Consumer genetics
DNA privacy: what happens to your genetic data?
A consumer DNA service may hold both a physical sample and data derived from it. Before testing or uploading a raw DNA file, check storage, research consent, third-party sharing, account deletion, sample destruction and legal coverage separately. Privacy rules differ by service and jurisdiction; “delete account” does not by itself prove that every copy or sample is destroyed.
Published February 18, 2026 · Reviewed July 17, 2026 · Educational information, not legal or medical advice
The three things a DNA service may hold
Physical sample
Saliva, cheek swab or another biological specimen retained by the company or laboratory.
Genetic data
Genotype calls, sequence data, raw downloads and interpretations derived from the sample.
Account context
Identity, contact details, family links, surveys, traits, consent records and service activity.
The FTC specifically warns businesses that consumers may not realize the sample and the information derived from it are separate. A meaningful deletion answer therefore names each layer, the processor or lab that holds it, the retention period and any exception.
DNA privacy checklist before you test or upload
- 1
Sample
Will the saliva or cheek-swab sample be stored? For how long? Who can order its destruction?
- 2
Derived data
Can you download, correct and delete the genotype or sequence data produced from the sample?
- 3
Research
Is research consent separate and optional? Can it be withdrawn, and what happens to prior research use?
- 4
Sharing
Which laboratories, processors, researchers, commercial partners or authorities can receive data, and under what trigger?
- 5
Account changes
Will the company notify you and seek consent before materially expanding uses of existing genetic data?
- 6
Exit plan
Does account closure delete identifiers, derived files and backups, and instruct the laboratory to destroy the physical sample?
What U.S. protections do not automatically prove
- HIPAA: do not assume every direct-to-consumer service is a HIPAA-covered entity. Coverage depends on the organization and activity.
- GINA: federal protections address employment and health coverage, but not life, disability or long-term-care insurance. State law can add different protections.
- De-identification: removing obvious identifiers reduces risk but does not make genomic data inherently anonymous in every context.
- Raw-data uploads: after downloading and sending a file to another service, that recipient’s terms and security practices govern its copy.
Research, relatives and unexpected results
Genetic information can implicate biological relatives, and ancestry testing can reveal unexpected relationships. Research or commercial use may also extend beyond the consumer report. The NHGRI advises checking whether data may be used for research or advertising, and notes that direct-to-consumer privacy practices vary. Treat optional research participation as a separate decision from buying the test.
A raw-data interpretation is not a clinical diagnosis. The NHGRI’s professional FAQ warns that third-party interpretation can produce false positives and that health-relevant findings may need confirmation through an appropriate healthcare professional or genetics specialist.
What Genetiqo is—and is not—today
Genetiqo Vault is currently an on-device iPhone health-journaling product. It does not offer DNA testing, accept raw DNA uploads, interpret genetic variants or operate a consumer genetic database. Journal entries stay in the app unless the user explicitly exports or shares a file; optional AI Digest has a separate external-provider boundary described in the product guide.
Read the current product privacy modelDNA privacy FAQ
Are direct-to-consumer DNA tests covered by HIPAA?
Not necessarily. HIPAA applies to covered health plans, clearinghouses and many healthcare providers and their business associates; a consumer genetic-testing service may fall outside that framework. Check the company, the service and the applicable privacy policy instead of assuming every DNA test is a HIPAA record.
Does deleting a DNA-testing account destroy the saliva sample?
Not automatically. Account data, derived genetic data and the physical sample can have different retention and deletion rules. Ask separately what is deleted, what is retained, whether laboratories receive a destruction request and what legal or research exceptions apply.
Can a DNA company use genetic data for research?
Policies vary. A service may ask for separate research consent or describe research and commercial uses in its terms. Review whether participation is optional, whether consent can be withdrawn and what happens to data already used in completed or ongoing research.
Does GINA cover every kind of insurance?
No. U.S. federal GINA protections address genetic discrimination in employment and health coverage, but the NHGRI notes that GINA does not cover life, disability or long-term-care insurance. State protections may differ.