DNA privacy: 7 questions to ask before using your raw genetic data

Your raw DNA file can help you explore genetics, but deciding where to use it deserves the same care as deciding what to learn from it. Start with concrete questions about data processing and your choices. A reassuring slogan alone cannot explain what happens to your information.

NHGRI explains that genetic privacy protections depend on the context in which information is collected and used. Downloading data or moving it to another service creates a new privacy decision. Read NHGRI’s overview of privacy in genomics.

1. What exactly leaves my device?

Ask whether the service receives the entire raw file, selected variants, or a different derived result. Also ask what personal information accompanies the genetic data. A file can stay on your computer while some of its contents are still sent elsewhere.

Evigenics parses the raw file in your browser rather than uploading or retaining it. For report generation, it sends genotype pairs matching its curated variant list, plus your provided profile information and consent timestamp. Where ancestry features are enabled, ancestry calculations run in the browser and the resulting population shares are sent. See the Evigenics privacy notice for the current details.

2. What is saved after processing?

Look beyond the raw file. A report may contain genotypes, interpretations, identifiers, and profile details. Ask whether the service keeps the inputs, the output, or both, and how it links them to your account.

Evigenics saves the account email and profile, report and report metadata, consent timestamp, and a one-way hash used to identify duplicate genotype inputs. Reports keep the genotypes displayed in them; other submitted pairs are not stored. These saved reports can contain sensitive genetic and health interpretations. Local file processing therefore does not make the saved report nonsensitive.

3. Who can access the information?

Check the account controls and the service providers described in the policy. Ask how report sharing works and whether a downloaded PDF remains protected by the account controls. Once you save a PDF elsewhere, its access depends on that new location.

Evigenics reports require an authenticated account and are scoped to the account owner. Its notice describes Resend for sign-in email, Cloudflare for site delivery and visit counting, and Google Fonts on public pages. It says Cloudflare counts page visits without receiving report contents. These are specific processing statements, rather than a promise that every privacy risk has been eliminated.

4. Which uses require a separate choice?

Separate the processing needed for the report from optional contributions. Look for a clear explanation beside each optional choice. If you cannot tell what a checkbox changes, ask before agreeing.

Evigenics describes optional grandparents’ birthplace information. Separately opting into reference contribution permits it to retain ancestry markers alongside those birthplaces to improve reference data. The notice specifies 23,262 positions for that contribution. This is additional genetic processing: it should not be confused with the ordinary report-generation description. Participation can be withdrawn in Account.

5. How do deletion and withdrawal work?

Find the actual controls before you need them. Ask what account deletion removes, whether optional contributions can be withdrawn separately, and what happens to copies you have already downloaded or shared.

Evigenics’ notice says Account → Delete account and reports immediately and permanently deletes the account and saved reports, birthplaces, and any reference contribution. Keep in mind that using a service’s deletion control does not recall a PDF you already sent to another person. Review those copies separately.

6. Can I understand future policy changes?

Check the policy’s date, the terms of use, and the available contact route. Save the policy link with a short note recording what mattered to your decision. When returning after a long break, read it again before submitting more data.

MedlinePlus recommends examining a consumer genetic testing company’s terms and privacy practices, including the implications for relatives who share genetic information. Its consumer checklist is a useful starting point for questions that apply beyond a single service.

7. How will I protect my own copies?

Choose private storage for raw downloads and reports. Review who can access a shared computer, backup folder, or cloud account. When discussing results publicly, avoid revealing names, birthdates, account details, or genotype tables. If someone needs the report, use a deliberate private sharing method and check the recipient.

For support requests, send an error message first. You can usually explain a download or file-selection problem without sending the genetic file itself. Contact Evigenics if you need clarification about its processing or a product issue.

Privacy is one part of choosing an interpretation service. Read what raw DNA interpretation can and cannot tell you and how to obtain your provider’s original download. You can learn about Evigenics before deciding whether to use your existing file. Its reports support education and discussion with a qualified provider; they are not a medical diagnosis.