Privacy policy

At dnaPower, protecting your privacy is a priority. This Privacy Policy explains how dnaPower Inc. (“dnaPower,” “we,” “us,” or “our”) collects, uses, discloses, stores, and protects personal information when you use our websites, customer portal, testing services, consultations, reports, and related services.

We do not sell or rent personal information, biological samples, genetic information, microbiome information, or test results. We handle personal information in accordance with applicable privacy laws and use administrative, technical, and physical safeguards designed to protect sensitive information.

1.  Scope of This Policy

This Policy applies to personal information collected through dnaPower websites and online stores, customer accounts and portals, testing kits and laboratory services, report reviews and consultations, customer support, marketing communications, and other interactions with dnaPower.

Third-party websites, laboratories, payment processors, technology providers, and other service providers may also have their own privacy policies. Where a third party processes information on our behalf, we require the information to be handled only for the services being provided and subject to appropriate confidentiality and security obligations.

2.  Information We Collect

Account, Contact, and Order Information

We may collect information such as your name, mailing address, billing address, email address, telephone number, account credentials, order information, kit or barcode identifiers, shipping information, and customer-service history.

Payment Information

Payment information required to complete a transaction is processed through third-party payment providers. dnaPower does not store full payment-card details.

Biological Samples and Test Information

Depending on the service purchased, we may receive cheek swabs, stool, saliva, dried blood, or other biological samples. Testing may generate genetic, microbiome, epigenetic, pharmacogenetic, or other test-related information.

Laboratories use barcode-based identifiers to help separate biological samples from directly identifying customer information. Test-related information is used to provide the service requested, prepare reports, and support related consultations or report reviews.

Self-Reported Health and Lifestyle Information

We may collect date of birth and sex where needed to process or interpret testing. During a report review or consultation, you may also choose to provide health, medication, nutrition, lifestyle, wellness, or other information so the discussion can be tailored to your circumstances. Providing additional information beyond what is required for the service is voluntary.

Website, Device, and Cookie Information

When you use our website, we may collect information such as pages viewed, navigation patterns, referral sources, visit times, device or browser information, and similar usage data. We use cookies and related technologies to support website functionality, remember preferences, understand website performance, and improve user experience.

You may control cookies through your browser or available website controls. Disabling certain cookies may affect some website features.

3.  How We Use Personal Information

Provide DNA, microbiome, pharmacogenetic, epigenetic, and other testing services you request. Register and track kits, process biological samples, and generate personalized reports.

Create and manage customer accounts and provide secure access to reports and order status. Provide report reviews, consultations, customer support, and responses to inquiries.

Process orders, payments, shipping, returns, and other service-related transactions. Communicate with you about your order, testing status, reports, appointments, or account. Improve website functionality, service quality, security, and customer experience.

Perform internal analytics, quality assurance, and operational activities.

Send marketing or educational communications where permitted and where the required consent has been obtained.

Meet legal, regulatory, laboratory, accounting, fraud-prevention, security, and operational requirements.

4.  Consent and Your Choices

We collect, use, and disclose personal information with consent where consent is required by law, or as otherwise permitted or required by law. The form of consent may vary depending on the sensitivity of the information and the circumstances in which it is collected.

You may withdraw consent to optional uses of your information, such as marketing communications, subject to legal, contractual, or operational restrictions. Withdrawal of consent may limit our ability to provide certain services where the information is necessary to complete testing, maintain required records, or deliver a requested service.

5.  Biological Samples and Laboratory Handling

Biological samples are handled using barcode-based systems designed to reduce unnecessary association between the physical sample and directly identifying information. Laboratories use samples only as necessary to perform the requested analysis and related quality-control activities.

After required testing, quality-control, or permitted retesting periods are complete, physical samples are securely destroyed or disposed of in accordance with applicable laboratory, biosafety, privacy, and legal requirements.

6.  How We Share Information

We do not sell or rent your personal information, biological samples, test-related information, or test results.

We may disclose limited information when necessary to provide services or operate our business, including to:

-        Laboratory partners that process samples or generate testing data.

-        Technology, hosting, security, email, customer-portal, analytics, and other service providers.

-        Payment processors, shipping providers, and other transaction-related service providers.

-        Authorized dnaPower personnel, consultants, and professional advisors who require access for a legitimate business or service purpose.

-        A healthcare practitioner, dnaPower partner, or other person you authorize us to share information with.

-        Government, regulatory, law-enforcement, or other authorities where disclosure is required or permitted by applicable law.

Authorized dnaPower personnel and consultants may access reports only where necessary to provide customer support, report reviews, consultations, or another service requested by you.

Where laboratory or service providers operate outside your province or country, information may be processed in another jurisdiction and may be subject to the laws of that jurisdiction. We use reasonable contractual, technical, and organizational measures to protect information entrusted to service providers.

7.  Sharing With Practitioners and Partners

Your results are private unless you choose to share them or authorize sharing. At your request and with appropriate authorization, we may provide results to a healthcare professional, dnaPower partner, consultant, or other authorized recipient. Where available, access may be provided through a secure partner or customer portal.

8.  Data Storage, Retention, and Destruction

dnaPower retains personal information only for as long as reasonably necessary to provide services, maintain business and laboratory records, meet legal or regulatory obligations, resolve disputes, enforce agreements, and support security and fraud-prevention requirements.

dnaPower states that customer information and test results are protected using encrypted systems and that genetic information is stored under strict privacy controls. Retention periods may vary by information type, laboratory, service, and legal requirement.

Where permitted by law, you may request deletion of your account or personal and test-related information. Some information may need to be retained where required by law, for legitimate recordkeeping, laboratory quality requirements, security, dispute resolution, or other permitted purposes.

9.  Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, loss, or disclosure. These safeguards may include encryption, access controls, secure systems, barcode-based sample management, and confidentiality requirements.

No electronic system or method of transmission can be guaranteed to be completely secure. Customers should protect their account credentials and notify dnaPower promptly if they suspect unauthorized access to an account.

10.  Email and Electronic Communications

We use email and other electronic communications for order updates, customer support, report notifications, appointments, service communications, and, with appropriate consent, marketing or educational communications.

You may unsubscribe from marketing communications using the unsubscribe mechanism provided or by contacting us. Transactional or service-related communications may still be sent where necessary to provide a service you requested.

Because ordinary email may not always be secure, you should avoid sending highly sensitive personal, health, or genetic information by unencrypted email unless necessary and you are comfortable doing so.

11.  Minors

Services for individuals under 18 must be purchased or authorized by a parent or legal guardian where required. A parent or legal guardian is responsible for providing the necessary consent for collection, use, and disclosure of a minor’s information. If personal information is collected without appropriate authorization, dnaPower may delete or restrict the information as permitted or required by law.

12.  Your Privacy Rights

Depending on where you live, applicable privacy laws may give you rights concerning your personal information. These may include the right to request access to information we hold about you, request correction of inaccurate information, withdraw consent where applicable, request deletion subject to legal exceptions, or make a privacy complaint.

U.S. residents may also have additional rights under applicable state privacy laws, which can include rights to know or access certain information, obtain a portable copy, request deletion or correction, and opt out of certain uses or disclosures where those rights apply. dnaPower does not sell personal or genetic information.

Requests are subject to identity verification and any exceptions, retention requirements, or limitations permitted by applicable law.

13.  Genetic Information and Non-Discrimination

dnaPower does not disclose genetic test results to employers or insurance companies for their independent use unless you specifically authorize the disclosure or disclosure is otherwise required or permitted by law.

Legal protections for genetic information vary by jurisdiction. In Canada, federal genetic non-discrimination legislation provides protections relating to the use and disclosure of genetic test results. In the United States, the Genetic Information Nondiscrimination Act (GINA) provides certain protections relating to health insurance and employment. These laws have limits and may not apply to every type of insurance, organization, or circumstance.

14.  Third-Party Websites and Services