Privacy Policy

Scope

This Privacy Notice applies to the processing of personal data by us in connection with:

Customers: Individuals who purchase our DNA testing kits, register a kit or access genetic analysis results through our services.
Suppliers: Organisations or individuals who provide products or services to us to assist us with the running of the business.
Practitioner/Partner: Professionals or partner organisations who use our services on behalf of or in connection with their own clients.
Website visitors: Anyone browsing our website or interacting with our content online.

Who We Are (Data Controller)

A "controller" is a person or organisation who alone or jointly determines the purposes for which and the way any personal data is or is likely to be processed. Unless we notify you otherwise, we act as the controller of your personal data for the purpose of this website where you are a customer, supplier/partner and website visitor.

Types of Personal Data

Personal data or personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed. This is known as anonymised data. Anonymised data falls outside the scope of Data Protection Laws.

What Personal Data We Collect and How We Collect It

Customer

What we collect	How we collect it
Contact & identity data: Name, email, postal address, phone (if provided). Payment data: Billing details (handled by third parties; we do not store full card information). Account data: Login Credentials, email, sample barcode. Special category data: Genetic data (raw DNA files from the lab) and inferred health data (variant reports), Biological Sex. Technical Data: IP address, device info, login times.	From you: When you purchase a kit, register your kit, create or access your account or communicate with us. From the laboratory: Raw genetic data generated from the analysis of your sample, which is provided to us in pseudonymised form and linked to your account using a sample barcode. Through our secure results portal: When you access, download or manage your results via the Tresorit Engage portal. Automatically: Limited technical information collected when you interact with our website or services for example IP address, device information and login activity.

What we collect

How we collect it

Contact & identity data: Name, email, postal address, phone (if provided).
Payment data: Billing details (handled by third parties; we do not store full card information).
Account data: Login Credentials, email, sample barcode.
Special category data: Genetic data (raw DNA files from the lab) and inferred health data (variant reports), Biological Sex.
Technical Data: IP address, device info, login times.

From you: When you purchase a kit, register your kit, create or access your account or communicate with us.
From the laboratory: Raw genetic data generated from the analysis of your sample, which is provided to us in pseudonymised form and linked to your account using a sample barcode.
Through our secure results portal: When you access, download or manage your results via the Tresorit Engage portal.
Automatically: Limited technical information collected when you interact with our website or services for example IP address, device information and login activity.

Suppliers, Practitioners, Partners

What we collect	How we collect it
Contact & identity data: Name, business name, job title, email address, postal address and telephone number. Business and contractual data: Information required to enter into and manage our contractual relationship including correspondence, service details and records of communications. Payment and financial data: Bank account details, invoicing information and payment records necessary to process payments. Technical data: Limited technical information such as IP address or device information where you interact with our systems, portals or websites.	From you: Where applicable when you provide services to us, or request services from us, communicate with us, enter into a contract or send invoices or other business documentation. From your organisation: Contact and role information provided by your employer. Automatically: Limited technical information collected when you interact with our website, systems or email communications for example IP address or system logs.

What we collect

How we collect it

Contact & identity data: Name, business name, job title, email address, postal address and telephone number.
Business and contractual data: Information required to enter into and manage our contractual relationship including correspondence, service details and records of communications.
Payment and financial data: Bank account details, invoicing information and payment records necessary to process payments.
Technical data: Limited technical information such as IP address or device information where you interact with our systems, portals or websites.

From you: Where applicable when you provide services to us, or request services from us, communicate with us, enter into a contract or send invoices or other business documentation.
From your organisation: Contact and role information provided by your employer.
Automatically: Limited technical information collected when you interact with our website, systems or email communications for example IP address or system logs.

Website Visitors

We may collect the following categories of personal data when you browse or interact with our website.

What we collect	How we collect it
Technical data: IP address, device type, browser type, operating system and usage information such as pages visited and access. Contact data (if you contact us): Name, email address and any information you choose to include in messages submitted through contact forms or email. Cookie-related data: Data collected through cookies.	Automatically: When you browse our website, we collect limited technical information such as your IP address, device type, browser type, pages visited and access times. From you: If you contact us through our website, email us or complete a form, we collect the information you choose to provide such as your name, email address and message content. Through cookies and similar technologies: Data collected through cookies required for the operation, security and functionality of the website.

What we collect

How we collect it

Technical data: IP address, device type, browser type, operating system and usage information such as pages visited and access.
Contact data (if you contact us): Name, email address and any information you choose to include in messages submitted through contact forms or email.
Cookie-related data: Data collected through cookies.

Automatically: When you browse our website, we collect limited technical information such as your IP address, device type, browser type, pages visited and access times.
From you: If you contact us through our website, email us or complete a form, we collect the information you choose to provide such as your name, email address and message content.
Through cookies and similar technologies: Data collected through cookies required for the operation, security and functionality of the website.

Depending on your relationship with us we may process the categories of data above and categories of personal data that is specific to you. Please see below in the Processing Table on how we may process your personal data depending on our relationship with you and our lawful basis for doing so.

Lawful Bases: How We Use Your Personal Data

We will only use your personal data when the law allows us to. We will use your personal data in the following circumstances:

Performance of a contract: Where we need to perform the contract, we are about to enter into or have entered into with you. For example, when you sign up to our services.
Legal obligation: Where we need to comply with a legal obligation. For example, for accounting or legal purposes.
Legitimate interests: Where it is necessary for our legitimate interests or those of a third party and your interests and fundamental rights do not override those interests.
Consent: Where you have given us clear and explicit permission to process your personal data for a specific purpose. This includes situations where we process special category data, such as genetic data based on your explicit consent.
Vital interests: Where is it necessary to protect your vital interests in case of emergencies.

Processing Tables

The processing tables explain why we process personal data and the lawful basis for doing so. Depending on your relationship with us, you may need to refer to different tables relevant to your specific interactions or services.

Customer

Processing Activity	Categories of Personal Data	Lawful Basis – GDPR
Providing DNA testing kits, processing orders and arranging delivery	Contact & identity data; payment data; order details	Performance of a contract
Registering kits and creating customer accounts	Contact & identity data; account data; technical data	Performance of a contract
Processing DNA samples and generating genetic reports	Special category data (genetic data, inferred health data, biological sex); account data (sample barcode)	Performance of a contract and explicit consent for special category data
Storing and providing access to genetic reports through the secure portal	Special category data (genetic data and inferred health data); account data; technical data	Performance of a contract and explicit consent for special category data
Providing customer support and managing accounts	Contact & identity data; account data; technical data; correspondence	Performance of a contract
Carrying out internal accuracy checks, quality assurance and system management	Account data; technical data	Legitimate interests
Complying with legal and regulatory obligations for example tax, accounting or regulatory requirements	Contact & identity data; payment data; transaction records	Legal obligation

Supplier, Practitioner or Partner

Processing Activity	Categories of Personal Data	Lawful Basis – GDPR
Onboarding and entering into contracts	Contact & identity data; business and contractual data	Performance of a contract
Managing relationships and communications	Contact & identity data; business and contractual data; correspondence records	Legitimate interests
Processing invoices and payments	Contact & identity data; payment and financial data; transaction records	Performance of a contract
Maintaining internal records, administration and service management	Contact & identity data; business and contractual data	Legitimate interests
Complying with legal, tax and accounting obligations	Contact & identity data; financial and transaction records	Legal obligation

Further information for Practitioner or Partner If you are a practitioner or partner ordering products on behalf of or for your customers:

You must ensure your clients are aware of and agree to this Privacy Policy for their data (name, address, sample details).
You are responsible for communicating to your customers that they must register their own samples via our sample registration form on our website.

Website Visitors

Processing Activity	Categories of Personal Data Processed	Lawful Basis – GDPR
Operating and maintaining the website, including security and performance monitoring	Technical data (IP address, device type, browser type, system logs)	Legitimate interests
Responding to enquiries submitted through the website or by email	Contact data; correspondence data	Legitimate interests
Managing and ensuring the functionality of essential and non-essential cookies	Technical data; cookie-related data necessary for website operation	Legitimate interests / Consent where required
Detecting and preventing fraud, misuse or unauthorised access to the website	Technical data; usage data	Legitimate interests

For Customers: How Access to Your Results Works

Once your DNA analysis is complete, we securely deliver your personalized results via invitation-only access to a dedicated, zero-knowledge end-to-end encrypted room on Tresorit Engage (a secure file-sharing platform).

You will receive a personalised invitation email containing a secure link. To view and download your results, you will need to create a free Tresorit account using your email address if you do not already have one this is a one-time step required for secure access.

Tresorit applies its own privacy policy to account creation and any non-encrypted metadata. We do not provide a public self-service portal on our website to ensure maximum privacy and control over access to your sensitive genetic data.

You are also reminded to download and safely store your DNA data when you first log into the Tresorit results portal. This notification is included in your results notification email.

Research libraries Your Gene Variant Reports may include hyperlinks to our Research Library (which also includes public resources and external sites). This takes you away from our site and we are not responsible for those third-party sites' content or privacy practices.

Cookies and Similar Technologies

We may gather information and statistics collectively about visitors to our website. Analysis of this information demonstrates the most frequently used sections of the website and assists us in continually improving the online service. Please also refer to our cookies notice for more information on how we set cookies.

Providing Personal Data

Where we need to collect personal data by law or under the terms of a contract and you do not provide that information when requested we may not be able to perform the contract we have or are trying to enter into with you for example to provide you with our services. In this case we may have to cancel our service but we will notify you if this is the case at the time.

Marketing Communications

We may send you marketing communication about our services. You have the right to object to processing of your personal data for direct marketing purposes. You can unsubscribe from receiving marketing communications from us by using the unsubscribe methods contained in communications we send to you or by contacting us. See Contact us.

Where you opt out of receiving marketing communications this will not apply to personal data provided to us as a result of registering for or using our service, your service experience or other interactions with this website.

No Sale or Marketing Use of Genetic Data We do not sell genetic data and we do not share genetic data with third parties for marketing, research or other purposes without your separate explicit consent.

Disclosure of Data

In certain circumstances, we may disclose your personal information to third parties for contract fulfilment purposes our legitimate purposes and other reasons subject to this Privacy Notice.

Such circumstances where we disclose information may include:

Internally: Your personal data will be used by our employees and contractors who are working on providing our services to you on a need-to-know basis.
Practitioners and Partners: Where practitioners or partners order DNA kits on behalf of their clients.
Our business service partners: who perform services on our behalf to ensure our business is running effectively for example IT management, customer support, cloud storage, hosting provider, courier and postal service providers.
Email communications providers: To assist us with service-related email communications.
Legal advisors: To enforce any applicable terms of service and to protect or defend the Services, our rights and the rights of our users or others.
Professional advisers: This would include bankers, auditors and insurers who provide consultancy, banking, insurance and accounting services.
Payment service intermediaries: These providers help facilitate payment to us.
Advertising networks and analytics service providers: This is to support and display ads on our website and other social media tools.
Business transactions (M&A): This is in connection with a business transaction such as a merger or acquisition. Where this is the case, your personal data shall continue to be processed in accordance with this Privacy Notice.
Laboratory processor (Eurofins Genomics): Eurofins Genomics carries out DNA extraction, SNP genotyping and provides the resulting raw data to us for the benefit of our customers.

Data Retention and Deletion

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means and the applicable legal, regulatory, tax, accounting or other requirements.

Further information: Eurofins Genomics Eurofins Genomics (the lab) retains physical DNA samples (post-analysis) and processed raw data/reports for 3 months after successful data delivery to us for quality control and compliance purposes. Samples and data are manually destroyed and discarded after this period. There is no automatic deletion before 3 months, but upon your request (via email to us), we will instruct Eurofins to delete data and destroy samples earlier where possible, before the 3-month period is due.

Further Information: Deletion of DNA data

When delete your DNA data, we will email you using the address you provided during sample registration. It is your responsibility to ensure you can receive emails from contact@mthfr-genetics.co.uk including checking your spam folder and whitelisting our address.

General deletion by customer: Where you are a customer you can request deletion of your data at any time via the self-service option in your Tresorit portal or by emailing us.

International Data Transfers

Where we transfer and process your personal data outside of the United Kingdom (UK) /European Union (EU) to countries where data protection laws are less stringent than those in the UK/EU. When we transfer your personal data outside of the UK/ EU we only do so to entities that offer our users the same level of data protection as that afforded by the UK Data Protection Act 2018 (including the UK GDPR) and the EU GDPR/ Data Protection Laws.

We will only transfer your personal information to countries that have been deemed to provide an adequate level of protection for personal information; or
We will use specific contracts approved for use in the UK or EU which give personal information the same protection it has in the UK/EU. For example, the use of Article 46 UK and EU GDPR safeguard mechanisms to transfer personal data endorsed by the UK Government or European Commission.

Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure. These measures include secure HTTPS/SSL encryption across our websites, restricted system access for authorised personnel only with multi-factor authentication, routine security monitoring and malware scanning and a data minimisation approach.

As part of our privacy-by-design framework, order data, sample registration information and genetic data are maintained in separate secure systems so that no single system contains a complete user profile.

Data Subject Rights

Under certain circumstances, you have rights under Data Protection Laws. Not all rights are absolute and depending on where you are located, not all rights are given to you. You can:

Request access to your personal data: This is known as a "subject access request" and enables you to receive a copy of the personal data we hold about you.
Request correction of your personal data: This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal data: This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. We may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you at the time of your request.
Object to processing of your personal data: This is where we are processing your personal data based on a legitimate interest or those of a third party and you may challenge this. However, we may be entitled to continue processing your information based on our legitimate interests or where this is relevant to any legal claims. See also Marketing communications.
Request restriction of processing your personal information: This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the information's accuracy (b) where our use of the information is unlawful but you do not want us to erase it (c) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims or (d) you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.
Request transfer of your personal information ("data portability"): This is where in some circumstances we will provide to you or a third party you have chosen your personal data in a structured, commonly used, machine-readable format.
Right to withdraw consent: This is where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. Depending on the processing activity, we may not be able to provide certain services to you if you withdraw your consent. We will advise you if this is the case at the time you withdraw your consent.
Automated decision making: This is where decisions are made about you by automated means. We do not carry out automated decision making.

Carrying out your data subject rights

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information or to exercise any of your other rights. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If you wish to exercise any of the rights set out above, please contact us at contact@mthfr-genetics.co.uk.

Keeping Personal Information Accurate and Current

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. Please contact us if you wish to update your personal data.

Concerns and Complaints

If you have any concerns about how we handle your personal data or how your rights have been exercised, please contact us at contact@mthfr-genetics.co.uk in the first instance. We will acknowledge your complaint within 5 working days and aim to investigate and respond fully within one month.

If you remain dissatisfied with our response, you have the right to lodge a complaint with a data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) (ico.org.uk). If you live or work outside the UK, you may also lodge a complaint with the supervisory authority in the country where you reside or where the issue occurred.

Changes to This Notice

This Privacy Notice may be changed from time to time in response to legal, technical or business developments. We will take appropriate measures to inform you when we update our Privacy Notice. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable Data Protection Laws.

Contact Us

If you would like more information about the way we manage personal information that we hold about you please contact us at:

Email address: contact@mthfr-genetics.co.uk

DPO Contact Details: Lifestyle Genomics has designated Harper James as our Data Protection Officer. They can be contacted through contact@mthfr-genetics.co.uk.