https://deepdna.ai/mcp) and a REST API (/api/v1) that return public, cited records, need no account and receive no personal data beyond the request records described in section 3. It also publishes deepdna-mcp, a free, open-source package that reads a raw DNA file on your own computer and sends nothing from that file to us. DeepDNA does not ask for, parse or store genetic or laboratory data. Until 25 October 2026 the website had a form that collected email addresses; the form and the endpoint behind it have been removed, and the addresses already given are kept as section 2 describes. The consumer analysis service described in earlier versions of this policy was retired in September 2026.
1. Data controller
DeepDNA is the data controller for the personal data described in this policy, as defined under the EU General Data Protection Regulation (GDPR).
For all privacy-related enquiries:
- Email: [email protected]
- Website: https://deepdna.ai
DeepDNA is based in Spain and operates under Spanish and EU law, including the GDPR.
2. What data we collect and why
Until 25 October 2026, the website had a form where you could leave your email address. It no longer collects email addresses. If you gave us yours through that form, we hold the following data:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | Your registration through the website form; telling you what changed at DeepDNA and answering your replies | Consent (Art. 6(1)(a) GDPR) | Until you request deletion |
| Timestamp | Record when you signed up | Linked to consent | Same as email |
| Source / CTA identifier | Understand which page you signed up from (e.g. "homepage-hero", "blog-post") to improve our site | Legitimate interest (Art. 6(1)(f)) — improving our service | Same as email |
| Referring URL | Understand how you found us. The full URL of the page you came from, which may include search query parameters | Legitimate interest (Art. 6(1)(f)) — marketing attribution | Same as email |
| Country code | Two-letter ISO country code (e.g. "ES", "DE") derived from your connection by Cloudflare. Used for geographic insights, not geolocation | Legitimate interest (Art. 6(1)(f)) — understanding our audience | Same as email |
| UTM parameters | Campaign tracking tags (utm_source, utm_medium, utm_campaign) if present in the referring URL | Legitimate interest (Art. 6(1)(f)) — marketing attribution | Same as email |
| What you are building (optional) | If you filled it in, what you wrote about your use case and, if you chose one, the monthly volume you expected (up to 500 characters together), so we know what to build first | Consent (Art. 6(1)(a) GDPR) | Same as email |
| IP address | Rate limiting of the form only (preventing abuse), while the form existed. Stored as a hashed key, not linked to your email record. No such key remains, since each was deleted after one hour | Legitimate interest (Art. 6(1)(f)) — abuse prevention | 3,600 seconds (1 hour), then automatically and permanently deleted |
Legitimate interest justification
For data processed under legitimate interest (source, referrer, country, UTM parameters), our interest is understanding where our users come from and how they find us, so we can improve our site and outreach. This data is non-sensitive metadata tied to the email address you gave us. We have assessed that this processing does not override your fundamental rights and freedoms, given the minimal nature of the data and its limited use.
For IP-based rate limiting, our interest was preventing automated abuse of the signup form while it existed. The IP address was stored ephemerally (auto-deleted after 1 hour) and was never linked to your email record.
Data you provide voluntarily
Giving your email address was always voluntary, and nothing on the site requires it: the website, the MCP server, the API and the local package need no account and no email address.
3. What we do NOT collect
Zero third-party trackers. No Google Analytics, no Facebook Pixel, no advertising scripts, no social media widgets, no external tracking of any kind.
Server-side aggregated metadata. We log aggregated pageview metadata server-side (path, day, anonymised user-agent bucket, referrer host, UTM parameters) under legitimate interest; no cookies, no IP storage, no fingerprinting.
API and MCP lookups. Our public knowledge API and MCP server (
deepdna.ai/mcp) need no account, and we do not store IP addresses, request bodies or medication lists from them. For the MCP server we record one data point per request: the method and tool called, the gene, rsID (a public variant identifier such as rs4244285) or drug name looked up (for a medication screen, only how many drugs were listed), whether we had an answer, the client’s self-declared name and version, its user-agent, and a country code. The MCP tools have no field for genetic data. An argument a tool does not declare, such as a genotype, is refused, and its value is not used, stored or counted. What is typed into a declared field is used to answer that request. We record it only as a short lookup label: an rsID in the form rs123, a gene symbol from our list of known pharmacogenes (for example CYP2C19 or TPMT), or a drug name when it is one we cover. Anything else, whatever it is, is recorded as “(other)”. Please don’t type a personal genetic result into these fields. Legitimate interest (Art. 6(1)(f)): knowing whether the service is used and what to cover next.Local package. Our local MCP package (
deepdna-mcp, on GitHub) runs on your own computer and reads a raw DNA file there. It sends us nothing from that file: it downloads the same public records from our knowledge API for every user, and its drug lookup sends only the gene and drug names. We handle those requests like any other knowledge API request, as described in “API and MCP lookups” above. What the package reports goes to the AI model your agent uses, under that provider’s terms, not to us.No profiling or automated decision-making. We do not use your data for profiling, scoring, or any form of automated decision-making as defined under GDPR Art. 22.
4. Genetic data — GDPR Article 9 special categories
Genetic data is classified as a special category of personal data under GDPR Article 9. It is defined in GDPR Article 4(13) as "personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question."
4.1 DeepDNA processes no genetic data
DeepDNA does not receive, parse or store DNA files, genotypes or laboratory reports on its servers. The MCP server takes gene symbols, rsIDs and drug names and refuses a genotype argument (section 3); the API takes only gene symbols, rsIDs and drug names in the URL path and has no parameter for one. The local package deepdna-mcp reads a raw DNA file on your own computer and sends nothing from that file to us (section 3). We do not build a database of genomes.
4.2 If this ever changes
If DeepDNA ever processes genetic data on its servers, it will first update this policy to say what is processed, on which legal basis under GDPR Article 9, and for how long, and will complete the assessment described in section 4.4.
4.3 Deletion rights
You have the right to request deletion of all data we hold about you at any time. Upon request:
- Your email record and all associated metadata are permanently deleted
- Deletion is confirmed by email within 30 calendar days
- DeepDNA holds no genetic data, so there is no genetic file or result to delete
To request deletion: [email protected]
4.4 Data Protection Impact Assessment (DPIA)
DeepDNA processes no genetic data today: the MCP server refuses a genotype (section 3), and the local package runs on your own computer. If DeepDNA ever processes genetic data on its servers, a Data Protection Impact Assessment under GDPR Article 35 will be completed and documented before it does.
4.5 No genetic discrimination
DeepDNA does not share your genetic data or analysis results with:
- Insurance companies
- Employers
- Government agencies
- Law enforcement (except where legally compelled by a valid court order, in which case we would have no raw genetic data to provide)
- Pharmaceutical companies
- Any other third party
We support and comply with the principles of the EU Charter of Fundamental Rights Article 21 (non-discrimination) as it applies to genetic characteristics.
5. Data processor
Your data is processed and stored using Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) as our data processor. Specifically:
- The site is hosted on Cloudflare Pages
- The email addresses and metadata described in section 2 are stored in Cloudflare Workers KV, a key-value store distributed across Cloudflare's global network
- The signup API that collected email addresses until 25 October 2026 ran on Cloudflare Workers (serverless functions at the edge)
- The MCP lookup records described in section 3 are stored in Cloudflare Workers Analytics Engine
Cloudflare acts as a data processor under GDPR Art. 28. Cloudflare maintains a GDPR compliance programme and offers a Data Processing Addendum (DPA) that includes Standard Contractual Clauses (SCCs) for international data transfers.
We do not share your data with any other third parties. We do not sell your data. We do not use it for advertising.
6. Data storage and international transfers
The email addresses and metadata described in section 2 are stored in Cloudflare Workers KV. Cloudflare KV is a globally distributed key-value store, which means your data may be replicated across Cloudflare's network of data centres worldwide, including locations outside the European Economic Area (EEA).
Cloudflare is a US-based company. International transfers of personal data to Cloudflare are governed by:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- Cloudflare's Data Processing Addendum (DPA), which incorporates appropriate safeguards under GDPR Art. 46
- Cloudflare's participation in relevant data transfer frameworks
We are transparent about this: we do not claim EU-only storage. Your data is processed within Cloudflare's infrastructure with contractual EU data protection standards applied regardless of where it is physically stored.
Genomic data transfers
DeepDNA processes no genetic data, so none is transferred. If that ever changes, this section will be updated first (section 4.2).
7. Data retention
- Email and associated metadata (timestamp, source, referrer, country, UTM): collected through the website form until 25 October 2026; retained until you request deletion, or until we determine the data is no longer needed for those purposes
- IP address (rate limit key): while the form existed, automatically deleted after 3,600 seconds (1 hour), enforced at the infrastructure level via Cloudflare KV TTL. None is created any more
- MCP lookup records (one data point per MCP request, as described in section 3 under “API and MCP lookups”): deleted automatically by Cloudflare Workers Analytics Engine three months after they are written
- Genetic or laboratory data: none is received, so none is retained
When you request deletion, we remove your email record and all associated metadata. Deletion is permanent.
8. Your rights
Under the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, contact us at [email protected]. We will respond within 30 calendar days.
- Right of access (Art. 15): Request a copy of all personal data we hold about you. We will provide it in JSON format
- Right to rectification (Art. 16): Request correction of inaccurate personal data
- Right to erasure (Art. 17): Request deletion of your personal data. We will delete all records and confirm by email
- Right to restriction of processing (Art. 18): Request that we limit how we use your data
- Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format (JSON)
- Right to object (Art. 21): Object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds
- Right to withdraw consent: You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. To withdraw, email us or request deletion
Additional rights for genetic data
Given the special nature of genetic data under GDPR Article 9, you have additional protections. DeepDNA holds no genetic data, so there is none to delete, explain or review; you can request deletion of any other data we hold at any time. If DeepDNA ever processes genetic data (section 4.2), this section will say how to exercise these rights.
9. Right to lodge a complaint
If you believe we have not handled your data correctly, you have the right to lodge a complaint with a supervisory authority. The relevant authority for complaints is:
Agencia Española de Protección de Datos (AEPD)
https://www.aepd.es
You may also lodge a complaint with the supervisory authority in your own EU/EEA member state of residence.
10. Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Art. 33
- Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Art. 34
DeepDNA holds no genetic data, so a breach could not expose any.
11. Children
DeepDNA does not knowingly collect personal data from anyone under the age of 16. If we become aware that we have collected data from a child under 16, we will delete it immediately.
12. Changes to this policy
We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes — particularly those affecting genomic data processing — we will notify by email anyone who has given us an email address and require re-consent where applicable.
13. Contact
For any questions about this privacy policy, your personal data, or to exercise your rights:
Email: [email protected]
Response time: Within 30 calendar days
See also: About DeepDNA · Methodology · Terms of Service