PRIVACY POLICY

OUR COMMITMENT TO YOUR PRIVACY IN REGARDS TO OUR DECODING DNA SERVICE WE PROVIDE THROUGH OUR COLLABORATIVE PARTNERS At SelfDecode and PromicsEdge (hereafter referred to as “SelfDecode” for brevity),

 

We are committed to protecting your privacy. We understand that your genetic, laboratory, and self-reported information is highly sensitive and personal. We value your trust and strive to maintain the confidentiality and security of your data.

WHAT THIS POLICY COVERS

This Privacy Policy describes how we collect, use, maintain, protect, and disclose your information when you use our Services. It explains the types of data we collect, how we use it, and the choices you have regarding your information.

YOUR CONSENT

By accessing or using our Services, you consent to the data practices described in this Privacy Policy. If you do not agree with these practices, please do not use our Services.

KEY TERMS

Capitalized terms not defined in this Privacy Policy have the same meaning as in SelfDecode’s Terms of Service.

Personally Identifiable Information (PII)

PII is any information that can be used to identify, contact, or locate a specific individual, either alone or in combination with other information. This includes, but is not limited to:  

• Direct Identifiers:

  • Name

  • Email address  

  • Postal address  

  • Phone number  

  • IP address  

  • Government-issued identification numbers (e.g., Social Security number, driver’s license number)  

• Indirect Identifiers:

  • Date of birth  

  • Gender  

  • Race  

  • Ethnicity  

  • Location data  

  • Online identifiers (e.g., usernames, account numbers, cookies)  

  • Genetic Information  

Information SelfDecode Collects

SelfDecode may collect and store the following types of PII:

• Name

• Email address  

• Postal address 

• Billing address

• Phone number

• Date of birth

• Gender   

• Ethnicity

• Genetic Information

• Laboratory Information

• Self-Reported Information like symptoms and conditions

• Location data  

• IP address

• Device identifiers

• Online identifiers (account numbers, cookies)

• Payment information

DEFINITIONS OF KEY INFORMATION TYPES

Genetic Information

“Genetic Information” refers to any data about your genetic makeup, including:

• Raw genotype data that you upload to the SelfDecode platform or that is otherwise provided to SelfDecode (e.g., through DNA testing kits).

• Interpretations and analyses of your genetic data generated by SelfDecode.

• Any other information derived from or related to your genetic makeup.

Laboratory Information

“Laboratory Information” refers to any data about your laboratory test results, including:

• Raw laboratory test data that you upload to the SelfDecode platform or that is otherwise provided to SelfDecode.

• Interpretations and analyses of your laboratory test data generated by SelfDecode.

• Any other information derived from or related to your laboratory tests.

Sensitive Information

“Sensitive Information” includes any information that is considered highly personal and requires special protection, including:

• Health information

• Genetic Information

• Laboratory Information

• Self-Reported Information (as defined below)

• Information about your racial or ethnic origin

• Information about your sexual orientation

• Information about your political affiliation

Information We Collect

SelfDecode collects various types of information to provide and improve our Services. This includes:

1. Personal Information

• Registration Information: When you create an account, we collect your name, email address, password, and payment information (if you make a purchase).

• Account Activity: We collect records of your interactions with our Services, including correspondence, transaction details, and account settings.

• Self-Reported Information: This includes information you provide directly to us, such as health conditions, personal traits, ethnicity, family history, and survey responses.

• Online Behavior Information: We collect data about how you interact with our Services, including but not limited to device information, IP address, browser type, and page views. We may use cookies, log files, web beacons, tags, scripts, and similar tracking technologies for this purpose.

1. Genetic and Laboratory Information

• Genetic Information: This includes raw genotype data you upload or provide through DNA testing kits, as well as interpretations and analyses of your genetic data.

• Laboratory Information: This includes raw laboratory test data you upload, as well as interpretations and analyses of your laboratory test data.

1. Sensitive Information

This includes information about your health, racial or ethnic origin, sexual orientation, and political affiliation. We handle this information with extra care and security.

1. Information from Third-Party Analytics and Marketing Tools

We use third-party tools like Google Analytics, Amplitude and others to analyze usage patterns, improve user experience, and optimize our marketing and communication efforts. These tools may collect individual-level or aggregate information, such as transaction details, personal identifiers or online behavior information. 

We may use your contact information to send you service updates, promotional offers, and other relevant communications.

1. Communications

We may use your contact information to send you service updates, promotional offers, and other communications. You can opt out of marketing messages, but certain service-related communications are necessary and cannot be opted out of.

1. Information from Other Parties

If you purchase a product as a gift for someone else, the recipient must create their own account. We will not share their personal information with you.

1. Children’s Privacy

Our Services are not intended for children under 18 years old. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us at

 privacy@selfdecode.com.

HANDLING OF USER INFORMATION

Genetic Information

• Collection and Storage: You may provide your Genetic Information by uploading a file to our platform. We store and process this information to provide our Services, including generating personalized insights (“SelfDecode Insights”).

• Use of Genetic Information:

  • With your consent, we use your Genetic Information to generate SelfDecode Insights, deliver personalized interpretations, and improve our Services.

  • We may combine your Genetic Information with that of other users in an anonymized and aggregated form (“Aggregated Genetic Information”) for research, product development, and promotional purposes.

• User Choice: You can choose not to receive SelfDecode Insights or use products that require Genetic Information.

Laboratory Information

• Collection and Storage: You may provide your Laboratory Information by uploading files or manually entering data. We store and process this information to provide our Services, including generating SelfDecode Insights.

• Use of Laboratory Information:

  • With your consent, we use your Laboratory Information to generate SelfDecode Insights, deliver personalized interpretations, and improve our Services.

  • We may combine your Laboratory Information with your Genetic Information to enhance interpretations.

  • We may combine your Laboratory Information with that of other users in an anonymized and aggregated form (“Aggregated Laboratory Information”) for research, product development, and promotional purposes.

• User Choice: You can choose not to receive SelfDecode Insights or use products that require Laboratory Information.

Self-Reported Information

• Purpose: You may provide Self-Reported Information, such as health conditions, personal traits, and lifestyle factors, to enhance the interpretation of your Genetic Information and enable the use of certain SelfDecode Products.

• Use of Self-Reported Information:

  • We may combine your Self-Reported Information with your Genetic Information to improve interpretations and personalize insights.

  • Some SelfDecode Products may require Self-Reported Information for accurate analysis and interpretation.

• User Choice: Providing Self-Reported Information is optional, but it may limit your access to certain products or features.

Consent and Data Storage

• Express Consent: Before using our services, you will be asked to provide your express consent to our Terms of Service, Privacy Policy, and other relevant terms and conditions.

• Data Storage: If you consent to us storing your Genetic Information, we will do so in accordance with this Privacy Policy, our Terms of Service, and all applicable laws and regulations.

HOW WE USE YOUR INFORMATION

SelfDecode uses your information for various purposes, as described below:

1. Providing and Improving Services

We use your information to:

• Operate and provide our Services, including account creation, payment processing, and communication.

• Analyze and improve our Services, such as through data analysis and research.

• Contact you about your account and relevant updates.

• Enforce our Terms of Service and other agreements.

• Monitor and prevent prohibited or illegal activities.

• Perform research and development activities.

1. Personalized Reports and Insights

We use your Genetic, Laboratory, and Self-Reported Information to generate personalized health insights and other reports.

1. Research

• With Your Consent: If you provide your consent, we may use your anonymized Genetic, Laboratory, and Self-Reported Information for research purposes, including studies aimed at publication in peer-reviewed journals.

• Anonymization: We anonymize your information before using it for research to protect your privacy.

• Collaboration: We may collaborate with third parties on research projects, but we will not share your individual-level data without your explicit consent.

• Data Aggregation: We may use Aggregated Genetic Information and Aggregated Laboratory Information for research and promotional purposes.

1. Promotional Purposes

We may use Aggregated Genetic Information and Aggregated Laboratory Information to describe our users in general terms for promotional purposes.

1. Legal Compliance

We may use and disclose your information as required by law or legal process.

Specific Considerations for EEA and UK Users

• Legal Basis for Processing: We process your Personal Information in accordance with our Terms of Service and this Privacy Policy.

• Sensitive Information: Our legal basis for processing your Sensitive Information is your consent. You may withdraw your consent at any time, but this will not affect the lawfulness of processing based on consent before its withdrawal.

WITHDRAWAL OF CONSENT

• You may withdraw your consent to participate in SelfDecode’s research studies at any time.

• To withdraw your consent, please contact us at privacy@selfdecode.com with the subject line “Withdrawal of Consent for Research.”

• Please include your full name and email address associated with your SelfDecode account in the email.

Effect of Withdrawal

• Your withdrawal of consent will be effective from the date we receive your email.

• We will not use your data for any new research studies after you withdraw your consent.

• However, any research involving your data that has already been performed or published before your withdrawal will not be reversed, undone, or withdrawn.

Specific Considerations for EEA and UK Users

• For individuals located in the European Economic Area (EEA) or the United Kingdom, the legal basis for processing your Sensitive Information for research purposes is your consent.

• You may withdraw your consent at any time, but this will not affect the lawfulness of processing based on consent before its withdrawal.

DATA SHARING WITH THIRD PARTIES

Sharing with Service Providers

• We may share your information with third-party service providers who assist us in providing, analyzing, and improving our Services. These providers may include data storage providers, payment processors, translation services and analytics providers.

• We only share the information necessary for these providers to perform their services, and we have contracts with them that require them to protect your information.

Sharing for Genetic and Laboratory Information Processing

• We may share your Genetic Information and Laboratory Information with third-party service providers who help us process and analyze this data.

• By accepting our Privacy Policy and Terms of Service, you consent to this sharing.

Sharing with OpenAI for DecodyGPT

• If you use the DecodyGPT feature, you consent to the sharing of your anonymized and masked data with OpenAI.

• This data is shared via API and cannot be traced back to you directly.

• OpenAI does not retain any personal data shared through this process.

• In future versions of DecodyGPT, we plan to eliminate the need for sharing data with any third parties.

DATA STORAGE AND SECURITY

Data Storage

• We store your information using third-party cloud storage providers that offer secure storage in dedicated databases.

• Our cloud storage providers implement security measures to protect your data from unauthorized access, use, or disclosure.

Data Security

• We implement various security measures to protect your information, including intrusion detection and prevention systems.

• We have contractual agreements with our service providers that require them to protect the confidentiality and security of your information.

• However, no method of electronic storage or transmission is completely secure. We cannot guarantee the absolute security of your information.  

•  

Online Behavior Information

• When you use our Services, our third-party service providers may collect Online Behavior Information about your visit, such as the links you click on and the pages you visit.

• We use this information to improve site navigability and assess our marketing campaigns.

• We comply with applicable data protection regulations, including cookie consent requirements for users in the EU, UK, and other international locations.

Data Transfers

• For individuals in the European Economic Area (EEA) and the United Kingdom, we implement appropriate safeguards when transferring your Personal Identifiable Information to a third country or international organization.

Data Sharing

• Aggregate Information: We may share Aggregate Information, which is de-identified and combined with data from other users, with third parties.

• Individual-Level Information: We will not share your individual-level Genetic Information with any third party, other than our service providers as necessary to provide the Services, without your explicit consent.

• Companies under Common Ownership: We may share your Personal Identifiable Information with other companies under common ownership or control to improve services and user experience.

Legal Disclosures

• We may disclose your Personal Identifiable Information to comply with legal obligations, such as responding to lawful requests from public authorities or law enforcement agencies.  

•  

Business Transitions

• In the event of a merger, acquisition, or sale of assets, your Personal Identifiable Information may be among the assets transferred. Your information will remain subject to the promises made in any pre-existing Privacy Policy.

ACCESSING, CORRECTING, AND REMOVING YOUR INFORMATION

Accessing Your Information

• You can access your Genetic Information, Laboratory Information, Self-Reported Information, and all reports and insights generated by SelfDecode through your account on our platform.

• You can also access, correct, or update most of your Personally Identifiable Information (PII) through your account settings.

Marketing Communications

• You can opt in or out of receiving promotional emails and notifications when creating your account or using our Services.

• You can update your marketing communication preferences by contacting our Privacy Administrator at privacy@selfdecode.com.

Deleting Your Information

• If you wish to delete your account and information, please send a request to privacy@selfdecode.com.

• We will send you an email to confirm your deletion request.

• Once your request is confirmed, your account and associated PII will be deleted, and any stored Genetic, Laboratory, and Self-Reported Information will be discarded.

• Please note that some information may not be erased, such as data used in completed research studies or retained for legal or compliance purposes.

Data Retention

• We will retain limited information related to your account and data deletion request for a limited period, as required by law or contractual obligations.

Third-Party Websites

• We may provide links to third-party websites. We are not responsible for the privacy practices of these websites and encourage you to review their privacy policies.

INFORMATION FOR EEA AND UK CUSTOMERS

Data Storage and Processing

• Your Personal Information will be stored and processed in data centers located within the European Union (EU).

• If you have questions about our data processing practices, please contact us at euprivacy@selfdecode.com.

Data Controller and Processor Roles

• For most of our Services, SelfDecode acts as the “controller” of your Personal Identifiable Information, meaning we determine the purposes and means of processing your data.

• For some Services, we may act as a “processor” on behalf of third parties.

Legal Basis for Processing

We may process your Personal Identifiable Information based on:

• Your consent

• Our legal obligations

• Our contractual obligations with you

• Our legitimate interests, such as protecting our property, rights, and customers

Promotional Offers

• You can opt out of receiving promotional emails from SelfDecode by changing your account settings.

• You cannot opt out of service-related emails, such as order confirmations and policy updates.

• Promotional emails will include an “unsubscribe” option.

• You can also withdraw your consent for marketing communications at any time by emailing euprivacy@selfdecode.com.

Sharing for Marketing Purposes

• We will only share your Personal Identifiable Information with third parties for marketing purposes with your explicit consent.

• You can withdraw your consent for marketing data sharing at any time by emailing privacy@selfdecode.com.

EXERCISING YOUR PRIVACY RIGHTS

Your Rights

You have the following rights regarding your personal information:

• Right to Access: You can request access to the personal information we hold about you.

• Right to Rectification: You can request that we correct any inaccurate or incomplete personal information.  

• Right to Erasure (“Right to be Forgotten”): You can request that we delete your personal information under certain circumstances, such as when the information is no longer necessary for the purposes it was collected or when you withdraw your consent.  

• Right to Data Portability: You can request a copy of your personal information in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller.  

• Right to Restriction of Processing: You can request that we restrict the processing of your personal information under certain circumstances, such as when you contest the accuracy of the data or when the processing is unlawful.  

• Right to Object: You can object to the processing of your personal information based on legitimate interests or for direct marketing purposes.

• Right to Withdraw Consent: You can withdraw your consent to the processing of your personal information at any time.  

How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@selfdecode.com. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

Verification of Identity

We may need to verify your identity before fulfilling your request to protect your privacy and security.

Limitations

• Please note that there may be limitations to your rights under applicable law.

• We may not be able to fulfill your request if it would adversely affect the rights and freedoms of others.

• We may also need to retain certain information for legal or compliance purposes.

DATA PRIVACY PRACTICES

Information Shared with Others

• Rectification, Erasure, or Restriction: If you request rectification, erasure, or restriction of your personal information, we will notify any third parties with whom we have shared your data, unless providing notice is impossible or involves disproportionate effort.

• List of Recipients: Upon your request, we will provide you with a list of recipients with whom we have shared your personal information.

Automated Decision-Making

• We do not use automated processing, including profiling, to make decisions that produce legal or similarly significant effects on you, except as allowed by applicable data protection laws.

Data Retention

• We will retain your Personally Identifiable Information for as long as your account is open or as required by law.

• You can request deletion of your account and information at any time.

Limitations on Rights

• Your rights of access, correction, and deletion may be limited by local laws or if fulfilling your request would adversely affect the rights and freedoms of others.

Contacting Us with Privacy Concerns

If you believe your privacy rights have been infringed or if you have any questions or concerns about our privacy practices, please contact us at:

• Email: privacy@selfdecode.com

• EU Representative: DataRep, euprivacy@selfdecode.com

Filing a Complaint

You have the right to file a complaint with your local data protection supervisory authority.

Changes to this Privacy Policy

• We may update this Privacy Policy from time to time.

• We will provide notice of any material changes 1 before they become effective.  

• By continuing to use our Services after changes to this Privacy Policy, you agree to be bound by the revised Policy