Published: 22 March 2024
Updated: 14 July 2026

I. General Principles

1. Notice

This Data Privacy and Security Policy (this “Policy”) applies to the group of companies operating under the Gene Solutions brand, comprising: Gene Solutions Joint Stock Company (“GSVN”), Gene Solutions Lab Company Limited (“GSL”), and Medical Genetics Joint Stock Company (“MGJ”), together with their subsidiaries, affiliates, and related entities owned, controlled, or managed, directly or indirectly, by the foregoing companies (collectively, “Gene Solutions”, “GS”, or “We”).

Depending on the type of service provided and the entity that enters into the contract with the Customer, GSL, MGJ, or another member company of Gene Solutions may act as: (i) the Personal Data Controller; (ii) the Personal Data Processor; or (iii) both the Personal Data Controller and Processor, as provided by law. Information regarding the specific entity responsible for controlling and/or processing personal data will be specified in the relevant contract, testing consent form, and/or related agreements.

The purpose of this Policy is to describe the measures and procedures for collecting, storing, processing, securing, and managing Customers’ personal data in accordance with applicable law.

2. Scope of the Policy

This Policy describes how Gene Solutions collects, receives, compiles, stores, uses, processes, discloses, shares, and secures personal customer information provided by organizations and individuals (“Customer”), including customers/patients, agents, suppliers, contractors, partners, collaborating experts, etc., when they:

(i) Use the services provided by GS;

(ii) Cooperate with GS in providing services to Customers; and/or

(iii) Cooperate with GS in providing services to Customers; and/or:

• Website https://genesolutions.vn
• Website https://genesolutions.com
• Website https://hcp.genesolutions.vn
• The “Genesolution HCPs” application
• Social media groups (Facebook, LinkedIn, etc.) managed by GS (collectively, the “Services”).

Gene Solutions’ personal data processing policy adheres to the following principles:

• Data is collected and processed only for specific, clear, and lawful purposes;
• Processing is limited to what is necessary to achieve the notified purpose;
• Personal data is kept accurate, complete, and updated as necessary;
• Data is retained for a period appropriate to the purpose of processing or as required by law;
• Appropriate technical, administrative, and organizational measures are applied to protect personal data.

We recommend that You review this Policy regularly, as We may update it from time to time in line with the applicable law. Where any amendment changes the scope, purpose, or method of processing personal data, or affects the rights or interests of the Data Subject, Gene Solutions will provide notice and obtain consent (where required by law) before such amendment takes effect.

This Policy forms part of the General Terms and Conditions and is an integral part of the contracts/agreements, etc. that You have entered into with Gene Solutions.

3. Personal data

The categories of personal data collected by Gene Solutions (collectively, “Customer Information”) include basic personal data and sensitive personal data as defined by law, including but not limited to:

• Full name, gender, place of birth, residential address, nationality, race/ethnicity
• Phone number, email address
• Payment card information, bank account details
• Personal preferences, lifestyle habits, living environment
• Location, images
• National ID card/Citizen ID card information
• Date of birth, marital status
• Insurance information
• Transaction information, access history, customer journey
• Biometric data
• Genetic information
• Family medical history
• Medical records/health information

Health data, genetic information, biometric data, medical records, medical history information, and other data falling within the category of sensitive personal data will be subject to enhanced protection measures applied by Gene Solutions in accordance with law.

4. Language

This Policy is prepared in both Vietnamese and English. In the event of any discrepancy or conflict between the two versions, the Vietnamese version shall prevail.

5. Contents of the Policy:

This Policy covers the following main contents:

• Customer Information collected
• How we collect, store, process, and use Customer Information
• How we share Customer Information
• How we protect Customer Information
• Customers’ rights and obligations
• Contact information, notices, and amendments

6. Definitions

You: means the individual (or organization) that registers for or uses the Services, or accesses or interacts with Gene Solutions through channels owned, managed, or operated by Gene Solutions.

Applicable Law: means all legal provisions or legal normative documents of Vietnam in effect and applicable to Gene Solutions at the relevant time.

Personal Data: means digital data or information in other forms that identifies or contributes to identifying a specific individual, comprising basic personal data and sensitive personal data. Personal data that has been de-identified is no longer considered personal data.

Processing of Personal Data: means any activity that affects personal data, comprising one or more of the following: collecting, analyzing, compiling, encrypting, decrypting, editing, deleting, destroying, de-identifying, providing, disclosing, and transferring personal data, and other activities affecting personal data.

Third Party: means any individual or organization not belonging to Gene Solutions that Gene Solutions cooperates with, engages, authorizes, or permits to participate in providing the Services, supporting system operations, or processing personal data in accordance with law and related agreements, including but not limited to:

• Independent individuals or organizations;
• Providers of products, services, information technology solutions, cloud computing services, or other support services;
• Medical facilities, clinics, hospitals, consulting experts, or partners involved in providing the Services;
• Other organizations or individuals as provided by law.

II. Customer Information Collected

We collect Customer Information during the course of providing the Services and communicating directly with You, as well as through websites, mobile applications, automated data collection technologies, or other means.

1. Information You Provide

We collect information when You directly provide it to Us through one or more of the following activities:

• Using the Services, cooperating in the provision of services, or participating in scientific research or clinical trials conducted by GS.
• Registering an account, logging in, and interacting with information channels controlled and managed by GS.
• Participating in seminars, events, or surveys conducted by GS.
• Using biometric features controlled and implemented by GS.

The Customer is responsible for the completeness, accuracy, and currency of the information provided. Gene Solutions shall not be liable if such information is inaccurate or incomplete.

Gene Solutions processes Customers’ personal data to the extent necessary to provide the Services, on the basis of a valid testing consent form confirmed by the Customer and/or other related agreements, undertakings, or transaction documents, consistent with the purposes set out in this Policy. The processing of personal data may include collecting, recording, storing, using, analyzing, sharing, transferring, editing, updating, deleting, destroying, and other forms of processing as provided by law.

With the Customer’s consent, Gene Solutions may use a patient’s remaining samples and de-identified information for scientific/medical research purposes. Such research does not permit the identification of any individual, and its results may be published in scientific journals or used to develop products and services. Customers will not be notified of, or compensated for, such research activities (for example, cancer screening research).

For the personal data of individuals under 18 years of age, Gene Solutions will process such data only with the valid consent of the parent(s) or legal guardian, unless otherwise provided by law. Gene Solutions reserves the right to decline to provide the Services in the absence of such consent.

2. Automatically Collected Information

We collect the following information in the course of the Customer’s interaction with Gene Solutions in connection with registering for and using the Services, with the Customer’s consent to provide:

• Transaction information
• Payment method (full card numbers, CVV, etc. are not stored)
• IP address
• Device information
• Operating system
• Browser
• Geographic location
• Pages visited
• Number of visits
• Advertising information

3. Cookies

We use cookies to:

• Recognize You when You log in
• Personalize content
• Remember Your preferences
• Analyze and improve services
• Prevent fraud
• Enhance security
• Display relevant advertising

You may manage cookies and advertising permissions in Your browser settings.

4. Information from Other Sources

Gene Solutions may collect information about you from other sources, including service providers, partners, and publicly available sources.

III. Protecting the Customer Information

1. Information Security

1. Protecting Customer information is a top priority for Gene Solutions, and we are committed to safeguarding it in accordance with the following standards:
2. Data is stored securely in accordance with applicable legal standards and requirements.
3. Security measures such as firewalls, encryption, access control, and selective access authorization are applied.
4. Sensitive payment card data is not stored.
5. Unauthorized intrusion, unauthorized access to data, and system hacking or sabotage are strictly prohibited.
6. Customers must keep their account information and OTP confidential.
7. Data is retained for as long as necessary for its purpose or as required by law.

2. Data Retention Period

Gene Solutions retains Customers’ personal data in a manner consistent with the purpose of processing, operational requirements, and applicable law.

Specifically:

• Test result analysis reports: retained for ten (10) years from the date of issuance, or for such longer period as required by law at the relevant time.
• Raw data (data in specialized technical genetic-information formats generated during the operation of sample processing systems, gene sequencing analysis, and quality control under the licensed procedures of the genetic testing laboratory): retained for a minimum of three (3) months from the date of completion of the service, and thereafter managed, stored, or deleted in accordance with Gene Solutions’ policy in effect at the relevant time.

IV. Purpose of Data Processing

We use Customer Information for the following purposes:

1. Receiving requests, processing registrations, providing products and services, and carrying out other necessary activities to serve Customers in accordance with the agreement between the parties;
2. Collecting, transporting, storing, and processing samples; conducting test analyses; providing diagnoses and consultations; delivering test results; and performing other professional activities as required by law;
3. Coordinating with affiliated companies, professional partners, medical facilities, laboratories, transportation providers, delivery providers, and other relevant service providers to perform or support the performance of the services requested by the Customer;
4. Managing customer information and records, and carrying out administrative procedures related to the provision of products and services;
5. Contacting Customers to provide consultation, customer care, technical support, answer inquiries, handle complaints, and notify them of test results or other matters relating to products and services.
6. Measuring, evaluating, controlling, and improving the quality of Gene Solutions’ products, services, operating procedures, and customer experience;
7. Conducting scientific research, medical research, technology development, and product development in accordance with law; where the law requires the data subject’s consent or requires data to be anonymized, Gene Solutions will comply with the applicable legal requirements;
8. Carrying out marketing and promotional activities for Gene Solutions’ products, services, customer care programs, or promotional campaigns. Customers have the right to refuse or withdraw their consent to such activities at any time;
9. Detecting, preventing, investigating, and addressing fraud and violations of law; protecting the lawful rights and interests of Customers, Gene Solutions, and related parties;
10. Ensuring security and safety at Gene Solutions’ offices, laboratories, testing centers, and other operational premises (including CCTV), and applying other appropriate security measures as required by law;
11. Conducting internal administration, audits, risk management, compliance controls, dispute resolution, and protecting Gene Solutions’ lawful rights and interests;
12. Fulfilling obligations under the law and requests from competent state authorities;
13. Other lawful purposes related to Gene Solutions’ operations that have been consented to by the Customer or are permitted by law.

V. Sharing of Customer Information

Gene Solutions shares personal data only to the extent necessary to fulfill the notified purposes, and with the Customer’s written consent and/or other lawful bases for data processing as provided by law, including with:

1. Medical staff and medical facilities (hospitals/clinics) that provide examination, consultation, and treatment services to patients.
2. Administrative staff of Gene Solutions or its affiliated companies involved in providing or managing the provision of the Services.
3. Third parties authorized to process personal data to ensure the most effective medical consultation, examination, and treatment. Such organizations and individuals are bound by strict data confidentiality obligations under applicable law and the contracts entered into with Gene Solutions.
4. Doctors/clinics/hospitals that request data for medical/scientific research purposes.
5. For purposes of Gene Solutions’ business operations (including but not limited to corporate restructuring).
6. To protect the lawful rights and interests of Gene Solutions and Customers.
7. Other activities consistent with applicable law.

VI. Compliance with HIPAA and Local Law

Gene Solutions references and applies technical, administrative, and operational measures based on international standards and security practices appropriate to the nature of health data, including internationally recognized principles widely applied in the healthcare industry, such as HIPAA (the Health Insurance Portability and Accountability Act, a U.S. law governing the security and protection of Protected Health Information (“PHI”)).

Gene Solutions is committed to complying with the laws of Vietnam on personal data protection, the security of medical information, and other related legal requirements.

VII. Rights and Obligations of Customers

Customers have the right to:

1. request access to their own personal data in accordance with law;
2. request information regarding the transfer of their personal data to third parties;
3. consent or object to the processing of their personal data;
4. request access to, review, and correct their personal data;
5. request restriction of the processing of their data;
6. request deletion of their data (except where the data must continue to be retained under law or for purposes of protecting GS’s lawful rights and interests);
7. object to the processing of their data;
8. withdraw their consent;
9. file complaints, denunciations, or lawsuits;
10. claim damages;
11. exercise other rights as provided by law.

Customers have the obligation to:

1. Be responsible for the accuracy of the personal data provided to Gene Solutions;
2. Provide complete personal information as required by Vietnamese healthcare regulations when using medical services;
3. Protect their own personal data and comply with the law on personal data protection;
4. Safeguard their account information, password, OTP, and other authentication credentials (if any), and promptly notify Gene Solutions upon detecting unauthorized access or signs of a data security breach;
5. Cooperate with Gene Solutions in verifying, updating, correcting, or processing requests relating to personal data;
6. Comply with the law on personal data protection and other relevant regulations when using Gene Solutions’ Services.

VIII. Notices and Amendments

This Policy may be updated or amended by Gene Solutions from time to time in accordance with applicable law and the operation of the Services.

For any questions regarding the Services, please contact:

Hotline: 028 7101 8688

Email: support@genesolutions.vn

For any requests or questions relating to the processing of personal data, please contact:

Personal Data Protection Team

Email: dataprivacy@genesolutions.vn

Gene Solutions will respond to requests within a period consistent with applicable law and the internal procedures in effect at the relevant time.

Data Controller and Processor

Depending on the service provider or the entity collecting the data, the data controller and processor may be:

GENE SOLUTIONS LAB COMPANY LIMITED

Business Registration No.: 0315977568

Address: 3rd Floor, Room 301, WMC Building, 102-A-B-C Cong Quynh Street, Pham Ngu Lao Ward, District 1, Ho Chi Minh City, Vietnam

MEDICAL GENETICS JOINT STOCK COMPANY

Business Registration No.: 0314715087

Address: 186-188 Nguyen Duy Duong Street, Ward 2, District 10, Ho Chi Minh City, Vietnam

2. Legal Basis for Data Processing:

Gene Solutions processes personal data on one or more of the following bases:

• With the Customer’s consent;
• To perform a contract or agreement with the Customer;
• To comply with legal requirements;
• At the request of competent state authorities;
• Other cases permitted by law.

3. Cross-Border Data Transfer

Gene Solutions may use information technology infrastructure, cloud computing services, or other technical solutions to store, back up, and manage data in connection with providing the Services. Where personal data is stored or processed on systems located outside the territory of Vietnam, Gene Solutions will comply with applicable law and apply appropriate technical and administrative measures to ensure the safety and security of personal data.