Join our wellness community:

Subscribe
Prac Portal Login
DNApal logo

Contact Us

Affiliates

Privacy Policy

Our Privacy Statement

Hi, welcome to the DNApal privacy policy document. This is where we let you know how we use and protect your data. Please read through carefully and only use our services (website, mobile application, subscription and DNA test) if you agree and are happy to proceed.

If you have questions or concerns, please feel free to email us at: hello@dnapal.me

1.1 This Privacy Policy sets out how DNApal.me Ltd with registered office The 1929 Building, Merton Abbey Mills, 18 Watermill Way, London, UK, SW19 2RD (“DNApal”) and its subsidiaries, related bodies corporate and franchisees (collectively referred to in this policy as “DNApal”, “we” or “us”) protects the privacy of your Personal Information (as defined below) and the basis on which any Personal Information we collect from you, or that you or third parties provide to us, will be processed and used by us.

1.2 We are committed to ensuring that your privacy is protected and to ensuring that your Personal Information is processed in accordance with applicable laws and regulations (as amended or replaced from time to time) protecting the privacy of Personal Information in the jurisdictions in which we operate (“Applicable Laws“).For the purposes of this Privacy Policy, “Personal Information” means information that is about you as an identifiable individual, such as personal health information or other personal information as defined by the Applicable Laws. “Special Category Personal Data” means Personal Information revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership, Genetic and biometric data (when processed to uniquely identify an individual), Data concerning health, sex life or sexual orientation. DNApal will only collect, use, store, disclose and transfer your Personal Information in accordance with this Privacy Policy, any related Privacy Notices and Applicable Laws including UK General Data protection Regulation (UK GDPR).

1.3 Please read the following carefully to understand our views and practices regarding your Personal Information and how we will treat it.  By using our nutrition and wellness service which provides software applications to read and analyse your genetic data to provide you insights to personalise your nutrition, diet and exercise, and assist in making it easy to take actions on those insights in your daily life (the “Service”), you confirm that you have read, understood and agree with the collection, use, storage, disclosure and transfer of your Personal Information in accordance with this Privacy Policy and the related Privacy Notice.  If you do not agree or withdraw your consent, you should not use the Service.

1.4 If you are under the age of 18, you must not use the Service or submit Personal Information to us unless you have the consent of and are supervised by a parent or guardian.  We do not knowingly collect information from people under the age of 18 without such consent.

1.5 This Privacy Policy was last updated on, and is effective as of, 16 September 2021. DNApal reserves the right, in its sole discretion, to modify, revise, delete and update this Privacy Policy from time to time.  We will use reasonable endeavours to notify you in advance of any modifications to the terms of this Privacy Policy. If you do not agree with the modifications, revisions, deletions or updates, your exclusive remedy is to cease using the Service. By continuing to use the Service after those changes are made, you shall be deemed to have accepted and agreed to the changes.

THE PERSONAL INFORMATION THAT WE COLLECT FROM YOU

2.1 When you use the Service, we collect the following Personal Information about you in order to make our advice and service as personalised as possible, take payment and/or deliver your DNA test. Such information may include, but is not limited to:

    • your name or nickname, gender and date of birth;
    • your email address;
    • genetic and biological health information, including information regarding your genetic profile generated by third parties (“Genetic Information”);
    • your behavioural information, such as smoking, drinking or exercise;
    • Family and / or personal health history 
    • your contact details including telephone number and physical address (if we need to ship a DNA test to you); and

your bank account or credit card details, which are passed to Stripe SDK along with your telephone number and relevant information already input into the app, in order to take payment from you for the services.

COOKIES AND MOBILE ANALYTICS

  • We and our third-party partners use cookies and similar technologies (such as web beacons, tags, scripts and device identifiers) to help us recognise you, customise and improve your experience, provide security, analyse usage of our Service (such as to analyse your interactions with the results, reports, and other features of the Service), gather demographic information about our user base, to offer our products and services to you, to monitor the success of marketing Services, and to serve targeted advertising on our site and on other sites around the Internet. We and our third-party partners do not use your sensitive information, such as Genetic Information, for targeted advertising. If you reject cookies, you may still use our site, but your ability to use some features or areas of our site may be limited.
  • In addition to the above, when interacting with our website, we gather certain information automatically about the website’s users and store it in log files. This information may include internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and/or clickstream data. We may combine this automatically collected log information with other information we collect about you, such as your user profile ID or order number. We do this to improve services we offer you, and to improve marketing, analytics, and site functionality.
  • When you access our website by or through a mobile device, we may receive or collect and store a unique identification numbers associated with your device or our mobile application (including, for example, a UDID, Unique ID for Advertisers (“IDFA”), Google Ad ID, or Windows Advertising ID), mobile carrier, device type, model and manufacturer, mobile device operating system brand and model, phone number, and, depending on your mobile device settings, your geographical location data, including GPS coordinates (e.g. latitude and/or longitude) or similar information regarding the location of your mobile device.
  • We use mobile analytics software to allow us to better understand the functionality of our mobile application on your phone. This software may record information such as how often you use the application, the events that occur within the application, aggregated usage, performance data, and where the application was downloaded from. We do not link the information we store within the analytics software to any Personal Information you submit within the mobile application.

WHAT WE DO WITH YOUR PERSONAL INFORMATION AND WHY WE COLLECT IT

3.1 Under data protection law, we can only use your personal data if we have a proper reason, eg:

  • where you have given consent;
  • to comply with our legal and regulatory obligations;
  • for the performance of a contract with you or to take steps at your request before entering into a contract; or
  • for our legitimate interests or those of a third party.

3.2 A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.

3.3 DNApal (and third party data processors who may be acting on our behalf) may collect, store and process your Personal Information described above for the following purposes:

  • to administer and operate the Service, and any services and programs provided in connection with the Service, including:
    • opening your account, communicating with you and implementing your requests;
    • processing payment for DNA tests, subscriptions and in-app purchases (via Stripe SDK)
    • running our mobile application and website, authenticating your visits, providing custom, personalised content and information, and tracking your usage of our Services
    • processing payment for DNA tests, subscriptions and in-app purchases
    • processing and analysing your Genetic Information and other Personal Information; and
    • providing health, nutritional and wellness analysis and recommendations related to your Genetic Information and other Personal Information, analysis regarding weight gain risk, exercise behaviours, exercise motivation, favourable macronutrient percentages for weight loss, and micronutrient deficiency risks, as well as advice to follow certain behaviours to reduce your genetic risk;
  • to connect you with other individuals using our Service who have similar conditions such as you to allow you and such other individuals to share information, approaches and other information regarding with each other
  • conduct analytics to improve and enhance our Service;
  • offer new products, programs or services to you, including through emails, promotions or contests, subject to applicable laws;
  • for our internal record keeping requirements including collection of anonymised details about use of the Service to compile aggregate statistics or produce internal reports;
  • to share your Personal Information with selected third parties in accordance with Section 4 of this Privacy Policy;
  • to provide you, or permit selected third parties acting on DNApal’s behalf to provide you with information by SMS, e-mail or other electronic messaging service about goods or services we feel may interest you including, without limitation brochures, details of promotions, events, new products and services, subject to applicable laws;
  • to the extent we have a legal obligation, right or duty under the Applicable Law to use or disclose your information (including for crime and fraud prevention and related purposes); and
  • to anonymise and aggregate the Personal Information (including Genetic Information) for any other purposes, provided that no identifiable personal information can be readily identified.

3.4 Where we process special category personal data, we will also ensure we are permitted to do so under data protection laws, eg:

  • we have your explicit consent;
  • the processing is necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent; or
  • the processing is necessary to establish, exercise or defend legal claims

3.5 We will only retain your Personal Information for as long as reasonably necessary having regard to the purposes for which your Personal Information was collected and will delete such Personal Information after the expiry of such period unless otherwise required under the Applicable Law and any anonymised and aggregated information will be retained by DNApal.

DISCLOSURE OF YOUR PERSONAL INFORMATION

4.1 DNApal may share your Personal Information that it collects from you or that you provide to DNApal with selected third parties for the following purposes:

  • to operate the Service and provide the programs in connection with the Services or any other purposes as set out in paragraph 3.1 above;
  • to enforce or apply the Service’s Terms and/or other agreements and/or to investigate potential breaches of such agreements;
  • to protect DNApal’s rights, property or safety or the rights, property or safety of other users of the Service or others (e.g., for fraud protection etc.); and
  • to take payment from you for any purchases (including via Stripe SDK) – your telephone number and information already input into the app will be passed to Stripe SDK in order to take payment; and
  • to comply with any applicable laws, regulations, governmental and quasi-governmental requests, court orders or subpoenas.

4.2 For greater certainty, your Genetic Information and Personal Information will not be disclosed by us except to provide you with the Service unless we have obtained your express consent to do so. DNApal will not disclose your Genetic Information and Personal Information to insurance companies or marketing agencies without your express consent to do so.

4.3 DNApal may share your Personal Information with, without limitation:

  • companies that provide statistical analysis services; and
  • analytics and search engine providers, such as Google Inc, that assist us in the improvement and optimisation of our website
  • Stripe SDK in order to take payment from you; and
  • A qualified practitioner to assist in personal consultations as requested by you

4.4 DNApal will ensure that third parties who have received Personal Information from DNApal will maintain a comparable level of protection of the Personal Information as set out in this Privacy Policy by using contractual or other means. To the fullest extent permitted by Applicable Law, DNApal excludes all liability arising from the use of your Personal Information by third parties. DNApal can, on request, confirm the name of each third party that Personal Information is, or will be, transferred to. We use Stripe SDK to take payment from you, and their privacy policy is found at Privacy Policy.

4.5 Except as set out in this Privacy Policy, we will not disclose, sell, distribute, rent or lease your Personal Information to third parties unless we have your permission or to complete a transaction for you. We do not share your identifiable Personal Information with third parties for their direct marketing use without your express consent.

4.6 In the event that a third party proposes to acquire all or some of our business and/or assets, we may disclose your Personal Information to that third party in connection with their proposed or actual acquisition. In the event that we become insolvent or we are in any similar situation, we may also disclose your Personal Information to third parties as part of a business or asset sale carried out where such disclosure is lawful and compliant with the Applicable Laws.

4.7 We may also need to:

  • share personal data with external auditors, eg in relation to ISO[or Investors in People] accreditation and the audit of our accounts;
  • disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations;
  • share some personal data with other parties, such as potential buyers of some or all of our business or during a restructuring—usually, information will be anonymised but this may not always be possible, however, the recipient of the information will be bound by confidentiality obligations.

WHERE YOUR PERSONAL DATA IS HELD

5.1 Personal data may be held at our offices and those of our third party agencies, service providers, representatives and agents as described above.

5.2 Some of these third parties may be based outside the UK.

INTERNATIONAL TRANSFERS OF DATA

6.1 DNApal may transfer and/or store the Personal Information collected from you to our overseas related entities, subsidiaries, related bodies corporate and franchisees in order to provide the Service. It may also be necessary for us to transfer and/or disclose your Personal Information to third parties located in the United Kingdom and Europe or other jurisdictions in connection with the purposes set out in this Privacy Policy.

6.2 By submitting your Personal Information you consent to the transfer, storage and/or processing of your Personal Information outside the jurisdiction in which the information was originally collected. We will take all steps reasonably necessary to ensure that your Personal Information is treated securely and in accordance with this Privacy Policy. Where we have engaged international third parties to perform services in relation to the Service, we will use contractual or other means to ensure such third parties offer a comparable level of protection in respect of the Personal Information. However, Applicable Laws in some jurisdictions may not provide the same level of protection for your Personal Information as does your home jurisdiction.

6.3 Under data protection law, we can only transfer your personal data to a country or international organisation outside the UK[/EEA] where:

  • the UK government [or, where the EU GDPR applies, the European Commission] has decided the particular country or international organisation ensures an adequate level of protection of personal data (known as an ‘adequacy decision’);
  • there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for data subjects; or
  • a specific exception applies under data protection law

These are explained below.

Adequacy decision

6.4 We may transfer your personal data to certain countries, on the basis of an adequacy decision. These include (but are not limited to):

  • all European Union countries, plus Iceland, Liechtenstein and Norway (collectively known as the ‘EEA’)
  • Gibraltar; and
  • Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay.

6.5 The list of countries that benefit from adequacy decisions will change from time to time. We will always seek to rely on an adequacy decision, where one exists.

6.6 Other countries or international organisations we are likely to transfer personal data to do not have the benefit of an adequacy decision. This does not necessarily mean they provide poor protection for personal data, but we must look at alternative grounds for transferring the personal data, such as ensuring appropriate safeguards are in place or relying on an exception, as explained below.

Transfers with appropriate safeguards

6.7 Where there is no adequacy decision, we may transfer your personal data to another country or international organisation if we are satisfied the transfer complies with data protection law, appropriate safeguards are in place, and enforceable rights and effective legal remedies are available for data subjects.

6.8 The safeguards will usually include using legally-approved standard data protection contract clauses.

6.9 To obtain a copy of the standard data protection contract clauses and further information about relevant safeguards, please contact us.

Transfers under an exception

6.10 In the absence of an adequacy decision or appropriate safeguards, we may transfer personal data to a third country or international organisation where an exception applies under relevant data protection law, eg:

  • you have explicitly consented to the proposed transfer after having been informed of the possible risks;
  • the transfer is necessary for the performance of a contract between us or to take pre-contract measures at your request;
  • the transfer is necessary for a contract in your interests, between us and another person; or
  • the transfer is necessary to establish, exercise or defend legal claims

6.11 We may also transfer information for the purpose of our compelling legitimate interests, so long as those interests are not overridden by your interests, rights and freedoms. Specific conditions apply to such transfers and we will provide relevant information if and when we seek to transfer your personal data on this ground.

SECURITY

7.1 DNApal has in place security measures to store all Personal Information collected and received securely. We use appropriate technical, organisational, administrative and physical measures to protect your Personal Information contained in our system against accidental damage, deletion, misuse, loss and unauthorised access or alteration.  Although we will do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted by a third party to us. Once we have received your Personal Information, we will use various procedures and security features (including by encrypting the Personal Information) to try to prevent unauthorised access, use or disclosure. We will also limit access to your personal data to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

7.2 We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

7.3 Protecting your Personal Information is also your responsibility. We ask you to be responsible for safeguarding your password, secret questions and answers, and other authentication information you use to access our Service. You should not disclose your authentication information to any third-party and should immediately notify us of any unauthorised use of your password. We cannot secure Personal Information that you release on your own or that you request us to release.

YOUR RIGHTS

8.1 You may access, correct or update some of your Personal Information from our mobile application. You also have the right to access any and all details of your Personal Information that we hold about you by written request and to request rectification or erasure of such Personal Information, if the Applicable Laws allows you to do so.

8.2 You have the right to change your mind about consenting to the use, disclosure and transfer of your Personal Information in accordance with this Privacy Policy by contacting us at the address listed below. If you withdraw your consent for DNApal to process your Personal Information in accordance with this Privacy Policy, DNApal may not be able to provide you with all of parts of the Service.

8.3 You have the right to require us to restrict processing of your personal data in certain circumstances, eg if you contest the accuracy of the data.

8.4 You have the right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations.

8.5 You may choose to no longer receive communications from us by replying UNSUBSCRIBE to communications (if any) you receive from us. You may unsubscribe to any email from us using the instructions in the email you receive; this will not stop us from sending emails about your account or transactions with us or other information required for your use of the Service. You have the right to object, in certain other situations to our continued processing of your personal data, eg processing carried out for the purpose of our legitimate interests.

8.6 You have the right to make a complaint about a possible breach of the Applicable Laws to us. We will consider any complaints we receive and respond to your complaint within a reasonable period of time. You also may lodge a complaint about the treatment of your Personal Information with the supervisory authority located in you jurisdiction, if the Applicable Laws allows you to do so.

8.7 You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.

8.8 You can exercise your rights above by contacting us at the address listed below.

MARKETING

9.1 We may use your personal data to send you updates (by email, text message, telephone or post) about services, including exclusive offers, promotions or new services.

9.2 We have a legitimate interest in using your personal data for marketing purposes. This means we do not usually need your consent to send you marketing information. However, where consent is needed, we will ask for this separately and clearly.

9.3 You have the right to opt out of receiving marketing communications at any time by:

  • contacting us at hello@dnapal.me; or
  • using the ‘unsubscribe’ link in emails or ‘STOP’ number in texts.

9.4 We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

9.5 We will always treat your personal data with the utmost respect and never sell or share it with other organisations for marketing purposes.