This page summarizes how NexGenomics handles data processed on its platform. It is a public summary of the NexGenomics AI Privacy & Data Security Policy. What this website itself collects is covered separately, in the Privacy Policy.
Your Data Doesn't Leave. That's Not a Promise — It's the Architecture.
Data processed by the NexGenomics AI Fabric stays within NexGenomics-controlled infrastructure. It is not transmitted to, shared with, or made accessible to third parties, apart from the small set of exceptions listed below.
Customer data processed within NexGenomics Axiom and NexGenomics Nexus does not leave that environment. For on-premises deployments, data remains within the customer's own environment.
What the policy covers
Genomic and genetic data as a special category. Genetic information is given heightened protection: explicit informed consent, restricted access, and an enhanced breach response. Its exposure cannot be undone, and it can implicate biological relatives who never consented.
Consent, lawful basis, and data minimization. Personal data is collected only for specified, legitimate purposes, with clear means to access it, correct it, or withdraw consent.
The exceptions to the closed architecture. Legal and regulatory requirements, HIPAA Business Associate relationships, authorized sub-processors bound by equivalent contractual protection, and disclosures the customer has authorized. There are no others.
Data sovereignty and cross-border transfers. Transfers are controlled, with additional restrictions specific to genomic data.
Retention and deletion. Data is kept on a defined schedule, and deletion requests are honored on a documented timeline.
Breach notification
| Recipient | Framework | Maximum timeline |
|---|---|---|
| EU Data Protection Authority | GDPR Article 33 | 72 hours from awareness |
| UK Information Commissioner's Office | UK GDPR Article 33 | 72 hours from awareness |
| HHS Office for Civil Rights (US) | HIPAA Breach Notification Rule | 60 days from discovery |
| Affected NexGenomics customers | Contractual obligation | 48 hours from a confirmed breach |
| Any breach involving genomic data | Internal policy | 24 hours from confirmation |
NexGenomics commits to notifying at or ahead of each of these limits, and does not treat the deadline as the target.
HIPAA and Business Associate Agreements
Where NexGenomics acts as a Business Associate, data handling is governed by an executed Business Associate Agreement, the safeguards of the HIPAA Security Rule, and the minimum-necessary standard.
The full policy
The full policy is available to customers and prospective customers on request. Write to info+policy@nexgenomics.ai.