Privacy policy

Version PP-2026-01 · Effective from September 14, 2026 · Replaces version of September 9, 2025 ·

This Policy explains what personal data we process, for what purposes, on what legal basis, for how long, and what rights you have. It forms part of the contract together with the Legal Terms, the Informed Consent, and the Cookie Policy.

Genetic data constitutes special category personal data. Therefore, its processing is explained in detail in the Informed Consent, which takes precedence over this Policy in everything related to genetic analysis and voluntary authorizations.

1. Who is the data controller

Data Controller: GENELINK, S.L., commercial brand "tellmeGen". Tax ID (NIF) B98649494. Address: calle Arquitecto Mora 5, floor 2, door 4, 46010 Valencia, Spain. Health authorization no. 11540 issued by the Conselleria de Sanidad of the Generalitat Valenciana.

•      General contact: info@tellmegen.com · Phone: +34 960 090 596

•      Privacy and exercise of rights: lopd@tellmegen.com

•      Data Protection Officer: dpo@tellmegen.com

We provide the service from Spain and apply Regulation (EU) 2016/679, Organic Law 3/2018, and Spanish health regulations, without prejudice to mandatory local laws applicable in your country of residence.

2. Who this Policy applies to

2.1 It applies to those who visit the Website, create an account, purchase our services, upload their own genetic data, participate in research, or contact our support team.

2.2 A genetic report may contain information that also concerns your biological relatives. tellmeGen does not process data of those individuals unless they are users of the service on their own account. It is your responsibility to decide with whom you share your reports.

3. What data we process and where it comes from

3.1 Categories of data:

•      Account and contact: first and last name, email address, encrypted password, date of birth, sex (if provided), postal address, telephone number, language, and country.

•      Biological sample: saliva collected using our kit.

•      Genetic data: in Starter and Advanced, microarray results on a predefined panel; in ULTRA, whole-genome sequencing data with an approximate target average coverage of 30×.

•      Responses to health and wellness questionnaires, filled out on a voluntary basis, except for the preliminary questionnaire required in Spain to prescribe Advanced and ULTRA, together with the medical assessment regarding the test.

•      Purchasing and payments: orders, billing, status and renewals of tellmeGen+, and transaction metadata. We do not store complete card numbers.

•      Platform usage: log-ins, reports consulted, downloads, features used, metrics, and data collected via cookies.

•      Communications with customer support and incident records.

•      Documentation proving legal representation or support measures, when contracted on behalf of a minor or a person requiring support.

•      Genetic data files that you upload originating from another provider.

3.2 Source. Data originates from you, is generated during the provision of the service, or is uploaded by yourself from a third party. We do not acquire personal data from external sources to profile you.

4. Why we process your data and on what legal basis

•      Processing the sample, analyzing it, and generating your reports, and, in Spain, evaluating the preliminary questionnaire and determining the medical prescription: performance of a contract (Art. 6(1)(b)), explicit consent for genetic data (Art. 9(2)(a)), and, for the prescription, provision of healthcare (Art. 9(2)(h)).

•      Creating and managing your account, logistics, access to reports, and subscription: performance of a contract (Art. 6(1)(b)).

•      Issuing secondary findings in ULTRA, activating DNA Connect or Professional Access: your specific consent given in each case (Arts. 6(1)(a) and 9(2)(a)).

•      Addressing your rights of access, portability, and other rights: legal obligation (Art. 6(1)(c)).

•      Verifying identity, legal representation, and support measures, and preventing unauthorized analyses: compliance with applicable legal obligations (Art. 6(1)(c)) and, in the absence of a specific legal obligation, legitimate interest in preventing unlawful or fraudulent use (Art. 6(1)(f)). The retention of proof of consent and representation is further supported by Art. 9(2)(f).

•      Improving the service, ensuring its security, preventing fraud, and defending against legal claims, using aggregated or anonymized analytics wherever possible: legitimate interest (Art. 6(1)(f)), with the right to object.

•      Complying with statutory tax, commercial, healthcare, quality, and vigilance obligations, as well as addressing requests from public authorities: legal obligation (Art. 6(1)(c)).

•      Research and development, including training artificial intelligence models, within the scopes described in Section 20 of the Informed Consent: your specific and severable consent (Arts. 6(1)(a) and 9(2)(a)).

•      Transactional and support communications: performance of a contract (Art. 6(1)(b)).

•      Electronic marketing communications: your consent or, for products and services similar to those already contracted, legitimate interest provided under information society services regulations, with the possibility to unsubscribe in every communication.

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. Where based on our legitimate interest, you may object, and we will assess your specific situation; the balancing test is available upon request by writing to dpo@tellmegen.com.

5. Genetic data: specific rules

5.1 We process your genetic data solely to provide the contracted service and for the voluntary purposes you have authorized in the Informed Consent.

5.2 The sample is processed in the laboratory in coded form: laboratories do not receive your identifying details.

5.3 You decide what information you wish to know and may hide specific categories of results, in accordance with Section 10 of the Informed Consent.

5.4 Unless expressly agreed otherwise, contracting the service does not imply an obligation to re-analyze your sample or to contact you individually when scientific evidence evolves. We will inform you should we detect an error affecting one of your health-related results.

5.5 We do not sell or rent individual-level identified data, neither now nor as part of any future transaction.

6. Research, development, and artificial intelligence

6.1 Participation is voluntary, severable, and revocable, and does not condition the service or its pricing. It is granted through a specific authorization covering internal research and improvement, external scientific projects, and collaborations with commercial partners, pursuant to Section 20 of the Informed Consent.

6.2 When authorized, we may use pseudonymized or anonymized data from the permitted categories, and combine them, to develop, train, validate, and improve analytical models and artificial intelligence systems intended for genetic interpretation, the improvement of reports, and the development of new products and services.

6.3 Models are developed on pseudonymized or anonymized data and are engineered and verified to prevent the reconstruction or re-identification of an individual's genetic data.

6.4 Participating third parties receive pseudonymized or aggregated data under contract, with an express prohibition against re-identification. Each project determines whether the collaborator acts as a data processor, joint controller, or independent data controller.

6.5 You may withdraw any authorization with the same ease with which you granted it. Withdrawal prevents new inclusions and terminates future processing based on it, but does not affect processing already lawfully carried out, publications already made, irreversibly anonymized data, or already trained models from which your data cannot be individually extracted.

7. Minors and individuals under legal support measures

7.1 Contracting requires being 18 years of age or older. Minors may take the test, but cannot register or contract on their own: the test can only be registered and contracted by their mother, father, or legal guardian (even if the kit was purchased or gifted by another person), who provides their own details as account holder, grants consent on behalf of the minor, and receives the results. Minors do not have direct access to the results.

7.2 When contracting on behalf of a minor or a person under support measures, the holder of parental authority, guardianship, or support measures must provide supporting documentation pursuant to Section 14 of the Informed Consent. We do not begin analysis until this is verified.

7.3 Supporting documentation is retained exclusively as proof of authorization under restricted access and is not used for any other purpose.

7.4 Upon reaching 18 years of age, the individual may request ownership of the account and exercise all their rights directly.

8. Automated decision-making

8.1 Generating your reports is an automated process: our software identifies variants present in your DNA and matches them with contents from our knowledge base, developed by our genetics team based on peer-reviewed scientific literature.

8.2 This processing does not produce legal effects concerning you or similarly significantly affect you, as the report is purely informational and does not in itself determine any medical or health decisions.

8.3 In any case, you may request a review of your report by a member of our genetics team by writing to lopd@tellmegen.com, express your point of view, and contest the result.

9. ULTRA, tellmeGen+, and data downloads

9.1 Secondary findings. You may choose whether to receive them or not according to the recognized list in force, and modify your preference prior to the issuance of results.

9.2 Downloads. While your subscription is active, and during the 12-month grace period following its termination, you may download your VCF file and, when available, BAM or FASTQ. Three free exports per calendar year are included; additional exports are priced as specified in the Legal Terms.

9.3 The exercise of rights of access and portability is free of charge and does not consume these exports. Only a manifestly unfounded or excessive request may give rise to a reasonable fee or refusal under Article 12(5) of the GDPR.

9.4 Deletion. Prior to the end of the grace period, we will notify you six months, two months, one month, one week, and one day in advance, followed by a final notice once it expires. Downloads remain available throughout the grace period and, in all cases, for a minimum of 365 days following subscription termination. After this period, sequencing data will be securely deleted, including backup copies within a maximum of 90 additional days.

9.5 This deletion does not affect information that we must retain in blocked status pursuant to Section 10.

10. Retention periods and blocked archiving

•      Account and contract: for the duration of the relationship and thereafter for the applicable statutory limitation periods.

•      Billing and accounting: for the periods required under commercial and tax laws.

•      Biological sample: approximately 60 to 120 days from results issuance and, in any event, less than six months, unless legal requirements dictate otherwise.

•      Genetic data and reports: as long as the account remains active and, for ULTRA, according to Section 9; in Spain, the preliminary questionnaire and medical test decision, as part of the medical record, for at least five years following the completion of each healthcare episode.

•      Technical and security logs: between 12 and 24 months, proportionate to their purpose.

•      Documentation proving representation and consent acceptance logs: as long as liability may arise.

•      Research: depending on the project duration or until withdrawal of consent, subject to the exceptions in Section 6.5.

When you request erasure or close your account, information that we must retain due to legal, healthcare, quality, tax obligations, or for the defense of legal claims is blocked, with restricted access, kept free from any other use, and deleted once the applicable retention period expires.

11. Recipients, processors, and sub-processors

11.1 We do not sell or rent individual-level identified data. We may disclose data to the following categories of recipients:

•      Genotyping and sequencing laboratories, which receive the coded sample.

•      Infrastructure, hosting, storage, and security providers.

•      Payment gateways and payment processors.

•      Logistics providers.

•      Customer support, communication, and analytics tools.

•      Research partners, where you have authorized it, receiving pseudonymized or anonymized data.

•      Public authorities and bodies, when under a legal obligation.

11.2 All data processors are bound by contract in accordance with Article 28 of the GDPR, implementing appropriate technical and organizational measures.

11.3 You may request the specific, updated list of processors and sub-processors, their location, and their role by writing to lopd@tellmegen.com.

12. International transfers

12.1 Genetic analysis and data storage take place entirely within the European Economic Area. Laboratory analysis is conducted at Eurofins (Denmark), GenePlanet (Slovenia), and MGI (Poland), which operate under quality management systems certified according to the ISO standards applicable to their activity; all other providers fall within the categories listed in Section 11.1.

12.2 If any ancillary feature requires processing outside the European Economic Area, we implement appropriate safeguards: European Commission adequacy decisions, standard contractual clauses accompanied by impact assessments and supplementary measures, or binding corporate rules. The transfer will be identified on that list.

12.3 You may request information regarding the safeguards implemented and, where applicable, a copy thereof by writing to dpo@tellmegen.com.

13. DNA Connect, Professional Access, and uploading third-party data

13.1 DNA Connect is an optional feature, deactivated by default, allowing other users who also activated it and share DNA segments with you to find and contact you. It is enabled via specific consent—either when accepting the Informed Consent or later from your account settings—and can be turned off at any time. Deactivation prevents new connections but does not erase what you have already shared voluntarily.

13.2 Professional Access allows a healthcare professional of your choice to review your reports. Authorization is granted upon activation, specifying the recipient, scope, and duration, and may be revoked at any time; revocation does not cover materials that the professional may have already downloaded.

13.3 Uploading external data. If you upload a genetic data file obtained from another provider, the processing is carried out on your initiative. You declare that the file is yours or that you have adequate authorization. We do not verify the identity of the data subject or the analytical quality of the original file.

14. Commercial communications

We may send you information regarding tellmeGen products or services when you have consented or when they concern products and services similar to those you have already purchased. You may opt out at any time, easily and free of charge, via the unsubscribe link in each communication or by emailing lopd@tellmegen.com.

15. Cookies and advertising

15.1 We use technical and analytics cookies and, solely with your consent, advertising cookies. At the first level of the consent banner, you can accept, reject, or customize your preferences, and modify them at any time. Details are provided in the Cookie Policy.

15.2 For analytics and advertising purposes, we share information with our partners, including Google, in accordance with Google's EU User Consent Policy. You can learn how Google uses data from sites utilizing its services on Google's Privacy & Terms page.

15.3 These tools have under no circumstances access to your genetic data or your reports.

16. Security and data breaches

16.1 We implement technical and organizational measures appropriate to the risk: encryption in transit and at rest, pseudonymization, role-based access control, logging and monitoring, perimeter and application protection, incident management, and privacy by design and by default. We have conducted a Data Protection Impact Assessment (DPIA).

16.2 No information system is entirely immune to risks. Should a security breach occur presenting a high risk to your rights, we will notify you without undue delay, outlining the nature of the incident, its potential consequences, and the remedial measures taken.

17. Your rights

17.1 You may exercise your rights of access, rectification, erasure, restriction of processing, data portability, and objection, withdraw consents previously granted, and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

17.2 To exercise them, email lopd@tellmegen.com or write to GENELINK, S.L. (Attn: Data Protection), calle Arquitecto Mora 5, floor 2, door 4, 46010 Valencia, Spain. We may ask you to provide proof of your identity.

17.3 We will respond within one month, which may be extended by two further months if the request is complex, informing you of any such extension and its grounds.

17.4 Exercising your rights is free of charge, except for manifestly unfounded or excessive requests, notably due to repetitive character, in which case a reasonable fee may be charged or the request may be refused with justification.

17.5 You may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority in your country of residence.

18. Change of control and corporate succession

18.1 GENELINK may undergo corporate restructuring operations such as mergers, demergers, transfers of business units, or total/partial divestments.

18.2 During preliminary negotiation and due diligence phases, no individually identifiable genetic records are disclosed to third parties: shared information is strictly limited to aggregated, statistical, or pseudonymized data without individual genomic access, under confidentiality agreements.

18.3 If the transaction is completed, the acquiring entity assumes the role of data controller and remains bound by the Informed Consent and this Policy, without expanding processing purposes. We will inform you without undue delay and, whenever possible, before it begins processing your data.

18.4 For materially different purposes, the new controller must inform you and secure a valid legal basis or, where appropriate, obtain fresh consent.

18.5 In case of bankruptcy or liquidation, your genetic data may only be transferred within the framework of service continuity under equivalent safeguards; failing that, data will be deleted or anonymized, save for information subject to mandatory retention.

19. Changes to this Policy and proof of consent

19.1 We may update this Policy to reflect legal, technical, or service modifications. Each version carries an identifier code and date, and historical versions can be requested at lopd@tellmegen.com.

19.2 If a change expands processing purposes or affects any of your consents, we will inform you prior to its entry into force and, where appropriate, request a new consent. We will not apply new purposes to previously collected data without an appropriate legal basis.

19.3 We keep verifiable records of each consent given, including the version shown, date, and timestamp. You can review and download this record from your account.

20. Contact

For any inquiries regarding this Policy, you can write to lopd@tellmegen.com, or to dpo@tellmegen.com for matters requiring the involvement of our Data Protection Officer.