Privacy Notice

This Privacy Notice describes how Kashi Clinical Laboratories, LLC (“KCL,” the “Company,” “we,” “us,” or “our”) collects, uses, stores, and discloses personal information in connection with the use of our services, including when you access our website at https://kashilab.com or otherwise engage with us through sales, marketing, events, or other related activities.

Questions or Concerns

Reading this privacy notice will help you understand your privacy rights and choices. If you have any questions or concerns, you may contact our Privacy Group at privacy@kashilab.com.

What Information Do We Collect

We collect personal information you voluntarily provide when you request information, procure our Services, participate in related activities, or contact us.

Personal Information Provided by You

We collect personal information based on your interactions with our Services, your choices, and the features you use. This may include names, phone numbers, email addresses, contact preferences, and contact or authentication data.

Sensitive Information

With your consent or as permitted by law, we may process sensitive personal information. All information you provide must be accurate and complete.

Non Identifiable Information

When you use the KCL Site, KCL automatically collects non identifiable information through passive technologies. This information cannot be used to identify you personally and may be stored by KCL or its affiliates, agents, or service providers. KCL may combine this data with other information to track Site usage, such as visitor counts, page visits, and visitors’ internet service providers. No Personal Data is collected or used in this process.

How We Process Your Information

• We process personal information to provide, operate, maintain, and improve our Services.
• We use personal information to communicate with users, including responding to inquiries and providing customer support.
• We process information to ensure security, prevent fraud, and comply with applicable legal obligations.
• Where required, we may process personal information for additional purposes with your consent.

 

How We Legally Process Your Information

We process personal information only where necessary and in accordance with a valid legal basis under applicable law, including consent, statutory compliance, the provision of services, the performance of contractual obligations, the protection of rights, or the pursuit of legitimate business interests.

We are committed to protecting the privacy and security of your health in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and applicable federal and state laws. This means:

• We will only use or disclose your Protected Health Information (PHI) for purposes of treatment, payment, healthcare operations, or as otherwise permitted or required by law.
• You have the right to access, inspect, and request a copy of your laboratory records, as well as request corrections to your information.
• We will not share your PHI without your written authorization, except in situations allowed by HIPAA, such as public health reporting or compliance with legal requirements.
• We maintain administrative, technical, and physical safeguards to protect your PHI from unauthorized access, use, or disclosure.

 

If you are in the European Union or the United Kingdom, this section applies to you

In accordance with Article 6 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR, we identify the following legal bases for the processing of personal information:

• Consent (Article 6(1)(a)). We may process personal information where you have provided your freely given, specific, informed, and unambiguous consent for one or more specific purposes. You may withdraw your consent at any time by contacting us at privacy@kashilab.com.
• Performance of a Contract (Article 6(1)(b)). We may process personal information where such processing is necessary for the performance of a contract to which you are a party, including the provision of our Services, or in order to take steps at your request prior to entering into a contract.

 

If you are in Canada, this section applies to you

We may process your personal information with your express or implied consent, which you may withdraw at any time. In limited circumstances permitted by law, we may process information without consent, including when:

• It is clearly in an individual’s best interests and consent cannot be obtained in a timely manner.
• It is required for investigations, fraud prevention, or business transactions that meet legal conditions.
• It is necessary to assess, process, or settle an insurance claim.
• It is needed to identify injured, ill, or deceased persons or to contact next of kin.
• There are reasonable grounds to believe an individual may be a victim of financial abuse.
• Obtaining consent would compromise an investigation into a legal or contractual breach.
• Disclosure is required by law, court order, or legal process.
• The information was produced in the course of employment or professional activities and used consistently with its purpose.
• The collection is solely for journalistic, artistic, or literary purposes.
• The information is publicly available as defined by regulations.

 

When and With Whom We Share Personal Information

KCL does not sell your Personal Data and treats it as a core part of our relationship with you. We may, however, share Personal Data without further notice in limited circumstances, including:

• Business transactions such as mergers, sales, or reorganizations.
• Related companies for purposes consistent with this Privacy Policy.
• Contractors and service providers who perform business functions on our behalf and require access to such data to do so.
• When required by law or when disclosure is necessary to comply with legal obligations, protect KCL’s rights or property, ensure public or user safety, or prevent legal liability.

 

How Long Do We Keep Your Information

We retain your personal information only as long as necessary to fulfill the purposes described in this privacy notice unless a longer period is required or permitted by law. When there is no ongoing legitimate business need, we will delete or anonymize your information or securely store it and isolate it until deletion is possible.

How Do We Keep Your Information Safe

We implement appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, including measures to protect the confidentiality, integrity, and availability of personal data. While we take reasonable steps to safeguard personal information, no method of transmission or storage can be guaranteed to be completely secure, and absolute security cannot be assured. Access to our services should therefore be undertaken within a secure environment.

Do We Collect Information From Minors

We do not knowingly collect or market personal data from children under thirteen. If you are under thirteen, please do not submit personal data through the Site. Parents and guardians are encouraged to supervise their children’s internet use and ensure they do not provide personal data without permission. If you believe a child under thirteen has provided personal data to KCL, please contact us at privacy@kashilab.com, and we will take steps to delete the information.

What Are Your Privacy Rights

As a patient of Kashi Clinical Laboratories, you have specific rights regarding your Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA), including:

• Right to Access Your Information
  You have the right to inspect and obtain a copy of your PHI maintained by KCL in designated record sets, including laboratory results and related records.
• Right to Request an Amendment
  You may request that we correct or amend your PHI if you believe it is inaccurate or incomplete. We may deny certain requests in accordance with applicable law but will provide a written explanation.
• Right to an Accounting of Disclosures
  You have the right to request a list of certain disclosures of your PHI made by KCL, as required by HIPAA regulations.
• Right to Request Restrictions
  You may request restrictions on how your PHI is used or disclosed for treatment, payment, or healthcare operations. While we are not required to agree to all requests, we will comply when required by law, including restrictions related to services paid out-of-pocket in full.
• Right to Request Confidential Communications
  You may request that we communicate with you about your health information in a specific way or at a specific location (for example, by mail or at an alternate address).
• Right to a Paper Copy of This Notice
  You have the right to receive a paper copy of this Privacy Notice at any time, even if you have agreed to receive it electronically.
• Right to Be Notified of a Breach
  You have the right to be notified if your unsecured PHI has been breached in a manner that compromises its privacy or security.
• Right to File a Complaint
  If you believe your privacy rights have been violated, you may file a complaint with KCL or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. Filing a complaint will not result in retaliation.

 

How to Exercise Your Rights

To exercise any of these rights, please contact:

Privacy Group
Kashi Clinical Laboratories
Email: privacy@kashilab.com
Mail: 10101 SW Barbur Blvd, Suite 200, Portland, OR 97219

We will respond to your request in accordance with applicable law.

Additional Contact Information

If you have concerns about how your personal information is handled, you may contact the appropriate supervisory authority based on your location:

• United States:
  Office for Civil Rights (OCR), U.S. Department of Health and Human Services (HHS)
  Website: https://www.hhs.gov/ocr
• Canada:
  Office of the Privacy Commissioner of Canada
  Website: https://www.priv.gc.ca
• European Economic Area (EEA) and United Kingdom:
  European Commission (for guidance on data protection authorities)
  You may also contact your local Data Protection Authority (DPA).
  Website: https://commission.europa.eu
• Switzerland:
  Federal Data Protection and Information Commissioner (FDPIC)
  Website: https://www.edoeb.admin.ch

 

Withdrawing Your Consent

To the extent we rely on your consent to process your personal information, you may withdraw such consent at any time by contacting us at privacy@kashilab.com.

Withdrawal of consent will not affect the lawfulness of any processing conducted prior to such withdrawal, nor will it affect any processing carried out on other lawful bases, as permitted under applicable law.

Updates to This Notice

We may revise this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or other operational considerations. When we do so, we will update the “Revised” date at the top of this Privacy Notice.

Any updates will become effective upon posting to the Site. Your continued use of the Site following the posting of changes constitutes your acknowledgment of such updates, to the extent permitted by applicable law. We encourage you to review this Privacy Notice periodically to remain informed about our information practices.

Unsolicited Information

This Privacy Policy applies solely to Personal Data collected by KCL through the Site. It does not apply to any unsolicited information submitted to KCL by any means, including information posted in public areas of the Site or any ideas, concepts, materials, or other submissions (collectively, “Unsolicited Information”).

All Unsolicited Information will be deemed non-confidential and non-proprietary. KCL may use, disclose, reproduce, modify, and distribute such Unsolicited Information for legitimate business purposes, without restriction and without any obligation to compensate the submitting party. KCL will not be required to provide attribution unless otherwise agreed in writing.

Revised: 04/27/2026