Data Processing Addendum

The clinic is the controller of personal data it submits to Humanome.AI, including genetic and health data. Wentzel Investments LLC, operating Humanome.AI, is the processor and acts only on the clinic's documented instructions.

The subject matter is genomic variant analysis for the clinic's patients. Data subjects are the clinic's patients and users. Data categories are identifiers, genetic variants and clinical context the clinic submits.

Humanome.AI processes personal data only to provide the service, ensures that people authorised to process it are bound by confidentiality, and tells the clinic if an instruction appears to violate data protection law.

Humanome.AI does not sell personal data, does not use it to train models for other customers, and does not combine it with data from other sources.

Humanome.AI keeps technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access control limited by role, audit logging, and tested backups.

The clinic gives general authorisation for subprocessors that host and operate the service. Humanome.AI binds each one to equivalent data protection terms and stays responsible for them.

Humanome.AI gives the clinic notice of a new subprocessor at least 30 days ahead, and the clinic may object on reasonable grounds.

Where personal data moves outside the EEA, UK or Switzerland, the parties rely on the Standard Contractual Clauses (controller to processor) or another lawful transfer mechanism, which are incorporated by reference.

Humanome.AI helps the clinic answer data subject requests, carry out data protection impact assessments and consult regulators, taking into account the nature of the processing. It forwards any request it receives directly to the clinic.

Humanome.AI notifies the clinic without undue delay and no later than 72 hours after becoming aware of a personal data breach, with the information the clinic needs to meet its own notification duties.

Humanome.AI provides the information needed to show compliance with this addendum and allows reasonable audits by the clinic, on 30 days' notice and during business hours.

At the end of the services Humanome.AI deletes or returns all personal data at the clinic's choice within 30 days, unless law requires storage.

For PHI under HIPAA, the Business Associate Agreement at /legal/baa also applies and controls on any conflict about PHI.