BRIGHTGENE PTE. LTD. operates a genetic testing and ancestry analysis laboratory in Singapore, and this policy explains how the company collects, uses, stores, shares and removes personal data. The website and the laboratory services are provided by BrightGene, the developer name used by the company for its digital products, and by BRIGHTGENE PTE. LTD., the legal entity registered at 55 AYER RAJAH CRESCENT #01-26, Singapore 139949.
Genetic data is sensitive by nature. The company therefore applies a narrower standard than ordinary commercial practice, keeps collection to the minimum needed for a stated purpose, and gives every person a clear route to ask questions, obtain a copy of their record or request deletion. This document describes those commitments in detail and should be read together with the Terms of Service.
1. Who We Are
BRIGHTGENE PTE. LTD. is a company incorporated in Singapore with its registered address at 55 AYER RAJAH CRESCENT #01-26, Singapore 139949. The company provides genetic testing, ancestry analysis, laboratory review and related professional services, and it builds the integrated computer systems that support those services. For the purposes of Singapore data protection law, the company is the organisation responsible for the personal data described in this policy.
BrightGene is the developer name under which the company designs and maintains its website, sample tracking tools and reporting interfaces. References to BrightGene in this policy mean the same responsible organisation, and any question addressed to BrightGene is answered by the data protection team of BRIGHTGENE PTE. LTD.
The company does not sell genetic data, does not trade personal data for advertising value and does not operate a consumer data brokerage of any kind. Where this policy uses the word we, it refers to BRIGHTGENE PTE. LTD. and the staff who handle your information on its behalf.
2. Scope of This Policy
This policy applies to personal data collected through the website at brightgene.lat, through sample collection kits, through correspondence by email or telephone, and through the laboratory information systems used to process orders and issue reports. It covers visitors who only browse the website, clients who order a test, authorised representatives who act for a client, and clinicians or researchers who send samples to the laboratory.
The policy does not apply to independent genetic counsellors, clinics or courier companies that interact with you under their own privacy notices. When a referral is made, the counsellor is a separate organisation and will provide separate information about the handling of records created in that relationship.
Where a client is a company or a research institution, the agreement between that organisation and BRIGHTGENE PTE. LTD. may add further conditions. If those conditions conflict with this policy in a way that gives stronger protection to individuals, the stronger terms apply to the data covered by that agreement.
3. Information We Collect
We collect information that you provide directly, information created during laboratory work, and a limited amount of technical information generated when a browser loads the website. The categories are described below so that you can see exactly what a given interaction involves.
Identity and contact details
This includes your name, email address, telephone number, postal address, date of birth and, where relevant, the name of the clinic or organisation that referred you. We ask for the minimum needed to identify a sample correctly and to reach you about a result.
Order and sample information
When a kit is issued we record the kit lot, the return tracking reference, the acceptance check and the assay requested. Sample identifiers are barcoded, and the link between a barcode and your identity is held in a controlled part of the laboratory system rather than printed on the tube.
Health and family history information
Some services require a short health questionnaire, a note of known family conditions or the reason for testing supplied by a clinician. This information is used to select an appropriate panel, to interpret a result correctly and to decide whether a counselling referral is appropriate.
Correspondence
Emails, contact form messages, telephone notes and appointment records are kept so that the laboratory can answer questions consistently. When you use the contact form on this website, your message is composed in your own email program and sent to our support address. The website itself does not store the content of that message.
Technical information
Server logs may record the time of a request, the page requested, the browser type and a truncated network address. These records support security monitoring and fault diagnosis. They are not used to build advertising profiles.
4. Genetic Samples and Laboratory Data
A genetic sample is treated as sensitive personal data. The laboratory receives a tube or kit, confirms the seal and barcode, and records the acceptance decision before any analysis begins. From that point the sample carries an internal identifier, and access to the mapping between identifier and identity is restricted to staff who need it for the work at hand.
Raw data produced during a run, including quality metrics and control lane observations, is stored with the result. We keep these intermediate records because a later question about a report can often be answered from them without asking you for a second sample. Raw data is never released to a third party without your instruction or a lawful requirement.
Residual sample material is retained for a defined period so that a repeat assay remains possible. After that period the material is destroyed under the laboratory disposal procedure. You may request earlier destruction in writing at any time, understanding that a repeat test would then require a new sample.
Reports are stored in a signed, versioned form. Amendments are issued as a new version with a note explaining the change, and the earlier version remains in the record for audit purposes. We do not quietly overwrite a result.
5. How We Use Personal Data
Personal data is used to deliver the service you requested and to run the laboratory safely. The principal purposes are set out below. Where a new purpose arises that is not compatible with these, we will ask before proceeding.
- To register an order, issue a kit and confirm that the sample reached the laboratory in usable condition.
- To perform the requested assay, interpret the result and prepare a report in language that the client can understand.
- To review reports before release, including the quality checks described on the services page.
- To answer questions about a result, arrange a counselling referral and keep a record of the follow up.
- To maintain laboratory quality systems, investigate an anomaly and improve a procedure.
- To meet accounting, tax, record keeping and regulatory obligations that apply in Singapore.
- To protect the website and the laboratory systems against misuse, fraud or unauthorised access.
We do not use genetic data to make employment, insurance or credit decisions, and we do not provide data to any party that wishes to do so. We do not use your data to train a general purpose model that is offered to other customers.
6. Legal Bases for Processing
Under Singapore law we generally rely on your consent for the collection, use and disclosure of personal data, and on the performance of a contract where you have ordered a service. Certain processing is necessary to comply with law, to protect life or health in an emergency, or to pursue a legitimate interest that does not override your own interests.
Consent for genetic testing is recorded separately from consent for general communication. You can withdraw consent for future processing at any time by writing to support@brightgene.lat. Withdrawal does not affect processing already completed, nor does it remove records that the laboratory is required to keep by law.
Where a clinician orders a test on your behalf, that clinician is responsible for obtaining your consent before the sample is sent. The laboratory confirms that a consent record exists at intake and will pause the order if the record is missing or unclear.
9. Service Providers and Vendors
BRIGHTGENE PTE. LTD. uses a small number of vendors for hosting, email delivery, courier transport and laboratory consumables. Each vendor is selected with data protection in mind and is bound by a written agreement that limits use of the data to the service provided.
Vendors that handle sample transport are instructed on temperature control and chain of custody. Vendors that handle information systems are assessed for access control, encryption and incident reporting. We review these arrangements periodically and require notice before a subcontractor is introduced.
A vendor is never permitted to use the content of a report for its own product development, to combine our data with data from other customers, or to contact a client for marketing purposes.
10. International Transfers
Laboratory analysis is performed in Singapore. Some support services, such as hosted email or remote system maintenance, may involve a provider with infrastructure outside Singapore. Where personal data leaves Singapore, we require a comparable standard of protection through contractual terms, access limits and, where appropriate, encryption in transit and at rest.
If you are located outside Singapore and order a test, your information will be processed in Singapore for the purpose of the order. Where local law grants you additional rights, we will honour those rights to the extent they are consistent with the record keeping duties that apply to the laboratory.
We do not transfer genetic data to a jurisdiction for the purpose of advertising, profiling or resale. A transfer for research is described in the research section of this policy and requires separate consent.
11. Retention and Disposal
We keep personal data only as long as needed for the purpose for which it was collected, for a documented laboratory retention period, or for a legal requirement. Retention periods are set by record type rather than by a single blanket rule.
- Contact enquiries that do not become orders are removed after twelve months.
- Order, consent and report records are kept for the laboratory retention period, which supports repeat interpretation and audit.
- Residual sample material is destroyed after the stated material retention period or earlier on written request.
- Financial records are kept for the period required by Singapore accounting and tax rules.
- Server logs are removed on a short operational cycle.
When a record reaches the end of its retention period it is deleted from active systems. Backups that still contain the record are overwritten on their normal cycle, and a deletion log is kept to show that the action occurred.
12. Security Safeguards
We use administrative, physical and technical safeguards to protect personal data. Access to the laboratory systems requires named accounts, and privileged access is limited to staff who administer those systems. Passwords are managed through a controlled process, and shared accounts are not used for record systems.
The laboratory area is access controlled and sample handling follows written procedures with two person identity checks. Workstations are locked when unattended, and removable media are restricted. Data in transit between the website and internal systems is protected by standard encryption.
Staff receive training on confidentiality and on the handling of genetic information. A suspected incident is reported to the data protection team immediately, and the team follows the response procedure described later in this policy. No system is perfect, and we do not claim otherwise, but we design so that a single mistake does not expose an entire record set.
13. Your Rights and Choices
You may ask for access to the personal data we hold about you, request a correction, ask for deletion where no legal duty requires retention, withdraw consent for future processing, and ask for an explanation of how a decision about your data was made. You may also ask us to stop sending non essential communication.
Requests should be sent to support@brightgene.lat or by post to BRIGHTGENE PTE. LTD., 55 AYER RAJAH CRESCENT #01-26, Singapore 139949. We may need to confirm your identity before releasing a record, particularly where genetic data is involved, and we will tell you what evidence is needed.
We aim to respond within ten working days for a simple request and within thirty days for a complex one. If a request cannot be met, we will explain the reason and identify any route for further review. A fee is charged only where the law permits and where a request is manifestly excessive.
If you are not satisfied with our response, you may raise the matter with the data protection authority in Singapore or with the supervisory authority that applies where you live.
14. Privacy for Children
Services on this website are intended for adults who can give informed consent. We do not knowingly collect personal data from a child through the website. Carrier panels are not offered for children, and requests of that kind are referred back to the ordering clinician.
Where a test concerns a child for a clearly clinical reason, the order must come from a qualified clinician with the consent of a parent or legal guardian. The laboratory applies additional review to any such order and limits the report to the clinical question that prompted it.
If you believe that a child has provided personal data to us without appropriate authority, contact support@brightgene.lat and we will investigate promptly and remove the data where removal is consistent with legal obligations.
15. Research and Secondary Use
De identified data may be used internally to check assay performance, compare lot to lot variation and improve a reporting template. This internal work stays within the laboratory and does not result in publication or sharing with an outside party.
Any use of data for external research requires a separate, explicit consent that describes the research question, the parties involved and the form in which data would be shared. Consent for testing is never treated as consent for research, and declining research has no effect on the service you receive.
You may withdraw research consent at any time. Withdrawal stops future use, and where feasible we will remove already contributed data from an active research set, subject to the practical limits of a study that has already been analysed.
16. Marketing Communications
We send service messages, such as kit dispatch confirmations, sample acceptance notices, report release notices and appointment reminders, as part of the service. These messages are not marketing and are sent even if you have declined promotional contact.
Promotional messages, such as a note about the winter testing calendar, are sent only with consent and always carry a simple way to stop. We do not buy contact lists and we do not share your address with a marketing partner.
If you stop promotional messages, you will still receive messages about an active order. You can also ask us to change the channel we use, for example from email to telephone, where the law allows it.
17. Data Breach Response
If we become aware of unauthorised access, loss or disclosure of personal data, the data protection team will contain the incident, assess its scope and preserve evidence. The team will determine whether the incident poses a risk of harm and will notify affected individuals and the relevant authority where the law requires it.
Notification will describe what happened, the data involved, the steps already taken and the steps we recommend. Where the investigation is incomplete, we will give an initial notice and follow it with an update rather than wait for every detail.
After an incident we review the cause and change the procedure or system that allowed it. A summary of lessons learned is shared with staff, and the corrective action is tracked to completion.
18. Changes to This Policy
We may update this policy when a service changes, when a vendor changes or when the law requires it. The effective date at the top of the page is revised with each update, and a material change is announced on the homepage or by direct message to clients with an active order.
Where a change would broaden the use of genetic data, we will ask for fresh consent. We will not apply a broader use to data collected under an earlier version of this policy without that consent.
Earlier versions are kept on file and can be provided on request. If you would like the version that applied when you ordered a test, write to support@brightgene.lat and quote the approximate order date.
19. How to Contact Us
Questions about this policy, a request to access or correct data, or a concern about the handling of a sample should be sent to the data protection team. Please include enough detail for us to locate the record, such as an order reference or the approximate date of contact.
BRIGHTGENE PTE. LTD.
55 AYER RAJAH CRESCENT #01-26
Singapore 139949
Email support@brightgene.lat
Telephone +16067692583
Our support desk answers messages during Singapore business hours, Monday to Friday from 09:00 to 18:00 and Saturday from 09:00 to 13:00 for scheduled kit drop offs. A message received outside those hours is logged and answered on the next working day.
This policy is governed by the laws of Singapore. The company keeps a written record of its data protection practices and reviews that record at least once a year.