1. Scope of this policy
This policy explains how Sophont Inc. (“Sophont,” “we” or “us”) collects, uses, maintains, shares and protects consumer health data that people in the United States provide to us, or that we receive at their direction, in our Patient Data Program.
“Consumer health data” means personal information that identifies, or can reasonably be linked to, a person and describes that person’s past, present or future physical or mental health. It includes medical records, pathology images, test results, genetic data, and health information we infer or derive. Data that has been de-identified in accordance with applicable law is treated separately, as described below.
This is our dedicated consumer health data privacy policy for purposes including Washington’s My Health My Data Act, Nevada’s consumer health data law, Connecticut’s privacy and genetic-data laws, and California’s Genetic Information Privacy Act. Our website privacy policy is a separate notice covering general website activity. Each participant’s Patient Data Consent and Release describes the permissions applicable to that participant.
2. Health data we collect and where it comes from
| Category | Examples |
|---|---|
| Identity, contact and demographic information | Name, date of birth, age, sex, state of residence, email, phone, relevant dates, and information about legal representatives or caregivers |
| Pathology and specimen information | Digital slide images, including H&E, IHC and other stains; slide labels and barcodes; pathology reports; specimen dates, body sites and clinical context |
| Genetic, genomic and molecular information | Tumor and inherited (germline) test results and raw data; DNA, RNA and other sequencing data; single-cell and spatial assays; related phenotypic information |
| Imaging and clinical records | MRI, CT and PET images and reports; clinical notes; laboratory results; diagnoses; medications; treatments; outcomes; and family medical history contained in the patient’s records |
| Communications | Information in emails, messages, forms, calls and meetings, including recordings and transcripts |
| Information we derive | Reports, analyses, annotations, model outputs, inferred health information, datasets and benchmarks |
We collect this information from the patient or their legal representative; the patient’s doctors, hospitals, laboratories and other providers when authorized; records services, caregivers and others assisting the patient; and our own analysis of the information.
3. How we process and use health data
Our processing methods include receiving, collecting, storing, copying, organizing, combining, analyzing, transmitting, de-identifying and deleting information. We use consumer health data for the following purposes, subject to each participant’s signed permissions:
- Requested analysis and reports: analyzing the patient’s information with our own models and methods, third-party software and AI tools, and staff and contractors; preparing, delivering and updating research reports and observations.
- Communication and follow-up: answering questions; requesting additional records; learning about treatment and outcomes; communicating with representatives, caregivers and providers; and inviting participants to additional research.
- Research and development: using identifiable, coded or de-identified information for medical, scientific and AI research; training, testing, evaluating and improving models; creating datasets, benchmarks and training environments; and developing and commercializing products and services.
- Genetic data for research: using identifiable or coded genetic data for the research and development purposes above only when the participant has separately selected that permission.
- Publication and commercialization: using de-identified information in case studies, scientific and marketing materials, datasets, models and products. We use a participant’s name, photo or identifiable story only with separate publicity permission, which does not cover genetic data.
- Operations and legal purposes: securing and operating our business; maintaining records; enforcing agreements; complying with law; protecting safety, rights and property; and completing lawful business transactions.
AI and large language models: We collect and use personal data, including health data and, with separate permission, genetic data, to train and test AI models, which may include large language models. We may also sell or license de-identified data for AI training. We do not sell identifiable personal data without separate written authorization.
We do not use consumer health data to make solely automated decisions that produce legal or similarly significant effects for a participant.
4. When we share health data
We share the categories of consumer health data described above with the following categories of recipients, for the purposes described:
| Recipient category | Data and purpose |
|---|---|
| Service providers and professional advisers | Identifiable or coded data as needed for cloud storage and computing, file transfer, communications, AI processing, security, and legal, financial and research services. They process data for us, subject to contractual and legal restrictions. |
| Providers, records services and designated contacts | Records, analyses and reports needed to obtain or clarify information, discuss results and follow up, at the patient’s direction. |
| Research and commercial recipients, or the public | De-identified data and materials derived from it for research and commercial purposes. Recipients may include universities, hospitals, nonprofits, AI developers, biotechnology and pharmaceutical companies, and other organizations. We and they may receive money or other value. |
| Research collaborators: universities, hospitals, research laboratories, and biotechnology, pharmaceutical and AI companies | Identifiable or coded data, except genetic data, for research and development, only with the participant’s separate permission. |
| Business successors and transaction parties | Data disclosed as reasonably necessary in connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of assets. |
| Government agencies, courts and other legally authorized recipients | Information disclosed as required by law or legal process, or as reasonably necessary to protect safety, rights, security or property. |
We do not currently share consumer health data with affiliates for their own independent use.
We do not sell identifiable consumer health data without separate authorization. De-identified data may be shared, licensed or sold as described in this policy.
Sophont does not enable third parties to collect consumer health data about program participants over time and across different websites.
5. De-identified data and our public commitment
“De-identified” means information has been processed so it cannot reasonably be used to identify, or be linked to, a person or household. We select methods reasonably designed to meet applicable legal standards, which may include methods recognized under HIPAA or other applicable standards.
For de-identified data derived from the Patient Data Program, Sophont publicly commits to:
- take reasonable measures to ensure that the data cannot be associated with a person or household;
- maintain and process the data only in de-identified form and not attempt to re-identify it, except to assess our safeguards;
- contractually require every recipient, including through the terms of a public release, not to attempt re-identification and to apply equivalent restrictions to onward disclosures;
- take reasonable steps to monitor compliance with those contractual commitments; and
- use a particular de-identification method where applicable law requires one.
6. Additional genetic-data practices
- Consent for each use: Requested genetic analysis is covered by the required consents. Secondary research or commercial development using identifiable or coded genetic data requires the participant’s separate express permission.
- Access: Apart from disclosures described in this policy, only Sophont personnel, contractors and service providers who need genetic data for authorized work may access it. A current list is available on request.
- Disclosure: We disclose identifiable genetic data to a third party other than a service provider only with the participant’s written consent naming the recipient, unless the law requires or permits otherwise.
- De-identified research: De-identified genetic or phenotypic information may be shared with or disclosed to third parties for research purposes in accordance with 45 C.F.R. Part 46 where applicable. We may also use, share, license or sell de-identified genetic data for other research and commercial purposes as permitted by law.
7. Security, retention and location
We use reasonable administrative, technical and physical safeguards designed to protect consumer health data and limit access to people who need it for authorized work. No system is completely secure, and we cannot guarantee security.
We keep identifiable and coded consumer health data while the relevant consent remains effective and we have an authorized use for it. After withdrawal, we stop new uses covered by the withdrawn permission. After a full withdrawal, we delete or de-identify the identifiable and coded data we hold, subject to legal exceptions and required retention of consent, withdrawal and compliance records.
De-identified data and materials may be retained and used as permitted by law. Consumer health data is stored and transmitted electronically, may be disclosed electronically as described in this policy, and may be stored or processed in the United States or other countries.
8. Your privacy rights and how to exercise them
Depending on your state and the data involved, you may have some or all of the following rights, subject to legal exceptions:
| Right | What you may request |
|---|---|
| Confirm, access and copy | Confirmation whether we collect, use, share or sell your consumer health data; access to or a portable copy of it; and information about third parties and affiliates that received it. |
| Correct | Correction of inaccurate personal information, taking into account its nature and our processing purposes. |
| Delete | Deletion of consumer health data, with notices to service providers, contractors and other recipients where required, and deletion from backups within applicable time limits. |
| Withdraw or revoke consent | Withdrawal of collection, use or sharing consent, including any separate collaborator-sharing, genetic-research or publicity permission. Withdrawing one permission does not withdraw the others unless you say so. |
| Opt out or limit processing | Opt out of sale or sharing, targeted advertising, or profiling for legal or similarly significant decisions, as applicable. |
| Appeal | A reconsideration of our decision to deny a privacy request. |
How to make a request. Email [email protected] with the subject “Health data request.” Tell us your state of residence and which right you want to exercise. An authorized agent or legal representative may also make a request for you. We may verify your identity and authority. We respond within the time the law requires.
How to appeal. Reply to our decision with the subject “Appeal.” We will reconsider and respond in writing within the applicable deadline. If you disagree with the result, you may contact your state attorney general: Washington, Nevada, Connecticut or California.
Data that has been de-identified in accordance with applicable law is not subject to the same consumer rights as identifiable data. Subject to applicable law, prior reports, publications, licenses and sales may continue, and models already trained or released need not be recalled or retrained unless the law requires otherwise.
We do not discriminate against you for exercising applicable privacy rights. Withdrawing a permission needed for the requested analysis may end that analysis.
9. Changes to this policy
We will post any updated policy on this page with a new effective or last-updated date. We will provide additional notice and obtain affirmative consent before collecting, using or sharing additional categories of consumer health data, using it for additional purposes, or sharing it with additional categories of recipients, where required by law.
10. Contact us
For questions about this policy or our health-data practices, contact Sophont Inc. at [email protected] or 1520 E Covell Blvd, Ste 5, PMB 803, Davis, CA 95616.