When you use MyGenoRoot services, we collect the following categories of personal data:

• Identity data: Name, date of birth, gender.
• Contact data: Email address, phone number, and postal address.
• Genetic data: DNA sample and resulting genomic data generated from your test. This is sensitive personal data and is treated with the highest level of protection.
• Usage data: How you interact with our platform, pages visited, and features used.
• Payment data: Transaction details processed via our payment partners. We do not store card numbers.
• Communications: Any messages you send us via email or support channels.

We never collect genetic data without your explicit, informed consent.

We use the data we collect for the following purposes:

• Service delivery: Processing your genetic test orders, generating reports, and delivering results.
• Account management: Creating and maintaining your MyGenoRoot account.
• Customer support: Responding to queries, resolving complaints, and providing technical assistance.
• Legal compliance: Meeting obligations under applicable Indian laws and regulations.
• Platform improvement: Analysing aggregated, anonymised usage data to improve our products and services.

We will never sell your genetic data to any third party. Your genomic information is used solely to generate your personal health report and is not shared with insurance companies, employers, or advertisers.

We implement industry-leading technical and organisational measures to protect your personal and genetic data:

• ISO 27001 certified information security management system.
• NABL accredited laboratories handling all biological samples under strict chain-of-custody protocols.
• End-to-end encryption for data in transit and at rest.
• Role-based access controls — only authorised personnel can access your data for the purpose of delivering your results.
• Regular third-party security audits and penetration testing.

Despite our best efforts, no system is completely secure. If a data breach affecting your rights occurs, we will notify you as required by applicable law.

Under the Digital Personal Data Protection Act, 2023 (India), you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to correction: Ask us to correct inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to withdraw consent: Withdraw your consent for processing at any time. This will not affect the lawfulness of prior processing.
• Right to grievance redressal: Raise a complaint with our Data Protection Officer at mygenoroot@gmail.com.
• Right to nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email us at mygenoroot@gmail.com with the subject line "Data Rights Request". We will respond within 30 days.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Genetic report data and account information: retained for as long as your account is active, plus 7 years after account closure for legal compliance.
• Biological samples (DNA): destroyed within 6 months of report generation unless you explicitly request extended storage.
• Communication records: retained for 3 years.
• Payment records: retained for 7 years as required under Indian financial regulations.

You may request early deletion of your data at any time, subject to our legal retention obligations.

We work with trusted third-party service providers to operate our platform. These include:

• NABL-accredited laboratories for sample processing and DNA analysis.
• Cloud infrastructure providers for secure data hosting within India.
• Payment gateways for processing transactions securely.
• Courier partners for kit delivery and sample collection logistics.

All third-party partners are bound by data processing agreements that require them to protect your data in accordance with applicable law. We do not allow them to use your personal data for their own purposes.

Our platform may contain links to third-party websites. We are not responsible for the privacy practices of those sites.

This Privacy Policy is governed by the laws of India. Any disputes arising in connection with this policy shall be subject to the exclusive jurisdiction of the courts at Amaravati, Andhra Pradesh.

If you have questions, concerns, or requests about this policy or our data practices, please contact us:

• Company: MyGenoRoot Solutions Private Limited
• Email: mygenoroot@gmail.com
• Phone: +91 8332 888 999
• Address: Amaravati, Andhra Pradesh, India

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and notify you via email if the changes are material.