At Color, privacy and trust are core values.
When you take a Color COVID-19 test, we know you are trusting us with your health data. That’s a responsibility we take seriously. It’s why we want to be clear and transparent about how we use your test samples and health data.
COVID-19 samples are only for COVID-19 testing.
Color does not analyze your genome or any of your DNA.
Color does not perform testing of any kind without explicit patient consent. We maintain a strict separation between our COVID-19 testing and our clinical genetic testing. We do not and will not run any genetic testing or sequencing on any human DNA from SARS-CoV-2 samples, either at the time of testing or after. Our SARS-CoV-2 testing is physically and functionally distinct from our clinical genetics lab. They are separate facilities with entirely different protocols and procedures.
We do not rent, sell, monetize, or otherwise use any patient data.
Color treats samples, data, and information as Protected Health Information.
Given the legacy of misuse of genetic information — particularly within communities of color — Color has always been very clear about data, information, and samples. We treat these as Protected Health Information (PHI), which must be safeguarded under the Health Insurance Portability and Accountability Act (HIPAA). As a HIPAA covered entity, Color follows all HIPAA privacy and security rules for safeguarding PHI.
Health data (including your personal information, the fact that you took a test, the test results, and the samples themselves) is all protected. Protected means: secure, private, never sold. Health data is only shared with the explicit permission of the patient.
We do not retain any COVID-19 samples.
Color destroys all COVID-19 samples seven days after results are released.
We do not retain any COVID-19 samples long-term. Color retains COVID-19 samples for seven days in order to allow time for a “re-run,” in case the first attempt at generating a result is not successful, and for quality assurance and improvement reasons, like internal validation of our COVID-19 assay. This second use case only uses de-identified samples, so no personal information is used. This is consistent with the federal Common Rule on ethical research, and is described in your consent and our COVID-19 terms of service.
We are required to retain lab data.
Color keeps COVID-19 lab data and reports for at least two years.
Color’s labs are regulated by Clinical Laboratory Improvement Amendments (CLIA), a set of federal standards overseen by the FDA, CDC, and Centers for Medicare and Medicaid Services (CMS), and accredited by the College of American Pathologists (CAP). We are required by CAP accreditation standards to retain COVID-19 lab data for at least two years. All CAP-accredited labs have this requirement.
We send identified data to public health reporting agencies.
Color is required by law to provide test results to public health agencies.
Because infectious diseases present an urgent challenge for the public health of a community, all clinical testing labs are legally required to provide test results to public health agencies. This supports contact tracing and outbreak mitigation efforts.
Color reports testing information to relevant state agencies and such other authorities as required by applicable law. For example, Congress mandates that “every laboratory that performs or analyzes a test that is intended to detect SARS-CoV-2 or to diagnose a possible case of COVID-19” report the results from each such test to the Department of Health and Human Services (HHS).
Color’s COVID-19 test does not amplify, detect, or analyze human DNA.
Our tests only amplify viral RNA and a human RNA control.
Color’s COVID-19 test amplifies viral genetic material, allowing it to detect small amounts of the SARS-CoV-2 RNA. It does not analyze human DNA.
The test does include a probe that detects the presence of the human RNaseP RNA transcript, a necessary control that indicates that the sample was collected correctly. It is not specific to any individual and cannot be used to identify any particular individual. Assays that lack this control have a substantially higher false negative rate.