Built on regulated infrastructure

CLIA-certified, CAP-accredited lab partner

Every order placed on HelixDX is processed by our exclusive lab partner — CLIA-certified, CAP-accredited, and licensed to accept samples from all 50 US states, including New York's additional licensing requirements. Lab partner identity is disclosed to approved merchants under NDA.

• CLIA + CAP accreditation, audited annually
• Turnaround time SLA: 3–5 business days from sample receipt
• Redundant courier and lab capacity for peak demand

Nationwide physician order network

Lab testing requires physician authorization in most states. HelixDX provides a turnkey 50-state physician network through our telehealth partner. Every test order is reviewed and authorized by a licensed physician in the patient's state — at no additional cost to you or your customer.

HIPAA-compliant infrastructure

All PHI is stored in HIPAA-compliant infrastructure with encryption at rest (AES-256) and in transit (TLS 1.3). HelixDX operates as a Business Associate of every merchant, with a signed BAA covering data handling, breach notification, and access controls.

• AES-256 at rest, TLS 1.3 in transit
• Signed Business Associate Agreement on every merchant account
• Role-based access controls with full audit logging

Operated by Aspire Payments

Payments run under Aspire Payments LLC, a registered payment processor with relationships with Paysafe and Worldpay. Every order is processed under healthcare-appropriate merchant category coding. Aspire is the merchant of record — HelixDX absorbs the operational complexity of payments, including fraud prevention, chargebacks, and PCI compliance.

You own your customer data

Customer data captured on your storefront is yours. You can export it at any time. HelixDX is contractually prohibited from marketing to your customers or sharing data with other merchants. Customers grant data access to you (the merchant) at checkout, with explicit consent.

Marketing review on every listing

Every kit listing and storefront copy is reviewed by our compliance team before launch — and randomly audited after. Marketing claims that cross the FDA line ('diagnose,' 'treat,' 'cure') are flagged before they ever reach customers. This protects you, your customers, and our shared infrastructure.

Annual independent audit

HelixDX undergoes annual SOC 2 Type II audit, HIPAA risk assessment, and PCI DSS review. Audit summary reports are available to Pro and Enterprise merchants under NDA.

• SOC 2 Type II — annual
• HIPAA risk assessment — annual
• PCI DSS — continuous attestation via Aspire