This Privacy Notice Addendum explains how GeneLinx collects, uses, and shares your personal data when you participate in the Danon Disease Programme managed via the Sano Genetics platform.

1. CONTACT DETAILS

The controller within the meaning of Art. 4 para. 7 EU General Data Protection Regulation (GDPR) is GeneLinx GmbH, Keibelstraße 4, 10178 Berlin, Germany, email: www.gene-linx.com. We are legally represented by Alekhya Narravula.

Our data protection officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, E-Mail: datenschutz@heydata.eu.

2. RELATIONSHIP OF THE PARTIES

GeneLinx and Sano Genetics act as Independent Data Controllers. Sano Genetics manages your platform account, eligibility, and testing logistics. GeneLinx is independently responsible for providing your clinical genetic counseling sessions, family history intake, and authorizing the genetic test orders.

3. LEGAL BASES FOR PROCESSING (Art. 6 & 9 GDPR)

• Providing Counseling & Creating Notes: We process your standard data under Article 6 para. 1 lit b GDPR (Performance of a service contract requested by you) and your health/genetic data under Article 9 para. 2 lit. a GDPR. Your clinical record-keeping is a professional medical obligation and does not rely on consent. Therefore the legal basis is Article 9 para. 2 lit. h GDPR.
• Sharing Clinical Notes with Sano: We rely on your explicit consent under Article 6 para. 1 lit a GDPR and Article 9 para. 2 lit. a GDPR to upload your pre- and post-test clinical consultation notes back to the Sano platform to coordinate your care and release your genetic results.

4. DATA RECIPIENTS AND INTERNATIONAL TRANSFERS

• Sano Genetics: Your necessary consultation notes are shared with Sano Genetics as an independent controller to finalize your trial eligibility.
• Fulgent Genetics (US Laboratory): Your genetic test is analyzed by Fulgent Genetics in the United States. Please note that GeneLinx does not transfer your data directly to Fulgent Genetics. Sano Genetics coordinates this international transfer and maintains the required legal safeguards. More information you can find here
• Sub-processors: GeneLinx utilizes contracted Genetic Counselors (GCs) to conduct sessions. These GCs act as clinical sub-processors and are bound by strict professional confidentiality and data processing agreements.
• Your GP: If authorized by you, your consultation notes and testing outcomes will normally be shared with your General Practitioner (GP).
• International transfers: GeneLInx is processing your personal data within the EU.

5. DATA RETENTION AND ERASURE

If you request the deletion of your account or data via Sano Genetics, GeneLinx is legally required to retain your clinical consultation files. Under GDPR Article 17 para. 3 lit. b GDPR, we must keep medical records in accordance with statutory medical retention laws (ranging from 5 to 30 years depending on the country). We will deactivate the data link connecting your medical records to the Sano platform, but your file will be securely retained for the legally mandated period.

6. RIGHTS OF THE DATA SUBJECTS

Data subjects have the following rights against us with regard to their personal data:

• Right of access,
• Right to correction or deletion,
• Right to limit processing,
• Right to object to the processing,
• Right to data transferability,
• Right to revoke a given consent at any time.

Data subjects also have the right to complain to a data protection supervisory authority about the processing of their personal data. Contact details of the data protection supervisory authorities are available at https://www.bfdi.bund.de/EN/Service/Anschriften/Laender/Laender-node.html.

7. CHANGES TO THE PRIVACY NOTICE

We reserve the right to change this privacy notice with effect for the future. A current version is always available here.

8. QUESTIONS AND COMMENTS

If you have any questions or comments regarding this privacy policy, please feel free to contact us using the contact information provided above.