Skip to main content

Addendum and References#

The following is a list of policy addendum and references.

Controls and Procedures#

sidebar_label: Key Definitions

hide_title: true#

Key Definitions#

2026.5

  • Application: An application hosted by Tuna, either maintained and created by Tuna, or maintained and created by a Customer or Partner.

  • Application Level: Controls and security associated with an Application. In the case of PaaS Customers, Tuna does not have access to and cannot assure compliance with security standards and policies at the Application Level.

  • Audit: Internal process of reviewing information system access and activity (e.g., log-ins, file accesses, and security incidents). An audit may be done as a periodic event, as a result of a patient complaint, or suspicion of employee wrongdoing.

  • Audit Controls: Technical mechanisms that track and record computer/system activities.

  • Audit Logs: Encrypted records of activity maintained by the system which provide: 1) date and time of activity; 2) origin of activity (app); 3) identification of user doing activity; and 4) data accessed as part of activity.

  • Access: Means the ability or the means necessary to read, write, modify, or communicate data/ information or otherwise use any system resource.

  • BaaS: Backend-as-a-Service. A set of APIs, and associated SDKs, for rapid mobile and web application development. APIs offer the ability to create users, do authentication, store data, and store files.

  • Backup: The process of making an electronic copy of data stored in a computer system. This can either be complete, meaning all data and programs, or incremental, including just the data that changed from the previous backup.

  • Backup Service: A logging service for unifying system and application logs, encrypting them, and providing a dashboard for them. Offered with all Tuna Add-ons and as an option for PaaS Customers.

  • Breach: A data breach is the intentional or unintentional release of secure or sensitive information to an untrusted environment or individual. A data breach often involves an incident where information is stolen or taken from a system without the knowledge or authorization of the system's owner.

  • De-identification: The process of removing identifiable information so that data is rendered to not be personally identifiable .

  • Disaster Recovery: The ability to recover a system and data after being made unavailable.

  • Disaster Recovery Service: A disaster recovery service for disaster recovery in the case of system unavailability. This includes both the technical and the non-technical (process) required to effectively stand up an application after an outage. Offered with all Tuna Add-ons and as an option for PaaS Customers.

  • Disclosure: Disclosure means the release, transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information.

  • Customers: Contractually bound users of Tuna Platform and/or services.

  • Environment: The overall technical environment, including all servers, network devices, and applications.

  • Event: An event is defined as an occurrence that does not constitute a serious adverse effect on Tuna, its operations, or its Customers, though it may be less than optimal. Examples of events include, but are not limited to:

    • A hard drive malfunction that requires replacement;
    • Systems become unavailable due to power outage that is non-hostile in nature, with redundancy to assure ongoing availability of data;
    • Accidental lockout of an account due to incorrectly entering a password multiple times.

  • Hardware (or hard drive): Any computing device able to create and store sensitive data .

  • IaaS: Infrastructure-as-a-Service.

  • Individually Identifiable Health Information: That information that is a subset of health information, including demographic information collected from an individual, and is created or received by a health care provider, health plan, employer, or health care clearinghouse; and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and identifies the individual; or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

  • Indication: A sign that an Incident may have occurred or may be occurring at the present time. Examples of indications include:

    • The network intrusion detection sensor alerts when a known exploit occurs against an FTP server. Intrusion detection is generally reactive, looking only for footprints of known attacks. It is important to note that many IDS "hits" are also false positives and are neither an event nor an incident;
    • The antivirus software alerts when it detects that a host is infected with a worm;
    • Users complain of slow access to hosts on the Internet;
    • The system administrator sees a filename with unusual characteristics;
    • Automated alerts of activity from log monitors like OSSEC;
    • An alert from OSSEC about file system integrity issues.

  • Intrusion Detection System (IDS): A software tool use to automatically detect and notify in the event of possible unauthorized network and/or system access.

  • IDS Service: An Intrusion Detection Service for providing IDS notification to customers in the case of suspicious activity. Offered with all Tuna Add-ons and as an option for PaaS Customers.

  • Law Enforcement Official: Any officer or employee of an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, who is empowered by law to investigate or conduct an official inquiry into a potential violation of law; or prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

  • Logging Service: A logging service for unifying system and application logs, encrypting them, and providing a dashboard for them. Offered with all Tuna Add-ons and as an option for PaaS Customers.

  • Messaging: API-based services to deliver and receive SMS messages.

  • Minimum Necessary Information: Protected health information that is the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. The "minimum necessary" standard applies to all protected health information in any form.

  • Off-Site: For the purpose of storage of Backup media, off-site is defined as any location separate from the building in which the backup was created. It must be physically separate from the creating site.

  • Organization: For the purposes of this policy, the term "organization" shall mean Tuna.

  • PaaS: Platform-as-a-Service.

  • Partner: Contractual bound 3rd party vendor with integration with the Tuna Platform. May offer Add-on services.

  • PMP or Platform: Tuna Precision Medicine Platform and its overall technical environment.

  • Role: The category or class of person or persons doing a type of job, defined by a set of similar or identical responsibilities.

  • Sanitization: Removal or the act of overwriting data to a point of preventing the recovery of the data on the device or media that is being sanitized. Sanitization is typically done before re-issuing a device or media, donating equipment that contained sensitive information or returning leased equipment to the lending company.

  • Trigger Event: Activities that may be indicative of a security breach that require further investigation (See Appendix).

  • Restricted Area: Those areas of the building(s) where protected health information and/or sensitive organizational information is stored, utilized, or accessible at any time.

  • Role: The category or class of person or persons doing a type of job, defined by a set of similar or identical responsibilities.

  • Precursor: A sign that an Incident may occur in the future. Examples of precursors include:

    • Suspicious network and host-based IDS events/attacks;
    • Alerts as a result of detecting malicious code at the network and host levels;
    • Alerts from file integrity checking software;
    • Audit log alerts.

  • Risk: The likelihood that a threat will exploit a vulnerability, and the impact of that event on the confidentiality, availability, and integrity of sensitive data, other confidential or proprietary electronic information, and other system assets.

  • Risk Management Team: Individuals who are knowledgeable about the Organization's Privacy, Security and Compliance policies, procedures, training program, computer system set up, and technical security controls, and who are responsible for the risk management process and procedures outlined below.

  • Risk Assessment:

  • Identifies the risks to information system security and determines the probability of occurrence and the resulting impact for each threat/vulnerability pair identified given the security controls in place;

  • Prioritizes risks; and

  • Results in recommended possible actions/controls that could reduce or offset the determined risk.

  • Risk Management: Within this policy, it refers to two major process components: risk assessment and risk mitigation.

  • Risk Mitigation:

    A process that prioritizes, evaluates, and implements security controls that will reduce or offset the risks determined in the risk assessment process to satisfactory levels within an organization given its mission and available resources.

  • SaaS: Software-as-a-Service.

  • Security Incident (or just Incident): A security incident is an occurrence that exercises a significant adverse effect on people, process, technology, or data. Security incidents include, but are not limited to:

    • A system or network breach accomplished by an internal or external entity; this breach can be inadvertent or malicious;
    • Unauthorized disclosure;
    • Unauthorized change or destruction of sensitive data (i.e. deletion or alterations not following Tuna's procedures);
    • Denial of service not attributable to identifiable physical, environmental, human or technology causes;
    • Disaster or enacted threat to business continuity;
    • Information Security Incident: A violation or imminent threat of violation of information security policies, acceptable use policies, or standard security practices. Examples of information security incidents may include, but are not limited to, the following:
    • Denial of Service: An attack that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources;
    • Malicious Code: A virus, worm, Trojan horse, or other code-based malicious entity that infects a host;
    • Unauthorized Access/System Hijacking: A person gains logical or physical access without permission to a network, system, application, data, or other resource. Hijacking occurs when an attacker takes control of network devices or workstations;
    • Inappropriate Usage: A person violates acceptable computing use policies;
    • Other examples of observable information security incidents may include, but are not limited to:
      • Use of another person's individual password and/or account to login to a system;
      • Failure to protect passwords and/or access codes (e.g., posting passwords on equipment);
      • Installation of unauthorized software;
      • Terminated workforce member accessing applications, systems, or network.

  • Threat: The potential for a particular threat-source to successfully exercise a particular vulnerability. Threats are commonly categorized as:

    • Environmental - external fires, HVAC failure/temperature inadequacy, water pipe burst, power failure/fluctuation, etc.
    • Human - hackers, data entry, workforce/ex-workforce members, impersonation, insertion of malicious code, theft, viruses, SPAM, vandalism, etc.
    • Natural - fires, floods, electrical storms, tornados, etc.
    • Technological - server failure, software failure, ancillary equipment failure, etc. and environmental threats, such as power outages, hazardous material spills.
    • Other - explosions, medical emergencies, misuse or resources, etc.

  • Threat Source: Any circumstance or event with the potential to cause harm (intentional or unintentional) to an IT system. Common threat sources can be natural, human or environmental which can impact the organization's ability to protect sensitive data.

  • Threat Action: The method by which an attack might be carried out (e.g., hacking, system intrusion, etc.).

  • Unrestricted Area: Those areas of the building(s) where protected health information and/or sensitive organizational information is not stored or is not utilized or is not accessible there on a regular basis.

  • Vendor: External individuals or organizations marketing or selling products or services, or providing services to Tuna.

  • Vulnerability: A weakness or flaw in an information system that can be accidentally triggered or intentionally exploited by a threat and lead to a compromise in the integrity of that system, i.e., resulting in a security breach or violation of policy.

  • Workstation: An electronic computing device, such as a laptop or desktop computer, or any other device that performs similar functions, used to create, receive, maintain, or transmit sensitive data. Workstation devices may include, but are not limited to: laptop or desktop computers, smart phones, tablet PCs, and other handheld devices. For the purposes of this policy, "workstation" also includes the combination of hardware, operating system, application software, and network connection.

  • Workforce: Means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity.

sidebar_label: Employee Handbook and Policy Quick Reference

hide_title: true#

Employee Handbook and Policy Quick Reference#

2026.5

This is an abridged version of Tuna's security policy that all workforce members are required to be familiar with and comply with.

You are assumed to have read and fully understood the corporate security and privacy policies, standards, guidelines, controls and procedures even if you haven’t. So, it’s probably best you still go through the whole thing at some point.

  • You are required to follow detailed procedures defined in certain policies related to your job role.

Security is everyone's responsibility. If this is not your first job, don’t do anything that might get you in trouble at your previous workplace. When in doubt, stop and ask.

!!! check "Acknowledgement"

As a Tuna employee, I acknowledge that
* I have reviewed and will comply with company
[security policies and procedures][1], [acceptable use][2], and [sanction policies][3].
* I accept that my work devices, including approved BYOD devices, and activities on such devices are subject to security monitoring.
* I will protect my work devices at remote locations and will not leave devices unattended.
* I will ensure my laptops and workstations are securely configured with whole disk encryption, endpoint security agent, malware protection, local firewall, password protected screensaver, and latest security patches.
* I will follow documented policies and procedures to protect sensitive and confidential data.
* I understand that customer data and sensitive data may only be stored in approved production environments.
* I understand company and regulatory requirements to protect critical data and will NOT
* store critical data such as customer data and passwords on online file shares (such as Google Drive, SharePoint, Dropbox), in logs and source codes;
* send critical data such as customer data and passwords by email, chat, or similar public communication channels;
* post critical data such as customer data and passwords in blogs, support tickets or other public forums; and
* discuss patient information in public.
* I understand that use of paper records and fax transmission for sensitive customer data is not allowed.
* I will keep my passwords confidential and will NOT share my individual user passwords with other users.
* I will NOT use shared/generic, guest/anonymous, emergency or temporary accounts without explicit approval.
* I will regularly back up business data on my user devices to approved data storage media/repositories such as the company SharePoint site.
* I will report any incident and suspicious activity to Security and/or my manager.

Training#

You will be prompted as part of onboarding, and periodically going forward, to complete the following security training:

Acceptable use policy for end-user computing#

Tuna policy requires that:

(a) Per Tuna security architecture, all workforce members are primarily considered as remote users and therefore must follow all system access controls and procedures for remote access.

(b) Use of Tuna computing systems is subject to monitoring by Tuna IT and/or Security team.

(c) Employees may not leave computing devices (including laptops and smart devices) used for business purpose, including company-provided and BYOD devices, unattended in public.

(d) Device encryption must be enabled for all mobile devices accessing company data, such as whole-disk encryption for all laptops.

(e) Use only legal, approved software with a valid license. Do not use personal software for business purposes and vice versa.

(f) Encrypt all email messages containing sensitive or confidential data.

(g) Employees may not post any sensitive or confidential data in public forums or chat rooms. If a posting is needed to obtain technical support, data must be sanitized to remove any sensitive or confidential information prior to posting.

(h) Anti-malware or equivalent protection and monitoring must be installed and enabled on all endpoint systems that are commonly affected by malware, including workstations, laptops and servers.

(i) All data storage devices and media must be managed according to the Tuna Data Classification specifications and Data Handling procedures.

(j) Mobile devices are not allowed to connect directly to Tuna production environments.

Your responsibilities for computing devices#

Tuna provides company-issued laptops and workstations to all employees. Tuna currently does not require or support employees bringing their own computing devices.

The laptops and/or workstations assigned to you are yours to configure and manage according to company security policy and standards. You are responsible to

  • configure the system to meeting the configuration and management requirements, including password policy, screen protection timeout, host firewall, etc.;

  • ensure the required anti-malware protection and security monitoring agent is installed and running; and

  • install the latest security patches timely or enable auto-update.

IT and Security provides automated scripts for end-user system configurations and/or technical assistance as needed.

You are also responsible for maintaining a backup copy of the business files local on your laptop/workstation to the appropriate location on Tuna file sharing / team site (e.g. SharePoint). Examples of business files include, but are not limited to:

  • Documents (e.g. product specs, business plans)
  • Presentations
  • Reports and spreadsheets
  • Design files/images/diagrams
  • Meeting notes/recordings
  • Important records (e.g. approval notes)

!!! important

DO NOT backup critical data such as customer data or PII to file sharing sites.
If you have such critical data locally on your device, contact IT and
Security for the appropriate data management and protection solution.

Unless the local workstation/device has access to Critical data, backups of user workstations/devices are self managed by the device owner. Backups may be stored on an external hard drive or using a cloud service such as iCloud if and only if the data is both encrypted and password protected (passwords must meet Tuna requirements).

Getting help#

Support for most of our business applications are self-service, such as password reset via Keycloak.

If needed, users may use our internal service desk to request IT and Security support. Common requests include:

  • Password reset and access requests
  • Request new software and hardware
  • Technical support
  • Recommend changes to policies and processes

How to report an incident or suspicious activity#

You are responsible to report all suspicious activities and security-related incidents immediately to the Information Security team, by one of the following channels:

  • (preferred) “Report a security incident” by creating an issue on Jira and/or via the [internal help desk](](mailto:security@tuna.uy)

  • For non-sensitive, non-confidential security issues and concerns, employees may post questions on Tuna’s #infosec Slack channel.

  • Additionally, employees may report the incident to their direct manager.

  • To report a concern under the Whistleblower Policy, you may first discuss the concerns with your immediate manager, or report it directly to the CEO or COO. See the Whistleblower Policy section in the HR Security Policy for additional details.

sidebar_label: Approved Software

hide_title: true#

Approved Software#

2026.5

Software approved for use at Tuna includes, but is not limited to:

  • Adobe suite
  • Atlassian suite
  • Code editors (Atom, Emacs, Vim, VS Code, etc)
  • Dashlane
  • Docker
  • Node/NPM
  • Google Apps
  • Keycloak (and any apps/services managed by Keycloak)
  • Postman
  • Slack
  • Sketch
  • Zoom

Reputable and well documented open source / free software may be used for development purposes at the discretion of the Engineering team. Cb Defense agents must be active to monitor the behavior of all application processes. Additional periodic audit may be conducted to review the usage of open source tools. Examples of such software include, but are not limited to:

  • Chrome and various browser extensions
  • Firefox and various browser extensions
  • Homebrew
  • GraphQL/GraphiQL
  • Keybase
  • Skitch
  • Spectacle
  • etc.

Software not in the list above may be installed if it is necessary for a business purpose, legal, with a valid license, and approved on a case-by-case basis by your manager or the Security Officer.

sidebar_label: Approved Vendors

hide_title: true#

Approved Vendors#

2026.5

For confidentiality reasons, the list of approved vendors is maintained internally at company Wiki / SharePoint site.

sidebar_label: Cookie Policy

hide_title: true#

Cookie Policy#

Updated:

We at Tuna (Tuna Software, Inc and our subsidiaries and affiliates) are committed to protecting your privacy. We and our partners use cookies and similar technologies on our services, including our websites and mobile applications (the "Services"). This Cookie Policy explains these technologies, why we use them, and the choices you have.

By visiting or using our Services, you are consenting to us gathering and processing information (as defined in our Privacy Policy) about you in accordance with this Cookie Policy.

TECHNOLOGIES WE USE#

Like many Internet-enabled services, we use technologies that place small files/code on your device or browser for the purposes identified in our Privacy Policy, primarily to remember things about you so that we can provide you with a better experience.

Cookies. A cookie is a small data file stored on your browser or device. They may be served by the entity that operates the website you are visiting ("first-party cookies") or by other companies ("third-party cookies").

  • For example, we partner with third-party analytics providers, like Google, which set cookies when you visit our websites. This helps us understand how you are using our Services so that we can improve them.

Pixels (Clear Gifs/Web Beacons/Web Bugs/Embedded Pixels). These are small images on a web page or in an email. They collect information about your browser or device and can set cookies.

Local Storage. Local storage allows data to be stored locally on your browser or device and includes HTML5 local storage and browser cache.

Software development kits (“SDKs”). SDKs are blocks of code provided by our partners that may be installed in our mobile applications. SDKs help us understand how you interact with our mobile applications and collect certain information about the device and network you use to access the application.

OUR USE OF THESE TECHNOLOGIES#

Below are the ways that we and our partners use these technologies on our Services.

CATEGORY OF USEPURPOSE OF USE
PreferencesTo help us remember your settings and preferences so that we can provide you with a more personalized experience.
Authentication and SecurityTo log you into the Services; enable us to show you your account data; and help us keep your data and the Services safe and secure.
Service Features and PerformanceTo provide you with functionality and optimize the performance of the Services. For example, to allow you to share information from Tuna mobile apps with friends within your social networks/circles.
Analytics and ResearchTo help us understand how you are using the Services so that we can make them better, faster, and safer.

YOUR CHOICES#

You have a number of options to control or limit how we and our partners use cookies and similar technologies, including for advertising. Please note that Tuna websites and our Services do not respond to Do Not Track signals because we do not track our users over time and across third-party websites to provide targeted advertising. However, we believe that you should have a choice regarding interest-based ads served by our partners, which is why we outline the options available to you here below.

You can set your device or browser to accept or reject most cookies, or to notify you in most situations that a cookie is offered so that you can decide whether to accept it. However, if you block cookies, certain features on our Services may not function. Additionally, even if you block or delete Cookies, not all tracking will necessarily stop.

  • To prevent your data from being used by Google Analytics, you can install Google's opt-out browser add-on.
  • For information on how our advertising partners allow you to opt out of receiving ads based on your web browsing history, please visit http://optout.aboutads.info/.
  • To opt out of ads on Facebook, Pinterest, Google or other sites that are targeted to your interests, use your Facebook, Pinterest, Google Ads, or the other site settings.
  • Check your mobile device for settings that control ads based on your interactions with the applications on your device. For example, on your iOS device, enable the "Limit Ad Tracking" setting, and on your Android device, enable the "Opt out of Ads Personalization" setting.

As an additional step, these advertising companies may participate in one of the following advertising industry self-regulatory programs for online behavioral advertising, with corresponding user opt-outs:

CONTACT US#

If you have questions about our use of cookies and similar technologies, please contact us at privacy@tuna.uy.

Privacy Officer
Tuna Software, Inc
policy@tuna.uy

sidebar_label: Privacy Policy

hide_title: true#

Privacy Policy#

Updated:

We at Tuna (Tuna Software, Inc and our subsidiaries and affiliates) are committed to protecting your privacy. This privacy policy applies to our applications, software, websites, APIs, products, and services including our associated mobile applications ("Mobile Apps"), (each a "Site", "Service", or "Mobile App" or collectively, the "Services"), owned and controlled by Tuna.

This Privacy Policy governs our data collection, processing and usage practices. It also describes your choices regarding use, access and correction of your personal information. If you do not agree with the data practices described in this Privacy Policy, you should not use our Services.

Specifically, this Privacy Policy covers:

TopicSummary
Information we collect about youWe may collect Personal Information, Usage and Device Information (collectively, "information", defined in detail below) about you in connection with your (or your organization’s) use of our Services that link to this Privacy Policy.

Learn more below
How we use your informationWe use the information we collect only in compliance with this Privacy Policy. We may use your information to provide services (either directly to you or to those third parties who have engaged us as service providers to process your information on their behalf); respond to inquiries and provide customer support and technical assistance; communicate with you; process transactions; improve, develop, provide content for, operate, deliver and market our Services; implement social networking features; comply with our company policies and procedures and with applicable law; ensure proper and authorized use of the Services; perform Services tracking and analysis; and, as otherwise permitted by applicable law.

Learn more below
How we share your informationWe may share your information with our business units, affiliates, subsidiaries, business partners, service providers and/or your representatives, in order to provide or improve our Services to you. We do not share information with third parties so that they can independently market their own products or services to you unless we have explicitly given you the option to opt-in such disclosures. We will never sell your Personal Information to any third party.

Learn more below
Your Rights Regarding Your Personal InformationWe provide you with the opportunity to be informed of whether we are processing your information and to access, correct, update, oppose, delete, block, limit or object, upon request and free of charge, to our use of your Personal Information to the extent required by applicable law.

Learn more below
Retention of your informationWe keep your account information, like your name, email address, and password, for as long as your account is in existence because we need it to operate your account. In some cases, when you give us information for a feature of the Services, we delete the data after it is no longer needed for the feature. We keep your account data until you use your account settings or tools to delete the data or your account because we use this data to provide you Services. We also keep information about you and your use of the Services for as long as necessary for our legitimate business interests, for legal reasons, and to prevent harm, including as described in the How We Use Your Information and How We Share Your Information sections.
Security of your informationWe work hard to keep your data safe. We use a combination of technical, administrative, and physical controls to protect the confidentiality, integrity and availability of your data. This includes using Transport Layer Security ("TLS") to encrypt data transmission and Advanced Encryption Standard ("AES") to encrypt data storage. No method of transmitting or storing data is completely secure, however. If you have a security-related concern, please contact Customer Support or our Security team.

Click here to learn more about our security practices.
International Data TransfersTuna is a U.S.-based company that offers our Services to U.S. and international customers. As a result, information that we collect, including personal information, may be transferred to our data centers or service providers in the U.S. By providing your personal information to us, you are consenting to the transfer of your personal information to the U.S. and to our (and our services providers’) use and disclosure of your personal information in accordance with this Privacy Policy.

We rely on multiple legal bases to lawfully transfer personal data around the world. These include your consent, the EU-US and Swiss-US Privacy Shield. Tuna complies with the Privacy Shield principles regarding the collection, use, sharing, and retention of personal information as described in our Privacy Shield certifications, and we follow internal procedures for verifying that our commitments under this Privacy Policy have been implemented. Our compliance with this obligation can be investigated and enforced by the U.S. Federal Trade Commission. Learn more about Privacy Shield here.

If you have a complaint about our Privacy Shield compliance, please contact us. You can also refer a complaint to our chosen independent dispute resolution body JAMS, and in certain circumstances, invoke the Privacy Shield arbitration process or lodge a complaint with the supervisory authority in your country of residence in the EU.
Cookies and similar TechnologiesWe may use “cookies” and similar technologies to help deliver our Services. This technology may involve placing small files/code on your device or browser that serve a number of purposes, such as remembering your preferences and to offer you a more personalized user experience. Read our Cookie Policy to learn more.
Marketing Analytics and CommunicationsWe work with partners who provide us with marketing analytics and communications services. This includes helping us understand how users interact with our Services, communicating with you about our Services and features, and measuring the performance of those communications. These companies may use cookies and similar technologies to collect information about your interactions with the Services and other websites and applications. To learn more and about your privacy choices, please see more details in the How We Use Your Information and How We Share Your Information sections and read our Cookie Policy.
Links to Other WebsitesOur Services may contain links to other websites or services that are not owned or controlled by Tuna, including links to websites of our sponsors and partners. This Privacy Policy only applies to information collected by our Services. We have no control over these third-party websites, and your use of third party websites and features are subject to privacy policies posted on those websites. We are not responsible or liable for the privacy or business practices of any third-party websites linked to our Services. Your use of third parties’ websites linked to our Services is at your own risk, so we encourage you to read the privacy policies of any linked third-party websites when you leave one of our Services.
Our Policies for ChildrenOur Services are directed toward adults. If you are under the age of 16, you must obtain the authorization of a responsible adult (parent or legal custodian) before using or accessing our Services. We will not knowingly collect or use any personal information from any children under the age of 16. If we become aware that we have collected any personal information from children under 16, we will promptly remove such information from our systems.
Situations where this Privacy Policy does not applyThis Privacy Policy does not apply to job applicants or employees, which are subject to relevant privacy notices. This Privacy Policy does not apply to the extent that:
• Our products and services set forth an additional or alternative Privacy Policy; or
• Applicable law imposes different processing or privacy requirements on your information.
Changes to this Privacy PolicyWe periodically update this Privacy Policy. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice by sending you notification by email or notification alert within our Services. While we will notify you of any material changes to this Privacy Policy, we encourage you to review this Privacy Policy periodically. We will also keep prior versions of this Privacy Policy in an archive for your review.
How to contact usYou can contact us using the Contact Us page on our Sites or by mail at policy@tuna.uy.

If you have questions, suggestions, or concerns about this policy, or about our use of your information, including filing a complaint, please contact our Data Protection Officer or Privacy Officer at privacy@tuna.uy.

INFORMATION WE COLLECT ABOUT YOU#

When you use our Services, we collect the following types of information.

INFORMATION YOU PROVIDE US ("PERSONAL INFORMATION")#

ACCOUNT INFORMATION. Some information is required to create an account on Services, such as your

  • name,
  • email address,
  • password,
  • company, and
  • phone number.

ADDITIONAL INFORMATION. To help improve your experience or enable certain features of the Services, you may choose to provide us with additional information, such as

  • a profile photo,
  • biography,
  • mailing address,
  • country information,
  • date of birth,
  • gender,
  • height,
  • weight,
  • additional health information or activity data such as your logs for food, weight, sleep, water,
  • additional contact phone numbers such as your mobile telephone number,
  • community or social media username, and
  • messages on discussion boards or to your social contacts on the Services.

You may also connect with friends on the Services or invite friends who have not yet joined by providing their email addresses, accessing social networking accounts or using the contact list on your mobile device. We do not store your contact list and delete it after it is used for adding contacts as friends.

If you contact us or participate in a survey, contest, or promotion, we collect the information you submit such as your name, email address, contact information, and message.

INFORMATION FROM THIRD-PARTY SERVICES. If you choose to connect your account on our Services to your account on another service, we may receive information from the other service. For example, if you connect to Facebook or Google, we may receive information like your name, profile picture, age range, language, email address and friend list. You may also choose to grant us access to your personal information such as activity data or health data from other services. You can stop sharing the information from the other services with us by removing our access to each other service.

INFORMATION PROVIDED BY OTHER INDIVIDUALS. While using our Services, individuals may provide information about another individual, or an authorized user (such as an account administrator) creating an account on your behalf may provide information about You. When one individual provides us with information (including personal information) about another individual, we assume that the individual has permission and authority to do so and to consent on behalf of that individual to the collection and use of personal information as described in this Privacy Policy. Please contact us immediately if you become aware of an individual providing us with personal information about another individual without being authorized to do so, and we will act consistently with this Privacy Policy.

PAYMENT AND CARD INFORMATION. Some Tuna Services support payments and transactions with third parties. If you activate this feature, you must provide certain information for identification and verification, such as your name, billing address, credit, debit or other card number, card expiration date and CVV code. This information is used solely to check your financial qualifications and collect payment from you. We do not store your payment information. We use a third-party service provider to manage payment card processing. Note that third-party payment processors may retain this information in accordance with their own privacy policies and terms. This service provider is not permitted to store, retain or use information you provide except for the sole purpose of credit card processing on our behalf.

INFORMATION WE RECEIVE FROM YOUR USE OF OUR SERVICES#

USAGE AND DEVICE INFORMATION. When you use our Services, we receive certain usage data ("Usage and Device Information"). This includes information about your interaction with the Services, for example, when you view or search content, install or open applications or software, create or log into your account, import data into your account, or integrate a third-party service to your account. We may also collect data about the devices and computers you use to access our Services, including IP addresses, browser type, language, operating system, or mobile device information (including device and application identifiers), the referring web page, pages visited, location (depending on the permissions you have granted us), and cookie information.

HEALTH AND OTHER SPECIAL CATEGORIES OF PERSONAL DATA. To the extent that information we collect directly from you is health data or another special category of sensitive personal data subject to the European Union’s General Data Protection Regulation ("GDPR"), we ask for your explicit consent to process such sensitive personal data. We obtain this consent separately when you take actions leading to our obtaining the data, for example, when you activate the activity tracking features in our Mobile Apps or grant us access to your health or activity data from another service. You can use your account settings or contact us to withdraw your consent at any time, including by stopping use of a feature, removing our access to a third-party service, requesting deletion your data or closing your account.

However, if we are acting as a service provider (a "Data Processor") processing your personal information on behalf of a third party that has collected such data from you, and such third party is the party that has the right to determine the purposes for which it will process your personal information and the means it will use to process your personal information (the "Data Controller"), then such Data Controller has the legal obligation to ask for your explicit consent to process your sensitive personal data (including health data), and we are not responsible for obtaining such consent from you. In such a scenario, the Data Controller may have their own, separate policies regarding the use and disclosure of your personal information, including any sensitive personal data you provide to such Data Controller. In such a scenario, this Privacy Policy does not apply to, we cannot control the activities of, and we are not responsible for the activities of the applicable Data Controller generally; this Privacy Policy only applies to our processing of your personal information that we, as a Data Processor, have been asked to process on behalf of the Data applicable Data Controller. We encourage you to review such Data Controller’s privacy policy and/or contact the applicable Data Controller for more information about the policies that apply to their use and disclosure of your personal information, including any sensitive personal data.

HOW WE USE YOUR INFORMATION#

We use the information we collect for the following purposes.

PROVIDE AND MAINTAIN THE SERVICES#

We use the information we collect to deliver the Services to you and honor our Terms of Service for each Service or business contract with you. For example,

  • to administer, operate, maintain and secure our Services;
  • to monitor and analyze trends, usage and activities in connection with our Services;
  • for accounting, recordkeeping, backup and administrative purposes;
  • to customize and improve the content of our communications, websites and social media accounts;
  • to provide customer service and support;
  • to communicate with you, including responding to your comments, questions and requests regarding our Services;
  • to process and complete transactions, and send you related information, including alerts and notifications about your service, purchase confirmations and invoices; and
  • to educate and train our workforce in data protection and customer support.

For the Services’ social features, we may use your information to help you find and connect with other users and to allow other users to find and connect with you. For example, your account contact information allows other users to add you as a friend. When another user has your email or mobile phone number in their contact list or in their friend network on a connected service, we may show that user that you are a user of the Services.

IMPROVE, PERSONALIZE, AND DEVELOP THE SERVICES#

We use the information we collect to improve and personalize the Services and to develop new ones. For example, we use the information to troubleshoot and protect against errors; perform data analysis and testing; conduct research and surveys and develop new features and Services.

COMMUNICATE WITH YOU#

We use your information when needed to send you Service notifications and respond to you when you contact us. We also use your information to promote new features or products that we think you would be interested in. You can control marketing communications and most Service notifications by using your notification preferences in account settings or via the "Unsubscribe" link in an email.

PROMOTE SAFETY AND SECURITY#

We use the information we collect to promote the safety and security of the Services, our users and other parties. For example, we may use the information

  • to authenticate users;
  • to facilitate secure payments;
  • to respond to a legal request or claim, conduct audits, and enforce our terms and policies;
  • to investigate and protect against fraud, malicious or unauthorized access, and other illegal activities; and
  • to demonstrate and verify compliance with our internal policies and procedures, and applicable privacy and data security laws and regulations, such as HIPAA and GDPR.

USE AND DISCLOSURE OF DE-IDENTIFIED INFORMATION#

"De-identified" means that we have removed, or rendered unreadable through complex computational algorithms, your personally-identifiable information, such as your name, address, or birthdate. We may use de-identified information that we have obtained from our Services for various purposes, including for example:

  • In accordance with regulatory requirements, we may de-identify, store and use your information for internal quality control, validation and research and development. This is important for Tuna to maintain high quality Services. We may use de-identified information as permitted by law.
  • We may contribute de-identified genetic variants that we have observed in the course of providing our Services to publicly available databases such as ClinVar. We do this to increase understanding and raise awareness of the significance of genetic variants within the medical and scientific communities.
  • We may use or disclose de-identified information for general research and communications purposes. This may include analysis of this information to communicate observations and learnings, for example in the case of aggregated data. This may also include research collaborations with third parties, such as universities, hospitals or other laboratories, in which we utilize de-identified clinical cases, at the individual level or in the aggregate, in accordance with our study protocols, and we may present or publish such information. This may also include commercial collaborations with private companies for purposes such as to determine the prevalence of particular disorders or variants among the patients we have tested, or to determine whether any of the patients we have tested might be suitable for potential recruitment for research, clinical trials, or clinical care; however, we will not directly contact these patients about these opportunities without their prior written consent.

We use cookies and similar technologies for the purposes described above. For more information, please read our Cookie Policy.

For personal data subject to the GDPR, we rely on several legal bases to process the data. These include when you have given your consent, which you may withdraw at any time using your account settings and/or other tools; when the processing is necessary to perform a contract with you, like the Terms of Service; and our legitimate business interests, such as in improving, personalizing, and developing the Services, marketing new features or products that may be of interest, and promoting safety and security as described above.

HOW WE SHARE YOUR INFORMATION#