Privacy Policy

This privacy policy governs how Gene2Rx may process or use your personal data across all of our services, including the Gene2Rx website ("Website") and the Gene2Rx iOS mobile application ("App"). Together, the Website and the App are referred to as the "Service." You can contact us via the contact form on Gene2rx.com if you have any questions or concerns regarding your privacy.

Gene2Rx is a genetic annotation system that creates a personal report (a "Report") based on a raw DNA data file ("DNA Data File") uploaded by the user, or on genotype results the user enters from another pharmacogenetic test ("Entered Results"), using published pharmacogenetic guidance from the Clinical Pharmacogenetics Implementation Consortium (CPIC®), the U.S. Food and Drug Administration (FDA), the Dutch Pharmacogenetics Working Group (DPWG) and our own review of the scientific literature. We do not have any affiliation with CPIC, the FDA or the DPWG. Gene2Rx is a platform for genetic analysis, that allows its users to: (i) upload DNA Data Files generated by different DNA testing service providers; (ii) optionally store DNA Data Files; (iii) generate Reports based on the uploaded DNA Data Files or Entered Results; (iv) optionally create a private account through which they can manage the DNA Data Files and the Reports; (v) access their pharmacogenetic results and related health tracking tools through the Gene2Rx mobile application; and (vi) with a Gene2Rx Pro membership, use additional tools on the Website such as the medication tracker, the Medication Selector and the Report Assistant.

Your privacy is important to us. By using the Service (including the Website and/or the App) and uploading a DNA Data File, you consent to the collection, use and storage by us of your DNA Data File and other personal data in accordance with this Privacy Policy, until deleted by you or by us.

What personal data is collected?

If you upload a DNA Data File and/or create an account, your DNA Data File and your email address will be processed by us. We will process this information for as long as needed to provide you with the service. When you create an account, we collect your first and last name, your email address, a password (stored only in hashed form), and whether you would like to receive marketing emails.

If you order a Report from Entered Results instead of a DNA Data File, the genotype results you enter (for example, the gene results from a GeneSight or Genomind report) are processed and stored in the same way as a DNA Data File.

If you use the medication tracker on the Website, the medications you add (drug names, doses, frequencies and any notes you write) are stored in your account on our servers so that we can check them against your Report. If you use the Report Assistant, your conversations are stored in your account. If you answer the optional questions in our guided start (such as why you are interested in testing, which medication areas matter to you, and which DNA test you have), we store your answers, and if you join a waitlist we store your email address with them.

If you make a payment to use Gene2Rx, we use the Stripe service for billing (on the Website) or Apple In-App Purchase (in the App) and therefore we do not store your credit card information or other billing information on Gene2Rx; it is stored by the respective payment processor and we do not have access to it.

When you generate a Report, you must enter your email address for the Report to be emailed to you.

Gene2Rx mobile application

The Gene2Rx iOS App is a companion application to the Website that allows you to view your pharmacogenetic results, track medications, log symptoms and moods, and optionally integrate with Apple HealthKit. The App collects and processes the following categories of data:

1. Account credentials. Your email address and password are used to authenticate with our servers. Authentication tokens are stored securely in the iOS Keychain on your device.
2. Pharmacogenetic results. Your gene test results (including gene names, diplotypes, phenotypes, and activity scores) are retrieved from our servers and stored locally on your device for offline access.
3. Medication data. You may optionally log medications including names, dosages, frequencies, start/end dates, and notes. This data is stored locally on your device and is not transmitted to our servers.
4. Symptom and mood data. You may optionally log symptoms (including severity, descriptions, and triggers), mood entries, and energy levels. This data is stored locally on your device and is not transmitted to our servers.
5. Dose tracking. You may optionally track medication adherence, including when doses are taken, missed, or skipped. This data is stored locally on your device and is not transmitted to our servers.
6. App Store purchases. If you buy Gene2Rx Pro in the App while signed in, the App sends the App Store's signed record of the purchase to our servers so that Pro also works on the Website. From it we store, with your account, the subscription's product, its App Store transaction identifier, its renewal and expiry status, and whether it is in a free trial or shared through Family Sharing. It contains no payment information.
7. Drug information. The App may query the U.S. Food and Drug Administration (FDA) public APIs for drug label and dosage information. No personal data is sent in these queries.

Apple HealthKit data

The App may request your permission to read health data from Apple HealthKit, including heart rate, blood pressure, body weight, blood glucose, step count, resting heart rate, and sleep analysis. Access to HealthKit data is entirely optional and requires your explicit authorization through the iOS permissions system.

On iOS 26 and later, you can also choose to import medications from Apple Health. The App then reads only the medications you select, and when you took or skipped them, and adds them to the medications and dose history stored on your device.

HealthKit data is used solely to display health metrics and your imported medications alongside your pharmacogenetic information within the App. We adhere to the following strict policies regarding HealthKit data:

1. HealthKit data is stored only on your device and is never transmitted to Gene2Rx servers or any third party.
2. HealthKit data is never used for advertising, marketing, or data mining purposes.
3. HealthKit data is never sold, shared, or disclosed to any third party, including insurance companies or data brokers.
4. HealthKit data is never used to make eligibility decisions or for any purpose other than displaying it to you within the App.

You may revoke HealthKit access at any time through the iOS Settings app under Privacy & Security > Health > Gene2Rx.

Storage of your information

Gene2Rx maintains a copy of your report and DNA data file on our servers unless otherwise requested. If you delete your account, your server-side data will be deleted with it.

You can log into your account at any time and request to delete any of your data. While your DNA Data File is stored with Gene2Rx, you can re-generate a Report with the latest pharmacogenetic guidance.

If you upload a DNA Data File but you do not continue and generate a Report, the DNA Data File is automatically deleted within 24 hours.

Medications you add to the medication tracker on the Website, and your Report Assistant conversations, are stored in your account until you remove them or delete your account. Medications you log in the App are separate and are stored only on your device.

Data stored locally on your device by the App (including medications, symptoms, mood entries, dose tracking, and HealthKit data) remains on your device and is managed by your device's storage. Uninstalling the App will remove all locally stored data.

DNA data storage

DNA data storage is optional. You may opt-out from the storage option at the time of requesting the Report, in which case we will delete your DNA Data within 24 hours of your Report being generated. If you create an account and store DNA Data in it, you can delete your data at any time after your Report is generated. Otherwise, an encrypted copy of your data will be maintained on our servers.

Rights & License

We do not claim any ownership rights in your DNA Data File and genome and it belongs to you only.

By uploading your DNA Data File, you grant us a temporary, limited, revocable, royalty-free, world-wide license to process and use your DNA Data File for the purpose of providing you with the service. i.e., for generating and re-generating Reports, and if you created an account and stored your DNA Data File, also to use it with new genetic features of the service we may develop in the future, at no additional cost to you. You may delete your DNA Data File at any time.

By uploading DNA Data to Gene2Rx, you acknowledge that you acquire no rights in any research or commercial products that may be developed by us (whether or not they relate to the said DNA Data).

Use of your personal data

We may use your personal data under the following circumstances:

1. To provide you with the service.
2. To communicate with you. We may communicate with you for the purpose of informing you of changes or additions to the service or of any of our products and services or to seek feedback from you on the service. We may send updates when new pharmacogenetic guidance is available.
3. For internal business purposes. To improve Gene2Rx or to develop new products and/or services.
4. For measurement and advertising. To understand how people find and use the Website and to measure whether our advertising works, as described in Analytics & tracking below. We never use your DNA Data File, Report contents, Entered Results or medications for advertising.
5. For system improvement. We store de-identified summary statistics, called alleles, for further product development and system performance monitoring.

Security

When you provide us with any personal data, that personal data may be transferred to and stored by us in our secure data centers which may provide a different level of protection for personal data than in your country of residence. By providing us with personal data, you specifically consent to the transfer and processing of personal data and its storage in our data centers. By using services, you consent to have your personal data transferred to and processed in the United States and you acknowledge that your personal data may be used as described herein.

We have implemented commercially reasonable security measures in place to attempt to protect users' data under our control. However, we cannot guarantee unauthorized use. You acknowledge that you provide your personal data at your own risk.

You hereby acknowledge and agree that:

1. Downloading your Reports will create a copy that is not protected by our security and privacy settings;
2. Download and the storage of your Reports after you have downloaded them, shall all be made at your own risk;
3. We shall not have any control over the downloaded Reports and shall not be liable to you or to any third party in connection with any such download and/or storage.

Third-parties

Your personal data (including the DNA Data Files and/or the Reports) will never be sold, licensed or otherwise shared by us with any other third parties without your explicit informed consent, except in the very specific scenarios described below:

1. Service providers. To third parties providing services on our behalf: Stripe (Website payments), Apple (App purchases), Fly.io (hosting of the Website and its database), Amazon Web Services (storage of DNA Data Files and Reports), Resend (sending email), Sentry (error reporting, configured not to collect personal data), and OpenAI (the Report Assistant, which receives only the de-identified data described in that section). The use of the personal data by such third parties is limited in scope and subject to contractual protections. Such parties are prohibited from using it for any other purposes other than providing us or you with the required services. With respect to processors outside Europe, we attempt to ensure adequate safeguards for your personal data, as required by applicable law.
2. Apple. If you use the Gene2Rx App, Apple processes your in-app purchase transactions through the App Store. We do not receive or store your payment information from Apple. We receive the subscription details described in Gene2Rx mobile application above, from the App and from Apple's notifications about the subscription (such as renewals, refunds and expiry), so that Pro works on both the App and the Website. Apple's use of your data is governed by Apple's own privacy policy.
3. Analytics and advertising partners. Google receives information about your use of the Website as described in Analytics & tracking below. It never receives your name, email address, DNA Data File, Report contents, Entered Results or medications.
4. FDA public data. The App may query the U.S. FDA's publicly available drug information APIs. These queries contain only drug names, not personal or health data.
5. Business transfers. In the event that Gene2Rx, or substantially all of its assets or stock, are acquired, transferred, disposed of (in whole or part and including in connection with any merger, bankruptcy or similar proceedings), personal information including DNA Data will be one of the transferred assets. In such event, your personal information would remain subject to the promises made in the pre-existing Privacy Policy prior to the event.

Email & push notifications

We may send to you the following types of emails:

1. Transactional emails. Emails that are sent following a purchase of a Report. For example, if you make a payment, you will receive an email with a confirmation that your payment was received, or the charge has failed.
2. Notification emails. Emails that include a link to your Report or information concerning privacy policy updates.
3. Announcement emails. Emails concerning the service that announce new features, promotions and offers.

You cannot unsubscribe from transactional and notification emails, and by providing your email address you give your consent to receive such emails as necessary.

Push notifications (App): The App may request permission to send local push notifications for medication reminders, health check-in prompts, and adherence milestones. These notifications are generated entirely on your device and do not involve transmission of data to our servers. You can enable or disable push notifications at any time through the iOS Settings app.

Legal ground for processing

Under EU data protection law, all processing of personal information is justified by a "condition" for processing. In the majority of cases, any processing will be justified on the basis that:

1. As is necessary for the performance of a contract with you, in this case, your usage of our services;
2. As is necessary for our legitimate commercial interests subject to your interests and fundamental rights (e.g. analytics which we carry out of your use of the service);
3. The processing is necessary for us to comply with a relevant legal obligation.

In addition, the processing of "special category data" is only permitted where a relevant exemption exists. Special category data includes genetic information. The special category data is processed on the basis of your explicit consent. Where the basis of processing is your consent, you have the right to withdraw your consent, and therefore prevent that processing, at any time.

Data deletion & account removal

You can delete your account and all associated data at any time from your account page on the Website or from the account settings in the App. You can also ask us to do it through the contact form on our Website. Deleting your account permanently deletes your DNA Data Files, Entered Results, Reports, tracked medications, Report Assistant conversations and personal information from our servers.

To delete data stored locally by the App (medications, symptoms, mood entries, dose tracking, and cached genetic results), you may uninstall the App from your device. Uninstalling the App permanently removes all locally stored data.

Deleting your account cancels Gene2Rx Pro bought on the Website. It ends immediately, and the rest of the current billing period is not refunded. Pro bought in the App is billed by Apple and is not cancelled when you delete your account: cancel it through the App Store settings on your device first. Gene2Rx cannot cancel App Store subscriptions on your behalf.

Minors

If you are a child under the age of 18, please do not use our service. We will not knowingly contact or engage with children under the age of 18. If you have reason to believe that a child has provided us with their personal information, please contact us using the contact form on our website and we will endeavor to delete that information from our databases.

Modifications

Your use of the Service (including the Website and/or the App) constitutes your agreement to follow and be bound by this Privacy Policy. We reserve the right to update or modify this Privacy Policy at any time. For this reason, we encourage you to review this Privacy Policy whenever you use the Service.

If we decide to modify our Privacy Policy, we will issue an updated version of this Privacy Policy with an updated date legend (and notify you via email or by other appropriate means if the changes are material) so that you will be aware of what information we collect, how we use it and under what circumstances we disclose it in accordance with applicable law. If you do not consent to the Privacy Policy or to any changes thereto and as a result you would like us not to use or hold your information in accordance with the revised terms, you may delete your DNA Data and/or delete your account.

Use of the Service following any changes constitutes your acceptance of the revised Privacy Policy then in effect.

GDPR

You have the right to request access to your personal data that we process, and further have such personal data rectified or erased.

If you feel like your data protection rights under the GDPR have been violated, you may lodge a complaint at the supervisory authority in the Member State in which you reside, or alternatively with the ICO.

California privacy rights

California residents are entitled to ask us for a notice describing what categories of personal customer information we share with third parties or corporate affiliates for those third parties or corporate affiliates' direct marketing purposes. We do not sell your personal information, and we do not share it with third parties or corporate affiliates for their own direct marketing purposes. For visitors who are not signed in, the Google Ads tag described in Analytics & tracking helps us measure and show our own advertising, which may count as "sharing" for cross-context behavioral advertising under California law. You can opt out by blocking third-party cookies or by contacting us. Ad personalization is turned off while you are signed in, and we never share your DNA Data File, Report contents, Entered Results or medications for advertising.

Analytics & tracking

The Website uses Google Analytics to help us understand how people use it, and the Google Ads tag to measure our advertising on Google. These use cookies and similar technologies to collect information such as the pages you visit, the buttons you click, your browser and device type, and your approximate location from your IP address.

When you are signed in, Google receives only de-identified information: we never give it your name or email address, and we turn off Google signals and ad personalization so that your visits are not linked to your Google account or used to target ads. On pages that show your results or medications (your Report, its medication and drug-class pages, the medication tracker, Medication Selector rankings and the Report Assistant), Google receives a fixed page name instead of the real address and title, so it does not learn which medication or result you looked at.

When you make a purchase or a report finishes, our servers also send that event to Google Analytics so that we can measure which pages and ads lead to purchases. These events include your analytics cookie identifier, your Gene2Rx account number (which does not tell Google who you are), and the product and price. They never include your name, email address, DNA Data File, Report contents, Entered Results or medications.

You can block or delete these cookies in your browser settings or use Google's opt-out browser add-on. We do not use the Meta (Facebook) Pixel or other Meta tracking tools.

The App does not use any third-party analytics, advertising, or tracking frameworks. The App does not collect device identifiers, advertising identifiers, or any information for the purpose of tracking you across apps or websites. No data from the App is shared with third-party analytics or advertising services.

Report Assistant (AI chatbot)

The Report Assistant is an optional, AI-powered feature available to subscribers that lets you ask questions about your own Report in plain language. It is an informational tool only and is not a substitute for professional medical advice, diagnosis, or treatment. Always confirm any medication decision with a licensed clinician or pharmacist.

The Report Assistant is strictly opt-in. Before your first use, we show you a disclosure describing exactly what data is sent, and you must acknowledge it. You can choose not to use the feature at any time.

To generate answers, we send a limited amount of de-identified data from your Report to our AI provider, OpenAI, who processes it on our behalf as a service provider. Specifically, we send:

• Your gene results from the Report: genes, diplotypes, and phenotypes (for example, "CYP2C19: Rapid Metabolizer").
• The drug interpretation text contained in your Report.
• The questions you type into the assistant.

If you separately opt in to sharing your medications with the Report Assistant, we additionally send a de-identified list of the medications you track (the drug and ingredient names, dosage, and frequency) together with the guideline-based drug interaction and phenoconversion analysis we compute from them. This is a distinct, optional choice from using the assistant, and you can turn it off at any time. We do not send the free-text notes you attach to a medication.

We do not send your name, email address, date of birth, account identifiers, or your raw DNA Data File. The data sent is limited to de-identified genetic results, guideline-based interpretation text, and (if you opt in) your medications and their interaction analysis.

Please do not type any identifying information (such as your name, contact details, or other people's information) into the assistant, because anything you type is sent to the AI provider as part of your question. The assistant is instructed not to request or repeat identifying information.

We retain your chat history in your account so you can refer back to prior conversations, and we keep limited technical logs (such as the volume of usage) to operate and improve the feature. You can request deletion of your data as described in the Data deletion section above.