Data Handling Policy

1. Overview: Your Data Journey

2. What We Collect

Genetic Data

• Raw DNA data file (typically .txt or .zip format from 23andMe or AncestryDNA)
• Specific genetic variants (SNPs) relevant to our analysis

Personal Information

• Email address (required for report delivery)
• Name (optional)
• Payment information (processed by Stripe, not stored by us)

Technical Data

• IP address and browser information (for security)
• Transaction records (for customer service and refunds)

3. Data Retention Schedule

Note: The 7-day deletion window applies to your raw DNA file, which is stored only on our own servers and is never sent to any AI processor. To generate your report, we send your extracted genetic variant analysis and health profile—not your raw DNA file, and not your name—to our AI processor (Anthropic's Claude API). That processor retains what we send it for up to 30 days for safety and security purposes, after which it is not retained. It is never used to train AI models. See Section 6 for full details on this AI processor.

4. Security Measures

5. What We Do NOT Do

6. Third-Party Services

Your raw DNA file is processed through professional genetic analysis services that specialize in extracting and interpreting genetic variant information. These services:

• Have strict data retention and deletion policies
• Do not sell or share genetic data with third parties
• Do not use data for research without explicit consent
• Maintain their own comprehensive privacy policies

See our Privacy Policy for complete details on third-party data processors.

Payment & Infrastructure Services

• Stripe: Handles payment securely. We never see or store your full credit card number. View Stripe's Privacy Policy
• Email Service Provider: Used to deliver your report. They do not have access to your genetic data, only your email address.
• Cloud Infrastructure: Our servers use industry-standard cloud infrastructure with SOC 2 compliance. All data processing occurs in secure, access-controlled environments.
• AI Report Generation (Anthropic Claude API): Your extracted genetic variant analysis and health profile (weight, age, sex, medications, health conditions) are sent to Anthropic's Claude API to generate your report. Your raw DNA file is never sent—it stays on our own servers. Your name is also never sent: it is replaced with a neutral placeholder before the request goes out and reinserted only when your report is rendered. Anthropic retains this data for 30 days for safety and security purposes and then does not retain it further. We have model-improvement feedback disabled and have not joined any Anthropic data-sharing program, so this data is not used to train AI models. Anthropic's infrastructure is SOC 2 compliant.

7. Your Rights and Controls

Request Data Deletion

Contact us at privacy@wholegene.health to request deletion of any personal information we hold. We will comply within 30 days.

Access Your Data

You can request a copy of all personal information we have about you.

Correction

If any information we have is incorrect, contact us and we'll correct it.

Withdraw Consent

You can withdraw consent for future data processing at any time (note: this won't affect your already-delivered report).

8. Legal Disclosure

We may disclose your information only if required by law:

• Valid court order or subpoena
• Legal requirements in our jurisdiction
• Protection of our legal rights

However, since we delete your raw genetic data within 7 days of report delivery, we typically won't have it available even if legally requested. We will notify you of any legal requests unless prohibited by law.

9. Data Breach Procedures

In the unlikely event of a data breach:

• We will notify affected users within 72 hours
• We will notify relevant authorities as required by law
• We will provide clear information about what data was affected
• We will take immediate steps to secure systems and prevent further breaches

Note: Because we delete raw genetic data quickly, the risk window for the most sensitive information is minimized.

10. International Transfers

Your data may be processed in the United States. If you are located outside the US, your data will be transferred to the US for processing. We ensure appropriate safeguards are in place, including standard contractual clauses where required.

11. Changes to This Policy

We may update this Data Handling Policy to reflect changes in our practices or legal requirements. We will:

• Post the updated policy on our website
• Update the “Last Updated” date
• Notify existing customers of material changes via email

12. Contact Us

For questions about how we handle your data, or to exercise your data rights:

Data Protection Contact:
Email: privacy@wholegene.health

We aim to respond to all inquiries within 48 hours during business days.

13. Genetic Information Nondiscrimination Act (GINA)

In the United States, the Genetic Information Nondiscrimination Act (GINA) provides some protections against genetic discrimination in health insurance and employment. However, GINA does not cover life insurance, disability insurance, or long-term care insurance. We encourage you to understand your rights under GINA and related state laws.