Last updated: 17 October 2026

Privacy Policy

My Gene Story is a brand of The Gene Box. The company responsible for your personal data (your "data fiduciary" under India's DPDP Act 2023, and "controller" under the UK and EU GDPR) is:

Virtus Nutrition Pvt Ltd (CIN U15400MH2013PTC240768), 6th Floor, 601, Corporate Centre, Nirmal Lifestyle, LBS Marg, Mulund West, Mumbai 400080, Maharashtra, India.

Privacy and grievance contact: ask@mygenestory.com (put "Privacy" in the subject line).

1. What we collect and why

We do not sell your genetic data or personal data. We don't use your DNA file for research, advertising or any purpose other than your report, and we don't share it with insurers or employers.

2. Genetic data consent

Before you upload a file, we ask you to tick a box giving explicit consent for us to process your genetic data for your report. The full text is the Informed Consent. This consent is separate from any marketing consent. You can withdraw it at any time (see section 6). If you withdraw before we deliver your report, we stop work and delete your file.

3. Advertising and hashed email

We may send a hashed (scrambled) version of your email to Google or Meta to measure ads and to reach people with similar interests. We never share your DNA data for this.

• UK and EU: we only do this if you opt in.
• Everywhere else: you can opt out at any time by emailing ask@mygenestory.com, or by rejecting ad cookies in Cookie settings.

4. Who processes data for us

• Shopify handles our store and checkout.
• PayPal handles payments.
• Vercel hosts the site and runs Web Analytics.
• Resend sends our transactional emails.
• Google provides Analytics, Ads and Workspace email/Drive.
• Dropbox or Google Drive only if you choose to share your file that way.

They act on our instructions under their data-processing terms.

5. Transfers outside your country

We are based in India, and some of our processors store data in the US, EU or elsewhere. We transfer data only as DPDP allows, and for UK and EU users we rely on Standard Contractual Clauses or equivalent safeguards.

6. How long we keep data

• Raw DNA file: We keep your DNA file so you can unlock more reports without uploading again. Email ask@mygenestory.com anytime and we'll delete it within 30 days of your request.
• Uploads from before 17 October 2026: deleted 30 days after we deliver your DNA Story, including copies in email attachments we received, unless you ask us to keep the file.
• Your DNA Story report: kept for 2 years so you can download it again, unless you ask us to delete it earlier.
• Order and payment records: kept for 8 years, as Indian tax law requires.
• Waitlist data: kept until you unsubscribe, or for 24 months without contact, whichever comes first.
• Analytics data: kept for up to 14 months.

7. Your rights

Wherever you live, you can:

• access your data or get a summary of it
• correct or update it
• erase it
• withdraw consent (as easily as you gave it)
• India: nominate someone to act for you if you die or can't act yourself
• UK and EU: object, restrict processing and get a copy to move elsewhere (portability)
• US states such as California and Washington: know, delete, correct and opt out of targeted advertising

We do not "sell" or "share" data for cross-context advertising except as described in section 3, which you can opt out of.

To use any right, email ask@mygenestory.com. We reply within 30 days, or sooner where the law requires. We won't treat you differently for using your rights.

Complaints: contact us first. If you're not satisfied, you can complain to:

• the Data Protection Board of India
• the UK ICO
• your EU data protection authority
• your US state attorney general

8. Age

My Gene Story is for adults aged 18 or older. Don't send us a child's DNA file. If we learn we've received one, we will delete it.

9. Security and breaches

We keep data encrypted in transit and at rest, limit access to the people who need it, and keep access logs. If a breach affects your data, we will tell you without delay, along with the authorities where the law requires, including the Data Protection Board of India.

10. United Kingdom (UK GDPR and Data Protection Act 2018)

• Lawful bases:
  • Contract: to deliver your order and report.
  • Legal obligation: tax records.
  • Consent: analytics and ad cookies, hashed-email ads, waitlists.
  • Legitimate interests: cookieless site analytics and security.
• Genetic data is "special category" data. We process it only with your explicit consent (Article 9(2)(a)), which you give with the tick box before you upload. See the Informed Consent. You can withdraw it at any time.
• Your rights:
  • access, rectification and erasure
  • restriction, portability and objection
  • withdrawing consent, and not being subject to solely automated decisions with legal effects (we don't make any)
• Complaints: you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
• International transfers: your data goes to India (our company) and the US (some processors). We rely on the UK International Data Transfer Addendum or Agreement, or the UK–US Data Bridge where a processor is certified. Email us for a copy of the safeguards.
• EU users: the same protections apply under the EU GDPR, with the EU Standard Contractual Clauses for transfers. You can complain to your local supervisory authority.

11. United States

• California (CCPA/CPRA):
  • Categories we collect:
    • identifiers (email, name)
    • commercial information (orders)
    • internet activity (with consent)
    • sensitive personal information (genetic data)
  • You have the right to:
    • know and access your data
    • delete and correct it
    • opt out of sale and sharing
    • limit the use of sensitive personal information (we already use genetic data only to provide your report)
    • not be discriminated against for using these rights
  • Authorised agents can make requests for you.
  • We don't sell personal information for money.
• Do Not Sell or Share My Personal Information: ad pixels and hashed-email matching with Google and Meta may count as "sharing" for cross-context behavioural advertising.
  • You can opt out by rejecting ad cookies in Cookie settings, by emailing ask@mygenestory.com with "Do not sell or share" in the subject, or by sending a Global Privacy Control signal, which we honour.
  • We never sell or share genetic data.
• Washington (My Health My Data Act) and similar laws (Nevada, Connecticut):
  • We collect consumer health data (your DNA file and report) only with your consent and only to provide your report.
  • We will not share it with any third party, except processors acting for us, without your separate consent.
  • We will never sell it.
  • You can access or delete it, and withdraw consent, at any time.
• Illinois (GIPA) and other state genetic privacy laws:
  • We get your written (click-box) consent before we process your genetic information.
  • We won't disclose it to employers, insurers or other third parties without your specific consent.
  • We keep your DNA file so you can unlock more reports without uploading again. Email ask@mygenestory.com anytime and we'll delete it within 30 days of your request, and no later than 3 years after your last order. Uploads from before 17 October 2026 are deleted 30 days after we deliver your DNA Story, including copies in email attachments we received, unless you ask us to keep the file.
• Response times: we confirm US requests within 10 business days and respond within 45 days.

12. Changes

If we change this policy, we'll update the date above. If the change is significant, we'll email affected customers.