Privacy at Invitae
Our commitment to protecting your information
Invitae’s mission is to bring comprehensive genetic information into mainstream medical practice to improve the quality of healthcare for billions of people. From day one, patients owning and controlling their genetic data has been one of our core principles.
This page explains in high-level terms how Invitae protects patient data and empowers patients to set choices about how their data is used and shared. It also provides links to more detailed information about Invitae’s privacy practices. If you have any questions or comments, please contact us.
What types of data does Invitae use?
How does Invitae protect patient data?
Invitae takes robust measures to help keep patient data safe and secure and limit use of data only for permitted purposes. Invitae uses technical, administrative and physical safeguards to secure patient data and protect it against misuse, loss or alteration. Invitae also takes steps to de-identify or anonymize patient data in accordance with applicable laws. De-identified data (also called pseudonymized data) is data that has been stripped of identifying information (such as a name or email address), although the data may contain a key that Invitae can use to link back to the individual where required. Anonymized data is similar to de-identified data except that there is no ability to link back to an individual. For de-identified data, Invitae removes all identifiers under HIPAA and takes further precautions around genetic information by ensuring any information shared includes:
- No more than 4 common genetic variants
- No more than 6 rare genetic variants
- No unique, large family relationship data
The following activities are a core part of Invitae’s services:
- Providing genetic testing and related services, including preparation and delivery of a genetic test report to healthcare providers.
- Performing operational activities in support of providing and obtaining payment for genetic testing services, such as billing for services Invitae provides and complying with laboratory regulations.
- Conducting quality improvement activities that support genetic testing services. Examples of these activities include making sure test results are accurate and high-quality, ensuring the laboratory and technology systems supporting Invitae’s genetic testing services are kept current and up-to-date, refining and updating Invitae’s classification of genetic variants, and sharing anonymized variant information with ClinVar.
Invitae also performs research, product development, and commercial activities
- Performing internal research and product development activities. These activities help Invitae expand the genes it can offer for testing to patients and deliver new products and services.
- Sharing de-identified (pseudonymized) data and samples with third parties for research or commercial activities. Third parties may include academic researchers, commercial entities, and other genetic testing laboratories. Recipients of the de-identified data and samples are prohibited from attempting to re-identify patients. Invitae will NOT share identifiable data or samples for research or commercial activities without additional, explicit consent from the patient.
- Contacting patients about research opportunities, opportunities to connect with others, product feedback, and new products and services.