1. WHO WE ARE
SOPHiA GENETICS values the privacy of the website's users and the confidentiality of their data. That is why SOPHiA GENETICS is committed to treating your Personal Data with care, integrity, and transparency.
SOPHiA GENETICS SA, headquartered at La Pièce 12, 1180-Rolle, Switzerland, has the following subsidiaries:
• SOPHiA GENTICS, Inc., located at 401 Park Drive, 5TH Floor, Boston, MA 02215, USA.
• SOPHiA GENETICS S.A.S, located at Technopole Izarbel 158 allée Fauste d’Elhuyar 64210 Bidart, France.
• SOPHiA GENETICS S.R.L., located at Via Michelangelo Buonarroti, 39, Milano, 20145, Italy.
• SOPHiA GENETICS LTD, located at 60 Windsor Avenue, London, SW19 2RR, United Kingdom.
• SOPHIA GENETICS INTERMEDIAÇÃO DE NEGÓCIOS EIRELI, located at Av. Lauro de Gusmão Silveira, nº 479, sala 01, Jardim São Geraldo, CEP 07140-010, na cidade de Guarulhos, Estado de São Paulo, Brazil.
• SOPHiA GENETICS Pty Ltd, located at Level 14 12 Creek Street, Brisbane City, QLD 4000, Australia.
SOPHiA GENETICS SA and its subsidiaries (hereafter jointly referred as to “SOPHiA GENETICS”, “we”, “us” and “our”), act as Data Controllers collecting and using Personal Data of the sophiastg.wpenginepowered.com website visitor and SOPHiA Platform.
This Privacy Policy explains how your Personal Data may be used in this context. It may be amended from time to time based on applicable data protection laws, regulations, and guidelines provided by public authorities (“Applicable Data Protection Laws”).
Should you provide us with data not covered in this privacy policy, such data shall be covered by a distinct contractual relationship, as well as applicable laws and regulations.
2. WHAT DATA DO WE COLLECT?
We collect data that could identify you either directly (e.g. your name or surname) or indirectly (e.g. through your IP address). Those are Personal Data.
While visiting our website, personal data may be collected depending on your interactions with us. We distinguish the data collected automatically and the data you provide to us.
Data automatically collected
Website usage analytics
Those data are generated through cookies while you are using the website to provide information regarding the page you visited, the website you are coming from, the video that you played, etc. Our website installs cookies or similar technologies that allow us to measure the audience of our publications, improve the interface and the presentation of our website to propose the best user experience possible.
Click here for more information on the Cookies Policy.
Data that you provide directly
When you request a demo for one of our solutions, when you subscribe to our webinar, or when you contact us, you provide data allowing us to respond to your requests and to provide you with the best answers.
Contact requests, prospect support
| The type of data we collect | Personal Data concerning the identity of requestors, prospects or partners contacting us via our contact forms, including first name, last name, email address, phone number, country, contact purpose and message. |
| Why do we use them | These Personal Data are necessary to process your request and adapt our answers to best suit your demand.
If you agree to this by providing your consent, we may use your personal information to send you information about our products, services, and the events we may organize from time to time. We make sure that each contact form limits the collection of Personal Data to what is necessary and indicates the required information to provide. |
| Retention | Personal Data concerning our prospects shall be kept for three (3) years from the time they are collected or from the last contact sent by the prospect, without prejudice to any retention obligations or limitation periods. |
Applying candidates
| The type of data we collect | Personal Data concerning the identity of an applicant for a SOPHiA GENETICS’ job offer, including but not limited to first name, last name, email address, phone numbers, residence address, photography, birth date, nationality, residence permit, professional and academic background, resumes and cover letters. Each job offer form limits the collection of Personal Data to what is necessary and indicates the required information to provide. Sensitive information, such as race or sexual orientation, is not necessary for the job application process. If an applicant decides to include such information, the sensitive data will be processed in accordance with Applicable Data Protection Laws. |
| Why do we use them | These Personal Data are necessary to process your application. Each job offer form limits the collection of Personal Data to what is necessary and indicates the required information to provide. |
| Retention | Personal Data shall be kept for two (2) years from the time they are collected or from the last contact sent by the applicant, without prejudice to any retention obligations or limitation periods. |
Order, contracting, invoicing
| The type of data we collect | We collect Personal Data concerning employees of our customers including, but not limited to, identity information such as first name, last name, job title, and company name. We also collect contact information, including email address, phone number, and physical address, as well as order and transaction details such as billing and shipping addresses, invoicing details, payment information, and transaction history. Additionally, we may collect other relevant information as necessary to fulfill the order or manage the contractual relationship. This data is collected to ensure the proper execution of contractual agreements, including the processing of orders, managing invoicing, and fulfilling other contractual obligations.
|
| Why do we use them | We collect Personal Data concerning employees of our customers for the purpose of processing orders, invoicing, managing our business relationship, compiling statistics, conducting analysis, assessing customer satisfaction, and complying with applicable laws and regulations. |
| Retention | We retain these Personal data for the duration of the contractual relationship and, where applicable, for a period thereafter as required by legal and regulatory obligations. |
3. Why are we allowed to use your data?
We can collect and process your Personal Data when one of the following applies:
Your consent – This applies when you explicitly permit us to use your Personal Data to perform the processing purposes outlined above or to respond to your requests. This may include disclosing your Personal Data to third parties to fulfill these purposes and requests, or using your data for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized.
This is also applicable when you accept our cookies – Find out more in our Cookie Policy.
The performance of a contract – for the entering or the performance of a contract between SOPHiA GENETICS and you representing a (prospect) customer, a (prospect) partner or as an applicant with regards to processing operations, marketing and relationship monitoring;
Our legitimate interest – This applies where SOPHiA GENETICS conduct operations for the purpose of compiling statistics, marketing, promoting, and developing and/or improving SOPHiA GENETICS’ products and services, as well the defense of SOPHiA GENETICS’ rights and interests;
Compliance with legal obligations – This applies where SOPHiA GENETICS is required to process data with regard to invoicing and accounting purposes or the management of requests or for responding to the exercise of your rights.
4. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?
As a general rule, we do not provide, sell or lease your Personal Data to any third parties for their marketing use without your express consent.
From time to time, we need some help to propose the best user experience. When this happens, we rely on various third-party service providers and contractors to provide services that support the website and our operations, including, without limitation, career management service, maintenance of our databases, distribution of emails and newsletters on our behalf, data analysis. Such third parties may have access to your Personal Data for the purpose of performing the service for which they have been engaged. However, such service providers shall remain under contractual obligations, particularly confidentiality obligations, for as long as they hold relevant Personal Data.
5. IN WHAT INSTANCE DO WE TRANSFER YOUR PERSONAL DATA?
Transfers between SOPHIA GENETICS and its subsidiaries
Our headquarter is in Switzerland, and we work all over the world. Therefore, you acknowledge and consent that any data you provide, or we collect may be used, processed and/or transferred to Switzerland or to any jurisdiction where we have operational activities or other countries, territories, or jurisdictions as permitted under Applicable Data Protection Law.
We implement appropriate measures to protect your Personal Data when we transfer your Personal Data outside of your home country such as data transfer agreements that incorporate standard data protection clauses.
Transfers to third parties
We may share Personal Data with third parties, as established in this Privacy Policy, and consequently transfer Personal Data outside the country they came from. For example, we may transfer personal data to marketing or communication agency or to measure the audience of our website.
Before we transfer any data to third parties, we make sure that said third parties, which receive the data, offer the necessary standards of data protection required by Applicable Data Protection Law, either due to mandatory legal requirements or due to data protection agreements or contractual instruments signed with the third parties in question. All international data transfers are undertaken in accordance with Applicable Data Protection Law.
6. DATA PRIVACY FRAMEWORK
Framework’s Principles
SOPHiA GENETICS, Inc., a subsidiary of SOPHiA GENETICS SA, complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. SOPHiA GENETICS, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. SOPHiA GENETICS, Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Data Sharing and Transfer
As described above, we may share Personal Data, as defined in the EU’s General Data Protection Regulation (GDPR) with service providers we have retained to perform services on our behalf. When such service providers are located in other jurisdictions, we ensure they are (a) subject to GDPR, as applicable, (b) subscribe to the Data Privacy Framework program principles, or (c) contractually agree to provide at least the same level of protection for Personal Data as is required by the relevant DPF program. In the context of such an onward transfer to a third party, SOPHiA GENETICS, Inc. is responsible for and may be liable for processing Personal Data it receives under the DPF programs and subsequently transfers onward. If there is any conflict between the policies in this Data Privacy Policy and data subject rights under the EU-U.S., UK extension and Swiss-EU DPF Principles, the DPF Principles shall govern. To learn more about the DPF program, and to view our certification page, please visit https://www.dataprivacyframework.gov/.
Complaint Contact
In compliance with the DPF Principles, SOPHiA GENETICS, Inc. commits to resolve complaints about privacy and our collection or use of personal information transferred to the United States under the DPF. European Union, United Kingdom (including Gibraltar), and Switzerland, individuals with DPF inquiries or complaints should first contact SOPHiA GENETICS, Inc. at privacy@sophiagenetics.com.
Independent Recourse Mechanism
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, SOPHiA GENETICS, Inc. commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.
Arbitration
If a DPF-related complaint cannot be resolved through the above channels, under certain conditions, one may invoke arbitration for some residual claims not resolved by other redress mechanisms. For additional information please visit the relevant
link.
7. HOW DO WE COMPLY WITH LAW?
SOPHiA GENETICS cooperates with government and law enforcement officials and private parties to enforce and comply with the law. We may be required to disclose the Personal Data of an individual in response to a lawful request by public authorities, to meet national security, law enforcement or other legal requirements.
Additionally, SOPHiA GENETICS is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).
8. DATA SECURITY
We are committed to keeping Personal Data secure in our daily activities. We always consider the context and purposes of processing as well as the likelihood and impact of risks relating to Personal Data to adapt our security measures. Therefore, we implement appropriate technical and organizational measures and apply strict procedures and security features to prevent unauthorized access, loss, or damage of Personal Data. SOPHiA GENETICS implements appropriate technical and organizational measures in accordance with Applicable Data Protection Law. Such measures include, without limitation:
- ISO27001, ISO 27017, ISO 27018 certifications;
- Physical access control;
- Logical access control;
- Log-in information regulated with complex password and token;
- End-to-end encryption;
- Pseudonymization and de-identification of genetic and other health related data;
- Segregation of data;
- Confidentiality undertaking for all representatives who access data;
- For French Customers, all the data are hosted on an “Hébergeur de données de santé” certified server.
We always use extra caution when we entrust third parties to handle Personal Data and we require that they abide by the same standards to those we apply.
9. DO WE PROCESS MINOR’S DATA?
The Website is not directed towards persons under the age of 18. We do not knowingly collect Personal Data from minors under the age of 18 who use the Website. If you become aware that a user under the age of 18 has used the Website, please contact SOPHiA GENETICS at privacy@sophiagenetics.com. If we become aware that a minor under 18 has provided us with Personal Data, SOPHiA GENETICS will take the necessary steps to have that Personal Data irrevocably removed.
10. YOUR RIGHTS
Exercise your rights
Depending where you are located and in accordance with Applicable Data Protection Law, you may:
Depending on where you are located and in accordance with Applicable Data Protection Law, you may:
- confirm the existence of data processing;
- access your Personal Data;
- review, update, correct, delete, restrict, block, object your Personal Data;
- choose (opt out) whether your personal information is (i) to be disclosed to a third party or (ii) to be used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized;
- request data portability pertaining to your Personal Data;
- request information from public and private entities with which we have shared your Personal Data;
- request information on the possibility of not providing consent and on the consequences of refusal;
- revoke your consent.
Limited use in our email list
If you no longer wish to receive new notices, email newsletters or other future promotional communications from us, you may choose to unsubscribe by clicking on the link at the bottom of any such communication and following the instructions thereto.
Alternatively, you may notify us by email at privacy@sophiagenetics.com with the word “remove” in the subject header, and we will remove your name from our email recipient list within five (5) days. Opt-out is not possible for necessary services or other administrative and transactional notices.
How to contact us
If you like to exercise one of your rights, please contact us first at:
privacy@sophiagenetics.comPlease attach a copy of your identification card or any other valid identification document with your signature, so that we may ascertain that any requests concerning your Personal Data indeed originate from you. We may retain an archived copy of your request in accordance with Applicable Data Protection Laws.
Complaint to Authorities
You may also file a complaint with your local data protection authority if you consider that any processing of your Personal Data infringes upon the requirements of the Applicable Data Protection Laws. However, we invite you to contact us prior to doing so.
11. CONTACT US – DATA PROTECTION OFFICER
If you have questions regarding this Privacy Policy or how your Personal Data are processed, please contact SOPHiA GENETICS’ Data Protection Officer, at SOPHiA GENETICS SA, La Piece, 12, CH-1180 Rolle, Switzerland, or privacy@sophiagenetics.com.
12. CHANGES TO PRIVACY POLICY
This Privacy Policy is effective as of the date of its last revision. We reserve the right to change this Privacy Policy at any time. When we make changes, we will post the changed Privacy Policy at the Website, and it will become effective immediately.
Version 4 – June 2025
