My genetic data, my rights: how we protect your genetic data
Recent Posts
Related Posts
Your DNA is the most personal information you have. So it’s natural to ask questions before you hand over a sample. Who will see my results? Where is my data kept? Could it be sold, shared or used without my knowledge? Can I have it deleted?
These are good questions, and you deserve clear answers. This article explains how your genetic data is protected, both by the laboratory that runs your test in Europe and by us here in Australia. It also explains the rights you have, and how to use them.
Key takeaways
- Genetic data is treated as one of the most sensitive kinds of information under both European and Australian law.
- Your sample is tested by an accredited clinical laboratory in Europe, which uses your data only for your test. Research use needs your separate consent, and you can withdraw it at any time.
- You can ask us to have the laboratory completely delete your genetic data.
- In Australia we store only two documents, the laboratory report and your patient report. We don’t hold your raw genetic data.
- We keep your reports for 7 years from your last contact with us, as health records law requires, and then securely destroy them.
Why genetic data feels different
Genetic information isn’t like a password. You can’t change it if it’s exposed, and there are still many unknowns about what genetic data can reveal about you, your health and your family.
That’s why people often worry about:
- Who can see it: staff, other companies, or people who shouldn’t have access.
- What it’s used for: research or commercial purposes they didn’t agree to.
- Insurance: whether results could affect cover. (Read our article Genetic testing and your insurance: what Australian law says (2026 update).)
- Security: whether data could be lost or stolen.
- Permanence: whether data is kept forever, and whether it can ever be deleted.
The good news is that both European and Australian law treat genetic information as among the most sensitive information there is, and give it extra protection.
European protections: the GDPR
Your sample is tested by an accredited clinical laboratory in Europe. That means your genetic data is covered by the European Union’s General Data Protection Regulation (GDPR), one of the strongest privacy laws in the world. Our article on sending your sample overseas explains more about how overseas testing works.
Under the GDPR:
- Genetic data is a “special category” of data. Using it is prohibited unless a specific legal exception applies, such as providing health care or your explicit consent. Source
- Countries can add extra limits. EU member states may set further conditions on how genetic and health data is handled.
- You have strong rights. These include the right to see your data, to have it corrected, and to have it erased, sometimes called the “right to be forgotten”. Source
- Data sent outside Europe must stay protected. Transfers, such as your lab report coming to us in Australia, must meet the GDPR’s legal requirements.
Each EU country also has an independent data protection authority. You can complain to it if you believe your data has been mishandled.
What the laboratory does with your data
Our laboratory partner’s privacy policy sets out clear limits on how it handles your information:
- Only what’s needed for your test. The lab uses your personal data only to perform your genetic test and directly related tasks, such as billing. It won’t use it for anything else unless it is explicitly authorised.
- Limited access. Only staff involved in testing, customer service and, in some cases, technical support can access your data.
- No sharing without permission. The lab doesn’t share your personal data with anyone else unless it is authorised or legally required. It uses a small number of carefully checked service providers, such as secure data storage.
- Research only with your consent. Your data is only used for research if you give separate consent. Research data is coded so you can’t be identified, and you can withdraw your consent at any time.
- Anonymous science. The lab may contribute general scientific findings about genetic variants to public databases. These contain no personal information and can’t identify you.
- Strong security. Protections include encryption, pseudonymisation, staff training, confidentiality agreements and independent audits.
You can ask for your genetic data to be completely deleted
Under the lab’s privacy policy, you can request that all of your genetic data is completely deleted. Because we are the healthcare provider that ordered your test, the lab acts on our instructions. Simply contact us, and we will ask the lab to delete your data on your behalf.
If you don’t make a request, the lab keeps your data for a set period and then deletes it.
What we store in Australia
We keep as little genetic information as possible. In Australia, we store only two documents from your test:
- The report from the laboratory.
- Your patient report, prepared and approved by our genetic counsellors. Our guide to understanding your genetic test report explains what’s in it.
We don’t hold your raw genetic data. Your records are stored securely in Australia.
These reports are stored in accordance with Australian health information laws. Under the Privacy Act 1988, health information, including genetic information, is “sensitive information” and receives extra protection. Source This means we must:
- collect only what we need to provide your care
- use and share it only for the purpose you gave it to us, or with your consent
- keep it secure from misuse, loss and unauthorised access
- give you access to it, and correct it if it’s wrong.
Why we keep your reports for a set time
Health service providers must keep health records for a minimum period. In New South Wales, for example, private providers must keep an adult’s health information for 7 years from their last health service. Source We keep your reports for 7 years from your last contact with us. After that, they are securely destroyed.
This means that while your genetic data can be fully deleted from the laboratory, we may need to keep your reports for this legal period.
Your rights, in practice
Here’s what you can ask for, and how:
- See your information. Ask us for a copy of the reports we hold about you.
- Correct it. If something in your personal details is wrong, ask us to fix it.
- Choose about research. Research use is your choice. If you’ve given consent, you can withdraw it at any time.
- Delete your genetic data at the lab. Contact us and we’ll ask the laboratory to completely delete your genetic data.
- Ask questions. Want to know who your data is shared with, or why? Just ask us.
If you have a concern
Please contact us first. We take privacy seriously and will work to put things right. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). For concerns about the laboratory’s handling of your data, you can also complain to the data protection authority in the country where the lab is based.
Frequently asked questions
Will my GP see my results?
If your GP referred you for the test, they receive a copy of your results so they can include them in your care. If you ordered the test yourself, your results come to you, and you can choose whether to share your reports with your GP or any other doctor.
Will my results be uploaded to My Health Record?
Not by default. Our consent form is set so that your reports are not uploaded to My Health Record unless you choose to have them uploaded.
Can my employer or family members see my results?
No, not without your consent. Australian privacy law only allows us to use and share your health information for the purpose you gave it to us, or with your consent. Because results can matter for blood relatives, our genetic counsellors can help you decide whether and how to tell family members, and can give you information or referral links to pass on, so you stay in control of who is told.
Could my genetic data be sold or used for marketing?
Your genetic data is used to provide your test and your care. The laboratory uses it only for your test and directly related tasks unless you explicitly authorise anything else, and under Australian privacy law we can only use your health information for the purpose you gave it to us, or with your consent.
What happens to what I tell Tara?
Before you buy a test, chats with Tara are reviewed by our clinical team to check quality. If you go on to have a test, your chat becomes part of your health record with us. All chats are stored securely and reviewed only by our clinical team. They are not used to automatically train AI, and developers don’t read them.
If I delete my genetic data at the lab, can I have more testing later?
Yes, but you may need to provide a new sample. Once the laboratory has deleted your genetic data, it can’t be reanalysed, so any further testing would start again. The reports we hold are kept for the legal retention period described above.
Can a genetic test result affect my insurance?
Since 8 October 2026, life insurers in Australia can’t ask for or use genetic test results when deciding whether to offer cover or what to charge. They can still ask about symptoms, diagnosed conditions and family medical history. Private health insurance is community rated, so genetic results don’t affect it.
Your data, your choice
Genetic testing can give you and your family valuable information about your health. Deciding to have a test shouldn’t mean giving up control of your most personal data. Strong laws in Europe and Australia protect your genetic information, and you have real rights over it, including the right to have your genetic data deleted.
If you have any questions about how your data is handled, our team is always happy to talk them through with you before you test, or you can book a genetic counselling consultation.
This article is general information only and is not legal advice.
Related reading
- Everything you need to know about genetic testing and counselling
- Sending your sample overseas: your questions answered
- Genetic testing and your insurance: what Australian law says
- Myths and fears about genetic testing
Sources
- Article 9: Processing of special categories of personal data, EU GDPR text
- The EU’s GDPR in the health care context, Petrie-Flom Center, Harvard Law School
- Health and medical research, Office of the Australian Information Commissioner
- Guide to health privacy, Office of the Australian Information Commissioner
- A guide to retention and storage of health information in NSW for private health service providers, Information and Privacy Commission NSW
