Consumer health data policy

What we collect, and why

• Genetic data: the raw DNA file you upload, the genotypes read from it, and the results in your report (traits, polygenic scores and drug-response notes). We use it to build your report and, if you separately choose Connect, answer your questions in your chosen AI service.
• Health readings and notes from our iOS app, if you use it and allow it: the Apple Health data you choose to share and the notes you type. We use them to show you your own readings. If you choose Connect, it can read these and the labs or other records you add, and add or update the records that its permissions allow when you ask it to.

We collect it only with your consent (the box on the upload page), or where it is needed for a service you asked for: showing your Apple Health readings in our iOS app after you allow it.

Where it comes from

From you: the file you upload, and the readings your phone sends when you use our iOS app, or records your connected AI adds at your request. We don't buy health data about you.

Who it is shared with

We never sell consumer health data. Apart from an AI assistant you choose to connect, which sees what it reads under its provider's terms, and Meta, which learns which pages of indaga.ai and go.indaga.ai you viewed, that you created an account, and the amount and currency of an order you paid for (the amount can show which of our products you bought), if you said OK to marketing there (outside the European Union, Iceland, Liechtenstein, Norway, the United Kingdom, Switzerland, Washington and Nevada: unless you switched it off), we don't share it with any third party for their own use. Two services handle some of it for us:

• Worldstream (Netherlands) hosts our server and backups.
• Cloudflare carries the traffic between your browser and our server, without storing it.

Your genetic data is analysed only on our server and is not sent to any outside database or service to make your report. If you choose to connect an AI assistant, it sees what it reads, under its provider's terms, and most providers process data outside the EU. We have no affiliates that receive it. We use no geofencing around places where people get health care.

Optional sharing through Connect

If you connect an AI service or client, it can receive the genetic results, health readings, labs and notes it reads from your record. For OAuth, the approval page names that client and asks for your separate affirmative consent to this transfer before you approve. Your earlier upload or sign-up consent does not cover it.

A hosted AI provider handles these data under its own terms and privacy policy, including its use, storage and retention rules. It may process data outside the EU, including in the United States, and may use it to improve its services according to those terms and your settings. Check them before connecting. Indaga cannot control or undo that handling. For software you run yourself, check its configuration and destinations.

Revoke a connection in Connect settings to stop its future access. This leaves your other connections alone and does not delete copies the provider already received; request that from the provider. The privacy notice explains this optional transfer in more detail.

Your rights, and how to use them

• Confirm and access: ask whether we hold consumer health data about you, get a copy, and get the list of every third party and service that has handled it.
• Withdraw consent: at any time. We stop using the data within 15 days.
• Delete: we delete it within 30 days and tell our hosting and network service providers to delete their copies. Our encrypted backups expire within about 8 weeks. Copies already received by an AI provider through Connect are subject to that provider's deletion controls.
• Appeal: if we turn a request down, reply with the word “appeal”. We answer within 45 days. If we still say no, you can complain to your state's Attorney General; in Washington, at atg.wa.gov/file-complaint.

To withdraw and delete, use the button on your dashboard. For any of these requests, email support@indaga.ai from the address you sign in with. We answer within 45 days at the latest, and usually much sooner. We won't charge you or treat you differently for using these rights.

More

The full privacy notice covers everything else we collect, including account and payment data. The short version for your DNA file is on Your DNA file at Indaga. Indaga is a product of CryptoSvit (Ruslan Plakhuta, eenmanszaak, KVK 89565568), Soesterberghof 102, 2631 LH Nootdorp, Netherlands.