Compliance
Privacy law, covered.
HIPAA
We operate in line with HIPAA and sign Business Associate Agreements with US partners.
GDPR
Data processing agreements with Standard Contractual Clauses. EU data is processed and stored in the EU.
CCPA
A US data processing agreement covering California privacy law.
Wellness and clinical
Wellness reports show predisposition, not a diagnosis. Clinical reports are for clinician-led programs.
Security
Your customers' data stays yours.
AES-256 encryption
Pseudonymized samples: the lab never sees customer names
Secure tokenized API and webhooks
You own your customer data, and we never sell it
Deletion on request within 30 days
US or EU (Frankfurt) hosting to match your market
Security pack, on request
A recent completed security audit, our security policies, and evidence for any item in our security self-assessment.
Security first
Compliance your security team can check.
Ask for our security pack: a recent completed security audit, our policies and our self-assessment.
HIPAA BAAs and GDPR DPAs ready to sign
AES-256 encryption and pseudonymized samples
We never sell your customers' data
Request the security packLaboratories
Accredited labs on two continents
US lab
United States
CLIA certified and CAP accredited. Serves the US, Mexico and parts of Canada.
EU lab
European Union · Denmark
GLP compliant, ISO 9001 and ISO 13485 certified, ISO 15189 and ISO 17025 accredited. Serves Europe and the rest of the world.
Where we operate
Country availability
Rules on genetic testing and sample shipping vary by country. Here is where we work today; ask us about your market.
| Region | Available | Notes |
|---|---|---|
| United States | Yes | US lab and US hosting |
| Canada | Yes | US or EU kit depending on address |
| European Union and UK | Yes | EU lab; data stays in the EU |
| Mexico | Yes | US lab |
| Latin America | Most countries | EU kit; some countries limit sample export |
| India | Yes | Processed by our lab partner in India, with data stored in the EU |
| Rest of world | Ask us | Shipped through the EU lab's UK facility |
Data formats
Bring your own data
Already have DNA data? Here is what we accept.
| Input | Accepted | What you get |
|---|---|---|
| Consumer raw files (23andMe v3–v5, AncestryDNA) | Yes | Standard reports |
| Genotyping arrays from major platforms | Yes, if good quality | Standard reports |
| Whole genome from any sequencing lab | Yes | Standard and WGS reports |
| Exome data, or WGS as VCF, gVCF, BAM or CRAM | No | — |
FAQ
Questions security teams ask
Do you hold a SOC 2 report?
We don't currently hold a SOC 2 report. We're happy to provide a recent completed security audit, our security policies, and evidence of any item in our security self-assessment.
Do you sell customer data?
No. You own your customer data, and we never sell it.
Where is data stored?
In the EU (Frankfurt) for partners in the EU, EEA and UK, and in the US for partners everywhere else.
Can customers have their data deleted?
Yes. We delete data on request within 30 days.
Does the lab see personal information?
No. Samples are pseudonymized and linked only by kit barcode.
Can you sign our NDA or DPA?
Yes. We're happy to sign our mutual NDA or review yours, and we have BAAs and DPAs ready.
Ready for your security review.
Book a call and we'll send the security pack and our standard agreements.