MyHappyGenes Privacy Policy

MyHappyGenes, Inc. (“Company,” “we,” “us,” or “our”) provides this Privacy Policy to explain what information we collect from and about users (“you”) of the Website, how we use and share it, and the choices and rights you have. Genetic information and health information receive heightened protection, described in Sections 4 and 5.

Because privacy laws differ by where you live, this policy includes state- and region-specific sections (Sections 9–11). Where a specific law gives you greater rights, that law controls. We review and update this policy at least once every twelve (12) months and whenever our practices materially change.

By using the Website, you accept the practices described here. For sensitive data — including genetic and health data — we rely on your opt-in consent rather than implied consent, as described below.

Information you provide

When you register, place an order, contact us, complete surveys, or create a profile, we may collect your name, postal and email address, telephone number, username and password, date of birth, demographic details you choose to share, and payment information (processed by our payment processor).

Genetic information and biological samples

To generate your reports we collect genetic data — for example, raw data files from third-party testing services (such as AncestryDNA, 23andMe, or MyHeritage) or, where offered, samples and results from the Company’s own test. Genetic data typically includes your genotype (A, T, G, C), chromosome locations, and rsIDs. See Section 4 for how we protect this data.

Health and wellness information

Where you use a practitioner-supported service, any health or wellness information you provide is shared with and handled by your independent practitioner. MyHappyGenes® does not retain health-questionnaire responses as part of its Services. Any health-related information that is processed is treated as Consumer Health Data — see Section 5.

Information collected automatically

Like most websites, we automatically collect limited technical data — IP address, device and browser type, operating system, and pages viewed — through cookies, web beacons, and analytics tools. You can refuse cookies in your browser, though some features may not work. We honor recognized opt-out preference signals as described in Section 8.

We use personal information to: provide and personalize the products and reports you request; create and manage your account and provide support; process payments; communicate with you about your account and (with your consent where required) about products and services; maintain security and detect fraud; comply with law; and, only if you separately opt in, include your de-identified data in research.

We do not use genetic data, health data, or other sensitive personal information for targeted (cross-context behavioral) advertising, and we do not sell such data.

We treat genetic data and biological samples as highly sensitive and handle them in line with state genetic-privacy laws and FTC guidance.

• Use limited to your report. We use your genetic data to generate the report and services you request. We will not use it for any materially different purpose without your separate, express, opt-in consent.

• Separate consent for any transfer. We do not transfer or disclose your genetic data or biological samples to any third party other than service providers/processors acting on our behalf, except with your separate express consent or as required by law. We will never sell your genetic data.

• No disclosure to insurers or employers. We will not disclose your genetic data to health or life insurers, or to employers.

• Deletion and sample destruction. You may delete your genetic data and uploaded files at any time from your account dashboard, and you may request destruction of any remaining biological sample. We honor such requests and instruct any contracted laboratory accordingly.

• Retention limit. Our laboratory identifies your sample only by the kit barcode and destroys the physical sample after 90 days. The data extracted from your sample remains available in your account until you choose to delete it.

• Security program. We maintain a written information-security program with administrative, technical, and physical safeguards, including encryption of genetic data in transit and at rest, access controls, and vendor oversight.

• No retroactive changes. If we make a material change affecting genetic data we have already collected, we will notify you and obtain your consent before applying the change to that data.

• Substantiation. We maintain substantiation supporting any structure/function educational content we publish where appropriate.

Certain information processed through the Services — including genetic information, health-related information, wellness information, and other information that may identify your health status — may constitute “Consumer Health Data” under applicable state laws, including Washington’s My Health My Data Act, Nevada Senate Bill 370, Connecticut law, and other substantially similar laws.

If you reside in a state providing additional rights with respect to Consumer Health Data, those rights are described in our separate Consumer Health Data Privacy Policy, which is incorporated into this Privacy Policy by reference and is available through a link on our homepage. That policy explains the categories of Consumer Health Data we collect, the purposes for collection and use, categories of third parties with whom data may be shared, and your applicable rights, including rights of access, deletion, withdrawal of consent, appeal, and other rights available under applicable law.

We share personal information only as described here:

• Service providers/processors who perform services for us (e.g., hosting, laboratory processing, payment, customer support) under contracts limiting their use of the data to those services.

• With your consent, including any separate consent required for genetic or health data.

• Legal and safety: to comply with law, respond to lawful requests, enforce our terms, or protect rights, property, and safety.

• Business transfers: in a merger, acquisition, or sale, subject to this policy; any successor will be required to honor the genetic- and health-data commitments above, and we will notify you of any new policy and your right to opt out.

• Aggregated/de-identified data that cannot reasonably identify you.

We do not provide your contact information to third parties for their own marketing without your opt-in consent.

We use cookies and similar technologies (web beacons) to operate the Website, remember preferences, keep you logged in, and understand usage. We use analytics providers (such as Google Analytics) to measure and improve the Website; you can opt out via the Google Analytics opt-out browser add-on.

We do not use sensitive data for targeted advertising, and we do not use genetic information or consumer health data to create advertising profiles. To the extent we engage in any “sale” or “sharing” of non-sensitive personal information for advertising, you may opt out as described in Section 8. You can also use industry opt-out tools at the Network Advertising Initiative (optout.networkadvertising.org) and the Digital Advertising Alliance (optout.aboutads.info). The current list of analytics and advertising providers we use is available in our website cookie and consent manager.

Global Privacy Control. We recognize the Global Privacy Control (GPC) and other recognized opt-out preference signals. When we detect such a signal from your browser or device, we treat it as a valid request to opt out of any sale or sharing of personal information and of targeted advertising, as required by applicable law.

Marketing email. You can unsubscribe from marketing email using the link in any such message or through your account settings. We may still send service and account messages.

Cookies. You can control cookies through your browser settings.

If you are a California resident, you have the right to: know and access the personal information we collect, use, and disclose; delete your personal information; correct inaccurate information; opt out of the “sale” or “sharing” of personal information; limit the use and disclosure of sensitive personal information (which includes genetic and health data); and not be discriminated against for exercising these rights.

To exercise these rights, contact us using Section 14 or any “Do Not Sell or Share My Personal Information” / “Limit the Use of My Sensitive Personal Information” link on the Website. We will verify your request and respond within the time the law allows. You may use an authorized agent, and you may appeal a denial by contacting our Privacy Officer. Under California’s “Shine the Light” law (Civil Code §1798.83), you may also request information about disclosures for third-party direct marketing.

Notice at collection. This table summarizes the categories of personal information we collect, why we use them, whether we “sell” or “share” them, and how long we keep them.

We do not “sell” your personal information and do not “share” it for cross-context behavioral advertising. Sensitive personal information (including genetic data) is used only to provide the Services you request.

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others — have rights to access, correct, delete, and obtain a portable copy of their personal data; to opt out of targeted advertising, “sale,” and certain profiling; and to appeal our decision on a request. Several of these laws require your opt-in consent before we process sensitive data such as genetic or health information; we obtain that consent as described in Sections 4 and 5.

To exercise any of these rights, contact us using Section 14. We will respond and, where required, provide an appeal process.

The Website is operated from the United States. If you access it from the EEA or UK and the GDPR/UK GDPR applies, genetic and health data are “special category” data that we process only with your explicit consent or another lawful basis. You have rights to access, rectify, erase, restrict, port, and object to processing, and to lodge a complaint with your supervisory authority. Where we transfer data to the U.S., we rely on appropriate safeguards for the transfer. EEA and UK users may contact our Privacy Officer to exercise these rights or to raise a concern with their local supervisory authority.

We keep personal information only as long as needed for the purposes described here, to comply with law, resolve disputes, and enforce our agreements. Genetic data extracted from your sample is retained while your account is active or until you delete it; physical biological samples are destroyed by our laboratory after 90 days. Account, order, and payment records are retained for the life of your account and as needed to meet legal, tax, and dispute-resolution requirements; website usage data is retained for a limited period consistent with our cookie and analytics settings. See the notice-at-collection table in Section 9 for category-level retention.

We use industry-standard administrative, technical, and physical safeguards — including encryption of sensitive information in transit and at rest — to protect personal information. No system is perfectly secure, and you are responsible for keeping your login credentials confidential; notify us immediately if you suspect unauthorized access. If a breach affecting your personal information occurs, we will notify you and the appropriate regulators as required by applicable law. This does not waive any rights you have under breach-notification or other laws.

The Website is not directed to children under 13, and we do not knowingly collect their personal information except where a parent or legal guardian registers on behalf of a minor child receiving the service. We handle any such information in accordance with the Children’s Online Privacy Protection Act (COPPA), as amended. We do not “sell” or “share” the personal information of, or deliver targeted advertising to, known minors under 16 without opt-in consent (and parental consent for children under 13). A parent or guardian may review and request deletion of a child’s information by contacting us.

We may update this policy from time to time. We will post the new version with an updated effective date and, for material changes, provide additional notice. We may notify you by email or through the Services where required by law. For changes affecting genetic data we have already collected, we will obtain your consent before applying them, as described in Section 4.

To exercise your rights or ask questions or make a complaint, contact our Privacy Officer:

MyHappyGenes, Inc. — Attn: Privacy Officer
Stuart, Florida
Email: [email protected]   |   Phone: 678-771-5682

We will not retaliate against you for exercising your privacy rights or filing a complaint. California residents may also contact the California Privacy Protection Agency; residents of other states may contact their state Attorney General.