1. THE TEST
Hello there, we are FERN DNA Inc. operating as Fern DNA (“Fern”, “we”, “is” and terms of similar meaning) and we provide to you a lifestyle genetic fertility test (the “Test”), subject to this privacy policy (“Privacy Policy”). The Test encompasses (i) the website from which you order the Kit (hereinafter defined) (the “Fern Website”); (ii) the physical DNA testing kit, which consists of a cheek swab for sample collection (“Sample”), instructions, personal information collection and consent form (“Information Form”), as well as a pre-addressed return envelope (collectively, the “Kit”); (iii) the lab processing and analysis of the Sample (“Sample Processing”); (iv) a detailed report of your genetics results (“Report”); (v) access to a web portal from which you can view your Report (“Web Portal”); (vi) an optional 30 minute consultation with a genetic advisor (“Genetic Consultation”); and (vii) any other product or service provided by Fern in the future that is related to the Test.
2. CONSENTING TO THIS PRIVACY POLICY
By accepting the Privacy Policy when you order a Test, you expressly consent to our collection, use and disclosure of your Personal Information in accordance with this Privacy Policy.
“Personal Information” includes your (i) personal health information (“PHI”), as defined in the Personal Health Information Protection Act (Ontario) (“PHIPA”), as applicable; (ii) personally identifiable information, which is information that can be used to identify you (“PII”); and (iii) non-personally identifiable information, which is information that cannot be used to identify you (“Non-PII”).
3. OUR LAB SERVICE PROVIDER
We work closely with a third-party lab service provider to provide you with certain aspects of the Test (the “Third-Party Lab”). As of the current date of this Privacy Policy, the Third-Party Lab is DNALabs Canada Inc. The Third-Party Lab (i) receives and collects your Sample and Information Form; (ii) processes your Sample for the purpose of providing to you your Report; and (iii) operates and provides to you the Web Portal (collectively, the “Lab Services”).
Our Third-Party Lab is subject to confidentiality obligations to keep your Personal Information (which includes your PII and PHI) confidential, to not access or use your Personal Information other than as necessary to provide the Lab Services, to safeguard your Personal Information, and to not disclose your Personal Information to anyone else other than those who need-to-know such information and are bound by confidentiality obligations as strict as those that the Third-Party Lab is bound by.
Before your Sample is processed, it is de-identified and associated with a unique identification code. This means that there is no PII associated with your Sample when it is processed and analyzed by the Third-Party Lab. Your PII and raw genetic data resulting from the processing of your Sample are stored in separate databases. Both your PII and raw genetic data are both encrypted in-transit and at rest and stored on servers in Canada. Your Report (which includes your PII and interpretation of genetic data) are stored on a HIPAA-compliant web server that is accessible only via a secure portal. The Third-Party Lab destroys your Sample after 6 months of processing.
The Web Portal is HIPAA-compliant and subject to the terms of use and privacy policy of the Third-Party Lab.
4. COLLECTION OF PERSONAL INFORMATION
When we collect your Personal Information
We will collect your Personal Information in the following ways:
When you order a Kit from the Fern Website;
When you send us (or our Third-Party Lab) your Sample and Information Form for processing;
When you create an account and log into the Web Portal;
When you book an appointment and complete an intake form (if any) for a Genetic Consultation.
(collectively, the “Collection Methods”)
Personal Health Information
When we collect your Personal Information, we may collect the following PHI about you:
Name of clinician/practitioner (optional);
Name of clinic/practice (optional):
Clinic address/email/phone number (optional);
Fertility health history;
Any other information as requested in the Information Form;
Any other information as requested when you book an appointment for a Genetic Consultation or when you complete an intake form.
Personally Identifiable Information
When we collect your Personal Information, we may collect the following PII about you:
Your first name and last name, title, pronouns;
Email;
Phone number;
Address;
Your birth date;
Your gender/sex;
occupation
guardian (if less than 16)
Emergency contact
Payment transaction details;
Any other information as requested in the Information Form;
Any other information as requested when you book an appointment for a Genetic Consultation or when you complete an intake form
Any other information as required for you to create an account and log into the Web Portal;
Non-Personally Identifiable Information
Fern will collect the following Non-PII about you:
How you heard about Fern. We may ask you to let us know how you heard about Fern.
Website activity: We collect information about your use of the Fern Website and Web Portal, whether you purchase a Test, etc.
Device information: We also collect information that your device provides us in connection with your use of the Fern Website and Web Portal, such as your desktop device type, system language, mobile carrier, browser type, IP address, etc.
Cookies and similar technology: We use cookies in connection with your use of the Fern Website and Web Portal to collect information related to what you see and interact with. Cookies are small files placed on your hard drive that assist us in providing our services. We may use cookies to collect usage information, determine our total audience size and traffic and determining which areas of the Fern Website or Web Portal are of greatest interest to users.
Web Beacons/Pixel Tags. These are invisible tags placed on certain pages of the Fern Website or Web Portal. When you access these websites, pixel tags generate a notice of that visit. They usually work in conjunction with cookies, registering when a particular computer visits a particular page. If you turn off cookies, the pixel tag will simply detect an anonymous website visit. We may use web beacons to recognize users and access traffic patterns.
5. USE OF PERSONAL INFORMATION
How we use your Personal Health Information
Fern uses your PHI:
To prepare and provide to you your Report.
To receive and coordinate appointment bookings for your Genetic Consultation.
For any other purpose for which we have obtained your consent to the use of your PHI or PII, as applicable.
Other than as specified in this Section Fern will not use your PHI for any other purpose without your written authorization, or unless otherwise permitted or required by law.
How we use your Personally Identifiable Information
We will use your PII to:
To provide you with the Kit;
To coordinate the processing of your Sample;
To provide you with the Web Portal;
To provide you with the Report;
To troubleshoot problems;
Detect and protect us against error, fraud and other criminal activity;
To enforce our terms of use (if applicable), refund policy, including obtaining payment;
Provide you with system or administrative messages;
Inform you of site updates and notices related to privacy or security;
To send you information about your relationship or transactions with us;
To contact you about the status of the Kit, Sample, Sample Processing, Report, Web Portal and Genetic Consultation;
Deliver you information that may be relevant to your interests (if you have opted in to receive such information).
Other than as specified in this Section Fern will not use your PII for any other purpose without your written authorization, or unless otherwise permitted or required by law.
How we use your Non-Personally Identifiable Information
We use Non-PII for purposes such as measuring the number of users of various features of the Fern Website and Web Portal and making the foregoing more useful to you. We may use your Non-PII for research purposes, for marketing and promotional purposes, and to develop new learning tools and solutions. We may analyze trends, administer the Fern Website and Web Portal, track your movement, and gather demographic information in an aggregate anonymized non-personally identifiable way. We may also perform internal research on our users demographics, interests, and behavior to better understand, protect and serve you and your community.
6. DISCLOSING YOUR PERSONAL INFORMATION
Personal Health Information
Fern discloses your PHI:
To our genetic advisor with whom your appointment for a Genetic Consultation is booked;
To our Third-Party Lab in order to provide you with the Lab Services;
To our appointment booking platform, the Jane App, to enable you to book a Genetic Consultation;
To any other party for which we have obtained your consent to the disclosure of your PHI to such party, as applicable.
Other than as specified in this Fern will not disclose your PHI for any other purpose without your written authorization, or unless otherwise permitted or required by law.
Personally Identifiable Information
Fern discloses your PII:
To our genetic advisor with whom your appointment for a Genetic Consultation is booked;
To our Third-Party Lab in order to provide you with the Lab Services;
To our Third-Party Service Providers (hereinafter defined) for the purpose of providing you the Fern Website and appointment booking platform to enable you to book a Genetic Consultation;
To any other party for which we have obtained your consent to the disclosure of your PII to such party, as applicable.
Other than as specified in this Fern will not disclose your PII for any other purpose without your written authorization, or unless otherwise permitted or required by law.
Third-Party Service Providers
Some portions of the Test are reliant on third-party service providers, including but not limited to the Jane App for appointment booking, and our e-commerce software service provider (“Third-Party Service Provider”). These Third-Party Service Providers may be supplied with or have access to your Personal Information solely for the purpose of providing certain Test components to you on our behalf. Such Third-Party Service Providers are best-in-class and have appropriate confidentiality and security standards. The Jane App is PHIPA-compliant.
Legal Requests
We cooperate with law enforcement inquiries and demands for information that are made under force of law. Therefore, we may disclose your Personal Information (a) to any governmental authority as part of an investigation to determine our compliance with any applicable law, rule, or regulation (including privacy laws, rules, and regulations), in accordance with the applicable law (b) in response to a court order, subpoena, discovery request, or other lawful judicial or administrative proceeding, in accordance with the applicable law (c) as otherwise required under any applicable law.
Sale of Business
We may also disclose Personal Information to the acquirer or its agents in the course of the sale of our business. If we do this, the disclosure will be subject to confidentiality arrangements customary in such transactions.
7. STORAGE AND RETENTION OF YOUR PERSONAL INFORMATION
Retention of Personal Information
We retain Personal Information for only as long as required to fulfill the identified purposes for which it was collected or as required by law. We may retain some or all of your Personal Information on back-up files; provided, however, we assume no obligation or guarantee to archive any information and do not warrant that any archived information will later be made available to you.
Personal Information Stored Outside Canada
You acknowledge and understand that, in some instances, your Personal Information may be stored and processed outside of Canada.
8. PROTECTING YOUR PERSONAL INFORMATION
Fern and our Third-Party Lab strives to protect your Personal Information, including your PHI and PII. We and our Third-Party Lab use commercially reasonable administrative, technical, and physical measures to safeguard your PII and PHI in our possession against loss, theft and unauthorized use, disclosure or modification. We, our Third-Party Lab and our Third-Party Service Providers follow generally accepted industry standards to protect the information submitted to us, our Third-Party Lab and our Third-Party Service Providers, both during transmission and once we receive it.
Unfortunately, no data transmission over the internet and no storage of data, even in an encrypted form, can be guaranteed to be 100% secure. Therefore, while we, our Third-Party Lab and our Third-Party Service Providers strive to make all reasonable efforts to use commercially acceptable means to protect your PHI and PII, we, our Third-Party Lab and our Third-Party Service Providers cannot warrant the security of any information submitted and provided to you, and you acknowledge that there is always some risk in connection to the Test.
Fern will not permit its employees, contractors, representatives, directors, officers, etc. to have access to your PHI or PII unless they agree to be bound by a confidentiality agreement that includes the above restriction and have a need-to-know your with respect to your PHI or PII.
9. ACCESSING, UPDATING AND CORRECTING YOUR PERSONAL INFORMATION
You have a right to access your Personal Information and to request a correction to it if you believe it is inaccurate. If you have submitted Personal Information and would like to have access to it, or if you would like to have it corrected, please contact us using the contact information provided below. If an individual can show that Personal Information we hold about them is not accurate, complete or up-to-date, we will take reasonable steps to correct it. It is important that this information be complete, accurate and up-to-date. If during the course of our relationship, any of your information changes, we ask that you please inform us so that we can make any necessary changes.
An individual’s right to access their Personal Information is not absolute. We may deny access when, for example, access is required or authorized by law. If we deny an individual’s request for access to, or refuse a request to correct information, we will explain why.
10. REGARDING YOUR PERSONAL HEALTH INFORMATION
This section highlights some of your rights regarding your PHI.
Contact Person
Your contact person regarding your PHI is Jennifer Fitzgerald, and can be reached at Jen@ferndna.com.
Accessing your PHI
You have the right to obtain access to your PHI in either electronic or paper format. For instructions on how to get a copy of your PHI, please email Jen@ferndna.com. We reserve the right to charge you a reasonable cost-based fee, such as for photocopying or postage.
If you are requesting access to your PHI, we, of course, have to take reasonable steps to verify your identity before releasing your PHI to you.
Correcting your PHI
You have the right to make corrections to your PHI. For instructions on how to make corrections to your PHI, please email Jen@ferndna.com.
If you are requesting a correction to your PHI, we, of course, have to take reasonable steps to verify your identity before correcting your PHI for you.
Communicating in a Specific Way
When corresponding with Fern about your PHI, you may ask us to communicate with you in a specific way. Please let us know your email or phone number at which you would like us to contact you.
Complaints to Fern
You may make a complaint about our practices relating to your PHI by emailing Jen@ferndna.com
Complaint to the Commissioner
You may make a complaint to the Commission regarding our practices relating to your PHI by contacting:
Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400
Toronto, Ontario
M4W 1A8
10. QUESTIONS OR CONCERNS
It is our goal to make our privacy practices easy to understand. If you have questions or concerns, please email our privacy officer at Jen@ferndna.com