ChronicDNA.com

1. Information We Collect

1.1 Personal Information

When you create an account and use our service, we collect:

• Account Information: Email address, password (encrypted)
• Profile Information: Name (optional), country, age range
• Health Information: Self-reported symptoms (fatigue, post-exertional malaise, POTS, brain fog, etc.)
• Payment Information: Processed through Stripe (we do not store credit card details)

1.2 Genetic Data

We collect and process:

• DNA Data Files: Raw genetic data uploaded from third-party DNA testing services (23andMe, AncestryDNA, MyHeritage, etc.)
• Genetic Markers: Specific SNPs (Single Nucleotide Polymorphisms) analyzed for health predispositions
• Analysis Results: AI-generated interpretations of your genetic data in relation to your symptoms

1.3 Technical Information

• IP address and browser information
• Device type and operating system
• Access times and pages viewed
• Cookies and similar tracking technologies

2. How We Use Your Information

2.1 Primary Uses

• Service Delivery: Analyze your DNA data and generate personalized genetic reports
• Symptom Analysis: Correlate genetic markers with your self-reported symptoms
• Account Management: Create and maintain your account, process payments
• Communication: Send transactional emails (payment confirmations, report ready notifications)

2.2 AI Processing

We use OpenAI's GPT-4 model to analyze genetic data and provide interpretations. Your genetic data is transmitted to OpenAI's API for processing. OpenAI does not store or train on data submitted via their API, as per their data usage policies.

2.3 What We DON'T Do

• ❌ We do NOT sell your genetic data to third parties
• ❌ We do NOT share your data with insurance companies or employers
• ❌ We do NOT use your data for marketing purposes without consent
• ❌ We do NOT conduct research on your data without explicit opt-in consent
• ❌ We do NOT share identifiable genetic data with pharmaceutical companies

3. Legal Basis for Processing (GDPR)

Under GDPR, we process your data based on the following legal grounds:

• Explicit Consent: Processing of genetic data requires your explicit, informed consent (GDPR Art. 9)
• Contractual Necessity: Processing is necessary to fulfill our service agreement with you
• Legitimate Interests: Website analytics and security measures

4. Data Storage and Security

4.1 Where We Store Data

Your data is stored on Supabase (PostgreSQL database and object storage), which provides secure, enterprise-grade cloud infrastructure with data centers in the United States. For EU users, we utilize Supabase's EU region options where available and implement Standard Contractual Clauses (SCCs) to ensure GDPR compliance for international data transfers.

4.2 Security Measures

• Encryption: All data encrypted in transit (HTTPS/TLS) and at rest (AES-256)
• Access Controls: Row-level security policies restrict data access to authorized users only
• Authentication: Secure password hashing (bcrypt) and optional magic link authentication
• Minimal Access: Only essential personnel have access to backend systems
• Regular Audits: Security reviews and vulnerability assessments

4.3 Data Retention

• Active Accounts: Data retained as long as your account is active
• Deleted Accounts: DNA files and reports permanently deleted within 30 days
• Payment Records: Retained for 7 years for tax and legal compliance (anonymized after account deletion)
• Backups: Deleted data removed from backups within 90 days

5. Data Sharing and Third Parties

5.1 Service Providers

We share limited data with trusted service providers who assist in operating our platform:

• Supabase: Database and file storage (GDPR-compliant, EU servers)
• Stripe: Payment processing (PCI-DSS compliant)
• OpenAI: AI analysis of genetic data (API use only, no data retention)

All third-party providers are bound by data processing agreements (DPAs) and comply with GDPR requirements.

5.2 Legal Disclosures

We may disclose your information if required by law, such as:

• Valid court orders or subpoenas
• Legal obligations to government authorities
• Protection of our rights, safety, or property
• Prevention of fraud or illegal activities

We will notify you of such disclosures when legally permitted.

6. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

To exercise any of these rights, please contact us at privacy@chronicdna.com. We will respond within 30 days as required by GDPR.

7. Cookies and Tracking Technologies

7.1 Cookies We Use

• Essential Cookies: Authentication tokens, session management (required for service)
• Analytics Cookies: Anonymous usage statistics to improve the platform (optional)
• Preference Cookies: Remember your settings and preferences (optional)

7.2 Cookie Control

You can manage your cookie preferences at any time through our Cookie Settings page. You can also control cookies through your browser settings. Note that disabling essential cookies may affect platform functionality (e.g., you won't be able to stay logged in).

Your cookie consent is stored for 12 months, after which you'll be asked to renew your preferences. You can withdraw or modify your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

8. International Data Transfers

As a US-based company serving international users, we process and store data primarily in the United States. For users in the European Union, we ensure GDPR compliance through the following mechanisms:

• Standard Contractual Clauses (SCCs): Approved by the European Commission for lawful data transfers from the EU to the US
• Data Processing Agreements (DPAs): Executed with all service providers (Supabase, OpenAI, Stripe)
• EU Data Residency Options: Where available, we utilize EU-region hosting for EU users
• Privacy Shield Successor Frameworks: Monitoring and compliance with US-EU data transfer frameworks
• Supplementary Measures: Encryption, access controls, and technical safeguards as recommended by EU data protection authorities

For EU Users: Your genetic data may be transferred to and processed in the United States. By using our service, you consent to this transfer, which is protected by SCCs and additional security measures that meet GDPR requirements.

9. Children's Privacy

Our service is intended for adults aged 18 and over. We do not knowingly collect genetic data from minors. If you believe a minor has provided us with personal information, please contact us immediately, and we will delete the data.

10. Data Breach Notification

In the unlikely event of a data breach involving your personal or genetic data:

• We will notify affected users within 72 hours as required by GDPR (Art. 33-34)
• We will report the breach to relevant data protection authorities
• We will provide details on the nature of the breach and steps to protect yourself
• We will take immediate action to contain and remediate the breach

11. Automated Decision-Making

Our AI-powered genetic analysis does NOT make automated decisions that have legal or significant effects on you. The reports are informational and educational only. All results should be discussed with qualified healthcare professionals before making health decisions.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we make material changes:

• We will update the "Last Updated" date at the top of this page
• We will notify you via email if changes significantly affect your rights
• Continued use of the service after changes constitutes acceptance of the updated policy

13. Contact Information

14. Supervisory Authority

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with your local data protection authority. For EU residents, you can find your national authority at:

https://edpb.europa.eu/about-edpb/about-edpb/members_en