Draft — pending legal review. The final wording of this policy is being finalised with qualified counsel. The structure below reflects what the published policy will cover.
DRAFT — pending legal review. Not legal advice.
Research and Secondary-Use Consent
1. What this document is (and is not)
This is a separate, optional consent. It asks whether you are willing to let
VAMS BioInnovation Private Limited ("VAMS", "we", "us") use data and/or biological material
connected with your microbiome sample for purposes beyond delivering the
report and service you purchased.
You do not have to agree to anything on this page. The product you bought —
sample collection, processing, and your personal wellness report — is delivered
in full whether or not you sign this consent, and whether you agree to all,
some, or none of the individual items below.
This consent is not part of your purchase agreement, not a condition of
service, and not a marketing sign-up. It is governed by the Digital Personal
Data Protection Act, 2023 ("DPDP Act") and the laws of India, including Andhra
Pradesh.
This document does not change the informational, wellness-oriented nature of
VAMS reports. Nothing here diagnoses, treats, prevents, cures or predicts any
disease, and participating in research does not give you any medical or
diagnostic benefit.
2. The core promise: your service is unaffected
Declining changes nothing about your product. You get the same sample kit,
the same processing, the same report, the same support, at the same price.
**We will never withhold, delay, downgrade, or differently price the core
service** because you said no to research or secondary use.
You can say yes to some items and no to others. There is no "all or
nothing." Each item in Section 4 is a distinct, independent choice.
Silence means no. If you do not affirmatively tick an item, we treat it as
declined. We never pre-tick boxes and never assume consent.
3. How this consent works — granular, unbundled, affirmative
Consistent with the DPDP Act, your consent here is:
Affirmative — it takes effect only through a clear, deliberate action by
you (ticking a specific box or its equivalent). Continuing to use the service,
ignoring this page, or failing to opt out does not create consent.
Granular — each secondary use in Section 4 is presented as its own item
with its own checkbox. Agreeing to one does not agree you to any other.
Unbundled — this research consent is kept separate from your purchase,
from account creation, and from any marketing preferences. None of them are
packaged together.
Informed — each item states, in plain language, what data or material is
used, for what purpose, in what form (identifiable, coded, or de-identified),
and who may receive it.
Specific and limited — we will not quietly repurpose a "yes" on one item
to justify a different use. New categories of use require a new, separate
consent (see Section 4.6 and Section 8).
You give and manage these choices in your account's **Research and Data
Preferences** panel, or by writing to privacy@vamsbiome.com.
4. The individual choices (each is independently opt-in)
Below, each item is a separate consent you may grant or withhold on its own.
"Your data" here can include microbiome sequence data, sample-derived
measurements, and information you provided (such as questionnaire answers),
depending on the item. Where an item says material is "coded" or
"de-identified," see Section 5 for what that means and its limits.
4.1 Longitudinal profiling
☐ Optional — independent opt-in
What it is: Linking your results over time — across repeat kits or future
tests — to build a longer-term picture of how your microbiome changes.
What we use: Your results, held in identifiable, linked form so that
successive samples can be connected to you.
Why it stays identifiable: By design, longitudinal profiling requires a
durable link to you; it cannot be done on fully anonymous data.
If you decline: Each of your reports is still delivered; we simply do not
build or retain a linked, over-time profile for research purposes.
4.2 Algorithm and product development
☐ Optional — independent opt-in
What it is: Using your data to help develop, train, test, and improve our
scoring methods, models, reference ranges, and future products.
What we use: Your data in coded or de-identified form wherever the work
allows it.
What you should know: Improvements derived partly from your data may be used
in commercial products. You do not gain any ownership of, or royalty or payment
from, any model, method, or product that results. Contributed data may be
retained in training or validation sets for as long as those sets are in use.
If you decline: We develop and improve our methods without using your data.
4.3 Commercial research
☐ Optional — independent opt-in
What it is: Using your data in research that has a commercial purpose,
including research we conduct with or for commercial partners, and research
intended to support commercial products or services.
What we use: Your data in coded or de-identified form wherever feasible.
What you should know: This may generate commercial value for VAMS or its
partners. You are not entitled to a share of that value. Where a specific
commercial collaborator is involved and can be named, see item 4.5.
If you decline: Your data is not used for commercially motivated research.
4.4 Biobank retention of your biological sample
☐ Optional — independent opt-in
What it is: Retaining your physical biological sample (or a derived
extract) beyond the Unless a different period is disclosed and consented to, residual biological samples will normally be destroyed within 30 days after the final report is issued. Samples may be retained longer only for necessary repeat testing, quality investigation, legal requirements or separately consented research. needed to deliver your report, so
it may be used in future analysis and research.
What we use: The stored biological material itself, held under a code
rather than your name where the biobank protocol allows.
What you should know: A stored biological sample can, in principle, be
re-analysed with methods that did not exist when you gave it, and biological
material carries inherent re-identification potential (see Section 5). Retention
is subject to our governance rules (Section 6) and the storage limits described
in your Privacy Notice.
If you decline: Your sample is destroyed or disposed of after the standard
Unless a different period is disclosed and consented to, residual biological samples will normally be destroyed within 30 days after the final report is issued. Samples may be retained longer only for necessary repeat testing, quality investigation, legal requirements or separately consented research. in the ordinary course, and is not banked for future
research.
4.5 Sharing with research collaborators
☐ Optional — independent opt-in
What it is: Sharing your data (and, only if you have also agreed to item
4.4, sample-derived material) with third-party research collaborators.
Who this covers — you consent by category and, where known, by name:
Named collaborators (if any at the time you consent): https://www.vamsbiome.com/legal/subprocessors
/ named research partners as listed in your preferences panel.
Categories of collaborators: academic and research institutions;
non-commercial research consortia; and, **only if you have also agreed to item
4.3**, commercial research partners.
What we use: Your data in coded or de-identified form wherever feasible,
shared under a written agreement that binds the recipient to confidentiality,
purpose limitation, security, and a prohibition on attempting to re-identify you.
What you should know: Some collaborators may be located outside India; any
cross-border sharing is done consistent with the DPDP Act and applicable
transfer restrictions. We maintain the current list of named collaborators and
categories and make it available to you on request.
If you decline: Your data and material are not shared with external research
collaborators.
4.6 Future, currently unspecified research
☐ Optional — independent opt-in
What it is: Permission for research purposes that we cannot fully describe
today because they do not yet exist.
Important limits on this item — this is deliberately narrow:
It authorises only research within our governance framework (Section 6),
using data in coded or de-identified form.
It does not authorise a materially new category of use (for example, a new
type of sharing, a new commercial arrangement, or use of identifiable data)
that a reasonable person would not expect from the items above. For those, we
will come back to you for a fresh, specific consent.
You may set this item to require case-by-case notification, so that we tell
you about a new study before your data is used in it, and you can object.
If you decline: We only use your data for the specific items you agreed to,
and we contact you afresh for anything new.
5. De-identification — what it means and its honest limits
Where an item says your data is coded or de-identified, we mean:
Coded (pseudonymised): Direct identifiers (such as your name and contact
details) are replaced with a code. The key that links the code back to you is
held separately and access-controlled. Coded data is still personal data.
De-identified: We remove or obscure identifiers so the dataset is not, on
its own, reasonably attributable to you, and we apply controls (such as
aggregation and access restrictions) to keep it that way.
The honest limits — we do not claim de-identification is absolute:
Microbiome and genomic-type data can be inherently identifying. Sequence
data derived from your sample may carry features that, combined with other
datasets, could in principle allow re-identification. No lab process removes
this risk entirely.
Re-identification risk rises as datasets are combined, as technology
advances, and as more information about you exists elsewhere.
We reduce — but cannot promise to eliminate — this risk. Our controls include
access restrictions, contractual bans on re-identification attempts by
recipients, and governance oversight (Section 6).
Because of this, agreeing to items that keep data linked or identifiable
(notably 4.1, and the physical sample in 4.4) carries more privacy exposure
than items that use coded or de-identified data. We flag this so your choice
is genuinely informed.
6. Governance
Research uses of your data and material are subject to internal review against
our data-governance and ethics policies before they proceed.
Where an external ethics or institutional review is appropriate for a given
study, we seek it.
Sharing under item 4.5 happens only under written agreements imposing
confidentiality, purpose limitation, security obligations, and a ban on
re-identification.
We keep records of what you consented to, when, and in what version of this
document, and of the studies your data has been used in, to the extent
reasonably practicable.
VAMS remains the sole entity responsible to you for these commitments;
we do not offload that responsibility to collaborators.
7. Revocation — you can change your mind at any time
You may withdraw any item, at any time, through your Research and Data
Preferences panel or by writing to privacy@vamsbiome.com. Withdrawing
one item does not affect the others, and does not affect your product or
service.
Withdrawal is as easy as giving consent, consistent with the DPDP Act.
Effect going forward: Once you withdraw, we stop the relevant future use,
stop new sharing, and — for item 4.4 — arrange disposal of any retained sample
that is not otherwise required to be kept.
The honest limit on withdrawal: Data or results that have already been
incorporated into completed research, published findings, trained models, or
irreversibly aggregated / de-identified datasets **may not be recallable
or removable.** We cannot un-publish a study, un-train a model, or extract your
contribution from a dataset that no longer identifies you. Withdrawal stops
future use; it cannot always reverse past use.
Withdrawal does not affect the lawfulness of processing carried out before you
withdrew.
8. Your rights under the DPDP Act
Regardless of what you decide here, you have the right to:
Access a summary of the personal data we process about you and how;
Correct, complete, update, or erase your personal data, subject to lawful
retention needs;
Withdraw consent (Section 7);
Nominate another individual to exercise your rights in the event of your
death or incapacity;
Grievance redressal — raise a concern with our Data Protection Officer /
privacy contact at privacy@vamsbiome.com, who will respond within the
timelines required by law; and
Complain to the Data Protection Board of India if you are not satisfied
with our response.
To exercise any of these, contact legal@vamsbiome.com or privacy@vamsbiome.com.
9. Governing law and disputes
This consent is governed by the laws of India, including Andhra Pradesh
(Laws of India, including applicable laws of the State of Andhra Pradesh). Nothing in this document limits your access to the
Data Protection Board of India, Consumer Commissions, statutory grievance
mechanisms, or other competent regulators Ministry of Corporate Affairs; Ministry of Electronics and Information Technology; Data Protection Board of India; Department of Consumer Affairs and Central Consumer Protection Authority; and, depending on the product or claim, CDSCO, FSSAI, relevant State authorities and other competent regulators.. Any liability
that cannot lawfully be excluded — including for fraud, wilful misconduct,
statutory consumer remedies, and personal-data-security obligations — is
preserved.
10. Contact
General / rights requests: legal@vamsbiome.com
Data Protection Officer / privacy: privacy@vamsbiome.com
Registered office: Plot No. 59, A-12-4-1, Near Matha Towers, K P Nagar, Benz Circle, Vijayawada, Andhra Pradesh 520008, India
Version and Change History
Document name: Research and Secondary-Use Consent
Version: 1.0
Effective date: 10 July 2026
Change history: v1.0 (10 July 2026) — Initial publication.