The Gene-Chain only transmits de-identified genetic data. We strip all identifiable data from it. Moreover, because we never ask you who you are, you can create and account, upload data, sell it, and get paid all via any email address you want to use. Nothing more is needed. We have always complied with both HIPAA and the GDPR because of their specific exclusions for de-identified genetic data, and remain in total compliance with the new California law on genetic data privacy as well because it too does not apply to de-identified data.

While GIPA does not apply to de-identified data, GIPA does not incorporate HIPAA’s de-identification standards, but instead imposes a more stringent standard requiring that data cannot be used to infer information about, or otherwise be linked to, a particular individual and requires that DTC Companies do all of the following (and note we aren’t even a DTC company, but we do comply regardless according to its requirements):

• We take reasonable measures to ensure that the information cannot be associated with a consumer or household.
• We publicly commit to maintain and use the information only in de-identified form and not to attempt to re-identify the information, except that the business may attempt to re-identify the information solely for the purpose of determining whether its de-identification processes comply with the Act’s requirements, provided that the business does not use or disclose any information re-identified in this process and destroys the re-identified information upon completion of that assessment.
• Contractually obligate any recipients of the information to take reasonable measures to ensure that the information cannot be associated with a consumer or household and to commit to maintaining and using the information only in de-identified form and not to re-identify the information.

We were built by and ethicist/lawer and a scientist, and we will serve all these foundational values always.