Draft — pending legal review. The final wording of this policy is being finalised with qualified counsel. The structure below reflects what the published policy will cover.
DRAFT — pending legal review. Not legal advice.
Last updated: 10 July 2026
This Privacy Policy explains how VAMS BioInnovation Private Limited ("VAMS BIOME," "we," "us," or "our"), of Plot No. 59, A-12-4-1, Near Matha Towers, K P Nagar, Benz Circle, Vijayawada, Andhra Pradesh 520008, India, collects, uses, shares, and protects your personal information when you visit our website, purchase or use our at-home microbiome sampling kits, and receive your sequencing-derived reports.
VAMS BIOME provides educational, wellness-oriented information only. Our sampling kits, sequencing, and reports — including the ATLAS interpretation layer — offer sequencing-derived microbial context for general wellness and educational purposes. They are not a medical or diagnostic service and do not provide medical advice, diagnosis, treatment, or a cure for any condition. Always consult a qualified healthcare professional about your health.
Who We Are and How to Contact Us
For questions about this policy or your data, contact our privacy team at privacy@vamsbiome.com. Where required, our Data Protection Officer / privacy representative can be reached at the same address. If you are in the UK or EU, you may also lodge a complaint with your local supervisory authority.
Information We Collect
Account information: name, email address, password, and account preferences.
Order and contact information: shipping and billing address, phone number, order history, and customer-service correspondence.
Payment information: processed by our third-party payment providers. We do not store full card numbers; we receive limited transaction confirmation data only.
Biological samples: the physical sample you collect at home (gut, vaginal, oral, or skin) and the DNA extracted from it during processing.
Sequencing-derived data: microbial DNA sequencing results generated from your sample and the sequencing-derived microbial context, summaries, and ATLAS interpretations we produce for your reports.
Kit and health-context inputs: optional information you choose to provide (for example, sample type, collection date, or wellness questionnaire responses) to help contextualize your report.
Website and analytics data: IP address, device and browser type, pages viewed, and similar usage data collected via cookies and similar technologies (see Cookies below).
Sensitive Data
Sequencing-derived data from your biological sample is treated as sensitive personal data and is handled with heightened safeguards, in a manner consistent with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian law. We process it only for the purposes described here.
How We Use Your Data — Mandatory Processing vs Optional Uses
We are transparent about which processing is necessary to provide the service and which is optional and consent-based.
Mandatory service processing (necessary to deliver what you purchased):
Fulfilling orders, shipping kits, and processing and returning your sequencing-derived reports.
Laboratory processing of your biological sample and generation of sequencing-derived microbial context and ATLAS interpretations.
Providing customer support, maintaining your account, ensuring security, and meeting legal, tax and regulatory obligations.
If you do not agree to the mandatory processing, we cannot provide the service.
Optional uses (only with your separate, revocable consent):
Marketing communications and offers.
Research using de-identified data (see our Biological Sample & Data Consent).
Algorithm and product development to improve interpretation methods.
Residual-sample uses beyond what is necessary for your report.
Each optional use is presented separately, is not required to receive your report, and can be withdrawn at any time without affecting the mandatory service. Withdrawal does not affect processing already carried out before withdrawal.
How Samples and Genetic/Biological Data Are Handled
Your physical sample is linked to your order through a coded identifier rather than your name wherever practicable, to limit the exposure of directly identifying information during laboratory processing. Sequencing is performed by us or by our vetted laboratory partners under contractual confidentiality and security obligations. Once your report is generated, we retain your sequencing-derived data as described below and handle it under the heightened safeguards noted above.
We do not sell your genetic or biological data. We do not share it with insurers, employers, or for advertising. We will only share sequencing-derived data with third parties where necessary to provide the service, where you have instructed us to, or where legally required.
Sub-Processors and Sharing
We share personal information with trusted service providers ("sub-processors") who act on our behalf under contract, including providers of payment processing, shipping/logistics, laboratory sequencing, cloud hosting and storage, analytics, and customer support. A current list is available at https://www.vamsbiome.com/legal/subprocessors. We require each sub-processor to protect your data and to use it only for the services they provide to us.
We may also disclose data to comply with law, enforce our terms, or protect the rights and safety of users, and in connection with a corporate transaction (for example, a merger or acquisition), subject to appropriate safeguards.
Processing Locations and Transfers
We operate under the Laws of India, including applicable laws of the State of Andhra Pradesh. Your sample and data may be processed by qualified partners in India or in another location disclosed to you before sample submission or processing. Where data is processed or transferred outside India, we apply safeguards consistent with applicable Indian law and require our partners to protect your data under contract. The applicable processing location will be identified in your order documentation or report where relevant.
Data Retention and Deletion
We retain personal information only as long as necessary for the purposes described in this policy, or as required by law. Retention periods vary by data type and are set out in our internal retention schedule (Retention depends on the record type and purpose. Generally: order, invoice and statutory business records for up to 8 years; identifiable microbiome test data and reports for up to 3 years after report delivery or account closure; raw sequencing files for up to 12 months after report delivery; support records for up to 3 years; and consent records for as long as necessary to demonstrate compliance. Data may be retained longer where required by law, litigation hold or explicit research consent, and may be deleted or anonymised earlier when no longer necessary.). Where practicable, we destroy or return your physical biological sample after processing. When data is no longer needed, we securely delete or anonymize it. You may request deletion as described below, subject to legal retention obligations.
Your Rights
Consistent with India's Digital Personal Data Protection Act, 2023 and other applicable law, you may:
Access a summary of the personal data we process about you and the processing activities.
Correction and updating of inaccurate, incomplete or outdated personal data.
Erasure of your personal data where it is no longer required and retention is not mandated by law.
Withdraw consent for any consent-based (optional) processing, as easily as it was given.
Grievance redressal — raise a grievance with us and receive a timely response through our grievance mechanism.
Nomination — nominate another individual to exercise your rights in the event of your death or incapacity.
Complaint — escalate to the Data Protection Board of India if your grievance is not satisfactorily resolved.
To exercise any right or raise a grievance, contact our privacy team at privacy@vamsbiome.com. We will verify your identity and respond within the timeframes required by applicable Indian law. We will not deny you the service for exercising a right that is not required for that service.
Cookies
We use cookies and similar technologies for essential site function, analytics, and (with consent) marketing. For details and to manage your preferences, see our separate Cookie Notice.
Children
Our products and website are intended only for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
Security
We maintain technical and organizational measures designed to protect your data, including encryption in transit and at rest, access controls, coded sample identifiers, staff confidentiality obligations, and vendor due diligence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Changes to This Policy
We may update this policy from time to time. We will post the revised version with an updated version number and effective date and, where required, notify you of material changes.
Version and Change History
Document: Privacy Policy
Version: 1.0
Effective date: 10 July 2026
Change history: v1.0 (10 July 2026) — Initial publication.
Recruitment privacy
When you apply for a role at VAMS BIOME, the information you submit — including your CV — is used to assess your application, communicate with you about the recruitment process, conduct that process, and maintain security and audit controls. It is not used for marketing, and applying never subscribes you to any newsletter.
Retention: if your application is unsuccessful or withdrawn, your identifiable recruitment data and CV are deleted or irreversibly anonymized 180 days after the final recruitment event, unless a legal hold applies. If you separately opt into the talent pool, your profile is kept for 12 months from your consent and then deleted; talent-pool consent is optional, never required to apply, and never renewed automatically. If you are hired, only required employment information is carried into your employee record, and remaining recruitment material is removed within 12 months of your start date.
You may request deletion of your application at any time by contacting us; we honour deletion requests unless an overriding legal requirement applies. Non-identifiable, aggregated recruitment metrics may be retained.