ClariSeq TB - Mycobacterium tuberculosis WGS Drug-Resistance Analysis Tool

Privacy Policy

This Privacy Policy applies to ClariSeq TB as currently designed and deployed and takes effect on the Last updated date shown above. It should be read together with the ClariSeq Analytics LLP Terms and Conditions and any Order Document or data processing terms agreed with your organization. Where those terms and this policy conflict on how customer-submitted data is handled, the agreed terms prevail for that customer.

This Privacy Policy explains how ClariSeq Analytics LLP ("ClariSeq", "we", "us", or "our") collects, uses, stores, shares, protects, and deletes information when you access or use ClariSeq TB, our web-based Mycobacterium tuberculosis whole-genome sequencing drug resistance analysis platform, related websites, dashboards, reports, support channels, and administrative services (together, the "Service").

ClariSeq TB is intended for professional laboratory, research, clinical, public-health, and institutional users. The Service processes short-read sequencing files, sample metadata, analysis settings, interpreted resistance results, account information, billing/licensing information, support communications, free-trial requests, contact messages, audit logs, and consent records.

The Service may process health, genomic, infectious-disease, or patient-identifiable information. We treat such information as highly sensitive even where a specific law does not classify every item as personal data.

1. Who This Policy Applies To

This policy applies to:

• registered users of ClariSeq TB;
• trial users and prospective customers who submit forms on our website;
• customer administrators, laboratory staff, reviewers, and billing contacts;
• individuals whose sample, specimen, patient, or sequencing information is submitted to the Service by a customer;
• people who contact us by email, website forms, or support channels.

If you submit data about another person, including patient or sample data, you are responsible for ensuring that you have the authority, consent, legal basis, ethics approval, institutional approval, or other lawful permission required to submit that data to ClariSeq TB.

2. Our Role Under Privacy Laws

For account management, website forms, billing, security, service administration, product communications, and our own business operations, ClariSeq generally acts as the data controller under the GDPR and as the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

For patient sample data, FASTQ files, specimen metadata, genomic variants, and analysis outputs submitted by a laboratory or institutional customer, ClariSeq generally acts as a processor or service provider acting on the customer's documented instructions. The customer generally determines why the data is processed, who may submit it, how results are used, and whether patient-level consent or another lawful basis is available.

In limited cases, we may act as an independent controller or data fiduciary for security, fraud prevention, abuse prevention, legal compliance, audit logging, billing records, and protection of our rights and systems.

3. Information We Collect

Account and user information

• name, email address, phone number, affiliation, role, address, and organization details;
• login credentials and authentication records handled through our authentication provider;
• account status, free-trial or paid status, analysis credit balance and usage, access level and deployment mode.
• consent records showing accepted Terms and Privacy Policy versions and timestamps.

Sample, sequencing, and analysis information

• FASTQ sequencing files uploaded for analysis, processed transiently, and deleted as soon as analysis is completed;
• sample identifiers, specimen accession numbers, patient IDs, notes, referring facility, ordering clinician, geography, collection context, and other sample metadata entered by the user.
• analysis settings, platform type, pipeline status, quality metrics, coverage metrics, species identification evidence, lineage calls, mutations, drug-resistance interpretations, WHO resistance profile labels, review status, and generated reports;
• per-job logs, progress messages, error states, timestamps and technical metadata needed to run and troubleshoot analyses.

Website, support, CRM, and communications information

• free-trial signup details, contact-form submissions, quote or licensing requests, newsletter opt-ins, and support messages;
• email delivery metadata for transactional messages such as account activation, password reset, credit grants, admin notifications, and support replies;
• basic technical data such as IP address, browser type, device information, approximate location from network information, request timestamps, error logs, and security logs;
• website analytics data collected through Google Analytics on our public website, including cookie or similar identifiers, pages viewed, referring source, and session activity, as described in Section 16.

Payment and commercial information

Paid access is quotation-based and priced per sample analyzed. Where a quote request, quotation, invoice, purchase order, or payment is processed, we may process billing contact information, quotation and credit-order records, transaction records, tax details, payment status, and related commercial correspondence. Card or bank details, where applicable, should be handled by a payment processor and not stored directly by ClariSeq unless expressly stated in a separate agreement.

4. Information We Do Not Intentionally Collect

• We do not ask users to enter patient names. Users should not enter patient names in free-text fields.
• We do not require non-TB human genomic sequencing data for the intended use of the Service.
• We do not sell personal data, patient data, genomic data, or customer analysis data.
• We do not use customer-submitted patient data for targeted advertising.
• We do not knowingly collect children's account information for direct use of the Service.

5. How We Use Information

We use information for the following purposes:

• to create, authenticate, secure, and administer user accounts;
• to receive uploaded sequencing files and sample metadata;
• to run MTB species identification, variant calling, resistance interpretation, quality checks, and report generation;
• to show dashboards, PDF reports, Excel or data exports, cohort insights, historical-data features, and review workflows;
• to provide user support, investigate failed jobs, respond to contact requests, and manage trials or licensing requests;
• to maintain security, detect misuse, prevent unauthorized access, preserve audit logs, and enforce role-based access controls;
• to send transactional and administrative emails;
• to comply with law, respond to lawful requests, preserve records, resolve disputes, and enforce agreements;
• to improve the reliability, usability, and performance of the Service using technical, operational, and aggregated usage information, rather than customer-submitted sample, sequencing, or patient data.

6. Lawful Bases for Processing

Where the GDPR applies, our lawful bases may include contract performance, consent, legal obligations, legitimate interests, and, where relevant for health or genomic data, explicit consent, scientific or public health grounds, medical or diagnostic obligations, or processing carried out under the responsibility of a professional or institution subject to confidentiality obligations. The exact basis may depend on the customer, jurisdiction, sample source, and use case.

Where the DPDP Act applies, we process digital personal data for specified lawful purposes after providing notice and obtaining consent where required, or under another permitted lawful use. Users and customers must ensure that any patient or third-party personal data submitted to the Service has been collected and shared lawfully.

We rely on legitimate interests for security monitoring, fraud prevention, service diagnostics, product reliability, audit logging, and ordinary business administration, provided those interests are not overridden by applicable rights and freedoms.

7. Sensitive Health and Genomic Data

ClariSeq TB analyzes microbial sequencing data and TB resistance evidence. However, uploaded files and sample metadata can still relate to an identifiable patient, facility, clinician, outbreak, or public-health investigation. For that reason, we handle sample-linked data as sensitive data.

Customers should submit only the minimum patient-identifiable information needed for their legitimate workflow. Where possible, use coded identifiers rather than direct identifiers, avoid patient names, and keep local re-identification keys within your own institution.

ClariSeq TB is a decision-support and reporting tool. It does not replace professional clinical judgment, applicable laboratory validation, national TB program guidance, or regulatory obligations for diagnostic reporting.

8. Data Location and Architecture

The Service is designed so raw FASTQ files are never stored as a retained customer record. They are uploaded only for the purpose of running the requested analysis, processed transiently in the controlled analysis environment, and deleted as soon as analysis is completed. Raw FASTQ files are not stored in Supabase or any other cloud storage.

Between upload of the raw FASTQ files and generation of the final VCF, the pipeline creates intermediate files inside the controlled analysis environment. These typically include quality-trimmed or filtered FASTQ files; read-QC and read-statistics reports; alignment files (BAM or CRAM) and their index files; sorted or duplicate-marked alignment files; depth and coverage files; pileup and intermediate or unfiltered variant-call files; species-identification and lineage-detection outputs; consensus or reference-mapped sequence files; and per-job pipeline logs and temporary working files. All of these intermediate files exist only for the duration of the requested analysis and are deleted, together with the raw FASTQ files, as soon as the analysis is completed. The only per-user sequence artifact retained after completion is the final VCF file, together with the analysis result metadata described in Section 3.

The main ClariSeq TB platform is hosted on DigitalOcean in Bangalore. Account data, authentication records, entitlements, consent records, CRM records, and job metadata are stored in Supabase in the Mumbai region. The retained per-user analysis artifact is the VCF file generated from the completed analysis. PDF reports are not stored; they are generated fresh each time a user requests a PDF report.

We use this separation to reduce exposure of raw sequencing data and to keep authentication and customer account records separate from genomic analysis artifacts.

We may in future make the Service available from additional hosting regions or providers, including in the European Union or the United States, for particular customers or deployment models. The hosting region and provider applicable to a customer will be the one stated in that customer's Order Document or deployment schedule, or as notified to the customer, and will be confirmed on request. Introducing an additional region does not change the design principles described in this section: raw FASTQ files and intermediate pipeline files remain transient and are deleted on completion of the analysis, and account records remain separated from analysis artifacts.

9. How We Share Information

We share information only as needed for the Service and lawful business operations:

• with cloud hosting, database, authentication, email, storage, security, logging, payment, website analytics, and support vendors;
• with customer-authorized users within the same organization or account;
• with administrators and moderators under role-based access controls and approval workflows;
• with professional advisers, auditors, insurers, or legal representatives where necessary;
• with public authorities, courts, regulators, or law-enforcement bodies when legally required or necessary to protect rights, safety, and security;
• as part of a merger, acquisition, financing, restructuring, or asset transfer, subject to confidentiality and notice where required.

We require service providers to process information only for authorized purposes and to use appropriate confidentiality, security, and data-protection safeguards.

10. International Transfers

Your information may be processed in India and in other countries where we or our service providers operate. Where GDPR applies and information is transferred outside the European Economic Area, we will use an appropriate transfer mechanism such as an adequacy decision, Standard Contractual Clauses, contractual safeguards, supplementary measures, or another lawful mechanism.

Where the DPDP Act applies, cross-border transfers will be handled in accordance with applicable Indian law, including any restricted-country notifications or rules that may apply. The current production architecture keeps the main tool hosted on DigitalOcean in Bangalore and Supabase account/job metadata in the Mumbai region, unless a separate customer agreement states otherwise. Where we make an additional hosting region available and a customer is provisioned in it, that region determines where the customer's data is processed, and we will apply the transfer mechanisms and safeguards appropriate to that region, including Standard Contractual Clauses or another lawful mechanism where data moves outside the European Economic Area, and Indian cross-border transfer requirements where data originating in India is processed abroad.

11. Security Measures

We use technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, loss, and misuse. Our current safeguards include:

• HTTPS/TLS encryption in transit;
• role-based access controls for account, admin, and moderator functions;
• separation of raw sequencing data from account and entitlement data;
• deletion of raw FASTQ files and all intermediate pipeline files as soon as the requested analysis is completed;
• service-role access controls for locked CRM, audit, and consent tables;
• audit logging for administrative activity;
• confidentiality obligations for all personnel with access to the Service, and privacy and security awareness training;
• periodic review of administrative and support access, and prompt removal of access when a person's role no longer requires it;
• troubleshooting procedures under which patient-identifiable fields are accessed only where strictly necessary to resolve a reported issue, only by authorized personnel, and with the access recorded in our audit logs;
• redaction or masking of patient-identifiable data in administrative and troubleshooting views;
• environment-based secrets management and limited operational access;
• backups, monitoring, and deployment controls appropriate to the current environment.

No method of internet transmission or electronic storage is completely secure. We cannot guarantee absolute security, but we work to maintain safeguards appropriate to the sensitivity of the data and the risks of the processing.

12. Data Retention

We retain information only for as long as necessary for the purposes described in this policy, as required by contract, or as required by law. Unless a different agreement applies, our retention approach is:

• account records: for the life of the account and a reasonable period after closure;
• raw FASTQ files: not retained; deleted as soon as the requested analysis is completed;
• intermediate FASTQ and QC files (quality-trimmed or filtered FASTQ, read-QC and read-statistics reports): not retained; deleted with the raw FASTQ files on completion of the analysis;
• alignment and coverage files (BAM or CRAM files and index files, sorted or duplicate-marked alignments, depth and coverage files): not retained; deleted with the raw FASTQ files on completion of the analysis;
• intermediate variant, species-identification, lineage and consensus files (pileup files, unfiltered or intermediate VCFs, species and lineage outputs, consensus or reference-mapped sequence files, temporary working files): not retained; deleted with the raw FASTQ files on completion of the analysis;
• final VCF files: retained as the per-user analysis artifact while the account remains active or until deleted under product controls, written request, or a customer agreement, subject to legal or contractual retention duties;
• PDF reports: not stored; generated fresh each time the user requests a PDF report;
• analysis result metadata: retained while the account remains active or until deleted under product controls or written request, subject to legal or contractual retention duties;
• trial, contact, quote, support, and CRM records: for up to two years unless a longer period is needed for customer relationship, legal, or accounting reasons;
• billing, tax, payment, invoice, and commercial records: for the period required by applicable accounting, tax, and company law;
• website analytics data: retained for the period configured in our Google Analytics property, and thereafter available only in aggregate reports;
• application logs and security logs: for up to one year unless a longer period is required for security investigation, legal compliance, or dispute resolution;
• audit logs and consent records: for as long as needed to prove compliance, investigate misuse, resolve disputes, and maintain system integrity;
• VCF backups: retained and overwritten according to the applicable DigitalOcean backup policy and lifecycle.

When information is no longer needed, we delete, anonymize, aggregate, or securely isolate it unless retention is required by law, contract, public-health obligation, dispute resolution, or security necessity.

13. Your Rights

Depending on where you live and how the data is processed, you may have rights to access, correct, update, delete, restrict, object to, or receive a copy of your personal data. You may also have the right to withdraw consent, nominate another person to exercise rights on your behalf where applicable under DPDP, and lodge a complaint with a competent authority.

Under the GDPR, eligible individuals may have rights to be informed, access data, rectify inaccurate data, erase data, restrict processing, object to processing, data portability, withdraw consent, and avoid certain solely automated decisions with legal or similarly significant effects.

Under the DPDP Act, eligible data principals may have rights to access information about personal data, correction and erasure, grievance redressal, withdrawal of consent where consent is the basis of processing, and nomination.

If we process patient sample data on behalf of a customer, we may need to direct rights requests to that customer or cooperate with that customer in responding. We may verify identity and authority before acting on a request.

14. Consent and Withdrawal

Where consent is required, consent must be freely given, specific, informed, unambiguous, and capable of being withdrawn. Withdrawal does not affect processing that occurred before withdrawal. Withdrawal may also affect our ability to provide the Service, complete an analysis, retain an account, or maintain legally required records.

Customer users must ensure that they have obtained any required patient, institutional, ethics, or legal consent before uploading sample-related data. If you believe data was submitted without proper authority, contact us promptly at info@clariseq.com.

15. Automated Analysis and Decision Support

ClariSeq TB automatically processes sequencing data to identify species evidence, mutations, drug-resistance interpretations, quality flags, and report content. These outputs are generated through bioinformatics workflows and curated reference data.

The Service is not intended to make a final clinical decision without qualified human review. Customers are responsible for validating workflows, reviewing results, applying local guidelines, and determining whether and how outputs are used in clinical, public-health, or research contexts.

16. Cookies and Similar Technologies

We may use essential cookies, local storage, session tokens, and similar technologies to keep users signed in, protect the Service, remember account/session preferences, and operate core functionality. We do not use patient sample data for advertising cookies or behavioral advertising.

We use Google Analytics on our public website to understand how visitors find and use our pages. Google Analytics sets cookies or similar identifiers and processes technical information such as IP address (truncated or anonymized where that setting is available), device and browser type, operating system, referring source, approximate location derived from network information, pages viewed, and session activity. We use this information only in aggregate, to measure traffic and improve our website content, and not to identify individual visitors.

Google Analytics is not enabled inside the authenticated ClariSeq TB analysis environment. No sample, sequencing, specimen, patient, or analysis data is shared with Google Analytics or with any other analytics provider, and we do not combine analytics data with account or sample records.

Where consent is required under the GDPR, the DPDP Act, or other applicable law, analytics cookies are set only after you consent through our cookie notice. You can withdraw consent or refuse analytics cookies at any time through that notice or your browser settings, and doing so does not affect your ability to use the Service. Google acts as our service provider for this purpose and may process analytics data outside India and outside the European Economic Area under its own terms and transfer mechanisms; you may also opt out using Google's browser opt-out add-on.

If further analytics tools, marketing pixels, or other non-essential cookies are introduced later, this policy and our cookie notice will be updated before they are enabled.

17. Research, Product Improvement, and Aggregated Data

We may use de-identified, anonymized, or aggregated operational data to understand reliability, performance, error rates, usage patterns, and product quality. We do not use customer-submitted sample, sequencing, or patient data — whether identifiable, de-identified, or aggregated — to train, validate, or improve our drug-resistance interpretation engine, reference databases, or related models, unless you have separately agreed in writing. We will not publish customer-identifiable or patient-identifiable results without appropriate authorization.

Any use of identifiable sample, genomic, clinical, or customer data for research, benchmarking, model development, publication, or external collaboration requires an appropriate legal basis, agreement, consent, ethics approval, or de-identification process.

18. Breach Notification

If we become aware of a personal data breach, we will investigate, take steps to contain and remediate the issue, and notify affected customers, individuals, regulators, or authorities where required by applicable law. Under the DPDP Act, applicable personal data breaches may need to be notified to the Data Protection Board of India and affected data principals. Under the GDPR, certain breaches may need to be notified to a supervisory authority and, in higher-risk cases, affected individuals.

19. Children

The Service is for professional and institutional users, not children. We do not knowingly allow children to create accounts. If a customer submits sample data relating to a child, the customer is responsible for ensuring that any required parental consent, guardian consent, clinical authorization, ethics approval, or legal basis exists before submission.

20. Customer Responsibilities

Customers and users are responsible for:

• submitting only data they are authorized to submit;
• providing all legally required notices to patients, staff, institutions, and other data subjects;
• obtaining and documenting consent or another lawful basis where required;
• using coded identifiers where practical and avoiding patient names in free-text fields;
• maintaining local records, validation, quality systems, and clinical review processes;
• managing user access within their organization and promptly removing users who no longer need access;
• using outputs in accordance with applicable medical, laboratory, regulatory, and public-health obligations.

21. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the Last updated date when changes are made. If changes are material, we may provide notice through the Service, by email, or by requiring users to accept the updated Privacy Policy before continuing to use the Service.

22. Contact, Rights Requests, and Grievances

For privacy questions, rights requests, consent withdrawal, grievance redressal, security concerns, or requests relating to patient or sample data, contact: