Privacy Policy

The entity responsible for processing your personal data is:

• Name: Francisco Alberto Cano Prieto
• Tax ID (NIF): 36528793D
• Registered address: Mallorca 609, 08026 Barcelona, España
• Website: dnainfolab.org
• Contact: info@dnainfolab.org · 652693041

Legal notice

We collect and process the following data, either voluntarily provided by you or generated automatically:

• Account data: username and email address, both always required. If you register with a password we keep its hash (bcrypt) and never the password itself; if you sign in with Google there is no password and we keep your Google identifier.
• Genetic data (special category under GDPR Art. 9): SNPs from the raw DNA file you upload, and the results derived from them, including internally computed trait scores that are no longer shown in the report but are still stored and included in your data export.
• Session data: server-side session ID in an HttpOnly cookie to keep you logged in, plus the date of your last login and last activity (used to count active users and to delete inactive accounts).
• Technical data: IP address and user-agent, recorded only in error logs (retained 90 days).
• Product analytics: non-identifying usage events (e.g. a feature you used) linked to your account, without IP or user-agent, kept for 365 days. Used only to understand and improve the product.
• Order and payment data: amount, currency, date, order status, the language and version of the terms accepted, and Stripe identifiers (checkout session, charge, refund). We do NOT receive or store your card number.

Mandatory data, and what happens if you do not provide it. To have an account: a username and an email, plus a password if you register with one — with Google there is no password, and instead we receive your Google identifier and your email. The email is mandatory on both paths, because it is the channel for a password reset and for the purchase confirmation consumer law requires. To generate a report: the DNA file and the genetic consent. Without them we cannot create the account, generate the report or sell it — there is no other consequence, and none of it is used for any other purpose.

Your data is processed strictly for the following purposes:

• To create and manage your account.
• To cross-reference your SNPs with the GWAS Catalog, PharmGKB and ClinVar databases and produce your report.
• To generate, store, and display your genetic reports.
• To generate AI-powered plain-language explanations, which involves sending to Anthropic (Claude) the health area concerned and its variant counts, gene names, variant identifiers (rsids), your genotypes at those variants, the risk allele, the effect size and the trait each study measured, plus public PubMed abstracts. We do NOT send your full DNA file.
• To handle the purchase: create the order, charge through Stripe, unlock the full report, and process withdrawals and refunds.
• To send you the emails the service requires: password reset, and the confirmation of the contract on a durable medium, containing the exact text of the terms you accepted. We do not send marketing.
• To keep the accounting and tax record of sales for the period the law requires.
• To understand and improve the product with first-party analytics: which features are used and where a process is abandoned. If you accept analytics cookies, the same purpose is additionally served by Google Analytics.
• To keep the service secure: detect and limit abuse, and diagnose errors.

• Consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)): You give explicit consent for your genetic data to be processed when you upload a DNA file: it is asked before every upload and recorded with its version, its language and the exact text you read. It is also the basis for third-party analytics cookies, which only load if you accept them in the banner. You can withdraw either at any time — the genetic one by deleting your data or your account, the cookie one from the banner.
• Contract (GDPR Art. 6(1)(b)): Processing your account data and your order and payment data is necessary to perform the contract you asked for: creating your account, charging for the report, giving you access to what you bought, and sending you the purchase confirmation.
• Legitimate Interest (GDPR Art. 6(1)(f)): Two processings rest on our legitimate interest. Error logs with IP and user-agent are kept for 90 days to diagnose incidents and prevent abuse. And our own product analytics records which features are used, linked to your account but with no IP, no user-agent and no free-form text, so we can tell where the product fails; we weighed that the data is minimal, is shared with nobody, is not used for advertising or to decide anything about you, and that you can object by writing to us.
• Legal obligation (GDPR art. 6(1)(c)): The record of orders and payments is kept for the period accounting and tax law require, even if you delete your account. This basis does not depend on your consent and, while that period runs, cannot be withdrawn.

These are the providers and recipients involved in the service. Not all of them are processors: some decide part of the processing themselves, as explained below.

• Stripe: Payment processing (Stripe Payments Europe, Limited, Ireland; Stripe Technology Europe, Limited may act for regulated EEA payments). It receives your email and your card details directly on its own page; we only keep identifiers and the amount. Stripe acts as a processor when it takes the payment on our behalf, and as an independent controller for fraud prevention and its regulatory obligations.
• Hetzner Online GmbH: Hosting of the servers and the database, in Germany (EU). Processes all data on our behalf.
• Cloudflare: Network, DNS and attack protection. All site traffic passes through Cloudflare, including the upload of your DNA file: Cloudflare terminates the encrypted connection (TLS) at the data centre nearest to you, which may be outside the European Union, and therefore processes the content of requests in transit, the file included. It does not store the file on our behalf or use it for its own purposes, and acts as a processor under its data processing agreement and the Standard Contractual Clauses.
• Brevo (Sendinblue): Transactional email delivery (password reset, purchase confirmation). It receives your email address and the contents of the message.
• Google Analytics 4: Google Analytics 4 (Google Ireland Limited), browsing statistics, and only if you accept analytics cookies in the banner: until then the script is not loaded at all. It receives PSEUDONYMOUS data, not anonymous — a client identifier (the _ga cookie) that tells you apart across visits, the page and referrer, the events, the browser and device, and an approximate location derived from your IP. Never genetic or order data. It may process data in the United States. The first-party product analytics described above uses no cookies and never leaves our servers.
• Google OAuth: Authentication only, if you use Sign in with Google. We receive your Google identifier and your email. Google acts as an independent controller for its own processing — see its privacy policy. This is a different service from Google Analytics.
• Anthropic Claude API: AI explanations only, and only when you request one. We send the derived results for that health area: how many variants we track there and how many were found in your file, and for each highlighted variant the rsID, the gene, your genotype, the risk allele, the zygosity (heterozygous or homozygous), the effect size (OR or beta) and the trait the study measured; plus abstracts of up to three public PubMed articles. No overall score, risk level or percentile is sent, because none is produced for display. The raw DNA file is never transmitted. Anthropic processes data in the United States under Standard Contractual Clauses (GDPR art. 46).
• NCBI PubMed: Public research database (NCBI, USA). We query PubMed for study abstracts by PMID — no personal data is sent.

A processor and an independent controller are not the same thing: a processor handles data only on our behalf and on our instructions (Hetzner, Cloudflare, Brevo, Anthropic); an independent controller decides on a given processing itself and answers for it. Stripe is both, depending on the processing: a processor when it takes the payment on our behalf, and an independent controller for fraud prevention and its own regulatory obligations, on which we give it no instructions. Google, if you sign in with Google, acts as an independent controller.

International transfers: hosting, the database and email are provided within the European Union, and that is where your variants and your results are stored. At least these three processings leave the EU. Anthropic processes in the United States the derived data sent for explanations, never the file. Cloudflare, by terminating the encrypted connection at the nearest data centre, may process the content of your requests in transit outside the EU — including the DNA file at the moment you upload it. And Google Analytics, if you accept analytics cookies, processes browsing data in the United States. All of them rely on the European Commission’s Standard Contractual Clauses (GDPR art. 46).

How to obtain the safeguards: you can ask us for a copy of the Standard Contractual Clauses covering those transfers, and the information on the supplementary measures, by writing to the contact address in section 1. We send it free of charge.

• If you buy the report, your DNA data and the report are kept for as long as your account is active. If you do not, the analysis — the extracted variants and the report — is automatically deleted 30 days after you upload it: we do not keep the genetic data of people who did not buy. You can export everything before then, delete it yourself at any time from your history, or upload the file again later.
• AI-generated explanations are stored alongside the report they belong to, so you can read them again without a new AI request. They are deleted with the report.
• Error logs are automatically purged after 90 days.
• Order and payment data are kept for the period accounting and tax law require, even if you delete your account. In that case the record stops being linked to your account and your report, but it keeps the amount, the date and the Stripe identifiers of the payment and of any refunds. That is pseudonymisation, not anonymisation: on their own those identifiers do not name you, but Stripe still holds the payment together with your details, so anyone with access to Stripe could link them back. We cannot delete that record before the legal period expires, and we do not use it for any other purpose.
• When you delete your account or an individual upload, the genetic data, the report and its AI explanations are permanently removed. The payment record is kept for the period accounting law requires, detached from your account and your report as described in the previous point.

You have the following rights over your personal data under GDPR (Arts. 15–22):

• Right of access — obtain a copy of the data we hold about you (available self-service via Account → Download your data).
• Right to rectification — correct inaccurate data.
• Right to erasure — delete your account and all associated data.
• Right to portability — receive your data in a machine-readable format (JSON export from your Account page).
• Right to restriction of processing — ask us to stop processing your data, while keeping it, whilst its accuracy is checked or the lawfulness of the processing is resolved.
• Right to object — withdraw consent or object to specific processing.

To exercise any of these rights, write to us at info@dnainfolab.org. We will reply within 30 days at the latest.

We implement reasonable technical and organisational measures to protect your data:

• Passwords are hashed with bcrypt (cost 12). Plain-text passwords are never stored.
• Session cookies are HttpOnly, SameSite=Strict, and Secure (HTTPS only) in production.
• All traffic is encrypted in transit via TLS (HTTPS). Servers are located in Germany (EU) at Hetzner Online GmbH.
• CSRF protection: Origin header validation + custom X-Requested-With header on all state-changing requests.
• Content Security Policy headers and X-Frame-Options: DENY to prevent XSS and clickjacking.
• HSTS enabled in production to force HTTPS for all future connections.