REQUEST SYSTEM SUPPLEMENTAL PRIVACY NOTICE

Othram, Inc., a Delaware corporation (“our,” “us”, or “we”), provides certain services through our Request System site, available at request.othram.com (the “Request System”). This Request System Supplemental Privacy Notice (this “Request System Supplemental Notice”) supplements, but does not replace, our Global Privacy Notice (the “Global Notice”) and describes the privacy practices governing your agency’s (the “Agency”) use of, and access to, the Request System. In the event of any conflict or ambiguity between this Request System Supplemental Notice and the Global Notice, this Request System Supplemental Notice shall control. All capitalized terms used but not defined in this Request System Supplemental Terms have the definitions given to such terms in, as applicable, (1) the Global Notice or (2) the Request System Supplemental Terms of Use.

1. Definitions.
1. “Case“ means a discreet case or project for a particular law enforcement investigation assigned by the Agency, and accepted by us, through the Request System. For clarity, a Case will never include a consumer-based investigation or any non-law enforcement investigation initiated or requested by a consumer.
2. “De-Identified Information“ means aggregated, de-identified, or anonymized data (without regard to the type or source of such data) that cannot be used to identify a particular individual and which is derived from, or relates to, Personal Information.
3. “DNA Profile Deliverable“ means the SNP profile delivered by us to the Agency and derived from a Submission.
4. “FBI QAS“ means the then-current Quality Assurance Standards for Forensic DNA Testing Laboratories adopted by the U.S. Federal Bureau of Investigation.
5. “Privacy Law“ means, with respect to a Case, any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree, requirement, or rule of law of any governmental authority applicable to Protected Information in such Case.
6. “Protected Information“ means, in connection with our providing a Request System Service, (i) information and materials received by us from the Agency, including Personal Information, and (ii) information and materials generated by us in connection with such service, including DNA Profile Deliverables and Work Product. Protected Information does not include information or materials that are publicly available through no fault of ours.
7. “Public“ means, with respect to a Case, the first time at which there is a public release or a public disclosure of such Case, whether by the Agency or someone else acting in concert with, or at the direction of, the Agency.
8. “Request System Service“ means a service provided by us to the Agency through the Request System.
9. “Submission“ means any item (of any kind) the Agency submits to us through the Request System, including submitted evidence and submitted extracts.
10. “Submission Service“ means a Request System Service directly involving a Submission.
11. “Technical Details“ means technical details highlighting or educating as to our capabilities.
12. “Work Product“ means the material that is generated as a function of analysis by us which is not subject to a chain of custody.
2. Uses. We shall use Protected Information in compliance with all applicable Privacy Laws and for the purpose of providing Request System Services to the Agency. In addition, if we and the Agency have separately agreed in writing to other privacy practices, then such other privacy practices shall apply to this Request System Supplemental Notice, and the order of precedence of this Request System Supplemental Notice and such other privacy practices shall be as described in such other written agreement. We are permitted to, and may, create De-Identified Information from Protected Information. We are permitted to, and may, to the extent not prohibited by law, use the De-Identified Information or share, sell, or transfer the De-Identified Information with or to third parties. Such uses may include (i) research and development, (ii) performance testing, and (iii) product development, including analyzing, building, and improving the Request System Services. For clarity, De-Identified Information shall not include DNA Profile Deliverables. The Agency shall have no right, title, or interest in or to the De-Identified Information and shall have no right to use or possess the De-Identified Information.
3. Controls. We shall maintain adequate privacy and security controls with respect to the Protected Information. We shall ensure that access, use, storage, processing, and protection of Protected Information is in accordance with applicable Privacy Laws.
4. Obligations.
1. Employees Only. We shall provide all Submission Services to the Agency using our employees only. We shall not provide any Submission Service to the Agency using any independent contractor without the Agency’s permission or approval.
2. Submissions. A Submission received by us at our facility from the Agency shall not leave our facility without the Agency’s permission or approval, including in the circumstances identified in Section 7.. We meet the FBI QAS applicable to (i) Submissions and (ii) Work Product.
3. Announcements. We shall not announce our involvement in or with a Case until the Case becomes Public (if ever). At the time a Case becomes Public (if ever), unless other arrangements are made between us and the Agency, we reserve the right to announce (including publicly) from time-to-time our involvement with a case. As part of any such announcement, we may disclose Technical Details regarding the Case. Examples of Technical Details include (i) quantity of DNA used, tested, or made available, (ii) degradation of materials, and (iii) proportions of mixtures.
4. Confidentiality. All our employees are subject to confidentiality restrictions that provide at least the same level of protection for Protected Information as those in this Request System Supplemental Notice.
5. Access. We shall ensure access to Protected Information is limited to our employees who are performing a Request System Service for the Agency and only for so long as necessary to perform such Request System Service. We shall maintain a disciplinary process to address any unauthorized access, use, or disclosure of Protected Information by our personnel. In the event of unauthorized access, use, or disclosure by our personnel of Protected Information relative to the Agency, we shall promptly notify the Agency after discovery of such unauthorized access, use, or disclosure. We have or shall enter into a written agreement or obtain written obligations with each our personnel member containing data protection obligations that provide at least the same level of protection for Protected Information as those in this Request System Supplemental Notice.
6. Safeguards. We have or shall implement safeguards of Protected Information providing for the following: (i) electronically tracking access to our facility, (ii) limiting physical and remote access to our facilities and data, and (iii) implementing network security, including protection against anticipated threats or hazards. In the event of unauthorized access by a third party of Protected Information, we shall promptly notify the Agency after discovery of such unauthorized access or disclosure.
5. Third-Party Communications. It is expected that all third-party communications regarding a Case shall be coordinated and made by the Agency. If asked by the Agency, we shall participate in third-party communications regarding a Case for the Agency, but, unless otherwise agreed to by us and the Agency, it is expected that an Agency representative shall participate with us in each such third-party communication.
6. DNA Profile Deliverables.
1. Searches. We use DNA Profile Deliverables generated from a Submission to search against third-party genealogical databases. We will attempt to cause such third-party genealogical databases to limit and restrict access to, and maintain the confidentiality of, any such DNA Profile Deliverable so-used.
2. No Returns. Unless a Request System Service provides for the return of a DNA Profile Deliverable or other arrangements are made between us and the Agency, we do not return any DNA Profile Deliverable to the Agency.
3. No Sale. We shall not sell any DNA Profile Deliverable, and we shall not sell access to any DNA Profile Deliverable.
4. Collection. We may collect information from DNA Profile Deliverables to establish genetic identity in the context of a Case, and we shall use such genetic identity from a DNA Profile Deliverable solely in the context of such Case. We will endeavor to avoid collecting or disseminating any DNA Profile Deliverable from which medically relevant information may be derived
7. Submissions Retention. We do not retain any Submission indefinitely. The Agency agrees to facilitate the return of each Submission at the conclusion of each Case.
8. Changes. We may change this Request System Supplemental Notice from time to time, so please be sure to check back periodically. We will post any changes to this Request System Supplemental Notice on othram.com/request. Unless otherwise indicated, any changes to this Request System Supplemental Notice will apply immediately upon posting to our Sites. You are responsible for periodically visiting our Sites and this Request System Supplemental Notice to check for any changes.