Privacy
Privacy Policy
This pre-launch privacy notice describes how DNA_CHECKS handles personal data in the beta report workflow.
The technical processing path is operational, but this notice remains subject to the final compliance review before the public beta opens. Controller identity, final legal wording and processor/transfer documentation will be completed as part of that gate.
Scope
What this policy covers
This policy covers personal data used to provide the DNA_CHECKS website, beta report workflow and related support.
Raw DNA and genetic report content are genetic data and may also reveal health, ancestry and information relevant to biological relatives. DNA_CHECKS therefore treats them as special-category personal data for the beta privacy model.
Data we process
Only the information needed for the requested workflow
The beta workflow is designed to minimise the information needed to generate, deliver and support a report.
The supported genotype file supplied for analysis.
The HTML report created from the requested analysis.
Used for report-ready notices and essential service communication.
Job ID, timestamps, processing status, software/report version and limited error information.
Transaction and payment-status information needed to confirm payment, support refunds and maintain essential records. Full card details are handled by the payment provider rather than DNA_CHECKS.
Information supplied when a user asks for help, raises a privacy request or reports a problem.
Why we process it
Purpose-limited processing
The standard report workflow uses genetic data only to provide the analysis the user requested.
Generate the requested reportValidate the file, run DNA_CHECKS and deliver the result.+
The core purpose is to process the uploaded genotype file through the DNA_CHECKS analysis pipeline and produce the requested report.
Operate and secure the serviceUse limited metadata for job management, support and security.+
Operational metadata may be used to process jobs, investigate failures, detect abuse, respond to support requests and demonstrate deletion or processing status.
No research reuse by defaultBuying a report does not enrol the user into a research project.+
Any future research or voluntary data-contribution programme would need to be clearly separate from the normal report workflow and based on a specific, optional choice.
No advertising or AI-training useUploaded DNA is not a marketing or model-training asset.+
The beta model does not use uploaded DNA to build advertising profiles or to train AI systems.
The current design is to rely on the contract/service relationship for the ordinary personal data needed to provide the report, together with explicit consent as the intended Article 9 condition for processing the user's genetic data. This wording must be confirmed against the final service and processor architecture before live processing begins.
Retention & sharing
Temporary DNA, temporary report delivery
The service avoids indefinite storage of uploaded genetic data and uses temporary report delivery.
Deleted after successful processing or terminal failure, with an upload-storage lifecycle fallback configured to expire raw-upload objects within one day.
Temporary secure delivery. Report links are intended to remain available for approximately seven days, with storage fallback cleanup shortly afterwards.
Retained only as required for payment, accounting, fraud prevention and legal obligations.
Retained for the period reasonably needed to handle the request and demonstrate the response.
Who may process data?Only service providers needed to operate the final beta workflow.+
The current beta architecture uses Cloudflare for website/API infrastructure, temporary storage and queueing, Stripe for payment processing, and Resend for essential transactional email. Raw DNA is intended to be exposed only to components that require it for the requested report workflow. The final processor and transfer review remains part of the compliance gate.
International transfersFinal provider locations and transfer safeguards must be documented.+
The final production notice will document the relevant provider locations and any applicable international-transfer safeguards after the processor and transfer review is completed.
Your rights
Requests, consent and complaints
UK data protection rights depend on the data, purpose and lawful basis involved.
Depending on the circumstances, individuals may have rights to access personal data, correct inaccurate data, request erasure or restriction, receive portable data, object to certain processing, and withdraw consent where processing is based on consent.
Withdrawing consent does not make earlier lawful processing retrospectively unlawful. Some rights are not absolute and may not apply in every situation.
Privacy rights requests and data-protection complaints can be sent to [email protected]. If a concern cannot be resolved with DNA_CHECKS, users can also raise a complaint with the UK Information Commissioner's Office.
Pre-launch review
Items reserved for the compliance gate
This page reflects the current technical privacy model, but the final production notice will be approved only after the remaining legal and governance details are completed.