Last updated: April 2026
ExomeDNA processes genetic data, which is classified as "special category data" under GDPR Article 9. This data receives enhanced protection.
Effective Date: April 2026. This addendum supplements the General Privacy Policy below.
1.1 Account Data
1.2 Genetic Data (Temporary)
1.3 Derived Trait Results (Retained)
1.4 What Is NOT Retained
This separation between temporary processing data and retained results is enforced at the application architecture level and is fundamental to our privacy design.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Generate your trait report | Raw DNA file (temporary), GWAS reference data | Your explicit consent (Service Consent) |
| Display your results | Derived trait scores, categories | Service operation under accepted Terms of Service |
| AI Health Coach responses | Trait names, scores, confidence, summaries | Your explicit, separate consent (AI Processing Consent) |
| Aggregate research (if you opt in) | De-identified, aggregated statistics only | Your explicit consent (Research Consent) |
| Product updates (if you opt in) | Email address only | Your explicit consent (Marketing Consent) |
| Service operation and security | Browser fingerprint (hashed timestamp and user agent — not your IP address), usage logs | Service operation under accepted Terms of Service |
3.1 AI Provider
ExomeDNA uses Anthropic, PBC (San Francisco, California, USA), operating the Claude language model, as its AI provider for the AI Health Coach feature.
3.2 What Is Sent to Anthropic
When you use the AI Health Coach, the following trait-level data is transmitted to Anthropic:
3.3 What Is NEVER Sent to Anthropic
The following categories of data are never transmitted to Anthropic or any other external AI service. This restriction is enforced at the application architecture level and cannot be overridden.
3.4 Zero Data Retention (ZDR)
ExomeDNA is configured to use Anthropic under a Zero Data Retention (ZDR) arrangement. Under this arrangement:
3.5 Separate Consent Required
Use of the AI Health Coach requires a separate, standalone consent authorization, provided through a dedicated consent screen in compliance with the Illinois Genetic Information Privacy Act (410 ILCS 513). This consent is distinct from and in addition to the general Terms of Service and Privacy Policy.
4.1 Infrastructure
ExomeDNA uses U.S.-based infrastructure providers for all core service operations.
4.2 Security Measures
4.3 Raw DNA File Handling
Your raw DNA file is processed in working memory only. It is never:
ExomeDNA does not sell, license, or rent your genetic data or derived trait results to any third party.
We share data only in the following limited circumstances:
| Recipient | What Is Shared | Purpose | Your Control |
|---|---|---|---|
| Anthropic (AI provider) | Trait-level scores and summaries only | AI Health Coach responses | Requires separate consent; revocable |
| Stripe (payment processor) | Payment information only | Process purchases | Required for paid tiers |
| Supabase (infrastructure) | Account and results data | Database hosting | Required for service operation |
No recipient receives raw genetic data, gene names, rsIDs, or genotype values.
The following rights are provided in compliance with applicable U.S. privacy laws. ExomeDNA currently serves U.S. residents. References to data access, deletion, and portability rights are provided in accordance with CCPA, Texas HB 2545, and as a matter of best practice — they do not constitute a representation that ExomeDNA is subject to GDPR or other non-U.S. regulatory jurisdiction.
6.1 Access: You may export all your data at any time from Settings > Privacy, or by contacting support@exomedna.com.
6.2 Deletion: You may request deletion of all data from Settings > Privacy or by contacting support@exomedna.com. Deletion is permanent and irreversible. Deletion of derived results is typically immediate. Consent audit records are retained for compliance purposes as described in Section 7.
6.3 Consent Withdrawal: You may revoke any optional consent (AI Processing, Research, Marketing) at any time from Settings > Privacy. Revoking AI Processing consent immediately disables the AI Health Coach. Revoking Service consent requires account deletion.
6.4 Data Portability: You may download your trait results in JSON format from Settings > Privacy or by contacting support@exomedna.com.
6.5 Non-Discrimination: We do not discriminate against you for exercising any of these rights (CCPA § 1798.125).
6.6 Insurance Disclosure: The federal Genetic Information Nondiscrimination Act (GINA) generally protects against genetic discrimination in health insurance and employment. However, GINA does not cover life insurance, disability insurance, or long-term care insurance. You should consider this before uploading genetic data or sharing your results.
| Data Type | Retention Period | Deletion Method |
|---|---|---|
| Raw DNA file | Duration of processing only (minutes) | Destroyed in memory immediately after analysis |
| Derived trait results | Until you request deletion or delete your account | Permanent deletion via Settings > Privacy |
| Consent records | Retained for a limited period after account deletion where reasonably necessary to demonstrate compliance, resolve disputes, or satisfy applicable legal obligations | Per Texas HB 2545 and FTC HBNR recordkeeping requirements |
| Payment records | As required by financial regulations | Managed by Stripe per their retention policy |
ExomeDNA does not knowingly collect genetic data from individuals under 18 years of age. If we become aware that we have processed genetic data from a minor, we will immediately delete all associated data.
ExomeDNA currently serves U.S. residents and uses U.S.-based infrastructure providers for all core service operations including data processing, storage, and AI interactions. We do not intentionally transfer genetic data or derived results outside the United States.
Material changes will be communicated via email at least 30 days before taking effect. For material changes to how ExomeDNA processes genetic data or shares data with third parties, we will request your renewed consent before the change takes effect. For other material changes, your continued use of ExomeDNA after the effective date constitutes acceptance.
For privacy-related inquiries, data access requests, or to exercise any of your rights:
Email: support@exomedna.com
Mailing address: 5900 Balcones Dr, Suite 100, Austin, TX 78731