Does this mean you other medical professionals can't get the data / records of these tests?
If you want to have your data, you can download them at any time and share them with anyone you want.
If you want us to delete the data, we will do that.
If you don't say anything, we will never share your data with anyone.
> The resulting data is then securely sent over to us (we’re HIPAA compliant)
So the material is considered and under the protection of HIPAA.
> At no time shall your Personal Information, including blood or metabolomic data collected from you in accordance with this Privacy Policy be deemed to be an electronic health record or an electronic medical record for any purpose, including without limitation for the purpose of compliance with the Health Insurance Portability and Accountability Act of 1996.
This reads like 'because we do not consider your data to be PHI, therefore it is not under HIPAA.' ergo, lose all HIPAA protection.
Might want to re-write this if that is not what you meant.
The thing you need to remember with consumer protection is that a failing company will abandon everything including ethics in order to pay the piper. Especially after they have laid you off.
There’s a reason some capital E ethical companies put poison pills or time bombs in their charter. Booby traps of this sort actually instill trust in people who have heard a line of bullshit so often they can see it a mile away.
I'd be specifically interested in exactly how you "delete" data after the user requests this, and how you ensure that any data breach could not reveal identifying information. Perhaps HIPAA covers some or all of this, I'm not sure. But personally I'd want extremely detailed reassurance about these items.