Where the data is, who can read it, and what we do not claim.
LYNNAGEN is two things: a web workspace, hosted in the cloud, and an analysis workstation in the laboratory. This page says plainly what each holds, how access is controlled, and what remains your responsibility.
Two parts, one service
The web workspace is where you sign in, start a case, follow it, and read the worklist, the variant dossier and the clinical report. It runs as a web application on Vercel, and its data lives in a Supabase project in the European Union (Frankfurt region): the database, the uploaded callsets, and the published results.
The analysis workstation is a laboratory machine that runs the interpretation itself: alignment and variant calling where needed, annotation, the evidence sources, phenotype fit. It takes a queued case from the workspace, downloads its callset, interprets it, and publishes the results back. The complete durable record of a case stays on the workstation.
The public site you are reading is served by the same web application, on the same domain, but it holds no clinical data. The only thing it stores is what you type into the demo-request form.
What is stored where
For a case started in the browser: the callset you upload is written to a private storage bucket, read once by the workstation, and removed as soon as the case is interpreted. For every case: the worklist rows, the variant records, the case summary — which includes the clinical history you typed — and the condition views are stored in the project so that the workspace can show them. Sequencing reads (FASTQ, BAM, CRAM) are never uploaded; they are handled on the workstation only.
Who can read what
Everyone signs in with an e-mail address and a password, or a code sent by e-mail; two-step sign-in with an authenticator app can be turned on by anyone for their own account, and once it is on, a sign-in without the code reads nothing. Cases belong to a workspace, and a person reads only the workspaces they are a member of: the database enforces this by row-level security on every query, and the web application reads the database as a role that cannot bypass it. The service key that can bypass it exists only on the workstation. Every case opened, report built, case submitted or cancelled in the workspace is written to an access log.
Your data, returned or erased
At the end of a service, or on request, a workspace's data can be exported in full and then erased from the cloud. Nothing of a customer's workspace is used for anything but that customer's own review.
Clinical review remains explicit
LYNNAGEN keeps variant pathogenicity, patient relevance, technical quality, evidence provenance and professional review distinct and inspectable. It supports clinical interpretation; it does not diagnose patients, and the final interpretation remains with the qualified clinician or laboratory reviewer.
What remains your responsibility
Genomic results are special-category health data. Whether your jurisdiction, your institution and your patients' consent allow them to be processed in a cloud workspace is a decision for you, together with the data-processing agreements of the providers involved. The security of a deployment also depends on your own access controls, devices and procedures: who holds an account, whether two-step sign-in is used, and how the workstation is kept.
What we do not claim
LYNNAGEN does not claim certifications, regulatory approvals or compliance statuses that have not been formally established. Security concerns can be reported to info@lynnagen.com.