Your genetic data is among the most personal information you have. Here's how we protect it.
ReadYourDNA is built with privacy-first architecture. Your DNA upload is encrypted at rest (AES-256-GCM) and in transit (TLS) and deleted once its analysis finishes, your results are never sold, our pages load nothing from any other company, and you can delete everything at any time. How to check all of this yourself.
Your DNA upload is encrypted (AES-256-GCM) and deleted as soon as its analysis finishes
Your genetic data is never sold to advertisers, insurers, or data brokers
Delete your DNA file and its results permanently, at any time
We collect only the minimum data necessary to provide our genomic analysis services:
Account information - Email address and username for authentication
If you sign in with Google - your email address, the fact that Google has verified it, and your Google account ID (a number Google assigns to your Google account), plus the date you connected it. We do not receive your name, photo, contacts or anything else from your Google account. The legal basis is the contract you ask us to set up and run (GDPR Art. 6(1)(b)). This is optional: an email address and a password work just as well
Genomic data - Raw DNA file you upload (e.g., from 23andMe or AncestryDNA)
Analysis results - Computed scores and variant data derived from your DNA file
Eligibility and consent records - Your country of residence, and your US state of residence if you live in the United States, your confirmation that you are 18 or older, the version of the Terms you accepted, and a timestamped record of each acknowledgement you give or withdraw (the results disclaimer, the medication module, the genome assistant, and your consent to your data being processed outside your own country)
How you found us - If the link you arrived by carried a referral code (a short code we put on our own listings and posts, and on the links our Share buttons create, which name the network the link was shared to), your browser keeps that code for 30 days and sends it once, when you create an account. At signup you may also answer "How did you hear about us?"; the answer is optional. We use both only to count which channels bring people here. They are stored with your account, included in your data export, deleted with your account, and never shared.
Technical access log - for each request to the site, the server records your IP address, the country Cloudflare reports it comes from, the page or file requested, the time, and the browser identification and referring page your browser sends. We keep it for 30 days, only to investigate security incidents and abuse, and it is then deleted automatically. The legal basis is our legitimate interest in keeping the service and your data secure (GDPR Art. 6(1)(f)).
Sign-in and sign-up attempts - to stop people guessing passwords or creating accounts in bulk, we count failed sign-ins, requests for a password-reset link, failed attempts to reset a password, new accounts and messages sent through the support form. For each attempt we keep the time, and the network (IP) address it came from and any email address entered, both only in a scrambled form. We never keep the password you typed. Each count is deleted once it is an hour old, and none is kept longer than about 70 minutes. The legal basis is our legitimate interest in keeping the service and your account secure (GDPR Art. 6(1)(f)).
Visits from other sites - to tell a person from automated traffic, when a page reports that it was opened from another site we keep the time and the network (IP) address it came from, only in a scrambled form. It lets us ignore more than 30 such reports an hour from one address, and count how many pages of ours the same address goes on to open within the hour, up to ten, which is how we know whether people read on. Each entry is deleted once it is an hour old, and none is kept longer than about 70 minutes. It is never joined to an account or to your results. The legal basis is our legitimate interest in knowing how many people actually use the service, as opposed to programs that only look like visitors (GDPR Art. 6(1)(f)).
Genome assistant question count - if you use the optional genome assistant, we count the questions your account asks each day, so that each account can ask one question at a time and no more than 50 a day. For this we keep your email address only in a scrambled form, the date and that day's count, and, while a question is being answered, the time it started. We keep none of your questions or the assistant's answers for this. Each day's count is deleted shortly after that day ends at midnight UTC, and at once if you delete your account. The legal basis is our legitimate interest in keeping the assistant available to everyone who uses it (GDPR Art. 6(1)(f)).
What you have to give us, and what happens if you do not. No law requires you to give us any of this. An email address and the eligibility answers are what an account needs, and a DNA file is what an analysis needs, because without one there is nothing to analyse. You are free to provide none of it. If you never upload a file you can still open an account, read everything on the site and explore the sample genome; you simply will not receive results of your own. Anything you have already given, you can withdraw and delete at any time.
We ask where you live because the country you live in, and in the United States your state, decides which rights you have and which regulator you can complain to, and because ReadYourDNA is not offered in Austria. We do not sell this information, share it, or use it to target you.
We do not track your location, and we do not follow you across other websites. Cloudflare, which carries traffic to the site, does tell us the country and region an incoming request comes from. We use that to enforce where the service is available, and we count it in aggregate to see which countries our users are in. Apart from the country recorded in the access log above, we do not keep it against your account or your visit.
Service statistics. We count how the service is used so we can run it properly: how many people sign up, how many files are analysed, how long an analysis takes and at which stage, how often it fails and why, which sections of the site are opened, which country a visit comes from, which browser, operating system and device type it uses, which language the browser asks for, which kind of website a visit arrived from (for example a search engine, an AI assistant or a social network, taken from the address of the referring site and never the page on it, or from the tag an AI assistant adds to its links) and, for an AI assistant, which one, and how much of our traffic is crawlers and automated scanners rather than people, by kind of crawler. To tell an automated visit from a real one we also count whether the page finished loading in a real browser and whether anyone then used it: once a page has drawn itself in a visible tab it sends one request back to us, one more the first time you scroll, press or type on it, one more if it stays in view for ten seconds, and a last one when you leave it. That last one says how many seconds the page was on screen, how far down the page you read, how many times you scrolled, pressed, typed, touched or copied, and what was pressed: a link of ours counts as the page it leads to, a link to another site as that site's address and never the page on it, and a button or tab by the label it shows you. Each carries only the kind of site the visit came from (for an AI assistant, its name as its link tag gives it), which section was opened, whether the browser reports itself as automated (a setting every browser exposes for that purpose), and a one-time code that the page itself was served with, so that only a page we actually sent can report back; the code is random, expires within a day, names nothing about you and is kept nowhere in your browser. There is no cookie and no identifier of any kind. We also check that a request carries the headers the browser it names always sends, so a script pretending to be a browser is counted as a script. We also count the shape of the files people upload, which we already work out in order to analyse them: which testing service produced the file, which reference genome it uses, and roughly how many markers it contains. These are counts and nothing else. They are totalled as they are recorded, so there is no record of an individual visit behind them: no IP address, no visitor or session identifier, and nothing that could be traced back to you or joined to your results. Pages that show a specific trait, variant or medication are counted only as “a trait page was opened”, never as which one. We use no analytics service and no third-party tracker of any kind, and we set no cookie for any of this.
ReadYourDNA is an educational service, not a healthcare provider, and is not a HIPAA-covered entity - HIPAA does not apply to this data.
ReadYourDNA is operated by Martin Pechhacker, a sole proprietor established in Vienna, Austria (the "data controller"). Because our operator is established in the European Union, the EU General Data Protection Regulation (GDPR) applies to our processing of your personal data in full - in addition to the law of the country where you live, which is set out in "Your Rights By Country" below.
Data controller - Martin Pechhacker, Arndtstraße 89/10, 1120 Vienna, Austria. The full operator directory is on our Legal & Contact page.
Privacy contact - support@readyourdna.com. We have voluntarily designated this as our data-protection contact point.
Right to complain - you can lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria, dsb@dsb.gv.at, dsb.gv.at.
We process your personal data only where the law gives us a valid basis. Under the GDPR our bases are:
To provide the service you signed up for - creating your account, storing the file you upload, and generating your educational reports. Basis: performance of our contract with you (GDPR Art. 6(1)(b)).
To analyze your genetic data and produce health-related insights - your polygenic trait, carrier, pharmacogenomic and variant reports. Genetic and health-inference data is a "special category," so our basis is your explicit consent (GDPR Art. 9(2)(a)), which you give at upload and can withdraw at any time.
Security, fraud prevention, and legal compliance - our legitimate interests (Art. 6(1)(f)) and our legal obligations (Art. 6(1)(c)).
Withdrawing consent does not undo processing we already carried out before you withdrew, but we will stop the relevant processing, and you can delete your data at any time.
Providing your data is entirely voluntary: it is not a statutory or contractual requirement, and you are under no obligation to provide it. The only consequence of not providing it is that we cannot generate your educational reports.
What our scores are, and what they are not. To build your reports, ReadYourDNA runs an automated analysis of the DNA file you upload. For trait and health reports this includes polygenic scoring: adding up the small effects of many common variants and comparing your result to a reference population to produce a percentile or score.
These scores are educational estimates, not a diagnosis and not a medical test. A score is a statistical comparison, not a prediction that you will or will not develop a condition.
Polygenic scores are built mostly from studies of people of European ancestry and are less accurate for other ancestries; they also do not capture rare, high-impact variants.
On a free account the same analysis runs on your file, and its results are stored on your account in the same way, so that ordering the full report later can open them without a second analysis. Until you order, you see only the traits you choose to unlock. A free account's data is protected, kept and deleted exactly like any other account's, and it is never sold or shared.
The analysis is used only to show you your own reports. It does not produce any decision with a legal or similarly significant effect on you (GDPR Art. 22): we never use it to decide anything about your eligibility, employment, insurance, or credit.
Your genomic data is protected with strong, standard security measures:
Your raw DNA upload is encrypted at rest with AES-256-GCM, using a key held separately from the data file, and it is deleted as soon as its analysis has finished; what stays are the results your reports are built from
Your results are kept in a folder named by a random code. Nothing in that folder names you: no email address, no username, and not even the name of the file you uploaded, which for some services contains your name
Sign-in sessions are stored only in scrambled (hashed) form, so a copy of our account records would sign nobody in
All data is transmitted over encrypted TLS (1.2+) connections
Our pages load nothing from any other company: no analytics, no advertising, no fonts or scripts from elsewhere, and your browser is told to refuse anything that is not ours
Your files are stored separately per account, and access is restricted on a least-privilege basis
Your data is never pooled with other customers' data - your reports are produced by comparing your genome against a fixed reference panel, and your upload is never added to that panel
On our production servers, the storage volume is encrypted at rest
We keep your data only as long as we need it to provide the service:
Your uploaded DNA file is kept only until its analysis has finished, then deleted. If an analysis stops or fails, the file stays so that you can run it again without uploading, and goes once a run finishes. To analyse your file again later, you upload it again.
The results derived from your file are kept for as long as your account is active, so your reports stay available to you. This is the same on a free account: the results of its free analysis are kept while the account is active, and deleted with it.
When you delete your genetic data or your account, your DNA file and every result derived from it are erased permanently and without undue delay. They are in no backup, so no restore can bring them back.
Your account record itself - your email address, username, your Google account ID if you sign in with Google, login credentials, settings, consent choices and any order details, never your DNA file or anything derived from it - is removed from our live systems at the same moment. It stays in the hourly encrypted operational archive on our server for up to 30 days, and in the copy of that archive on a Hetzner storage server in Helsinki, Finland, for up to 37 days: an archive leaves that storage server when it leaves our server, and the storage server keeps daily snapshots for 7 days. The encrypted offline copy of that archive, which we keep so that the service can be restored after a failure, is deleted on the same schedule, within 37 days. After 37 days no copy of a deleted account record remains anywhere.
Our server logs, the only place your IP address is written down, are deleted after 14 days. The site's own statistics are counts with no address, no visitor ID and no record of anyone's path through the site.
If you bought, the receipt for your order is kept for seven years, then deleted. Austrian tax law requires this (section 132 BAO; GDPR Art. 17(3)(b)) and counts the seven years from the end of the year of your order. The receipt holds the order number, your email address, the amount, the date and the payment reference, and never any genetic data. Deleting your account does not delete it. Once it is deleted, its copies in the archive described above go within the same 30 and 37 days, and it can remain longer in the offline copy.
We keep a minimal, append-only record of each consent you give or withdraw, and of the closing of your account, so that we can show we had your consent if that is ever questioned. This record contains no genetic data. We keep it for six years after your account is closed, then delete it. The entries in it about an order are tax records, so they are kept for seven years from the end of the year of the order, then deleted.
We aim to keep your data within the European Economic Area (EEA). Where any processing takes place outside the EEA, we protect the transfer with a safeguard required by GDPR Chapter V:
Hosting - your file and your results are stored and analyzed on servers we rent from Hetzner Online GmbH, in Finland, inside the EEA. Hetzner supplies the machines and the data center only: it processes your data solely as our processor, under a data-processing agreement, and may not use it for any purpose of its own. Because Finland is inside the EEA, this is not a transfer out of the EEA. If we ever move to a host outside the EEA, we will name it here before we do, put Standard Contractual Clauses or an adequacy decision in place first, and give you a copy of the safeguard on request.
Traffic between your browser and the site - every request to ReadYourDNA, including your upload, travels through the network of Cloudflare, Inc., a company in the United States, which protects the site against attack and delivers it quickly. Cloudflare ends the encrypted connection from your browser at its own servers and opens a new encrypted connection to ours, so for the moment it takes to pass a request on, Cloudflare handles that request, and the content of an upload, in readable form. It sees your IP address and the country it comes from, the page or file you ask for and the reply. It processes all of this only to carry and protect the connection, under a data-processing agreement that forbids any use of its own, and it does not keep a copy of what passes through; it may keep the public pages of the site in a cache so they load faster. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (and its Swiss and UK extensions), and the same agreement puts the EU Standard Contractual Clauses in place as a fallback should that certification ever lapse. A copy of the safeguard is available on request.
Optional AI chat - if you turn it on, your question and the relevant parts of your results are sent to Google's Gemini API, operated by Google LLC. Because ReadYourDNA is established in the EEA, Google applies its paid-service data terms to our account: your prompts and results are not used to improve or train Google's models, and are not read by human reviewers for product improvement. Google retains prompts for a limited period to detect abuse, and does not guarantee the country in which that processing happens. Google LLC is certified under the EU-US Data Privacy Framework. The chat is off by default and runs only when you turn it on.
Emails we send you - we send email through Sendinblue SAS, trading as Brevo, in France, inside the EEA. That covers order confirmations, withdrawal acknowledgements, a note that your report is ready, a link to reset your password when you ask for one, and notices about your account: a changed or reset password, two-factor authentication switched on or off, a deleted file or a closed account. You get the account notices whether or not you buy. If you tick the optional box at sign-up or at checkout, we may also email you occasionally about new content in your account; every such email carries an unsubscribe link, and you can withdraw at any time in your account settings or by writing to support@readyourdna.com. That box is never required, and we send nothing of the kind without it (GDPR Art. 6(1)(a)). Brevo receives your email address and the message itself; for an order, that is the order number, the price, the dates, and how to withdraw. If you write to us through the support form, or give a reason when you withdraw, your message and your email address also reach us by email through Brevo, so Brevo carries whatever you write in it. Apart from what you write to us yourself, it never receives your file, your results, or any description of what we analyze, and it may not use your address for anything except delivering those messages. We send the order confirmation because the law requires the contract to reach you on a medium you can keep, which a page on this website is not.
Signing in with Google - only if you choose “Continue with Google”. You sign in on Google’s own page, run by Google LLC in the United States (in the EEA, Google Ireland Limited), so Google knows that your Google account has been used to sign in to ReadYourDNA, and it lists ReadYourDNA among the apps connected to your Google account. Our server then receives your email address, whether Google has verified it, and your Google account ID from Google. We send Google nothing about you except a one-time sign-in code it issued a moment earlier: never your file, your results, or any description of what we analyze. For its part of the sign-in, Google acts under its own terms and privacy policy, not on our behalf. Google LLC is certified under the EU-US Data Privacy Framework. You can remove Sign in with Google in Settings (once your account has a password) and remove ReadYourDNA from your Google Account’s connections at any time.
Payments - when you buy, the payment is handled by Stripe Payments Europe, Limited, in Ireland, inside the EEA. Stripe receives your email address, the order number and price, and the name, card and any billing details you enter on its payment page. Card details go straight from your browser to Stripe and never pass through our servers. It never receives your file, your results, or any description of what we analyze: the product is called only “Report”, and your card statement shows “RYD REPORT”. Stripe processes the payment for us, and is also responsible in its own right, under its own privacy policy, for fraud prevention and the legal duties of a payment institution. Stripe may transfer data to Stripe, Inc. in the United States, which is certified under the EU-US Data Privacy Framework.
Wherever you live - if you are outside the European Economic Area, your file and your results are processed outside your own country from the moment you upload. The countries that receive them may not be required to protect your information in a way that, overall, gives safeguards comparable to the law where you live. We rely on two things: your consent, which we ask for separately before you upload and again before the AI chat is turned on, and a written agreement with each company named under “Data Sharing” that limits it to running ReadYourDNA for us and forbids any use of its own. We stay responsible to you for what they do with your data, and you can turn the chat off, or delete everything, at any time.
We maintain an incident-response plan to detect, contain, and investigate any unauthorized access to your data, and any disclosure of it we did not have your authorization to make. If a breach affecting your personal data occurs, we will:
Tell you as soon as practicable, and never later than the shortest deadline that applies where you live. Where no shorter deadline applies, no later than 60 days after we discover the breach
Tell you what happened, what data was involved, what we are doing about it, and the steps you can take to protect yourself
Notify the regulator each law requires, on its timetable and not ours: the Austrian Data Protection Authority within 72 hours (GDPR Arts. 33 and 34); the ANPD and you within three working days in Brazil; the Data Protection Board of India without delay, with the fuller report within 72 hours; the Personal Data Protection Commission within three calendar days in Singapore; the Office of the Australian Information Commissioner as soon as practicable, after assessing within 30 days; the Privacy Commissioner of Canada, and the Commission d’accès à l’information du Québec, as soon as feasible; the Office of the Privacy Commissioner in New Zealand as soon as practicable; the Information Commissioner’s Office in the United Kingdom within 72 hours; the Federal Data Protection and Information Commissioner in Switzerland as soon as possible; in the United States the Federal Trade Commission, plus prominent media for incidents affecting 500 or more people (16 CFR Part 318); and in every other country, the authority its own law names, within the time that law sets
If you believe your account or data has been compromised, contact us right away at support@readyourdna.com.
We never sell your data, and we never share it with third parties for their own purposes:
Your data is never sold, and never shared with advertisers, insurers, or data brokers
Five companies process personal data for us in all, each strictly on our behalf under a data-processing agreement and only for what we engaged it to do. Three of them are the only ones that ever handle your genetic data: Hetzner Online GmbH (it provides the servers in Finland where your file and your results are stored and analyzed), Cloudflare, Inc. (it carries and secures traffic between your browser and the site, so your upload passes through its network on the way to our server) and Google LLC (only if you turn on the optional AI chat, and only for the questions you ask it). The other two, Stripe and Brevo, are described in the next point and never receive your file, your results or any description of what we analyze. They may not use your data for their own purposes or to train their models. Some privacy laws, including several US state genetic-privacy laws, treat sending data to a service provider as a disclosure in its own right, so we name them here rather than rely on that distinction, and we ask for your separate consent before the chat sends anything to Google. (Full list in our Consumer Health Data Privacy Policy.)
When you buy, Stripe Payments Europe, Limited processes the payment. Brevo delivers the emails we send you: your order confirmation, the note that your report is ready, a password-reset link when you ask for one, and notices about your account's security or a deletion, which go to every account holder whether or not they buy. Neither receives your file, your results, or any description of what we analyze. What each one receives is set out under “International Data Transfers”.
If you sign in with Google, you sign in on Google’s own page, so Google learns that your Google account has an account here. We send Google nothing about you beyond the one-time sign-in code Google itself issued, and nothing about your file or your results. See “International Data Transfers” above
We never use your genetic data for research or to improve our models, and we never share your identifiable data with any third party for their own purposes. Your data is used only to generate and show you your own reports
We will only disclose data if legally required by a valid court order
You have complete control over your data:
Delete your genomic data at any time from Settings
Deletion of your genomic data is permanent and irreversible - it is excluded from every backup, so no restore can undo it
Account deletion removes all associated data promptly, within any timeframe required by applicable law; the account record clears the encrypted operational archive on our server within 30 days, and its copy on a Hetzner storage server in Helsinki and our encrypted offline copy within 37 days; if you bought, the receipt for your order (order number, email address, amount, date and payment reference) is kept for seven years under Austrian tax law, then deleted
We honor data access, correction, and deletion requests in line with the GDPR and with the privacy law of the country where you live, including the CCPA/CPRA and US state genetic-privacy laws in the United States
We keep tracking to zero:
No advertising or analytics cookies, and no third-party trackers
We store a small amount of data in your browser's local storage: your sign-in token, your account email and display name, which acknowledgements you have given (the results disclaimer, the medication module, the genome assistant), which sensitive results you have chosen to reveal, and a few flags that remember whether your analysis is running or finished. While you sign in with Google, a random one-time value is kept in that tab’s session storage so our server can tell that the sign-in which comes back from Google is the one your browser started; it is deleted when the sign-in finishes, and at the latest when you close the tab. If you use the optional Genome Assistant, your conversation with it is also kept in your browser's session storage for that tab, so it survives a reload; it is discarded when you close the tab, and you can clear it from the chat itself
All of it is strictly necessary to keep you signed in and to avoid re-asking you things you have already answered. None of it is used for advertising or analytics. Signing out clears it, and so does deleting your account; you can also clear it yourself at any time from your browser
Wherever you live, you can exercise these rights over your data at any time:
Access and portability - see and download a machine-readable copy of your data from Settings.
Correction - update your account details in Settings.
Deletion - permanently delete your genomic data and your entire account from Settings.
Withdraw consent - where a feature relies on your consent (for example, generating your genetic reports), you can withdraw it at any time.
Restriction and objection - ask us to pause our use of your data, or object to a particular use, while we look into a concern.
Lodge a complaint - if you are unhappy with how we handle your data, you can complain to a data-protection regulator, including the Austrian Data Protection Authority (see "Who We Are" above).
Because our operator is established in the European Union, these rights are backed by the GDPR (Arts. 15-22) for everyone, alongside the US rights below. We respond within one month (extendable where the law allows), and making a request is free.
United States residents, including under the California Consumer Privacy Act (CCPA/CPRA) and state genetic-privacy laws, also have the right to know what we collect, to have it deleted, and to opt out of any sale or sharing of personal information (we do not sell your data). To make a request or ask a privacy question, email support@readyourdna.com; if we decline a request, you may appeal by replying to our response.
Sensitive personal information. Your genetic data is "sensitive personal information" under California law (CPRA) and a "special category" of data under the GDPR. We use it to generate the educational reports you ask for and for related security and service purposes, and for nothing else. We do not use or disclose it to build advertising or marketing profiles, for cross-context behavioral advertising, or to infer things about you for any purpose outside those reports and services. Because we limit our use to these permitted purposes, we are not required to offer a separate "Limit the Use of My Sensitive Personal Information" option; you can still withdraw consent, and access or delete your data, at any time. See Your Privacy Choices for a summary of these options and how to use them.
Large language models. We do not sell your personal data to anyone developing a large language model, and we do not use it to train one, whether our own or anyone else’s. If you switch on the optional genome assistant, the parts of your results needed to answer your question are sent to Google’s Gemini API to produce that answer and are not used to train Google’s models. If you never switch it on, nothing of yours reaches a model at all.
Everything above applies wherever you live: we ask for your express consent before we analyze your file, we never sell your data, and access, export, correction and deletion are self-service in Settings and take effect immediately. Your own country adds a regulator, and sometimes a shorter deadline or an extra rule. Those are listed here rather than repeated throughout this policy.
United Kingdom - the UK GDPR and the Data Protection Act 2018 apply, because we offer the service to people in the UK. Your genetic data is special category data under Art. 9, and our gateway is your explicit consent under Art. 9(2)(a). You have the same access, portability, correction, deletion, restriction and objection rights as under the EU GDPR, and we answer within one month, extendable by two further months for a complex request. Under section 164A of the Data Protection Act 2018, inserted by the Data (Use and Access) Act 2025, you may complain to us first: write to support@readyourdna.com or use our support form. We acknowledge a data-protection complaint within 30 days, in practice far sooner, investigate it and tell you the outcome. You do not have to come to us first, and you may go straight to the regulator. Complaints: the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk.
Switzerland - the Swiss Federal Act on Data Protection (FADP, revised text in force since 1 September 2023) applies, because we offer the service to people in Switzerland. Your genetic data is sensitive personal data under Art. 5(c), and where we rely on your consent to process it that consent has to be, and is, express (Art. 6(7)(a)): it is the separate box on the upload page, which you can withdraw at any time. You have the right to ask what we hold about you and to receive it (Art. 25), to have it handed over or transferred in a common electronic format (Art. 28), and to have it corrected (Art. 32); all three are self-service in Settings, and if you write to us instead we answer within 30 days (Art. 25(7)). Our contact for all of this is support@readyourdna.com. Complaints: the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch. Switzerland is not in the European Economic Area, so the data of a person living in Switzerland is processed abroad from the moment of upload, on servers in Finland; the section “International Data Transfers” above says what leaves the EEA and on what safeguard.
European Economic Area - the GDPR governs everything we do, because our operator is established in Vienna. You may complain to the supervisory authority of the country where you live, where you work, or where you think the problem happened (Art. 77), not only to the Austrian authority. Austrian law adds section 71 of the Gene Technology Act, which binds us to keep data obtained from a genetic analysis secret and lets us pass it on only with your express and written consent, which you may withdraw in writing at any time. That is why the AI chat asks separately, records what you agreed and when, and why you can download that record from Settings. We answer within one month, extendable by two further months for a complex request. We set no cookies: what we keep in your browser is strictly necessary to deliver the service you asked for, which Article 5(3) of the ePrivacy Directive allows without consent, and that is why there is no banner. Austria is where our operator is established, and Austrian law therefore governs how we handle your data wherever you live, but we do not offer the service to people in Austria.
Canada - PIPEDA applies, and Quebec’s Law 25 as well if you live in Quebec. We answer within 30 days anywhere in Canada. The individual accountable for our compliance under PIPEDA Principle 4.1, and the person in charge of the protection of personal information under section 3.1 of Law 25, is the operator named on our Legal & Contact page, reachable at support@readyourdna.com. Section 5 of the Genetic Non-Discrimination Act allows the results of a genetic test to be collected, used or disclosed only with your written consent: the box you tick before uploading, and the dated record we keep of it, are that consent. We never require anyone to take a genetic test, and never ask anyone to disclose results as a condition of anything. Complaints: the Office of the Privacy Commissioner of Canada, priv.gc.ca, the Commission d’accès à l’information du Québec, or your provincial commissioner in Alberta or British Columbia.
Australia - the Privacy Act 1988 and the 13 Australian Privacy Principles apply, and we do not rely on the small business exemption. Your genetic information is “sensitive information” under section 6(1), so we collect it only with your consent. We answer access and correction requests within 30 days. Under APP 8 and section 16C we stay accountable to you for what our overseas providers do with your data. Our services also come with consumer guarantees under the Australian Consumer Law that cannot be excluded. Complaints: the Office of the Australian Information Commissioner, oaic.gov.au, after giving us 30 days first.
New Zealand - the Privacy Act 2020 applies, because we carry on business in New Zealand even though we have no place of business there. We decide access and correction requests as soon as reasonably practicable and never later than 20 working days. Our privacy officer under section 201 is reachable at support@readyourdna.com. We are not a health agency in the ordinary sense, but the Health Information Privacy Code can reach an agency that provides services in respect of health information, so we do not rely on being outside it: we apply its rules alongside the Act, and you may complain to us or to the Privacy Commissioner either way. Complaints: the Office of the Privacy Commissioner, privacy.org.nz.
Brazil - the LGPD applies. Your genetic data is “dado pessoal sensível”, and our only basis for it is your specific and highlighted consent for a specific purpose (Art. 11 I), which is the separate box on the upload page. You may refuse it, and the only consequence is that we cannot produce your reports (Art. 18 VIII). We confirm and give access immediately in simplified form, and give the full written statement within 15 days (Art. 19). Our encarregado under Art. 41 is the operator named on our Legal & Contact page, reachable at support@readyourdna.com. Complaints: the Autoridade Nacional de Proteção de Dados, gov.br/anpd. As a consumer you may also bring a claim at your own domicile, and you have the 7-day right of regret under Art. 49 of the Consumer Defence Code.
Singapore - the Personal Data Protection Act 2012 applies, because it covers any organisation that handles personal data in Singapore whatever its country. You may ask for a copy of your personal data and for an account of how it was used or disclosed in the year before your request, and for correction. We aim to answer within 30 days and, if we cannot, we write within 30 days to say when we will. Our designated individual under section 11(3) is the operator named on our Legal & Contact page, reachable at support@readyourdna.com, with the postal address on that same page. We publish an email and postal contact rather than a telephone number, because a number outside Singapore would not be a contact point you could usefully reach. We collect no telephone number and send no marketing, so Part 9 does not arise. Complaints: the Personal Data Protection Commission, pdpc.gov.sg.
India - the Digital Personal Data Protection Act 2023 has been passed but its main obligations are not yet in force; they are being commenced in stages and the substantive duties are expected in 2027. What binds us today is the Information Technology Act 2000 and the SPDI Rules 2011, under which your genetic and health data is sensitive personal information and we need your consent for it. We have chosen to give you the DPDP rights now rather than wait, as a commitment to you. You have the right to a summary of what we process, to correction, completion and erasure, to grievance redressal, and to nominate someone to exercise your rights if you die or cannot act for yourself. Email support@readyourdna.com from the address on your account, which is the identifier we use to recognise you. We answer a grievance within 30 days. Our grievance officer under rule 5(9) of the SPDI Rules 2011, and under rule 4(4) of the Consumer Protection (E-Commerce) Rules 2020, is the operator named on our Legal & Contact page, reachable at support@readyourdna.com. Once the DPDP grievance provisions commence, we will also observe the 90-day outer limit in rule 14(3) of the DPDP Rules 2025, and you will be able to approach the Data Protection Board of India after using our route first. The Board is not yet able to take your complaint, so until it is, please come to us or to a consumer forum. We are not onboarded with any registered Consent Manager, so that route is not available for ReadYourDNA. The Act has no separate category for genetic data; we hold it to the stricter standard described above anyway.
Every other country - if your country is not listed above, its own data-protection law applies to us alongside the GDPR, and where it gives you a further right or a shorter deadline, we follow it. Use any of these rights in Settings, or write to support@readyourdna.com; unless your law sets a shorter time, we answer within one month. You may complain to us first, or go straight to the data-protection authority of your country, and wherever you live you may also complain to the Austrian Data Protection Authority (see “Who We Are” above).
For any privacy-related inquiries, data access requests, or concerns:
Data controller: Martin Pechhacker, sole proprietor, Vienna, Austria
Email: support@readyourdna.com (also our voluntary data-protection contact point)
Supervisory authority (EU): Austrian Data Protection Authority - dsb@dsb.gv.at. For the countries listed under “Your Rights By Country” above, the regulator and its contact details are named there; anywhere else, it is the data-protection authority of the country where you live
Response time: within one month under the GDPR, extendable by two further months for a complex request, and sooner where the law where you live requires it or where we have committed to it (30 days in Canada, Singapore and Switzerland, 20 working days in New Zealand, 15 days in Brazil, and 45 days under the CCPA). In Australia the law requires a reasonable period and we treat that as 30 days; in India no period is prescribed for access or correction and we also answer within 30 days
Data portability: You can download all your data from Settings at any time
Your genetic data is not a business asset, and it is never sold or handed over with the business. If ReadYourDNA is ever sold, merged, closed, or becomes insolvent, your DNA file and every result derived from it are deleted, not transferred to a buyer, a successor or a creditor. We will tell you in advance, so that you can download your results first. A buyer or successor may continue the service only with genetic data that people upload to it afresh, under its own terms.
If we make a material change to how we use your genetic data, we will update the date below and notify you. Because processing your genetic data relies on your explicit consent, we will obtain fresh, explicit consent before applying any materially different use to data we have already collected - we will never silently apply a new policy to data you gave us under the old one. You can withdraw consent and delete your data at any time.
Last updated: October 2026
Raw DNA Data Reports for 23andMe & AncestryDNA · About ReadYourDNA · FAQ · Methodology & Science · Pricing · Support and complaints · Legal & Contact · Health Traits · Pharmacogenomics · Carrier Status · Variant Explorer · The Human Karyotype · Privacy Policy · Terms of Service · Accessibility · Consumer Health Data Privacy · Your Privacy Choices · Editorial Standards · Your Data, Checkable · Sample Report · ReadYourDNA and Promethease compared · What is inside a 23andMe raw data file · What is inside an AncestryDNA raw data file · What a chatbot can and cannot do with your raw DNA file · Where a raw DNA file can still be uploaded in 2026
Written, maintained and operated by Martin Pechhacker, sole proprietor, Vienna, Austria. Trade register GISA 40064420. support@readyourdna.com