Geneus DNA Privacy Policy

Geneus DNA LLC (“Geneus” or “we”) provides the GeneusDNA website, mobile applications, DNA test kits and Reports (the “Services”). We are a limited liability company organized under the laws of Wyoming, United States. Our contact address is 10 W Broadway, Salt Lake City, Utah 84101, United States. “Account”, “Kit”, “Sample”, “Genetic Data”, “Report”, “Research” and “Consent Document” have the meanings given in our Terms of Service.

Geneus DNA LLC is the data controller for the personal information it uses to provide and manage its own Services. This means we decide why and how that information is processed. If we act only on another controller’s behalf, we process information on its documented instructions. Section 6 explains the roles of payment agents, service providers and retailers.

This policy describes how Geneus handles information under its control. It does not transfer an earlier order, Sample or information held by another controller, or change the scope of a consent already given. If we propose a change of controller or a new use of existing information, we will explain the change and obtain any required separate consent before it takes place.

We comply with the data protection laws that apply to the processing in question. Depending on the circumstances, these may include U.S. state and federal laws, the EU General Data Protection Regulation (“GDPR”), the UK GDPR, Thailand’s Personal Data Protection Act (“PDPA”) and other applicable laws. Each law determines its own scope. Your location, the Services offered to you and where and how your information is processed may all matter.

• Account and contact information. This includes your name, email address, phone number, shipping address, date of birth and sex. We may request reasonable evidence of age, identity or authority when someone acts for another person or asks to exercise a privacy right. We also keep a record of consent choices and withdrawals.
• Sample and Genetic Data. We receive the Sample submitted for testing. Our laboratory returns Genetic Data linked to the kit ID, including raw data and individual results used in Reports. If an authorized person arranges a test for someone else, we may receive the information needed for that test from that person.
• Information you choose to provide. This includes optional answers to health or lifestyle questionnaires, survey responses, messages to Customer Care, and reviews or other content you submit. Some answers may reveal sensitive information such as health conditions or ethnic origin.
• Orders and payments. We receive details of products purchased, billing information, payment confirmations and refund transactions, as applicable. Payment service providers handle card details. We do not store full card numbers. Payment agents, shipping providers and authorized retailers may give us information needed to fulfill or support an order.
• Devices and use of the Services. We collect information such as IP address, browser type, pages viewed and interactions with the Services through cookies and similar technologies. Section 12 explains your choices.

Where applicable law requires a legal basis, we rely on the basis appropriate to each purpose below. Where we rely on legitimate interests, we weigh those interests against your rights and freedoms. Sensitive information is also subject to Section 5.

• Providing the Services. We use information to take orders, ship and register Kits, analyze Samples, deliver Reports and respond to support requests. We rely on performance of our contract with you where applicable. We obtain explicit consent before processing your Sample and for the Genetic Data or health information needed for the test. If you do not provide information or consent needed for a requested Service, we may be unable to provide it.
• Payments and records. We process payments, refunds and invoices to fulfill the contract and keep records required by tax and accounting laws.
• Content and reviews. We use private Customer Care messages only to provide or improve support or as required by law. Under our contract, we display a review as you choose to post it. We may use its non-personal public elements to promote the Services as described in the Terms of Service. We obtain separate permission before using your name, likeness or other personal information in a promotion and rely on consent where required.
• Security and verification. We verify identity and authority where needed, keep the Services secure, prevent fraud and resolve technical problems. We rely on our legitimate interests in providing a safe and reliable service or on a legal obligation where one applies.
• Product improvement and development. We use de-identified or aggregated information where possible. A kit ID or another code can still allow data to be linked to a person. If the information remains personal, we rely on our legitimate interests only where permitted. We obtain explicit consent for using Genetic Data or health information that can identify a person, including through a code, for product improvement or development.
• Research. Geneus or its research partners use your information for Research only if you give separate, explicit consent for the Research described in the Consent Document. Consent to testing or product improvement does not authorize Research.
• Marketing. We may send offers or news about our products with your consent or, where the law permits, on the basis of our legitimate interests, subject to your choices. You may opt out at any time. We use Genetic Data for marketing only with separate, explicit consent. Service messages about an order or a Report are part of providing the requested Service.
• Legal obligations and claims. We may process information when needed to comply with a legal obligation or to establish, exercise or defend a legal claim. For legal claims, we rely on our legitimate interests where permitted. For Genetic Data or health information, we also require a specific ground under applicable law and observe the disclosure limits in Section 5.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

We treat Genetic Data and health information as sensitive. We obtain explicit consent before collecting, using or disclosing that information for the Services. Acknowledging this policy, accepting the Terms of Service or purchasing a Kit does not give that consent. Testing begins only after Kit registration and the required consents. The person tested gives consent or, where permitted by law, a parent, guardian or other legally authorized person acts on their behalf. We also obtain the minor’s own consent where required. Purchasing a Kit for another person does not entitle the purchaser to see that person’s Report.

• Separate choices. We obtain separate, explicit consent to use Genetic Data for Research or marketing, to keep a Sample after analysis, or to disclose Genetic Data to a recipient other than a service provider or affiliate acting on our behalf, unless the disclosure is required by law. Declining optional Research, marketing or Sample storage does not prevent you from buying the core testing service.
• Sale and access by others. We do not sell Genetic Data. We do not disclose it to your employer or a health, life, long-term care or disability insurer without your separate, explicit consent. Our Terms of Service prohibit using the Services to obtain another person’s Genetic Data for an employer or insurer or for employment or insurance-underwriting decisions.
• Government requests. We disclose Genetic Data to a government authority only when a valid legal order requires us to do so. Where the law allows and we consider it appropriate, we may notify you.
• Your choices. You may withdraw consent, request deletion of your Genetic Data or Account, or ask us to destroy your Sample. Sections 8 and 10 explain how this works, including limited records we must keep and the effect of withdrawal on an ongoing Service.

We disclose only the information needed for the purpose described. Each disclosure must have a lawful basis, meet any additional requirements for sensitive information and comply with applicable transfer rules. Section 5 applies to every disclosure of Genetic Data. We do not sell personal information.

• Laboratories and service providers. We engage providers under written contracts to process information only as needed to carry out their work for us. Our laboratory analyzes Samples and returns results using the kit ID rather than your name. Other providers may handle cloud hosting, support, email, analytics or local logistics. Affiliates acting on our behalf are subject to the same limits.
• Direct orders and payments. For an order placed directly with Geneus, you may pay us directly or an authorized payment-collection agent identified before you pay. The agent may be an affiliate. The identified payee or a payment service provider receives the transaction information needed to collect payment, issue documents or process a refund. An agent receiving funds for us is not the retailer. If a party keeps its own statutory records or processes information for its own fraud-prevention obligations, it acts as a separate controller for that activity under its own privacy notice.
• Retailers and shipping companies. An authorized retailer selling a Kit on its own account handles the sale under its own privacy notice. We may exchange order or kit information needed for fulfillment or support. Shipping companies receive the delivery and shipment details they need. A sale, payment or delivery does not give a retailer, payment agent or shipping company access to the person’s Genetic Data or Report.
• People you choose. We may share a Report with a doctor, health coach or other person you specifically authorize. Any disclosure of Genetic Data is subject to your separate, explicit consent under Section 5.
• Legal and safety matters. Where lawful and necessary, we may disclose information to comply with legal obligations or valid legal process, establish, exercise or defend legal claims, or protect rights, safety or property. The specific restrictions on Genetic Data in Section 5 continue to apply.
• Business transactions. In a financing, merger, acquisition or asset sale, we share information only as lawfully needed and subject to this policy. A transaction does not by itself permit access to or transfer of Genetic Data. We will explain any proposed change of controller or purposes, provide any required notice and obtain any consent required by Section 5 or applicable law. In other cases, we seek your consent before disclosure.

Geneus is based in the United States. We and the parties providing Services for us may store or process information in the United States, Thailand and other countries where they operate. The protections in those countries may differ from those in your country. A Sample may also be sent to a laboratory abroad to perform the test you request.

When a transfer is subject to restrictions, we use a mechanism recognized by the applicable law. Depending on the transfer, this may include the European Commission’s standard contractual clauses, the UK International Data Transfer Addendum, or safeguards recognized under Thailand’s PDPA. We rely on an exception only in the limited circumstances permitted by law. You may ask us about the safeguards for a particular transfer and how to obtain a copy.

• Account information and Genetic Data. We keep these while your Account is open to provide the Services you request, unless you ask for deletion sooner. Closing an Account and requesting deletion are separate actions. When we no longer need the information for the Services, we keep only what is necessary for a lawful purpose described in this policy.
• Samples. A Sample is used up or destroyed after analysis under the laboratory’s procedures unless you separately consent to storage. You may ask us to destroy a stored Sample.
• Orders, payments and legal records. We keep order, payment and tax records for the periods required by tax and accounting laws. We keep information needed to establish, exercise or defend legal claims only for as long as needed for that purpose, taking account of the relevant limitation period. The laboratory may have to retain limited records linked only to the kit ID to comply with laboratory regulations.

When information is no longer needed, we delete it, destroy it or make it anonymous. Deleted information may remain in secure backups for a limited period until the normal backup cycle overwrites it.

You can contact our Data Protection Officer at [email protected]. You can also contact Geneus DNA LLC about your personal information using the postal address in Section 16.

Where applicable law requires us to appoint a local representative, we will provide the representative’s identity, address and contact details directly to you in the privacy notice for the relevant processing.

Depending on applicable law, you may have the following rights:

• Access your personal information and obtain a copy, including available raw Genetic Data. You may also request information about the source of personal information we obtained from someone else.
• Ask us to correct inaccurate information or complete information that is incomplete.
• Ask us to close your Account, erase your Genetic Data or other personal information, or destroy any remaining Sample. Section 8 explains the retention periods and exceptions that may apply.
• Ask us to restrict or suspend processing of your personal information.
• Object to processing based on our legitimate interests. You may object to direct marketing at any time.
• Where the right to data portability applies, receive your information in a structured, commonly used, machine-readable format or ask us to transfer it to another organization where technically feasible.
• Withdraw consent at any time, including consent to Research. We will stop future processing that relies on the withdrawn consent. Withdrawal does not affect the lawfulness of processing already carried out. Results of completed Research may remain in use if they no longer identify you. If withdrawal prevents us from analyzing your Sample or continuing to provide a Report, we will explain what it means for that Service.
• Complain directly to a data protection authority with jurisdiction. You may also ask us to address your concern.

To exercise your rights, email [email protected] or write to the address in Section 16. You may also use any other channel available under applicable law. If you use an authorized agent, we may ask for reasonable evidence of their authority. We take reasonable steps to verify the requester’s identity and authority before releasing information or acting on a request.

We respond without undue delay and within the period required by applicable law. For a request covered by the GDPR, the usual response period is one month from receipt. For an access request under Thailand’s PDPA, the usual deadline is 30 days. If the law permits an extension and we need to use it, we will explain the reason within the initial response period.

We may limit or refuse a request only where the law permits, for example if information must be retained to comply with law or to establish, exercise or defend legal claims. We may charge a reasonable fee only in circumstances permitted by law, such as a manifestly unfounded or excessive request where that rule applies. If we decline a request, we will explain the reason and any applicable complaint or review options.

You may unsubscribe from marketing messages using the unsubscribe link in a marketing email. Section 12 explains how to manage advertising cookies.

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information. These include access controls, appropriate encryption and the use of kit IDs to separate laboratory data from identifying details. We continue to protect data linked to a kit ID as personal information where it can be linked back to you.

If a personal data breach occurs, we will assess its impact, take appropriate steps to address it and notify the authorities and affected individuals when and within the time required by applicable law.

We use cookies and similar technologies to operate the Services, remember your preferences, understand how the Services are used and measure advertising. Where required by law, we ask for consent before using non-essential cookies. You may manage your choices through the cookie settings on our website or in your browser. Blocking some cookies may affect how the Services work.

Your cookie choices are separate from any express consent required to use your Genetic Data for marketing under Section 5.

The Services are not directed to children. Only adults who meet the eligibility requirements in the Terms of Service may create an Account. A parent or legal guardian with the necessary authority may submit a minor’s Sample. We obtain consent from the minor, parent, guardian or other authorized person as applicable law requires. Buying a Kit as a gift does not give the buyer authority to consent to testing, access a Report or exercise privacy rights on the recipient’s behalf.

We do not knowingly collect personal information directly from children, except as needed for an authorized testing process, to verify identity or authority, or to handle a privacy rights request. A minor or a person authorized to act for the minor may contact us to exercise the minor’s rights as applicable law allows.

If we learn that we have collected a child’s information in error or without the authority or consent required by law, we will stop the affected processing and delete that information, except to the extent we must retain it by law.

The Services may link to websites or services operated by others. Their privacy notices explain how they handle information they collect independently. Section 6 governs our disclosures to other parties.

We may update this policy. We will notify you by email or through the Services before a material change takes effect. A change will not operate retroactively to reduce your rights over information we already hold. If a new use or disclosure of your Genetic Data or other personal information requires separate consent, we will ask for it before starting that activity.

For privacy questions and rights requests, email [email protected].

You may also write to Geneus DNA LLC, Attn: Privacy, 10 W Broadway, Salt Lake City, Utah 84101, United States of America.