Last updated: October 2026
To fulfill your order, we collect: contact and shipping information; your date of birth, to verify you meet the minimum age requirement; your biological sex, to accurately interpret sex-linked genetic markers; payment information (handled directly by our payment processor, Stripe - we never see or store your full card number); your biological sample; the genetic data derived from sequencing that sample; and, if you contact us, any information you share with our support team.
We use your information to process your order, ship your kit, run sequencing and interpretation, generate and deliver your report, provide customer support, and meet our legal and accreditation obligations. Any use of your genetic data beyond fulfilling your order - including research - requires your separate, affirmative, opt-in consent: never a pre-checked box, and never a clause bundled into these terms. If we ever want to use your data for a new purpose, we'll ask again, specifically, before doing so.
Sequencing is performed by our accredited laboratory partner under a data processing agreement. Report interpretation and account data are stored on encrypted infrastructure. If you're in the EU/EEA or UK, we process your data consistent with the GDPR, including the lawful bases of contract performance (fulfilling your order) and explicit consent (for special category genetic data and any optional research use).
After your order is complete we may email you to ask how your experience went. To send you a review invitation, we share your email address - and nothing about your test, your results, or your health - with Trustpilot, an independent review platform, which then sends you its own invitation. We do this based on our legitimate interest in understanding and improving our service. You're free to ignore the invitation, and you can ask us at any time not to be contacted again. Anything you choose to post on Trustpilot is governed by Trustpilot's own privacy policy.
We don't yet have a customer login/portal. Instead, your report is emailed to you as a private, unique link - not a raw attachment - that stays active for a limited time (currently 7 days) and then stops working. This keeps a copy from sitting indefinitely, unencrypted, in an inbox. If your link expires before you've saved a copy, contact us and we'll issue a new one. A self-serve account with persistent access is planned as order volume grows.
The site currently uses only the cookies and local storage needed for it to function: keeping your cart contents, and remembering basic preferences. If you contact us through the optional live chat widget, that vendor sets its own functional cookie for the conversation - see Section 4 for how we handle vendors generally.
We use Google Ads to measure which marketing actually leads to an order. In line with our genetics-specific safeguard, the purchase signal we send excludes product names or identifiers that would reveal someone ordered a genetic test - only generic transaction data (that an order happened, and its value) is shared, never what was ordered. This tracking only activates if you accept the cookie banner shown on your first visit; declining keeps it off, and the site works identically either way.
Wherever you're located, you can, at any time by emailing us: request a copy of your raw data and reports; request permanent deletion of your data and sample, completed within a 30-day deletion window; correct inaccurate information we hold about you; and withdraw any research consent you previously gave, which stops any further use of your data for that purpose immediately. EU/EEA and UK residents additionally have rights to restrict or object to processing, to receive your data in a portable format, and to lodge a complaint with their local data protection authority. California residents have rights under the CCPA/CPRA, including the right to know, delete, and opt out of the sale of personal information - which, per Section 3, we don't do.
Your physical sample is destroyed after sequencing is complete and quality-checked, unless you separately opt in to long-term biobank storage. Report download links expire after the period stated in Section 5, but the underlying report and your order data are retained until you request deletion (a 30-day deletion window, per Section 7), or until our disclosed default retention period elapses, whichever comes first.
Genetic and order data is encrypted in transit (TLS) and at rest. Access is limited to personnel who need it to deliver your report, under confidentiality obligations. No system is perfectly secure, and we'll notify affected customers and relevant authorities promptly in the event of a breach involving personal data, as required by law.
Tunio is not directed at, and does not knowingly collect data from, anyone under 18. Testing a minor requires a separate parental/guardian consent process not yet available on this site.
If we make material changes to how we handle genetic data, we'll notify affected customers directly by email before the change takes effect, not just by updating this page.
Questions or requests: hello@tunio.health.