Privacy statement

Privacy Statement iGene Products

iGene Products B.V.

1. Introduction

This is the privacy and cookie statement (hereinafter: statement) of iGene Products B.V. (Chamber of Commerce number 63823764), registered in Nijmegen and with its office at Oude Haven 102, 6511 XH Nijmegen (hereinafter: iGene Products).

This statement applies to every processing of personal data of the users of iGene Products. ‘Personal data’ means any information relating to an identified or identifiable natural person. ‘Users’ include all purchasers of the products and services of iGene Products, including consumers and business customers, as well as visitors to the websites of iGene Products.

All processing of personal data is subject to privacy laws and regulations, including the General Data Protection Regulation (hereinafter: GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG). We are responsible for compliance with these laws and regulations.

We consider it important that our services are reliable and transparent. We handle the data of our users with discretion and care.

2. Role of iGene Products

iGene Products is the controller for the processing of users’ data if and to the extent that iGene Products itself determines the purpose and means of the data processing. Examples are processing operations in the context of offering its products and services, such as performing DNA tests, analysing DNA and making DNA reports available to users.

iGene Products acts as processor to the extent that iGene Products processes data on behalf of third parties (e.g. business customers). In that case, those third parties are the controllers. iGene Products enters into a data processing agreement with them.

3. What does iGene Products do?

iGene Products offers a genetic information service. The service comprises performing DNA tests, analysing DNA and making DNA reports available to users.

iGene Products offers genetic self-tests that give users insight into personal traits, lifestyle recommendations, medication sensitivity and genetic predisposition for various conditions.

The DNA testing process

The user collects biological material in the form of saliva using an iGene kit and sends it to iGene Products. iGene Products sends the material to a certified laboratory, where a large number of genetic variations (SNPs) are mapped. The results are analysed and processed into individual DNA reports, which are made available via the iGene application.

The service of iGene Products is primarily an information service and is not intended to replace regular medical diagnostics or treatment. Please refer to iGene’s General Terms and Conditions for more information about the nature of the service.

4. Purposes and legal bases for data processing

iGene Products processes data only for specified, explicitly described and legitimate purposes and on the basis of legal grounds:

4.1 Creating, using and managing an account

In connection with ordering products and services, the user can create an account in the iGene application. Legal basis: necessity for the performance of the contract.

4.2 Ordering products and services

The ordering and delivery of products and services, including the iGene kit, and the associated payment processing. Legal basis: necessity for the performance of the contract.

4.3 Performing DNA tests and providing reports

Performing genetic self-tests, analysing DNA and making DNA reports available on personal traits, lifestyle recommendations, medication sensitivity and genetic predisposition. This involves processing genetic data, which falls under the ‘special categories of personal data’ within the meaning of the GDPR. Processing special categories of personal data is prohibited unless a statutory exception applies. iGene Products processes genetic data exclusively on the basis of the user’s explicit consent.

4.4 Visiting and using websites and/or apps

When visiting the websites or apps, data such as visit data may be stored. See section 8 on cookies.

4.5 Direct marketing

Sending commercial communications to users. If iGene Products has received electronic contact details in the context of the sale of products or services, these may be used without further consent for the marketing of its own similar products and services (Article 11.7 of the Dutch Telecommunications Act). Legal basis: legitimate interest.

Users can easily unsubscribe from commercial messages at any time, via the unsubscribe link at the bottom of each email or by email to privacy@igene.eu. After unsubscribing, iGene Products will stop sending commercial messages as soon as possible, but no later than within five (5) working days.

When collecting electronic contact details, iGene Products offers users the opportunity to object to the use of these data for direct marketing. In every commercial message, iGene Products again offers a simple, free-of-charge option to unsubscribe.

4.6 Administrative or fiscal purposes

Administrative or fiscal obligations, for example towards the Dutch Tax Administration. Legal basis: legal obligation or legitimate interest.

4.7 Information requests, questions and complaints

Handling of requests, questions and complaints. Legal basis: contract, legitimate interest or legal obligation.

4.8 Scientific research and product development

iGene Products may use aggregated and anonymised data for scientific research and product development. To the extent that genetic or other special categories of personal data are processed for this purpose (prior to irreversible anonymisation), this is done exclusively on the basis of the user’s explicit consent (Article 9(2)(a) GDPR). The user may optionally give this consent when activating the account or afterwards via the settings in the iGene application. Consent can be withdrawn at any time with immediate effect. After irreversible anonymisation, iGene Products only uses statistical data at population level; these data fall outside the scope of the GDPR. Withdrawal of consent has no retroactive effect on data that had already been irreversibly anonymised before the time of withdrawal.

5. Data processed by iGene Products

iGene Products ensures that the data processed are adequate, relevant and limited to what is necessary.

5.1 Account and registration

When registering and using the app, iGene Products processes:

• Tube code (unique, pseudonymous code, randomly generated)
• Year of birth (no month or day of birth)
• Ethnicity (optional; see explanation below)
• Country of origin
• Language setting of the app
• Meta-information (operating system, app version, push tokens)
• Optional: email address (for push notifications, account recovery or requesting a report)

If ethnic data are processed, this is done exclusively to better align genetic interpretations statistically with known population differences in gene frequencies. Providing ethnicity is optional; without this information, certain interpretations may be less accurate. Data revealing ethnic origin are special categories of personal data; their processing is based on the user’s explicit consent (Article 9(2)(a) GDPR).

5.2 Order and delivery

When ordering products, iGene Products processes:

• Name, address and place of residence
• Email address (for track and trace)
• Payment details

5.3 DNA test and reporting

The DNA testing process comprises the following steps:

Step 1: The user collects biological material and sends it together with the tube code to iGene Products.

Step 2: Upon receipt of the return, iGene Products processes the biological material and the tube code. The tube code is not linked to any other data; iGene Products does not know which person the material originates from.

Step 3: iGene Products sends the biological material, labelled with the tube code, to a certified laboratory.

Step 4: The laboratory maps the genetic variations (SNPs) and sends the results back to iGene Products.

Step 5: The results are analysed and processed into individual DNA reports. The following are processed for this purpose: SNPs, tube code, year of birth, ethnicity, country of origin and language setting.

The above separation applies to the processing of the biological material. To the extent technically necessary to give the user access to their report, enable account recovery or send notifications, a functional link exists between the tube code and the user’s app account. This link is stored strictly separately from order and address data and is only accessible to authorised systems.

The DNA reports may contain results on:

• Personal traits (such as genetic variations potentially associated with nutrient metabolism)
• Medication sensitivity based on enzymatic profiles
• Genetic predisposition for conditions

5.4 Website visits

When visiting websites or apps, visit data may be stored, including URL, IP address, browser type, date and time of the visit, and click and usage behaviour. See section 8 on cookies.

5.5 Marketing and communications

For direct marketing, iGene Products processes data such as email address, name and address.

6. Third parties that process data

The starting point is that iGene Products does not share data with third parties. In the following situations, iGene Products may share data:

• With affiliated companies, to the extent necessary for the described purposes.
• With processors (parties that process data on behalf of iGene Products, such as IT suppliers), solely on the instructions of iGene Products and with appropriate safeguards.
• With certified laboratories that perform the DNA analysis.
• With Shopify Inc., which provides the ordering platform and payment processing. Shopify processes order data as a processor of iGene Products, but may also process certain data as an independent controller for its own legal obligations (including fraud prevention and security). See Shopify’s privacy policy for more information.
• With Intuit Mailchimp, which provides the email platform for sending newsletters.
• With a healthcare professional, solely if the user gives consent for this in the app.
• With employees of iGene Products, to the extent necessary for the performance of their duties and bound by a duty of confidentiality.
• If required by law, a court order or other legal procedure.
• In connection with a business transaction, such as a merger or sale of assets.
• With professional advisers (including lawyers, accountants, auditors, insurers and certification bodies), to the extent necessary for legal advice, audit, certification, insurance, security, compliance or the establishment or substantiation of legal claims.

If consent is required for sharing data, iGene Products will ask the user for it in advance.

7. Security

iGene Products takes the security of data very seriously and has taken appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. iGene Products is ISO 27001:2022 certified.

The key security principles are:

• The storage of genetic data and the analyses and reports are strictly separated from each other.
• Genetic data are linked exclusively to a pseudonymous code (tube code), not to other personal data.
• All data are stored and processed within the European Economic Area.
• Encrypted backups are made periodically.
• Payments are made through a certified Payment Service Provider over an encrypted connection.

iGene Products has carried out a data protection impact assessment (DPIA) for the processing of genetic data, in accordance with Article 35 GDPR. It is reviewed periodically.

8. Cookies

iGene Products may use cookies and similar technologies (such as JavaScripts, tracking pixels and web beacons) on its websites and apps. Cookies are small text files that store data when you visit the website. iGene Products distinguishes the following categories:

Functional cookies

Necessary for the operation of the website, such as session cookies and language preference. No consent is required for these. Retention period: duration of the session or a maximum of 12 months.

Analytical cookies

For measuring and analysing website usage (for example via Google Analytics). These cookies are only placed after the user has given consent. Retention period: a maximum of 26 months.

Marketing cookies

For showing personalised advertisements. These cookies are only placed after the user has given explicit consent. Retention period: a maximum of 12 months.

Users can change their cookie preferences at any time via the cookie settings on the website. The cookie policy is available on the iGene Products website.

9. Links to other parties

The websites and apps of iGene Products may contain links to third-party websites. iGene Products is not responsible for the way in which third parties handle users’ data. The privacy statements of those parties apply to those websites.

10. User rights

The user has the following rights with regard to their data. For any request, the user can send an email to privacy@igene.eu or a letter by post to Oude Haven 102, 6511 XH Nijmegen, the Netherlands.

iGene Products preferably verifies the identity of the user via the iGene application (logged-in session) or by email (verification code). Only if there is reasonable doubt about the identity may iGene Products additionally ask for a copy of a valid identity document (the photo and the citizen service number (BSN) may be blacked out). The copy is deleted immediately after identification.

Right to information

We inform the user about which data we process, for what purposes, on what legal basis and to whom we provide data. All of this information can be found in this statement.

Right of access

The user has the right of access to their data, including information about purposes, recipients, retention periods and origin.

Right to rectification

The user may ask iGene Products to rectify their data or to complete incomplete data.

Right to erasure

In certain cases, iGene Products is obliged to erase data, for example when the data are no longer needed or consent has been withdrawn. iGene Products always weighs this up, as processing sometimes remains necessary for legal obligations.

Right to restriction

The user has the right to have the processing restricted, for example when the accuracy of the data is contested.

Right to data portability

Under certain conditions, the user has the right to receive the data they have provided and the raw DNA data in a structured, commonly used format and to transfer these to another company. This right does not apply to the analyses, interpretations and reports generated by iGene Products, which are protected by intellectual property rights.

Withdrawal of consent

If the processing is based on consent, the user can withdraw it at any time. Withdrawal of consent for the processing of genetic data means that iGene Products can no longer provide the DNA reports. In that case, the account is terminated and all genetic data are deleted within thirty (30) days. The withdrawal does not affect the lawfulness of earlier processing.

Right to object

The user may object to the processing of their data. Following an objection, iGene Products will in principle stop the processing. The user may also object to the use of contact details for marketing by unsubscribing via the link in emails or by email to privacy@igene.eu.

Complaint to the supervisory authority

The user has the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to go to court.

If the user is under 16 years of age, consent from their parent(s) or guardian(s) is required.

The above rights are not absolute. iGene Products may refuse a request in whole or in part if this is necessary for compliance with legal obligations, security, fraud prevention, evidence, or the establishment or substantiation of legal claims. iGene Products informs the user of the reason for any refusal.

11. Retention periods

iGene Products does not retain data for longer than is necessary for the purposes for which they are processed. After that, data are deleted or anonymised.

• Order data (name, address, email): deleted no later than 6 months after delivery of the kit.
• Biological material: destroyed by the laboratory after completion of the DNA analysis, in accordance with the arrangements in the data processing agreement with the laboratory.
• Raw DNA data, analyses and reports: available for as long as the user has an active account. The raw DNA data are necessary for updates and extensions of the reports. Upon termination of the account, all genetic data are deleted within thirty (30) days.
• Visit data and cookies: a maximum of 26 months, depending on the type of cookie (see section 8).
• Administrative data: 7 years after the financial year, in accordance with the statutory tax retention obligation (Section 52 of the Dutch General Tax Act, AWR).
• Marketing data (email address for the newsletter): until the user unsubscribes.
• Consent logs, security logs, incident files and audit trails: for as long as necessary for security, evidence, fraud prevention, compliance or legal proceedings. Where possible, these data are pseudonymised.

Data that still appear in encrypted backups are retained exclusively for security and recovery purposes and are no longer actively processed. Backups are automatically replaced in accordance with the regular backup schedule and deleted after twelve (12) months at the latest.

See Article 6 of the General Terms and Conditions for the retention period for inactive accounts.

12. Data breaches

In the event of a personal data breach, iGene Products will report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours, unless the breach is unlikely to result in a risk. If there is a high risk, the user is also informed.

Security incidents or data breaches can be reported via privacy@igene.eu or by telephone on +31 (0)10 310 4200.

13. Transfer outside the EEA

All biological material, raw DNA data, analyses and reports are stored and processed within the European Economic Area (EEA) or in countries for which the European Commission has adopted a valid adequacy decision.

Some operational and analytical data (no genetic data) may be transferred outside the EEA, for example for website analytics or email services. This concerns only non-genetic data such as visit data and email addresses. Transfers take place on the basis of an adequacy decision of the European Commission or, in the absence thereof, EU Standard Contractual Clauses. In addition, appropriate safeguards are in place, including encryption of data in transit and at rest.

The main service providers outside the EEA that may receive non-genetic data are:

• Google LLC (United States) — for website analytics (Google Analytics) and tag management (Google Tag Manager).
• Intuit Mailchimp (United States) — for sending newsletters.
• Shopify Inc. (Canada/United States) — for the ordering platform and payment processing.

If international cooperation should in future require the transfer of genetic data outside the EEA, iGene Products will ask the user for explicit consent in advance and take additional technical and contractual safeguards, including a data protection impact assessment.

14. Changes

We may amend this statement if developments give reason to do so. The most recent version can be found on our website. In the event of material changes to the processing of personal data, we will inform the user in advance, for example by email or via a notification in the iGene application.

15. Contact details

For questions, requests, suggestions or complaints about this statement or data processing:

• iGene Products B.V. | Chamber of Commerce number 63823764
• Email: privacy@igene.eu
• Post: Oude Haven 102, 6511 XH Nijmegen, the Netherlands
• Data Protection Officer: Mr W. Limpens
• Telephone: +31 (0)10 310 4200

16. Glossary

The following terms are used in this statement:

Anonymisation

The irreversible processing of personal data in such a way that they can no longer be traced back to an identifiable natural person. Anonymised data fall outside the scope of the GDPR.

GDPR

General Data Protection Regulation (Regulation (EU) 2016/679), the European privacy legislation governing the protection of personal data.

Data subject

The natural person to whom the personal data relate. Referred to as ‘user’ in this statement.

Special categories of personal data

Personal data revealing, among other things, racial or ethnic origin, genetic data or data concerning health. Stricter rules apply to the processing of these data under the GDPR.

Tube code

A unique, randomly generated pseudonymous code used to identify biological material and DNA data without linking them to the identity of the user.

Cookie

A small text file that is stored on the user’s device when visiting a website and can be read during a subsequent visit.

Data breach

A breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to personal data.

DNA report

The report containing the results of the DNA analysis, which provides insight into, among other things, personal traits, lifestyle recommendations, medication sensitivity and genetic predisposition.

DPIA

Data Protection Impact Assessment: an assessment of the impact of a data processing operation on the protection of personal data, required for processing operations with a high risk (Article 35 GDPR).

Genetic data

Personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that person.

Personal data

Any information relating to an identified or identifiable natural person, such as name, email address, tube code or genetic data.

Pseudonymisation

The processing of personal data in such a way that they can no longer be attributed to a specific person without the use of additional information, provided that such additional information is kept separately.

SNP

Single Nucleotide Polymorphism: a variation at a single position in the DNA that occurs in a significant proportion of the population. SNPs form the basis of the DNA analysis by iGene Products.

Consent

Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they agree to the processing of their personal data (Article 4(11) GDPR).

Processor

A party that processes personal data on behalf of the controller, without itself determining the purpose and means of the processing.

Processing

Any operation performed on personal data, including collecting, recording, organising, storing, updating, altering, retrieving, consulting, using, disclosing, disseminating, erasing or destroying data.

Data processing agreement

An agreement between the controller and the processor that sets out the conditions for the data processing, as required by Article 28 GDPR.

Controller

The party that determines the purpose and means of the processing of personal data. In the context of the direct provision of services, this is iGene Products.

Last amended: 29 May 2026