to our records, whenever possible, or ask for a copy of your driver’s license or identification card, before processing your request. If you are acting on behalf of another individual, we will need proof that you are authorized to make a request on that individual’s behalf, such as a valid power of attorney or comparable documentation. Absent such proof, we reserve the right to refuse to comply with your request. We aim to respond within 45 days of receipt. If additional time is needed, we may take up to 45 more days (i.e., a maximum total of 90 days) to comply with your request, and we will inform you of the reason(s) why the extension is necessary within the initial 45 days of receiving your request.

ADDITIONAL PRIVACY RIGHTS FOR RESIDENTS OF QUEBEC

As a Quebec resident, you have certain data privacy rights that are protected by law. These rights include the right to access, correct, and delete your Personal Information (as defined by provincial law) that we collect and process on our Website. You also have the right to withdraw consent for the processing of your Personal Information at any time. If you wish to exercise any of these rights or have any concerns about how your Personal Information is being handled, please contact the Chief Privacy Officer by one of the methods listed below. Please note that we will need to verify your identity and residency.

REVISIONS TO OUR PRIVACY NOTICE

We reserve the right to amend this Privacy Notice from time to time and for any reason, in our sole discretion, without notice, by updating this Privacy Notice. Accordingly, users are strongly encouraged to review our Privacy Notice regularly. If we decide to change our Privacy Notice, the revised version will be effective the date it is posted, which is identified at the top of the page. Your continued access or use of our Website or Services following the posting of changes to this Privacy Notice means that you accept such revisions, changes and/or amendments. If you object to any of the changes to this Privacy Notice, please stop accessing or using our Website or Services. Please check this page frequently and review any changes to this Privacy Notice carefully so you are aware of any changes, as they are binding on you.