Privacy
Privacy Policy
This draft describes the intended privacy model for the DNA_CHECKS public beta.
Live DNA processing is not enabled yet. Controller identity, processor names, final retention periods, effective date and lawful-basis wording must be finalised before the service accepts real genetic data.
Scope
What this policy covers
This policy covers personal data used to provide the DNA_CHECKS website, beta report workflow and related support.
Raw DNA and genetic report content are genetic data and may also reveal health, ancestry and information relevant to biological relatives. DNA_CHECKS therefore treats them as special-category personal data for the beta privacy model.
Data we process
Only the information needed for the requested workflow
The exact production data map will be confirmed before launch. The intended beta categories are below.
The supported genotype file supplied for analysis.
The HTML report created from the requested analysis.
Used for report-ready notices and essential service communication.
Job ID, timestamps, processing status, software/report version and limited error information.
Transaction/status information needed to confirm payment. DNA_CHECKS should not store full card details.
Information supplied when a user asks for help, raises a privacy request or reports a problem.
Why we process it
Purpose-limited processing
The standard report workflow is intended to use genetic data only to provide the analysis the user requested.
Generate the requested reportValidate the file, run DNA_CHECKS and deliver the result.+
The core purpose is to process the uploaded genotype file through the DNA_CHECKS analysis pipeline and produce the requested report.
Operate and secure the serviceUse limited metadata for job management, support and security.+
Operational metadata may be used to process jobs, investigate failures, detect abuse, respond to support requests and demonstrate deletion or processing status.
No research reuse by defaultBuying a report does not enrol the user into a research project.+
Any future research or voluntary data-contribution programme would need to be clearly separate from the normal report workflow and based on a specific, optional choice.
No advertising or AI-training useUploaded DNA is not a marketing or model-training asset.+
The intended beta model does not use uploaded DNA to build advertising profiles or to train AI systems.
The current design is to rely on the contract/service relationship for the ordinary personal data needed to provide the report, together with explicit consent as the intended Article 9 condition for processing the user's genetic data. This wording must be confirmed against the final service and processor architecture before live processing begins.
Retention & sharing
Temporary DNA, temporary report delivery
The service is being designed to avoid indefinite genetic data storage.
Delete after successful processing, with a short lifecycle-based fallback deletion window for failed cleanup.
Temporary secure delivery. The exact expiry window will be published before launch.
Retained only as required for payment, accounting, fraud prevention and legal obligations.
Retained for the period reasonably needed to handle the request and demonstrate the response.
Who may process data?Only service providers needed to operate the final beta workflow.+
Before launch, DNA_CHECKS will publish the relevant categories and named providers for hosting, secure storage/queueing, payment and email delivery. Raw DNA should only be exposed to components that genuinely need it.
International transfersFinal provider locations and transfer safeguards must be documented.+
The production privacy notice will identify whether any provider processes personal data outside the UK and what applicable transfer mechanism or safeguard is used.
Your rights
Requests, consent and complaints
UK data protection rights depend on the data, purpose and lawful basis involved.
Depending on the circumstances, individuals may have rights to access personal data, correct inaccurate data, request erasure or restriction, receive portable data, object to certain processing, and withdraw consent where processing is based on consent.
Withdrawing consent does not make earlier lawful processing retrospectively unlawful. Some rights are not absolute and may not apply in every situation.
The live beta must provide a clear route for data-protection complaints and rights requests. If a concern cannot be resolved with DNA_CHECKS, users can also raise a complaint with the UK Information Commissioner's Office.
Launch details
Items still to be completed
This draft should not be treated as the final production privacy notice until the operational details below are fixed.