Privacy Policy

To ensure the continued satisfaction with our Services, we may also partner with certain third parties to provide customer support services. Our customer satisfaction teams may use certain tools to process and respond to your requests, and we may need to share your User Data as part of that process.

e. Information Technology

As needed, we may share your User Data with our IT providers who provide services that ensure the proper functionality and security of our Services.

When you use or interact with our Services, we work with third parties who provide certain marketing and analytics services. For example, we may work with a third-party service provider to collect information about your visit to the website such as the links you click and pages you read. We may share your User Data with such third parties in order to recognize you as an existing user.

We also work with third parties on various marketing campaigns and promotions and we may share your User Data (but not Survey or Genetic Data) with such third parties to contact you about our Services to the extent permitted under Applicable Laws. You will always have the ability to opt-out of marketing communication.

When we share User Data for marketing or analytics purposes, we only share the data for limited purposes and we prohibit those third parties from using or disclosing your User Data for their own (or another third party’s) marketing purposes.

g. As Required By Law

We may be required to share your User Data by law, such as by a lawful court order or subpoena. If we are required by law to share your User Data, we will attempt to provide you with notice prior to disclosing your data, unless we are prohibited by law from doing so. Absent a lawful court order or other law requiring us to disclose your User Data, we do not voluntarily disclose your Personal Information with any law enforcement agency.

h. Business Transactions

We may also disclose your User Data with third parties as it may be necessary to complete a business transaction involving DNA Complete, such as a merger or acquisition of DNA Complete, or a sale of all or a portion of the DNA Complete business or assets. In such a case, your Personal Information would remain subject to the promises made in this Policy.

10. Survey and Genetic Data

We disclose your Survey Data and Genetic Data only with your explicit, prior consent. We may ask for permissions to disclose your Survey Data and Genetic Data with the following third parties:

a. Partner Laboratories

In order to provide the Services we may need to work with one of our partner laboratories. If we work with such a third party partner, we will need to share your Genetic Data with the partner laboratory. Specifically, we will need to share your DNA sample with the third party laboratory who will then process it and extract the DNA Data that we need to provide the Services. When we use a partner laboratory to process your Genetic Data, we do so only with vetted and pre- approved third party laboratories who have a contractual relationship with DNA Complete. All Genetic Data shared with third party laboratories is shared only for a limited and specified purpose, and remains in our control, and cannot be shared for any other purposes by the laboratory.

b. Researchers

At DNA Complete, we believe that genetic research is crucial to our deeper and better understanding of the human genome and we aim to continue to conduct genetic research in meaningful ways. From time to time, we may offer you the ability to participate in research. Your participation is completely voluntary and your access to the Services will not be impacted whether you choose to participate in research or not.

i. United States Research

If you are located in the United States, we will only use Genetic Data that can personally identify you for research if you give us your affirmative consent. To participate in research, US based users must first consent to be in the Research Pool. You can find this consent form here for US. Your participation in the Research Pool does not give us consent to use your Personal Information for any research. Rather, it lets us know that you are interested in being contacted about specific research opportunities. When a specific research opportunity arises, we will then contact the users in the Research Pool with detailed information about each and specific research opportunity, which will include details about that research. You will then have the option to consent to the use of your Personal Information for that research.

You can view the current research projects by visiting our research page. You can revoke your consent to participate in research. To change your research consent settings, please visit dnacomplet1stg.wpenginepowered.com. Your decision to revoke consent will not impact your Services. In compliance with the applicable US laws, we may use de-identified data, including genetic or phenotypic information, for research purposes without any additional consent or authorization, but this data is not personally identifiable. We will not share Genetic Data that can personally identify you without your consent.

ii. EEA/UK Research

If you are located in the European Economic Area (“EEA”) or the United Kingdom (“UK”), we will not use any of your Personal Information, including your Genetic Data and any information you provide in response to surveys or otherwise uploaded to your account or shared to us through the use of our websites and Services, for research without your informed and explicit consent. You can find this consent form here for EU/UK.

The types of research projects we anticipate conducting ourselves or with other non-profit organizations, researchers, physicians, academic institutions, other DNA testing companies or life sciences (pharmaceutical and medical device) companies (“Research Partners”) include:

• Studies related to population structure, demography, genetic variations, and migration patterns.
• Studies related to human lifestyle and genetic markers related to diagnostics and medical conditions.
• Studies related to developing treatments and response to certain therapeutics.
• Studies related to the genetics of diet, sleep, mental health, and fitness.‍

You can find out more information about our research and consent to participate by visiting our research page.

If you consent to participate in research, we will only share research results which do not identify you by name, email, address or other information that identifies you directly. Research results are only based on de-identified, pseudonymized, or aggregated data.

You can withdraw your consent from participating in research at any time. To change your research consent settings, please email us at support@DNAcomplete.com. Your decision to withdraw your consent will not impact your ability to use our websites and Services.

1. De-Identified Data

We may use Personal Information in our possession to create de-identified and aggregated data sets. In other words, some of the data that we collect from you is stripped of all information that may be used to identify an individual by name. We may then use this de­ identified or pseudonymized genetic or phenotypic information (such as Genetic Data), which may be shared with or disclosed to third parties for research purposes in accordance with Part 46 (commencing with Section 46.101) of Title 45 of the Code of Federal Regulations, or where you are located in a country in the European Economic Area, Switzerland or the UK, as permitted under the EU/CH/UK General Data Protection Regulations.

2. Law Enforcement

DNA Complete will not voluntarily share your Survey Data or Genetic Data with law enforcement. However, under certain circumstances your Survey Data and/or Genetic Data may be subject to processing pursuant to laws, regulations or judicial or governmental orders, warrants or subpoenas. In other words, where we are legally compelled to disclosure your Personal Information to a governmental or regulatory authority, DNA Complete will not share any other categories of Personal Information, other than what is required to protect the safety of persons or property, or in enforcing our, our affiliates, or our partners’ legal rights. For example, if a user defrauds our Services, we may disclose that user’s Personal Information (but not Genetic Data) with law enforcement in an effort to recuperate the defrauded costs. If we are compelled to disclose your Personal Information, we will do our best to provide you with advance notice, unless we are prohibited under law from doing so.

3. Business Purposes

In the event that DNA Complete is acquired or transferred including in connection with corporate transaction, bankruptcy, or similar proceedings (including financing, merger, acquisition, dissolution, or a transfer, divestiture, or sale of a portion or all of our business or assets), we will share your Survey Data and Genetic Data with the acquiring or receiving entity as a part of the transaction or negotiation for such a transaction. Nonetheless, the promises of this Policy will continue to apply to your Personal Information that is transferred to the new entity. Any new entity will only be allowed to use your User Data, Survey Data, and Genetic Data pursuant to this Policy, or as otherwise authorized by you.

11. Data Retention Policies

We retain your Personal Information for as long as necessary to provide the products and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes. Because these needs can vary for different data types in the context of different products, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the data, the availability of automated controls that enable users to delete data, and our legal or contractual obligations. For example, all of the data collected by Google Analytics for the purposes of understanding our website usage is automatically deleted after 26 months, all mobile identifiers and cookie identifiers placed by Adroll expire and are then deleted after 13 months, and the Recent User Activity feed collected by Hotjar are retained for 1 year.

DNA Complete will store your Personal Information as long as your Account is open, unless you make a request for us to delete all or any of your Personal Information prior to the closing of your Account as described in this Policy. If you decide to close your Account, then DNA Complete will automatically destroy all Personal Information related to your account, including User Data, Survey Data, and Genetic Data. In specific circumstances such as by court order, subpoena, or other legal or regulatory obligations, however, DNA Complete may be required by law to store your Personal Information beyond the deletion of your Account or request for deletion of Personal Information for up to six years. DNA Complete may also retain disaster recovery copies for a fixed period following this deletion, although this data will not be used for any purpose other than disaster recovery.

If you provide us with your biological sample, we use it to provide the Services, but will not store or retain such sample unless we first obtain your consent.

You may access and delete or change much of your Personal Information through your Account Settings here. Otherwise, any Personal Information that is not accessible in your Account Setting can be accessed and changed or deleted by reaching out to support@DNAComplete.com

12. Maintenance and Security

DNA Complete maintains a comprehensive information security program designed to protect your Personal Information through the use of reasonable safeguards. DNA Complete has measures in place designed to protect against inappropriate access, loss, or misuse of Personal Information. For example, we use secure server software to encrypt Personal Information and work with data storage cloud partners that meet our security standards.

While we cannot guarantee that loss, access or misuse of data will not occur, we use reasonable efforts to prevent these outcomes. To help us protect Personal Information, we request that you use a strong password and never share your password with anyone or use the same password with other sites or accounts.

13. Data Location and Transfer

We are a global business. Personal Information may be stored and processed in any country where we do business or our service providers do business. We may transfer your Personal Information to countries other than your own country, including to the United States. These countries may have data protection rules that are different from your country. When transferring data across borders, we take measures to comply with Applicable Laws related to such transfer. Officials (such as law enforcement or security authorities) in those other countries may be entitled to access your Personal Information.

If you are located in the European Economic Area (“EEA”), the UK or Switzerland, we are directly regulated by the GDPR and your Personal Information will be transferred to the United States for processing by us. We may need to transfer your Personal Information to third parties and will comply with Applicable Laws to provide an adequate level of data protection for the transfer of your Personal Information. Where we do transfer your Personal Information to third parties, including partners, we will ensure that your Personal Information is protected by appropriate cross-border transfer solutions to provide adequate protection.

Please contact us if you would like to learn about the specific transfer security mechanisms we use.

14. Changes to This Privacy Statement

We will update this Policy when necessary to reflect changes in our products, how we use Personal Information, or the applicable law. When we post changes to the statement, we will change the “Last Updated” date at the top of the statement. If we make material changes to the statement, we will provide notice or obtain consent regarding such changes as may be required by law.

a. For global users (except in the EEA, Switzerland and UK): By using our Services, you are agreeing to this Policy and you provide your informed and explicit consent to the uses of your Personal Information including your Genetic Data. This Policy notifies you of the use of your Personal Information and by proceeding to use our Services you confirm your understanding of its terms.

15. Jurisdiction Specific Provisions

a. U.S. Consumer Data Rights

If you are a resident of the U.S., your state of residence may provide you additional rights regarding our use of your Personal Information. The rights that may be available to you include:

i. Right to Know and Access

You may have a right to request information about our collection, use, and disclosure of your Personal Information, and ask that we provide you with certain information, such as:

• Categories and specific pieces of Personal Information we have collected about you.
• Categories of sources from which we collect Personal Information.
• Purposes for collecting Personal Information.
• Categories of third parties with which we share Personal Information.
• Categories of Personal Information disclosed about you for a business purpose.
• If applicable, categories of Personal Information sold about you and the categories of third parties to which the Personal Information was sold, by category or categories of Personal Information for each third party to which the Personal Information was sold.

You can access your Personal Information within your account settings and the Survey Data within the specific survey page. To make a verifiable request for information about the Personal Information we have collected about you, you may reach out to the DNA Complete team at support@DNAComplete.com. Also, you may download your raw Genetic Data here. To the extent required under Applicable Laws, we will do our best to assist you without undue delay and within the time required by Applicable Laws. However, to the extent permitted by Applicable Law, we reserve the right to charge a fee or decline requests that are unreasonable or excessive, where providing the Personal Information would be prohibited by law or could adversely affect the privacy or other rights of another person, or where we are unable to authenticate you as the person to whom the Personal Information relates.

ii. Right to Portability

You may have the right to request that we provide a copy of the Personal Information we have collected about you, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. Once we receive your request and confirm your identity, we will provide to you a copy of your Personal Information as required under Applicable Laws. We may provide this data to you through your user account with us, or via email to the email address you have provided with your request.

iii. Right to Delete

You may also have a right to request that we delete your Personal Information, subject to certain exceptions. To make a verifiable request to delete the Personal Information we have collected about you, you may reach out to the DNA Complete team at support@DNAComplete.com

iv. Right to Correct

Subject to certain exceptions, you may have the right to request that we correct inaccurate Personal Information that we have collected about you. Once we receive your request and confirm your identity, we will review your request, taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information to see if we can correct the data. We may also request additional information showing that the Personal Information you want to correct is inaccurate.

v. Right to Non-Discrimination

Your state may prohibit treating you different than other customers for exercising your rights regarding your Personal Information under Applicable Laws. This includes by denying or providing a different level or quality of goods or services, or charging (or suggesting that we will charge) different prices, rates, or impose penalties on residents of such states who exercise their rights regarding their Personal Information, unless doing so is reasonably related to the value provided to us by your Personal Information.

vi. Right to Opt-out

You may have the right to opt-out of processing of your Personal Information for the purpose of (i) targeted advertising, (ii) sale or sharing of Personal Information, or (iii) profiling to provide you with tailored content, including suggested advertising. We do not process your Personal Information for the purpose of (i) targeted advertising, (ii) selling or sharing your Personal Information, or (iii) profiling, as those terms are defined under Applicable Laws.

v‍ii. Requests Made Through Agents

You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise the rights provided by your state of residence regarding your Personal Information. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

viii. Do Not Track

Some browsers have incorporated “Do Not Track” (DNT) features that can send a signal to the websites you visit indicating you do not wish to be tracked. Because there is not a common understanding of how to interpret the DNT signal, our websites do not currently respond to browser DNT signals. Instead, you can use the range of other tools to control data collection and use.

b. Florida

Pursuant to Fla. Stat. § 760.40, upon your request, your Genetic Data is available to your physician. If you wish to share this data with your physician, you may download your raw Genetic Data in your account, or by clicking here.

c. Additional rights for California Residents

i. Shine the Light

Where applicable, California Civil Code Section 1798.83 permits users of the websites that are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request please contact us using the information provided in the “Contact Us” section below.

ii. Financial Incentive Program

We do not offer any financial incentives as those are defined under the applicable data protection laws.

iii. Limit the Use of My Sensitive Personal Information

To the extent that we process any Sensitive Personal Information, as that term is defined under Applicable Law, we will only do so if you have given us your explicit consent to carry out such processing and the processing is necessary to provide the Services requested. To the extent we use your Sensitive Personal Information for any other purpose, such as to improve the Services, we have done so pursuant to your opt-in consent. You have the right to request that we limit the use of your Sensitive Personal Information to only purposes necessary to provide the Services. You may exercise that right by sending us an email with “Limit the Use of My Sensitive Personal Information” in the subject line at: support@DNAComplete.com

iv. Filing of a Complaint

Effective January 1, 2022, California residents also have the right to file a complaint with the California Attorney General’s Office alleging violation of the Genetic Information Privacy Act. As the Attorney General’s Office releases additional information on how to file that Complaint, we will supplemental this Policy with that information, as required under the applicable law.

Right to Appeal

If you make a request to exercise any of the above data access rights and we are unable to comply with your request, you may request to appeal our decision. To appeal any data privacy request decision, please contact us by emailing support@DNAComplete.com with the subject line “Data Access Request Appeal.” If after you complete the appeal process with us, you are still unsatisfied with our response, you may contact your Attorney General to file a complaint. Below is the contact information for the appropriate entity where you can inquire about filing an appeal:

i. Virginia residents:

Office of the Attorney General
202 North 9th Street
Richmond, VA 23219
Phone: (804) 786-2071
https://www.oag.state. va.us/

ii. Colorado residents:

Office of the Attorney General
Colorado Department of Law
Ralph L. Carr Judicial Building
1300 Broadway, 10th Floor
Denver, CO 80203
(720) 508-6000
https://coag.gov/

iii. Texas residents:

Office of the Attorney General
PO Box 12548
Austin, TX 78711-2548
(800) 621-0508
https://www.texasattorneygeneral.gov/contact-us

iv. Connecticut residents:

Office of the Attorney General
165 Capitol Avenue
Hartford, CT 06106
860-808-5318
https://portal.ct.gov

v. Montana residents:

Office of the Attorney General
Justice Building, Third Floor
215 North Sanders
PO Box 201401
Helena, MT 59620-1401
(406) 444-2026
https://dojmt.gov/

vi. Oregon residents:

Oregon Department of Justice
1162 Court Street NE
Salem, OR 97301-4096
503-378-4400
https://www.doj.state.or.us/

vii. Utah residents:

Office of the Attorney General
Utah State Capitol Complex
350 North State Street, Suite 230
SLC UT 84114-2320
1-801-366-0260

b. Nevada Residents:

Although we do not sell Personal Information (as defined in Chapter 603A of the Nevada Revised Statutes), Nevada residents have the right to submit a verified request directing us not to sell your Personal Information. To submit such a request, please contact us using the information in the “Contact Us” section below.

16. How to Submit a Request

You may submit a request to exercise your rights through one of two means:

1. By filling out a Consumer Data Request Form available here.

17. Verification Procedures

In order to process your request to exercise your rights, we must first verify it. We do this by asking you to:

• Provide personal identifiers we can match against information we may have collected from you previously; and
• Confirm your request using the email and/or telephone number stated in the request; or

We will not collect additional Personal Information from you for the sole purpose of your exercising your rights under the data protection laws. Similarly, we will not require you to create an account with us, solely for the purpose of exercising your rights under the data protection laws.

18. European Data Protection

If the processing of your Personal Information is subject to the EEA, Swiss or UK General Data Protection Regulations (GDPR), the rights available to you depend on our lawful basis for processing your Personal Information. Your rights may include:

a. Access: You have the right to ask us for copies of your Personal Information subject to applicable exemptions, which means you may not always receive all the Personal Information we process.

b. Rectification: You have the right to ask us to rectify Personal Information you think is inaccurate. You also have the right to ask us to complete Personal Information you think is incomplete.

c. Erasure/deletion: You have the right to ask us to erase your Personal Information in certain circumstances.

d. Restriction of processing: You have the right to ask us to restrict the processing of your Personal Information in certain circumstances.

e. Right to object to processing: You have the right to object to processing if we are able to process your Personal Information where the processing is in our legitimate interests.

f. Profiling: The right not to be subject to an automated decision-making without human intervention, including profiling.

g. Data portability: Where you have provided us with Personal Information based on your consent, you have the right to ask that it be given to you or transferred to another organization.

h. Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority if you are unhappy with any aspect of our processing of your Personal Information.

You are not required to pay any charge for exercising your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We have one month to respond to you.

For residents of France, you can send us specific instructions regarding the use of your data after your death.

To make such requests or contact our Data Protection Officer, you can contact us at support@DNAComplete.com

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Information (or to exercise any of your other rights). This is a security measure to ensure that your Personal Information is not disclosed to any person who has no right to receive it.

19. GDPR Statement

This GDPR Statement applies to persons located in the European Economic Area (EEA), Switzerland and the UK. This GDPR Statement supplements our Policy; however, where the Policy conflicts with this GDPR Statement, the GDPR Statement will prevail as to persons located in the EEA, Switzerland and the UK.

20. Controller of Your Personal Information and Local Representative

Nebula Genomics, Inc. is the controller of your Personal Information. You may contact our EU representative at Nebula.EUrep@datarologie.com.

Our EU representative’s role in this respect is limited solely to being a contact point for questions on data protection from persons located in the EEA or UK and data protection supervisory authorities. For the avoidance of doubt, our EU representative cannot field other communications or legal process on behalf of DNA Complete.

21. Legal Basis

Pursuant to the GDPR, we will rely on the following legal bases when processing your Personal Information: