How we handle your genetic and health-related data under US state consumer-health-data and genetic-privacy laws. We hold ourselves to the strictest of these standards for every US user. If you live outside the United States, your rights, deadlines and regulator are in our Privacy Policy under “Your Rights By Country”. This is separate from, and additional to, our general Privacy Policy.
We collect the minimum consumer health data needed to give you your reports, never sell it, share it only with processors who run the service, and let you access, delete, or withdraw consent at any time.
"Consumer health data" means personal information linked to your health. For ReadYourDNA that is essentially your genetic information. We collect only what is needed to provide the reports you ask for:
Your raw DNA file - the genotyping or sequencing file you upload. Purpose: to run the analysis you requested.
Analysis results derived from your DNA - genetic trait scores, pharmacogenomic and carrier results, and variant data. Purpose: to generate and show you your educational reports.
Questions you ask the optional assistant about your results. Purpose: to answer them.
Account details (email, username, and your Google account ID if you choose to sign in with Google) linked to the above. Purpose: to secure and operate your account.
We do not collect precise location or health-facility geolocation, biometric identifiers beyond your genetic file, browsing/advertising data, or any consumer health data beyond what the service needs.
We collect consumer health data directly from you - the DNA file you choose to upload, the account details you enter, and any questions you type into the assistant.
We do not obtain your consumer health data from data brokers, public sources, other apps, or any third party. If you choose to sign in with Google, Google tells us your email address and your Google account ID, and nothing else.
We do not sell your consumer health data, and we do not share it for advertising or with data brokers, insurers, employers, or others for their own use. We share it only with the service providers who process it on our behalf, under contract, solely to run ReadYourDNA:
Hetzner Online GmbH - provides the servers, in Finland, where your encrypted file and your results are stored and analyzed. It supplies the machines and the data center only, processes your data solely as our processor under contract, and may not use it for any purpose of its own.
Cloudflare, Inc. - carries and secures traffic between your browser and the site, so your upload passes through its network. It processes it only to deliver and protect the connection, under contract, and keeps no copy.
Google LLC (Gemini API) - powers the optional "Genome Assistant" chat, only if you turn it on, under a data-processing agreement, and is not permitted to use your data to improve or train its models. Google retains prompts for a limited period to detect abuse. We ask for your separate consent, naming Google, before anything is sent.
These are processors/service providers, not independent recipients. We disclose consumer health data outside this list only if compelled by a valid court order, and we do not share it with law enforcement without one.
If you sign in with Google. This is optional and happens only when you press “Continue with Google”. You sign in on Google’s own page, so Google LLC learns that your Google account has an account with ReadYourDNA, and shows ReadYourDNA among your Google account’s connected apps. We send Google no genetic information, no results and no description of what we analyze. You can remove the connection in Settings and in your Google Account at any time.
We collect, use, and share your consumer health data only with your consent, which we ask for before you upload your DNA, and only as necessary to provide the reports you request.
We never use your genetic data for research or any other secondary purpose. The only use beyond generating your own reports is the optional AI assistant, which is separately opt-in and off by default.
You can withdraw consent at any time from Settings; we stop the relevant processing going forward.
We would only ever sell consumer health data with your separate, written authorization first - and we have no plans to sell it.
Several states allow genetic information to be released only to you, or to a person you name in a written authorization, and they make no exception for service providers (Illinois 410 ILCS 513/30, Texas Occ. Code 58.102 and 58.104, Florida 760.40 and 817.5655). So the box you tick before you upload names its recipients: Hetzner Online GmbH and Cloudflare, Inc., both listed above, and nobody else. Google LLC is authorized separately, in the chat, and only if you turn the assistant on. Adding a recipient would need a fresh authorization from you first.
Wherever you live in the US, you can, at any time:
Confirm and access the consumer health data we hold, and download a copy, from Settings.
Delete your genetic data and your account permanently, from Settings. When you delete, we permanently remove your uploaded file and the results we derived from it from our systems, and we do not keep them in backups. Where a service provider processes data on our behalf (for example, the optional AI chat), we bind them by contract to use it only to provide the service, not to train their own models, and to honor deletion and retention limits (consistent with RCW 19.373.060).
Withdraw consent for any optional processing, from Settings.
Appeal if we decline a request - reply to our response and we will re-review, free of charge (the deletion right, our response window and this appeal follow RCW 19.373.040). If we still decline, you may contact your state Attorney General, who handles consumer-privacy complaints in your state. Because our operator is established in the European Union, you may also complain to the Austrian Data Protection Authority (contact details in our Privacy Policy).
To make a request or ask a question, email support@readyourdna.com. We respond within the timeframes required by applicable law.
We extend these access, deletion, and consent-withdrawal rights to every US user regardless of state, and we obtain your express, unbundled consent before collecting your genetic data. This is intended to meet the range of US genetic- and consumer-health-privacy laws, including the California Genetic Information Privacy Act, Nevada SB370, Connecticut’s provisions, the direct-to-consumer genetic-privacy statutes in states such as Florida, Texas, Virginia, Arizona, Utah, Montana, Tennessee, and South Dakota, and the standards set by Washington’s My Health My Data Act and the Illinois Genetic Information Privacy Act. ReadYourDNA is available in all 50 states, the District of Columbia and the US territories, including Illinois and Washington. The same rights, and the same named authorization before any disclosure, apply everywhere.
Your uploaded file is encrypted at rest with AES-256-GCM and in transit over TLS, stored on an access-controlled server, and deleted as soon as its analysis has finished; access follows least-privilege. Server logs, which hold IP addresses, are deleted after 14 days. We keep your consumer health data only for as long as your account is active, and delete it on your request. Your DNA file and the results derived from it are in no backup. Your account details leave the encrypted operational archive on our server within 30 days of deletion, and its copy on a Hetzner storage server in Helsinki, Finland, and our encrypted offline copy within 37 days. If you bought, the receipt for your order (order number, email address, amount, date and payment reference, no genetic data) is kept for seven years under Austrian tax law, then deleted. If we ever become aware of a breach of security affecting your consumer health data, we will notify you as required by law.
This service is operated by Martin Pechhacker, a sole proprietor established in Vienna, Austria. This policy describes how we meet the US state consumer-health-data and genetic-privacy laws. If you live outside the United States, see our Privacy Policy. Contact: support@readyourdna.com; postal address on our Legal & Contact page.
If we make a material change to this policy we will update the date below and, where required, obtain fresh consent before applying the change to previously collected data.
Last updated: September 2026
Raw DNA Data Reports for 23andMe & AncestryDNA · About ReadYourDNA · FAQ · Methodology & Science · Pricing · Support and complaints · Legal & Contact · Health Traits · Pharmacogenomics · Carrier Status · Variant Explorer · The Human Karyotype · Privacy Policy · Terms of Service · Accessibility · Consumer Health Data Privacy · Your Privacy Choices · Editorial Standards · Your Data, Checkable · Sample Report · ReadYourDNA and Promethease compared · What is inside a 23andMe raw data file · What is inside an AncestryDNA raw data file · What a chatbot can and cannot do with your raw DNA file · Where a raw DNA file can still be uploaded in 2026
Written, maintained and operated by Martin Pechhacker, sole proprietor, Vienna, Austria. Trade register GISA 40064420. support@readyourdna.com