Privacy Policy

1. Who we are

The Pinnacle Allergy Patient Portal (mypinnacleallergy.online) and online store (shop.pinnacleallergy.com) are operated by IQV Nexus Corporation ("we," "us," "our"), 3379 Peachtree Road NE, Suite 655, Atlanta, GA 30326. Testing is performed by DLS Research & Ventures, a CLIA-certified laboratory. Customers use the store to order tests, and the portal to complete health questionnaires, sign consents, track test kits and view reports.

2. Your health information and HIPAA

Health information connected to your test is protected health information under the Health Insurance Portability and Accountability Act (HIPAA). How it is used and shared, and your rights over it, are described in the Notice of Privacy Practices at mypinnacleallergy.online/privacy-notice, which is part of this policy. If this policy and the Notice ever differ about your health information, the Notice controls.

3. Information we collect

• Order and contact details: name, date of birth, sex, shipping and billing address, email address and phone number.
• Payment details. Card payments are handled by our payment providers; we do not store your full card number.
• Health information: tests ordered, intake questionnaire answers, symptoms and history you choose to share, sample collection details and test results.
• Signatures, consents and choices you give, including your research choice, with the date and time.
• Shipping and tracking details for test kits sent to you and returned to the laboratory.
• The licensed provider who reviews and orders your test.
• Security and usage information: sign-in times, actions in the portal, IP address, browser and device type.
• Store browsing information collected through cookies and tracking tools, if you allow them (see section 9).

4. How we use it

• To process your order and payment. Customers pay directly; we do not bill health plans or insurance.
• To have a licensed provider review and order your test, to perform it, and to report results to you and that provider.
• To collect the questionnaire answers, signatures and consents your test requires.
• To ship and track your test kit.
• To send messages about your order, such as reminders to finish your questionnaire, sign a consent or return your kit.
• For research, unless you opt out, as described in section 7.
• To protect your account, keep an audit trail, and meet laboratory, medical record and legal requirements.

We do not sell your information. We do not use your health information for marketing without your written authorization. Signing up for promotional emails from our store is a separate choice you can turn off at any time.

5. How we share it

• With the licensed provider who reviews and orders your test, and with DLS Research & Ventures, the laboratory performing it.
• With service providers that host the portal, ship kits and deliver messages, under written agreements, including Business Associate Agreements where HIPAA requires.
• With our online store and payment providers, which receive only the order, contact and payment details needed to complete your purchase. The store does not receive your questionnaire answers, consents, sample details or test results; those are collected only in the patient portal.
• With a parent or legal guardian for a minor's record, as described in section 8.
• When required by law, including public health reporting, or as otherwise allowed under HIPAA and described in the Notice of Privacy Practices.

6. Email and text messages

We send order-related messages by email, and by text only if you agree to receive texts. Texts never include your results or test details; they ask you to sign in to the portal. Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to opt out of texts at any time.

7. Research

Unless you opt out, your samples and related information may be used for research. You are offered the choice to opt out when your order is created and again when you sign your order. You can change your choice at any time by emailing cybersecurity001@clinlgx.xyz. Opting out does not affect your testing.

8. Minors

We test patients of all ages, including newborns. Tests for anyone under 18 must be ordered by a parent or legal guardian, who manages that patient's portal record and may see their information as state law allows.

9. Cookies and tracking

The patient portal does not use cookies to advertise to you, and it does not use cookies to track you across other websites.

• Keeping you signed in. When you sign in, the portal stores a secure sign-in token in your browser's local storage so you can move between pages without signing in again. It is never used to follow you to other sites, and it is cleared when you sign out, when the browser is closed, or after 15 minutes of inactivity, and in every case within 8 hours. Always sign out when using a shared device.
• Security. Our bot-protection service on the sign-in screen (Cloudflare Turnstile) may set a short-lived cookie that confirms you are a real person and not an automated attack. It is used only for that purpose.
• What we do not use. The portal sets no advertising cookies, no cross-site tracking cookies and no analytics profiling of your activity.
• Your test information. Your questionnaire answers, consents, sample details and test results are never placed in cookies or tracking tools.
• Our online store. The separate online store (shop.pinnacleallergy.com) uses cookies and tracking tools, for example to run the shopping cart and understand how visitors use the store. The store asks for your permission before using them. Tracking information is not stored for more than 90 days and is not shared with any third parties.
• Your choices. You can review, block or delete cookies and site data at any time in your browser settings. Blocking our security cookie may prevent you from signing in.

10. Security

Every sign-in to the patient portal requires a one-time code sent to your email address (multi-factor authentication), every time. We also protect your information with encryption in transit and at rest, role-based access controls and audit logging. If a breach affects your information, we will notify you as HIPAA and state law require.

11. Retention

We keep order, test and related records indefinitely, and in every case for at least as long as laboratory, medical record, tax and legal rules require. Tracking information is the exception and is kept for no more than 90 days.

12. Your rights

Under HIPAA you may ask to see and get a copy of your health information, ask us to correct it, ask for a list of certain disclosures, ask us to limit some uses, and ask us to contact you in a certain way. The Notice of Privacy Practices explains how. You may also file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint. Residents of some states may have added privacy rights under their state law.

13. Changes to this policy

We will post any changes on this page with a new effective date and notify you of material changes by email or in the portal.

14. Contact us