PrecisionLife

Privacy Policy

Effective Date: September 26, 2026

This Privacy Policy is intended to supplement PrecisionLife's corporate Privacy Policy for customers using shop.precisionlife.com, myaccount.precisionlife.com and the related at-home sample, laboratory, report and support services.

This Privacy Policy explains what personal data we collect from you and how we use it. We encourage you to read the summaries below.

This Privacy Policy constitutes a legal agreement between you ("User", "you") and PrecisionLife Ltd (“PrecisionLife”, "PL", "we", "us", "our"), a company registered in England and Wales (Company Number 08687703; Registered Office: Unit 8b Bankside, Hanborough Business Park, Long Hanborough, Witney, Oxon, OX29 8LJ, UK) whether you browse the PrecisionLife website or web portal (collectively, the “Site”) as a visitor or register as a user with access to our web portal to access our online services.

Term	Plain English Definition
Digital Genome	Electronic genetic data (genotype VCF file) produced via whole genome sequencing and imputation.
Guide	The PrecisionLife Wellness Guide is an educational resource. It is not personalized. It summarizes the available science.
Kits	Biological sample kits containing two cheek swabs to self-collect DNA for sequencing.
Operating Partners	Commercial operations partners subcontracted by PrecisionLife. PrecisionLife does not employ, dictate, advise, direct, or control any Operating Partners.
Report	The PrecisionLife DNA Wellness Report that includes personalized results report, mechanism-level results and downloadable DNA data file.
Services	The collective products, services, software, web portals, reports and guidance provided or coordinated by PrecisionLife.

Privacy at a glance

Your privacy is important to us.

We collect only the information reasonably needed to take payment, fulfill your order, manage your secure account, process your sample, and provide the Services including your Report, Guide and Digital Genome data file.
We do not sell your personal information, genetic data or biological sample.
We do not use your genetic data, report results or biological sample for advertising, and we do not share your genetic data with third parties for their own purposes. We do not use your data internally to train and improve our analytical models, and we never disclose it — even in de-identified form — to anyone outside PrecisionLife.
Your genetic data, including Digital Genome files and Reports are kept out of Shopify and our marketing systems. Shopify receives only the information needed to operate the storefront, checkout and order process.
Your physical sample is securely destroyed within thirty (30) days after it has been successfully analyzed, unless it must be destroyed sooner following a valid request or applicable law.
You retain full ownership of your data. You can view and download your Digital Genome data and view your Report and Guide through your secured account portal.
You can ask to access, correct or delete eligible information, withdraw consent for future consent-based processing, close your account or request destruction of any sample that remains.

1. Who we are and what this policy covers

PrecisionLife Ltd ("PrecisionLife," "we," "us" or "our") is responsible for deciding how personal information is used in connection with the PrecisionLife Shop and your PrecisionLife account.

This policy applies when you:

visit or purchase through the PrecisionLife Shop;
create or use your PrecisionLife account;
receive, activate, collect or return an at-home sample kit;
access an educational Guide, order update, personalized Report or Diagital Genome DNA data file;
contact us about an order, account, privacy request or technical issue; or
receive service-related or optional marketing communications from us.

The Services are intended only for people aged 18 or older who live in the United States. Our general website privacy practices are described in the PrecisionLife corporate Privacy Policy.

2. The information we collect

The information we collect depends on how you use the Services. It may include the following categories:

Category	Examples	Main source
Identity and contact	Name, email address, shipping and billing address, telephone number if provided.	You; Shopify.
Eligibility and consent	Age and residency confirmations, consent selections, policy versions, dates, times and related audit records.	You; the shop or account portal.
Account and security	Account identifier, protected login credentials, email-verification status, multi-factor authentication records, login history and security events.	You; the account and authentication services.
Order and transaction	Order number, items ordered, price, discounts, taxes, payment status, refunds, fulfillment status and limited payment identifiers. PrecisionLife does not intentionally store your full payment-card number.	You; Shopify; payment providers.
Kit and logistics	Kit identifier, delivery and return status, courier tracking information, sample receipt and processing status.	Shopify; logistics and laboratory providers.
Biological sample and genetic data	Your cheek-swab sample, extracted genetic material, digital genotype data, quality-control information and analytical outputs.	You; laboratory and analysis providers.
Report information	Your personalized results Report, mechanism-level results, education Guide, and downloadable Digital Genome DNA data file.	PrecisionLife report generator.
Support and communications	Emails, support requests, call or correspondence records and information you choose to include. Please do not provide unrelated medical information.	You; communications and support providers.
Device and usage	IP address, browser and device type, timestamps, page interactions, session identifiers, the URLs you visit, referring and exit pages, search terms and browsing history on our sites, cookie preferences and security logs.	Your device; Shopify; portal and cookie providers.
Marketing preferences	Whether you asked to receive marketing, your communication preferences and unsubscribe history.	You; our communications provider.

Data minimization: A purchase may reveal an interest in a wellness-related service. We treat order and account information accordingly and do not place genetic data or Report results in Shopify, advertising platforms or marketing profiles.

3. How we use your information

We use personal information only for defined purposes, including to:

operate the storefront, process payment, prevent fraud, and confirm your order;
create and secure your account, verify your email address, and provide multi-factor authentication;
arrange kit delivery and return, link your sample to your order, and provide status updates;
receive and process your sample, generate genetic data, perform quality checks, and create your report;
make your educational Guide, Report, and Digital Genome DNA data file available securely;
respond to account, order, technical, and privacy requests;
maintain security, investigate incidents, troubleshoot, and protect our customers and systems;
keep records required for tax, accounting, regulatory, consent, and dispute-management purposes;
collect and analyze the URLs you visit and your search and browsing history on our site to operate, secure, personalize, measure, and improve the service;
measure and improve the storefront or portal using appropriately configured analytics; and
send marketing communications only where permitted and according to your choices.

4. Legal grounds for processing

Different privacy laws describe the legal grounds for processing in different ways. Where the UK GDPR applies to PrecisionLife's processing, we generally rely on:

Ground	When it applies
Contract	To take steps at your request, process and fulfill your order, administer your account, and provide the purchased service.
Explicit consent	To process genetic and other sensitive information where consent is required, and for any optional activity clearly presented to you.
Legal obligation	To meet tax, accounting, privacy, security, consumer-protection, and other legal requirements.
Legitimate interests	To secure the service, prevent fraud, administer our business and improve non-sensitive service functions, where those interests are not overridden by your rights.
Cookie or marketing consent	For non-essential cookies and direct marketing where consent is required.

Where a US state law requires consent for collecting, using or sharing genetic or consumer health data, we obtain that consent as required. Processing that is strictly necessary to provide the service you requested may also be permitted by applicable law.

5. How we handle samples and genetic data

Genetic information is sensitive and receives additional protections.

Your sample and genetic data are used to perform the Services described in your informed consent. You retain full ownership of your biological sample, genetic data, and Report results. We do not acquire ownership of your genetic data and hold it only to provide the service to you.
Your primary service consent does not authorize secondary clinical, commercial, or academic research or any disclosure of your genetic data outside PrecisionLife.
We use your genetic data on a temporary basis to generate and deliver your Report and Digital Genome DNA data files. We do not use your genetic data for any other purpose; your DNA data file is thereafter retained only to provide you with access as described in Section 9.
We do not share your genetic data with any third party for that third party's own purposes. The laboratory, analysis, cloud and infrastructure providers listed in Section 6 act only as our service providers, and may use your genetic data solely to perform the Services on our behalf, and may not use it for any other purpose.
We do not sell, license, share or otherwise disclose your genetic data — or any derivative or de-identified form of it — to anyone outside PrecisionLife for any purposes.
We do not sell your sample, extracted genetic material, genetic data or Report results.
We do not use your genetic data or Report results for advertising, customer profiling or decisions about insurance, employment, credit or eligibility for unrelated services.
We do not disclose genetic data to employers or organizations making health, life, disability or long-term-care insurance decisions, except where a disclosure is specifically authorized and legally permitted.
Our contracted providers may use genetic data only to perform their agreed services and must protect it under contractual and legal requirements.
Your physical sample is securely destroyed within thirty (30) days after successful analysis.

You may withdraw consent for future consent-based processing. Withdrawal does not undo processing already lawfully completed and may mean that we cannot complete or continue providing the Services. Our informed consent and Terms of Service explain the consequences that apply at different stages.

6. When we disclose information

We disclose only the information reasonably required for the recipient's role. Recipients may include:

Recipient category	Purpose and information involved
Shopify and payment providers	Storefront, checkout, payment, fraud prevention, order and refund processing. Shopify is not provided with your biological sample, raw genetic data or personalized Report results.
Laboratory and sample-logistics providers	Kit fulfillment and tracking, sample receipt, DNA extraction or genotyping, quality control and secure transfer of the resulting data.
PrecisionLife report generation	Secure analysis, Report production and delivery of the Report and Digital Genome DNA data file.
Cloud, authentication and security providers	Hosting, encrypted storage, account authentication, monitoring, backup and system security.
Email and support providers	Order and account notifications, service messages and responses to support or privacy requests.
Analytics and content providers	Storefront or portal measurement and embedded content, subject to cookie choices and the restrictions in this policy.
Professional advisers and auditors	Legal, accounting, insurance, security, quality and regulatory support, under confidentiality obligations.
Authorities or transaction participants	Where required by applicable law or valid legal process, or during a corporate transaction subject to applicable notice, consent and data-protection requirements.

We do not exchange personal, genetic or consumer health data for money or other valuable consideration. We also do not share genetic or consumer health data for cross-context behavioral advertising or targeted advertising.

7. Third party services

Shopify powers the PrecisionLife Shop and checkout. Shopify receives information about your device, browsing, cart, transaction, payment and order interactions. In many circumstances, Shopify processes this information at our direction; it may also process certain information for its own services, such as Shop or Shop Pay, under its own policies.

You can learn more in the Shopify Consumer Privacy Policy and Shopify Cookie Policy.

Payment-card information is submitted to Shopify and the selected payment provider. PrecisionLife receives the information needed to confirm and administer the transaction, but does not intentionally store the complete payment-card number or security code.

External links and optional embedded content, such as videos, may be operated by another provider. If you choose to open or play that content, the provider may receive device and usage information under its own privacy policy.

8. Where information is processed

PrecisionLife is based in the United Kingdom and provides this service to customers in the United States. All data are generated, processed, and securely stored in the United States. Authorized PrecisionLife personnel in the United Kingdom may remotely access information where necessary to operate, secure and support the Services.

The PrecisionLife ecommerce and customer-account application servers and databases are hosted by Amazon Web Services in the U.S. East (N. Virginia) Region, identified by AWS as us-east-1. Shopify, payment, communications and other service providers may process information in the United States and other countries in accordance with their infrastructure and policies.

Where applicable data-protection law requires safeguards for an international transfer, we use recognized contractual or legal safeguards and assess our service providers' protections.

9. How long we retain information

We retain information only for as long as reasonably necessary or as required by law for the purposes described in this policy, including providing access to your account and purchased files, meeting legal and contractual requirements, maintaining security and resolving disputes.

Information	Retention approach
Physical sample	Securely destroyed within thirty (30) days after successful analysis, or sooner where required following a valid request, unless a longer period is required by law.
Genetic data, Report and Digital Genome DNA data file	Available through your account indefinitely while your account remains open. If you close your account or make a verified deletion request, we delete this information within thirty (30) days unless a longer period is required by law.
Account profile and order-status information	Retained while your account is active.
Transaction, tax and accounting records	Retained for the period required by applicable tax, accounting and consumer-protection laws.
Consent and policy-acceptance records	Retained for the period needed to demonstrate consent and compliance and to address legal claims.
Support records and security logs	Retained for a limited period based on their purpose, sensitivity, security value and applicable legal requirements.
Cookie and analytics information	Retained according to the cookie or technology used and the current cookie inventory available through Cookie Settings.

When retention ends, we delete and destroy the information. Deletion from archived backups may be delayed where legally permitted and operationally necessary. Deletion from backup systems will not be delayed beyond the period allowed by applicable law.

10. How we protect information

PrecisionLife maintains an information-security and privacy-management program aligned with its ISO 27001:2022 and ISO 27701:2019 certifications. Measures appropriate to the sensitivity of the information include:

encryption in transit and encryption of sensitive stored information where appropriate;
role-based access, least-privilege controls and confidentiality obligations;
email verification and multi-factor authentication for customer accounts;
logging, monitoring, backup, vulnerability management and incident-response procedures;
separation of genetic and Report information from ecommerce and marketing systems; and
security and privacy requirements for relevant service providers.

No internet transmission or storage system can be guaranteed to be completely secure. You are responsible for protecting your password and authentication methods and for signing out when using a shared device.

11. Your privacy rights and choices

Depending on where you live and the law that applies, you may have the right to:

ask whether we process information about you and obtain access to it;
request correction of inaccurate information;
request deletion of eligible personal, genetic or consumer health data;
request closure of your account and destruction of any biological sample that remains;
receive eligible information in a portable format;
withdraw consent from future consent-based processing;
restrict or object to certain processing;
opt out of targeted advertising, sale or sharing where those rights apply;
appeal a decision not to act on a privacy request where applicable; and
exercise your rights without unlawful discrimination.

To make a request under this Section 11, email GDPR@PrecisionLife.com. We may ask for information reasonably necessary to verify your identity and protect your account. An authorized agent may submit a request where permitted by law, but we may require proof of authority and verification of your identity.

If we deny an appealable request, our response will explain the reason and how to appeal. You may also contact the privacy regulator or attorney general for your state where applicable.

12. Communications and feedback

We send service messages needed to administer your order and account, including payment, dispatch, sample, processing, security and report-availability notices. These are not marketing messages.

We send promotional communications only where permitted and according to your choices. You can unsubscribe through the link in a marketing email or contact us. We do not use your genetic data, Report results or inferred health information to select advertising or marketing content.

If you provide to us, directly or indirectly, and by any means, any comments, feedback, suggestions, ideas, or other submissions related to the Services (collectively “Feedback”), the Feedback will be the sole property of us or our agents. We will be entitled to use, reproduce, disclose, publish, distribute, and otherwise exploit in any manner, all Feedback, without restriction and without compensating you in any way. We are and shall be under no obligation to maintain any Feedback in confidence, or to respond to any Feedback. When you use the Site or send communications to us through the Site, you are communicating with us electronically. You consent to receive electronically any communications related to your use of the Site. We may communicate with you by email or by posting notices on the Site. You agree that all agreements, notices, disclosures and other communications that are provided to you electronically satisfy any legal requirement that such communications be in writing. All notices from us intended for receipt by you shall be deemed delivered and effective when sent to the email address you provide to us.

13. Automated processing

We analyze selected genetic patterns to generate the information presented in your Report. Our Report Generator does not make decisions that produce legal or similarly significant effects, such as decisions about employment, insurance, credit, medical care, or access to public services.

14. Security incidents and breach notification

We investigate suspected security incidents and take steps to contain and address them. If a breach requires notification, we will notify affected individuals and relevant authorities in the manner and within the time required by applicable law. This may include applicable U.S. state breach laws, the FTC Health Breach Notification Rule, and UK GDPR data-protection requirements.

15. Cookie Policy

15.1 What cookies and similar technologies are

Cookies are small text files placed on your browser or device. Similar technologies include pixels, tags, local storage and software development tools. They can support checkout and sign-in, remember choices, protect the service, measure use or support content and advertising.

15.2 The categories we use

Category	What it does	Choice
Strictly necessary	Supports security, checkout, cart functions, payment, account sign-in, session management, fraud prevention, consent preferences and service delivery.	Required for the relevant service and cannot be disabled through our cookie controls.
Functional	Remembers optional preferences and supports enhanced features or content.	Used according to your choices where consent is required.
Analytics and performance	Helps us understand aggregate use, diagnose problems and improve the shop or portal.	Used only where permitted and subject to available consent or opt-out controls.
Marketing and advertising	Measures campaigns or supports advertising on other services.	Not required. Used only according to applicable law and your choices.
Embedded content	Enables optional third-party content such as video. The provider may set cookies when the content loads or plays.	Where practicable, loaded only after your choice or interaction.

15.3 Shopify cookies

Shopify places cookies needed to operate merchant storefronts and may place analytics or marketing cookies depending on store configuration and your privacy choices. Examples may include:

Example	Purpose	Typical duration stated by Shopify
_shopify_essential	Store functionality, session, checkout and anti-tampering information.	Up to 1 year
_tracking_consent	Stores privacy and tracking preferences.	Up to 1 year
cart	Stores information about the shopping cart.	Up to 2 weeks
_shopify_s	Identifies a browser session and store combination for analytics.	30-minute rolling expiry
_shopify_y / _shopify_analytics	Shopify storefront or checkout analytics.	Up to 1 year
_shopify_marketing	Marketing measurement on Shopify buyer surfaces where enabled.	Up to 1 year

Names, purposes and durations can change as Shopify updates its platform. The current Shopify Cookie Policy and our Cookie Settings tool should be treated as the current operational record.

15.4 Cookies in your PrecisionLife account

The account portal uses strictly necessary technologies for sign-in, multi-factor authentication, security, session management and preference storage. Our intended configuration is not to run advertising pixels in authenticated account, Report or Digital Genome DNA-data download areas.

If we use analytics in the authenticated portal, it must be configured to minimize data and must not collect genetic data, Report content, file names, support-message content or sensitive order-status details. Optional video or other embedded content may connect to a third-party provider when you choose to load or play it.

15.5 Managing cookies

You can select or change non-essential cookie choices through your cookie settings. You can also restrict cookies through your browser, although blocking strictly necessary cookies may prevent checkout, sign-in or other core functions from working.

Where required, we recognize supported browser-based privacy preference signals, such as Global Privacy Control, as a request to opt out of sale or sharing and targeted advertising for the applicable device and browser. Your choices may need to be set again if you use another device or browser or clear stored cookies.

16. Changes to this policy

We may update this policy when our service, providers, processing or legal obligations change. The current version and effective date will be posted online. If a change materially affects how we use sensitive information, we will provide additional notice and obtain consent where required.

17. Contact us

For privacy questions, requests or complaints, contact:

PrecisionLife Ltd
Attention: Data Protection Officer
Unit 8B Bankside, Hanborough Business Park
Long Hanborough, Witney OX29 8LJ
United Kingdom
Email: GDPR@PrecisionLife.com

For order or technical support that is not a privacy request, please use the contact form within our customer portal. Please do not send biological samples, raw genetic files or report attachments by email.

You may also have the right to complain to the regulator responsible for privacy in your jurisdiction. PrecisionLife's lead UK supervisory authority is the Information Commissioner's Office at ico.org.uk