Privacy Policy

The entity responsible for processing your personal data is:

• Platform: Genomic Analysis Engine
• Website: dnainfolab.org
• Contact: [email protected]

We collect and process the following data, either voluntarily provided by you or generated automatically:

• Account data: username, email (if you sign in with Google), hashed password (bcrypt). We never store plain-text passwords.
• Genetic data (special category under GDPR Art. 9): SNPs from the raw DNA file you upload, and the risk scores derived from them.
• Session data: server-side session ID in an HttpOnly cookie to keep you logged in.
• Technical data: IP address and user-agent, recorded only in error logs (retained 90 days).

Your data is processed strictly for the following purposes:

• To create and manage your account.
• To cross-reference your SNPs with the GWAS Catalog, PharmGKB, and ClinVar databases and compute polygenic risk scores.
• To generate, store, and display your genetic reports.
• To generate AI-powered plain-language explanations, which involves sending your risk scores, gene names, variant identifiers (rsids), your genotypes at those variants, and PubMed study IDs to Anthropic (Claude). We do NOT send your full DNA file.

• Consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)): You provide explicit consent to process your genetic data when you upload a DNA file and generate a report. You can withdraw consent at any time by deleting your data or account.
• Contract (GDPR Art. 6(1)(b)): Processing your account data is necessary to provide the service you requested.
• Legitimate Interest (GDPR Art. 6(1)(f)): Error logs with IP and user-agent are kept for 90 days to diagnose outages and prevent abuse.

We use the following data processors to operate the service:

• Google OAuth: Authentication only (if you use Google Sign-In). We receive your Google ID and email. Google acts as an independent controller — see Google's privacy policy.
• Anthropic Claude API: AI explanations only. We send trait scores, gene names, variant rsids, your genotypes, and PubMed IDs. No raw DNA file is transmitted. Anthropic processes data in the US under Standard Contractual Clauses (GDPR Art. 46).
• NCBI PubMed: Public research database (NCBI, USA). We query PubMed for study abstracts by PMID — no personal data is sent.

• Your DNA data and reports are retained while your account is active. You can delete any upload at any time from your history page.
• Error logs are automatically purged after 90 days.
• When you delete your account, all your personal and genetic data is removed from our active database within 24 hours. Encrypted backups are rotated every 7 days and overwritten within that window.

You have the following rights over your personal data under GDPR (Arts. 15–22):

• Right of access — obtain a copy of the data we hold about you (available self-service via Account → Download your data).
• Right to rectification — correct inaccurate data.
• Right to erasure — delete your account and all associated data.
• Right to portability — receive your data in a machine-readable format (JSON export from your Account page).
• Right to object — withdraw consent or object to specific processing.

To exercise any of these rights, contact [email protected]. We will respond within 30 days.

We implement reasonable technical and organisational measures to protect your data:

• Passwords are hashed with bcrypt (cost 12). Plain-text passwords are never stored.
• Session cookies are HttpOnly, SameSite=Strict, and Secure (HTTPS only) in production.
• All traffic is encrypted in transit via TLS (HTTPS). Servers are located in Germany (EU) at Hetzner Online GmbH.
• CSRF protection: Origin header validation + custom X-Requested-With header on all state-changing requests.
• Content Security Policy headers and X-Frame-Options: DENY to prevent XSS and clickjacking.
• HSTS enabled in production to force HTTPS for all future connections.