I signed up. $50 to be a guinea pig... Well it will get me to follow where you go, which I think is interesting. Ideally this would already be tested in a clinical trial, so you wouldn't need customers to pay to be your guinea pigs, but it's a low enough sum that I'm willing to do it for the entertainment and educational value to myself.

By the way, I was looking for an About page to see the team and couldn't find one (maybe I missed it). I found your link to LinkedIn and saw one of the founders went to the same college as me. That's cool, but I think you should have a "Team" page to give customers confidence. Unless none of you are medical researchers/biologists/doctors/etc. In that case it may actually detract... But surely you at least have some on your advisory board?

Good luck and I look forward to trying out the product. I assume part of this might be to eventually sell my microbiome's genetic data, which I'm okay with. You didn't mention on the website (at least I didn't see it) whether the kit also collects cheek cells and such to get my more generalized genetic data. If that's the case, I may just consider it a $50 loss and not participate.

Thank you for participating! Co-founder and CSO here. Thanks for the feedback regarding the website, we're in the process of updating the page to improve its layout.

We absolutely will not be selling your microbiome data without your consent, and it's something the team and I are quite adamant about. We also will NOT be selling or using any of your personal genetic data without consent. Any analysis and discovery will be on completely de-identified data, and will go toward our goal of improving health care.

Thank you for supporting us, and we hope that the insights we provide in the early access may be valuable to you!

> We absolutely will not be selling your microbiome data without your consent, and it's something the team and I are quite adamant about.

Are we relying on your word on this? I have had startups change their mind on me on these sorts of things in the past. I would want some sort of assurance that my data remains private even if you change your mind and wish to make it non-private.

What happens if the company goes bankrupt and someone else buys the IP including the data? Can they do whatever they want with the data? Without some enforceable legal restrictions here the data seems to be at risk.

We follow all HIPAA requirements and de-identify our data accordingly. That said, as a company we are committed to patient privacy and I’m interested in hearing about the experiences you’ve had in the past with companies changing their minds. If you’re open to it, email us at [email protected] and I’ll follow up with you to discuss!

Regarding the "about" page - our website is brand new and we're building out more information to coincide with announcements over the coming weeks. One of those is around our advisory board and another is relevant to your comment on clinical trials. Our team has backgrounds in genomics on both the research and commercial side! I worked at Illumina and ONT myself - other co-founders come from companies including Genentech, Twist, etc.

Is customer data protected by HIPAA?

Yes! We are 100% HIPAA compliant

You didn't answer the question asked, you answered a different question.

The question that was asked was if the customer data you collect is "protected by HIPAA," not if you choose to be "HIPAA compliment."

In other words - does the law (HIPAA) require you to handle customer data a certain way? Are you a "covered entity" under HIPAA?

I don't know much about your business, but I'm going to presume you are NOT a covered entry and HIPAA does NOT apply. I'm going to presume that because HIPAA is not a generic medical privacy law (even though people think it is), it applies to only "covered entities," which are - "Health Care Providers[1]", "Health Plans", and "Health Care Clearinghouses." You don't appear to be any of those, nobody claims to be providing any medical services, and you even provide a disclaimer that you are not providing medical services. - aka "just for funsies."

A useful rule of thumb is the "I" in HIPAA stands for insurance - if insurance is NOT involved HIPAA probably doesn't apply.

So I think your statement "Yes, we are 100% HIPAA compliment" was intentionally misleading.

[1] but only if they transmit information electronically in connection with a transaction for which HHS has adopted a standard

Hi Astura, apologies for the delay. To answer your question: no, we are not a covered entity - but we still maintain HIPAA compliant protocols with your data:

We follow all HIPAA compliant protocols in handling your data. We have additionally taken a number of security precautions beyond HIPAA compliance that mitigate the possibility of a data breach.

I appreciate you bringing this up as it is an important distinction and a good opportunity to clarify. We are not a covered entity under HIPAA as we are not (1) a health plan, (2) a health care clearinghouse, or (3) a health care provider. The laws surrounding HIPAA were enacted before genomics and consumer health became prevalent. This means that most of the companies in our space (23&me, Ancestry, Everlywell, etc.) are also not covered entities but are working with PHI (protected health information).

Covered entities are required to be HIPAA compliant to maintain the integrity of your PHI, and you can read more about those requirements here: https://www.atlantic.net/hipaa-compliant-hosting/hipaa-compl...

While Bristle is not a covered entity, we can be HIPAA compliant by enforcing the same guidelines around your PHI as are used for covered entities. This is an optional, but in our opinion critical and non-negotiable, component of our infrastructure to maintain user privacy.

> While Bristle is not a covered entity, we can be HIPAA compliant by enforcing the same guidelines around your PHI as are used for covered entities.

People respect HIPAA because sanctions for a HIPAA violation are very severe. In your case, if you have a violation, what would happen?

Absolutely positively nothing, their so-called "compliance" is strictly voluntary. That's why I'm calling them out on claiming that they are "HIPAA compliant."

If they were upfront I wouldn't give two fucks, I truly don't care. Like, I really really don't care. It's that they tried to lie is why I am called them out. They were caught with their pants down. I wouldn't be a thorn in their side if they were honest.

Did they have a choice to become a HIPAA covered entity and decided not to do it? Or that was never a choice?

The problem here is that the HIPAA legislation is outdated. Another problem is that there's almost no regulation around selling data.

My true question is: what's the business model here?

a) offering this testing service (which to be honest, sounds pretty interesting and useful)

b) selling the data of unsuspecting customers ("the 23andme model")

Sure, they could provide medical services and interface with health insurance companies, then they'd be a covered entity under HIPAA. They could employ medical staff to prescribe tests and provide test results to patients, then they'd be a covered entity under HIPAA.

I don't believe HIPAA is outdated, I believe that people just very much misunderstand it. The full title is "Health Insurance Portability and Accountability Act" - it's literally a bill to regulate health insurance companies, it was never meant to be more.

Congress could pass a general medical privacy bill tomorrow, yet they appear to be extremely uninterested in doing so, so they don't.

Their business model is probably just offering this testing service at the moment, but their weasely response when asked if their data was covered by HIPAA makes me think that they are keeping selling data on the back burner as an emergency option.

>we are not a covered entity under HIPAA

So why lie and say you are when directly asked? You could have just replied with this exact post when asked, instead you chose to blatantly lie. Why?

Did you just think nobody would notice and you'd just get away with it?

When people ask "Is customer data protected by HIPAA?" They don't mean "do you choose to follow HIPPA protocols [at the moment] with customer data?," They mean "Is customer data protected by HIPAA?" They want to know what you can legally do with their medical data, no what you currently choose to do with it. But you know that, you are playing stupid and are caught with your pants down.

We all know your competition also isn't a covered entity under HIPPA - so just admit you aren't either, don't be slimy and mealy-mouthed about it.

I’m sorry you feel that we were misleading you - that is not our intention. As I stated in my previous response: we are not a HIPAA covered entity but maintain HIPAA compliant protocols. We plan to include our data protection protocols on our site to make this information available and transparent for visitors and users. I appreciate you bringing this up!

Unless the question was answered in the first sentence ('Yes!' being one of the few single word sentences possible in English). In this perspective, the second sentence gives extra information instead of 'intentionally misleading'.

Then they need to provide additional information as to why they are considered a "covered entity" under HIPAA, because it is NOT obvious from their website why HIPPA would apply and the answer I was replying to appeared to be very mealy-mouthed based on the information given.

If they have additional information they'd like to share, I'd very much like to hear it.

HIPAA applies to any circumstance around handling PHI. We handle your self-reported survey data, and microbiome data as PHI. We do NOT have to be a "covered entity" to apply HIPAA compliant protocols to our data handling. It's an additional security measure we take in handling your PHI.

>HIPAA applies to any circumstance around handling PHI.

HIPAA does not apply at all as you are not a covered entity under HIPAA, stop lying.

>We do NOT have to be a "covered entity" to apply HIPAA compliant protocols to our data handling

Yeah, but that's just your current choice. You (more or less) claimed you were obligated to abide by HIPAA, but that's a lie, you are not.

I know you though nobody would call you out on this, but I am, because I understand the law. Please be upfront when asked, and stop lying.

I'm looking forward to replies from dannygrannick and david_l_lin if they are a "covered entity" under HIPAA, because that was the question asked, and hasn't been answered yet.

We self-impose HIPAA complaint protocols despite not being a covered entity. The answer to the question: "Is customer data protected by HIPAA?" is essentially the same.

1. Any data that can be considered PHI (survey data, medical data, genetic data) is stored under HIPAA complaint guidelines. 2. Yes, we are HIPAA complaint.

And it's likely never going to be answered.

You can find our response above. Thank you for your patience, and for the engaging discussion!

There is no country field and no mention of country limitations. Can I signup from Australian?

Apologies for the lack of clarity! I can’t make any immediate guarantees around sending our kit to Australia. However, we do not collect payment until after we ship the kit, so please sign up on our early access page to hold a spot in line. If/when we reach critical mass we may be able to onboard customers from Australia.

Is there a need to account for circadian rhythms in sampling, do you ask your customers to swab at noon or before bed, or do you just include this info in model training/prediction?

At the moment, we don't account for circadian rhythms. As we explore some of the insights to the oral microbiome, that's definitely one of the avenues we'd love to dig into. We do ask customers to fill out a relatively detailed health survey, so that we can explore associations between the oral microbiome in health and disease.

> We do ask customers to fill out a relatively detailed health survey, so that we can explore associations between the oral microbiome in health and disease.

So, you're learning from customers these associations, and after a significant number of customers you could offer statistical associations to future customers?

David put it nicely (and more succinctly) in another reply: "In short, there is a network effect with our platform. Each sample we sequence contributes to a database of novel bacteria, viruses, and fungi that we can use to discover new microbes." I would just add that discoveries also apply to new associations that we can include in future reports.

A little bit of both actually - as our user base grows we create a network effect that will spur new statistical associations. We can apply those new findings to new and existing users by updating their report accordingly.

You can imagine that even if you took the test once and had (for the sake of simplicity) 1 insight being reported back, you could revisit your profile in 2 years when we have tested 10,000 users and may have 4 new insights that have been added to your report as a result of the new discoveries we've made!

TLDR; there are associations reported now, and new ones that will be reported as we grow our user base and data

I see the ANALYSIS you provide does not use my DNA but I'm unclear- are you collecting my DNA? Are you saving it or storing it, in any form, in either physical or digital form? What assurances do I have that any of the labs or other partners you use won't do this either?

Bristle CSO here. To elaborate on Esyir's reply, through saliva collection, we inevitably will have your DNA in the sample. However, our analysis selectively removes host DNA from the sample, enabling targeted sequencing of the oral microbiome. During the processing of the sample, we may capture some signal from the host genome. Our sequencing, however, captures such a low level of the host genome that we cannot derive any meaningful signal from host genetic data, and actually selectively remove that signal from the analysis to enrich for microbial signals.

We keep your saliva sample and its molecular derivatives in physical form completely DEIDENTIFIED such that it cannot be mapped back to YOU without an encrypted key.

TLDR, we do NOT use host genetic data, but cannot guarantee that none of that data will be stored somewhere in this analysis. We do not share any identifiable data with anyone. We do not analyze host genetic data.

Who has the encrypted key?

The statement is meaningless if you have the key.

We maintain the key and will never share it without your consent. The key is critical to reporting microbiome data back to the correct person. Additionally, maintaining these identifiers will be crucial when we plan to add additional health features to our platform such as dental consults, tracking the outcomes of therapeutic/preventative interventions, and improvement tracking.

Of course, there are a few tricky circumstances around the future of the data. What happens if we go bankrupt/sell the company? I can't say for sure what will happen, but I am fully committed to the destruction of the key at any point when we realize that the identifiers do not serve a purpose.

but sharing the key would be sharing (access to) the DNA

Could we have an option of not storing biological materials after processing?

Assuming you don't store (notable) digital host data, it seems much safer, in case policy / ownership were to change, a breach happened and/or someone was compelled to produce samples/data.

Absolutely, you may request that your physical sample be destroyed after receiving your results. At present, we biobank samples in the event that the sample needs to be re-run.

Please send us an email at [email protected] and we can ensure your physical sample is destroyed post-sequencing.

Will you be using samples to identify NEW microbiome bacteria? Or are you only identifying KNOWN bacteria?

This is a great question! In short, there is a network effect with our platform. Each sample we sequence contributes to a database of novel bacteria, viruses, and fungi that we can use to discover new microbes.

Thanks to y'all for the elaboration

I know it is not good HN policy to doubt your intentions but by emphasizing the NOT's, DEIDENTIFIED and YOU, you make me highly suspicious. Anonymization of data is difficult at best and sometimes nearly impossible so I would advise to publish the entire protocol if you want to give people assurances. The encryption key, as already stated, is pointless without an explanation how you use it and why it is employed and is otherwise just smoke and mirrors and no real security.

I completely understand your hesitation around the anonymization of data, and will have more detail around how your data will be anonymizes and used on our website shortly.

There's no way to get the oral/gun microbiome using shotgun sequencing without also picking up human data along the way. The raw sequence files will contain reads mapping to the human genome, but those are often filtered out in subsequent steps of the data processing.

From another reply -

  We also will NOT be selling or using any of your personal genetic data without consent.

"Genetic data" seems to imply that they do look up your DNA too.

Genetic data is €€€.

See Esyir's response. In short, we do NOT look up your DNA, and only look into microbial DNA. In fact, we do a host depletion step to enrich for microbial DNA prior to sequencing, then a following host depletion step prior to microbial mapping. Sequencing will inevitably pick up some signal from the host genome, but at such low levels, we cannot derive meaningful signal from the host DNA.

TLDR, we do NOT use host genetic data, but cannot guarantee that none of that data will be stored somewhere in this analysis

Is this testing service HIPAA compliant? Will you sell my data like 23andme does?

Yes and no!

Why the focus on oral? Ubiome had a great product that worked on fecal sample to determine what bacteria's are present in the intestines.

Do you see your company expanding into that area?

Our core technology is based around the oral microbiome for a number of key reasons.

1. decades of research have shown causal relationships between the oral microbiome and preventable gum disease. 2. the oral microbiome is much lower in diversity than the fecal microbiome, granting the opportunity for the development of relatively low-cost diagnostics that leverage the microbiome. 3. new and exciting studies have shown correlations between the oral microbiome and a number of systemic health indications, which we hope to continue to uncover with our platform.

If you’re interested in learning more, please drop your email at the bottom of our home page at bristlehealth.com to receive our newsletter!

Beautifully said! Also feel free to reach out to [email protected] with any specific questions - we’ll get back to you.

Classic startup idea validation one-pager. I'm sure you'll get at least a few people signing up, but I don't think this is a good measure if people are really interested. Final price, look of the product, and the ability to market b2c matter much more.

23's success is more based on the execution of their product and marketing. They already have proven for you, there are customers in this space. Now you just need to build something great.

Thanks! We're continuing to develop and iterate the final product, and we hope that this program will provide some early user feedback. Current and new users will have their reports updated as we make changes and add new features.

US only or will you ship to other places too (in Canada myself)?

Hi everyone - looking into shipping capabilities. CA should be doable but will have to look into Europe further and will follow up tomorrow! We really appreciate the widespread interest!

I'm 90% sure we can do CAN. Sign up for early access through our website: bristlehealth.com, and we'll reach out when your kit is ready!

What about Europe?

I can’t make any immediate guarantees around sending our kit to Europe. However, we do not collect payment until after we ship the kit, so please sign up on our early access page to hold a spot in line. If/when we reach critical mass we may be able to onboard customers in Europe.

Ditto to David and we expect to have info on this in the next few days

Nothing about the mouth biome on HN, ever... and then a day before your launch, this article appears?

I feel like I'm being played.

If only we were that clever

1573 results: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

The Economist is always published on Saturday, and is regularly linked on HN.

I think more likely they timed their launch to coincide with the Economist article and then someone unrelated just happened to link the article just before their intended date.

Would love to say we thought this far ahead but this was a total coincidence through a text from a friend who is avid on HN