Applicable to the websites, web apps, digital platforms and genetic/genomic services of Innovagenome, also operated under the names NowGenome, ExploraGenome, BimboGenome and GenomeSport

Version: 2026_v01

Last update: 04/03/2026

This Privacy Policy describes how **Innovagenome S.r.l.** processes the personal data of users, customers, patients, professionals, partners and visitors who access its websites, digital platforms, web apps, reserved areas, online services and in-person services connected with the brands and/or names **Innovagenome**, **NowGenome**, **ExploraGenome**, **BimboGenome**, **GenomeSport** and other genetic or genomic services managed by the company.

This Policy is provided pursuant to Regulation (EU) 2016/679, known as the General Data Protection Regulation, or GDPR, and to the applicable Italian legislation on the protection of personal data.

This Policy applies exclusively to services managed by Innovagenome S.r.l. and does not apply to services, websites, platforms or activities attributable to other legal entities, even where they are connected through links, partnerships, agreements, welfare services, third-party portals or partner platforms.

Innovagenome services may include the sale and management of genetic and/or genomic test kits, DNA genotyping, bioinformatic analysis of the data obtained, interpretation of genetic variants, production of informational reports and, where applicable, online consultation or professional support services.

Unless otherwise specified, the reports and contents provided are intended for informational, preventive, educational or guidance purposes and do not replace the evaluation of a physician, geneticist, biologist, pharmacologist, nutritionist or other qualified healthcare professional.

The Data Controller is:

**Innovagenome S.r.l.**

Single-member company

Registered office: Via Caleppe 6, 25125 Brescia, Italy

VAT and Tax Code: 04179840980

REA: BS - 594677

Certified e-mail: innovagenome@pec.it

Privacy e-mail: privacy@innovagenome.com

For any request concerning the processing of personal data, users may contact Innovagenome S.r.l. at the addresses indicated above.

This Privacy Policy applies to the processing of personal data carried out within the scope of Innovagenome services, including, by way of example:

Services for the purchase, registration, management and processing of genetic and/or genomic tests, including sampling kits, collection and shipment of the biological sample, bioinformatic analysis, report generation and access to reserved areas.

Informational and genetic/genomic insight services, which may relate to predispositions, personal characteristics, wellness, health, prevention, family history, pharmacogenomics, nutrigenomics or other analysis areas.

Genetic or genomic services relating to minors, children or family pathways, where requested by a person exercising parental responsibility or another duly authorised person.

Genetic or genomic analysis services connected with physical activity, sport, fitness, performance, recovery, metabolic predispositions or other areas related to lifestyle.

Services offered through companies, agreements, welfare plans, professionals, operators, partner facilities, B2B/B2B2C portals or other authorised channels.

Innovagenome S.r.l. processes users’ personal data as Data Controller for activities relating to:

* management of websites, digital platforms and reserved areas;

* registration of the user and/or of the kit;

* management of user accounts;

* management of orders, payments, invoicing and support;

* shipment of kits, collection or shipment of samples and logistics management;

* coordination with laboratories, technical partners and suppliers involved in the service;

* bioinformatic analysis, processing of genetic/genomic data and generation of reports, where carried out directly or under the control of Innovagenome;

* service communications;

* administrative, accounting and tax activities;

* IT security and prevention of abuse;

* any promotional activities, within the limits permitted by law and on the basis of the consents that may have been provided.

Laboratories, couriers, payment platforms, hosting and digital infrastructure providers, automation platforms, healthcare professionals or consultants, commercial partners, third-party portals, affiliated companies and other external parties may be involved in the provision of the services.

Where such parties independently determine the purposes and means of processing, they act as **independent Data Controllers** and provide, where necessary, their own privacy notices.

Where, instead, they process personal data on behalf of Innovagenome S.r.l., they are appointed, where necessary, as Data Processors pursuant to Article 28 GDPR.

Depending on the service used, Innovagenome S.r.l. may process the following categories of personal data.

Name, surname, date of birth, sex, tax code, address, city, postcode, province, country, telephone number, e-mail address, access credentials, user account data, parent/guardian data in the case of minors, data of the person placing the order and other data necessary to identify the user or manage the service.

Purchased services, orders, cart data, payments, invoices, receipts, refunds, vouchers, promotional codes, payment methods, order status, administrative communications and data necessary to manage the contractual and tax relationship.

Full payment card data or other payment instrument data are normally processed by payment service providers and are not stored in full by Innovagenome S.r.l., except where necessary for administrative, accounting and evidentiary purposes relating to the order.

Kit code, sample code, kit status, registration date, kit shipment data, data relating to sample collection or shipment, courier information, any sample anomalies, need for a replacement kit, analysis progress status and related communications.

In relation to the requested service, health-related data concerning the user may be processed, such as, by way of example:

* medical history information;

* clinical or health data provided by the user;

* reports or health documents that may be uploaded;

* data relating to family history, declared conditions, therapies, allergies or intolerances;

* information necessary for the correct interpretation of the report or for any requested consultation;

* data necessary for pharmacogenomics, nutrigenomics, multifactorial predisposition, carrier-status, oncogenetics or other informational tests.

Innovagenome services may involve the processing of genetic and/or genomic data, including, by way of example:

* data derived from the biological sample provided by the user;

* genotyping data;

* detected genetic variants;

* SNPs, rsIDs, genotypes, allelic profiles and other technical data;

* bioinformatic data generated by processing;

* results, classifications, interpretations, profiles, reports and technical annexes;

* data relating to predispositions, traits, characteristics, drug response, carrier status, genetic or multifactorial risk, where provided for by the purchased test.

Genetic and genomic data are special categories of personal data and are processed with particular care, in accordance with the principles of minimisation, confidentiality, security, purpose limitation and controlled access.

Some services may concern minors or subjects other than the purchaser. In such cases, the person requesting the service declares that they are entitled to do so, that they exercise parental responsibility or that they have the necessary authorisation, where required.

Innovagenome S.r.l. may request additional information or documentation to verify the requesting person’s entitlement, where necessary.

 5.7 Data relating to the use of digital platforms

Access data, order history, kit registration, test status, report downloads, messages, uploaded documents, preferences, consents provided, request status, interactions with the platform and information necessary for the operation of online services.

IP address, technical identifiers, type of device, operating system, browser, access logs, security data, cookies and other tracking tools, as indicated in the Cookie Policy.

E-mail address, telephone number, preferences, consents, interactions with communications sent by Innovagenome S.r.l. and information necessary for sending promotional or informational communications, within the limits permitted by applicable legislation.

This Privacy Policy does not govern the processing of personal data carried out by legal entities other than Innovagenome S.r.l., including laboratories, healthcare facilities, professionals, welfare platforms, commercial partners, independent suppliers or other independent Data Controllers, where they independently determine the purposes and means of processing.

This Policy also does not apply to services provided by other companies, even where commercially connected or affiliated, for which a separate privacy notice is provided.

Personal data may be processed for the following purposes.

To allow browsing, access to reserved areas, account registration, authentication, user profile management, kit registration and use of the available functions.

 7.2 Management of orders and of the contractual relationship

To manage orders, payments, shipments, deliveries, kit registration, collection or shipment of samples, operational communications, customer support, invoicing, refunds, complaints, cancellations and any other activity necessary for the performance of the service purchased or requested by the user.

 7.3 Performance of the genetic/genomic test and sample management

To allow shipment of the kit, collection of the biological sample, transfer to the laboratory, verification of sample suitability, performance of technical analyses, management of any anomalies and communication of the service status.

To process the genetic or genomic data obtained, carry out bioinformatic analyses, interpret variants or genetic profiles according to the type of test purchased, and generate reports, technical annexes, informational summaries and personalised contents.

To manage any online consultations, clarifications, professional support, informational sessions, follow-up insights or services related to the report, where provided for or purchased.

To collect and organise any health or contextual information necessary to allow more accurate service management, test interpretation or professional consultation, where provided.

To manage payments, invoices, receipts, refunds, vouchers, contracts, accounting, tax and civil law obligations and legally required retention obligations.

To respond to requests for information, technical support, administrative assistance, clarifications on services, updates on orders, kits, samples or reports and other necessary communications.

To ensure the security of websites, platforms, accounts, information systems and data; to prevent unauthorised access, fraud, abuse, malfunctions, false orders or unlawful activities.

To send newsletters, promotional communications, offers, service updates, informational contents or commercial initiatives, only where permitted by applicable legislation and, where necessary, with the user’s prior consent.

The user may withdraw consent to marketing at any time, without affecting the lawfulness of processing carried out before withdrawal.

To carry out aggregate or statistical analyses, improve services, user experience, report quality, security and platform organisation. Where possible, these activities are carried out using anonymised or aggregated data.

Any further processing for research, development or scientific validation purposes requiring non-anonymised personal data, health data or genetic data will be carried out only where there is an appropriate legal basis, a specific notice and, where necessary, the data subject’s consent.

Some services may involve the use of digital tools, automation systems, algorithms, interpretation software, bioinformatic tools or artificial intelligence solutions to support activities such as:

* organisation of data entered by the user;

* bioinformatic analysis of genetic or genomic data;

* interpretation of variants or genetic profiles according to rules, databases, scientific literature or algorithms;

* generation of drafts, summaries, reports or informational contents;

* classification of requests or results;

* preparation of materials to be submitted to human or professional review;

* improvement of service efficiency.

These tools do not replace the assessment of a qualified healthcare professional, do not independently make diagnoses or prescriptions, and are used in accordance with criteria of data minimisation, security, human oversight where necessary and compliance with applicable legislation.

Where the use of such tools involves external suppliers, they are selected and regulated through appropriate contractual agreements, where required by law.

Depending on the purpose, personal data processing may be based on one or more of the following legal bases:

* performance of a contract or pre-contractual measures requested by the user;

* compliance with legal, tax, accounting or regulatory obligations;

* consent of the data subject, where required;

* explicit consent of the data subject for the processing of special categories of data, including health-related data and genetic data, where necessary;

* reasons of preventive medicine, diagnosis, healthcare or therapy, where applicable and within the limits provided by law;

* legitimate interest of Innovagenome S.r.l., for example for security, prevention of abuse, defence of rights, technical improvement of services and communications relating to similar services within the limits permitted by law;

* establishment, exercise or defence of legal claims in judicial or extrajudicial proceedings.

The processing of health-related data and genetic data is carried out in compliance with Article 9 GDPR and the applicable Italian legislation, on the basis of the conditions provided for the processing of special categories of personal data.

Within the scope of genetic and genomic services, Innovagenome S.r.l. may process personal data, health-related data and genetic/genomic data to allow the purchase, registration and performance of the test, management of the kit, biological sample, analysis, bioinformatic processing, report generation and related communications.

Data may be communicated, to the extent necessary, to analysis laboratories, healthcare facilities, professionals, couriers, technical suppliers, digital platforms and partners involved in the management of the service.

Analysis laboratories, healthcare facilities and other parties involved in the technical performance of the test may act as independent Data Controllers or as Data Processors, depending on the role actually assumed in the service.

The biological sample is used for the purposes indicated in the purchased service and in accordance with the contractual terms, this Privacy Policy, any consent provided and the applicable operating procedures.

Where technically and organisationally possible, the biological sample is sent to the laboratory in coded or pseudonymised form, through the use of a kit or sample identification code.

In such cases, the laboratory receives the information necessary for the technical performance of the analysis, but does not directly have the user’s identification data and does not know the identity of the subject to whom the sample refers, except where different technical, regulatory or organisational requirements are expressly indicated in the service.

The genetic or genomic reports provided by Innovagenome S.r.l. may concern, depending on the service purchased, predispositions, personal characteristics, multifactorial traits, wellness, nutrition, sport, pharmacogenomics, carrier status, family history, oncogenetics, dentistry, health, prevention or other informational areas.

Unless otherwise specified, the reports do not constitute a diagnosis, prescription, therapy, substitute medical opinion or self-sufficient clinical indication. The information provided must be interpreted with the support of a qualified professional, especially before making medical, clinical, therapeutic, pharmacological, nutritional or preventive decisions.

Innovagenome S.r.l. is not responsible for decisions taken independently by the user on the basis of the reports without appropriate consultation with a qualified healthcare professional.

In the case of services relating to minors, the processing of personal, health-related and genetic/genomic data takes place upon request and under the responsibility of the person exercising parental responsibility or another duly authorised person.

The requesting person declares that they are authorised to request the service, provide the sample and receive the related report in the minor’s interest.

Innovagenome S.r.l. may suspend or refuse the service where reasonable doubts arise as to the requesting person’s entitlement or the validity of the consents provided.

Some Innovagenome services may be offered through companies, agreements, welfare plans, partner portals, professionals, pharmacies, physicians, medical centres, healthcare facilities or other authorised operators.

Partners, professionals and authorised operators who enter or transmit personal, health-related or genetic data relating to customers/patients/beneficiaries declare that they have provided the data subjects with an appropriate privacy notice, that they have a valid legal basis for processing and that they are authorised to communicate the data to Innovagenome S.r.l., to laboratories and to the other parties involved in the provision of the service.

In the case of services provided through corporate welfare, except where strictly necessary for the administrative management of the service, Innovagenome S.r.l. does not disclose to the employer, the client company, the payroll office or the welfare platform any health information, genetic data, reports, test results or other data relating to the health or genetic heritage of the beneficiary, unless required by law or specifically requested/authorised by the data subject.

The provision of data required for registration, purchase, kit registration, shipment, collection or sending of the sample, performance of the test and generation of the report is necessary to allow Innovagenome S.r.l. to manage the user’s request.

Failure to provide the necessary data may prevent, in whole or in part, the provision of the requested service.

The provision of data for marketing purposes is optional. Failure to consent to marketing does not prevent the use of the services purchased or requested.

Personal data are processed using paper, IT, telematic, digital, bioinformatic and automated tools, in accordance with the principles of lawfulness, fairness, transparency, minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

Innovagenome S.r.l. adopts appropriate technical and organisational measures to protect personal, health-related and genetic data against unauthorised access, loss, destruction, disclosure, alteration or misuse.

Access to data is limited to authorised and instructed persons, within the limits of their respective duties and operational needs.

Personal data may be processed by:

* authorised personnel and collaborators of Innovagenome S.r.l.;

* analysis laboratories and healthcare facilities;

* healthcare professionals, biologists, geneticists, pharmacologists, nutritionists, consultants and other professionals who may be involved in the requested service;

* hosting, web infrastructure and cloud service providers;

* providers of digital platforms, databases, online forms and management systems;

* payment service providers;

* providers of automation, communication, e-mail, SMS, notification and customer care services;

* providers of bioinformatic tools, software, algorithms or artificial intelligence, where used;

* couriers and shipping providers, where necessary;

* affiliated companies, welfare portals, professionals, partners or authorised operators, within the limits necessary for the service and without communication of unnecessary health or genetic data;

* legal, tax, accounting, technical and insurance consultants;

* public authorities, supervisory bodies or parties legally entitled to receive the data.

The updated list of Data Processors may be requested from Innovagenome S.r.l. at the contact details indicated in this Policy.

For the provision of services, Innovagenome S.r.l. may use external platforms and suppliers for activities such as:

* management of online forms;

* management of reserved areas;

* kit registration;

* databases and web apps;

* online payments;

* operational automation;

* sending e-mails and notifications;

* hosting and security;

* shipments and sample collection;

* laboratory analysis;

* bioinformatic analysis;

* report generation;

* analytics and technical monitoring;

* customer support;

* any artificial intelligence or digital support tools.

Depending on the requested service, the suppliers used may include: payment platforms, hosting providers, web app and database providers, automation systems, e-mail services, couriers, partner laboratories, bioinformatic tools, artificial intelligence tools and other technical or healthcare suppliers.

The updated list of suppliers may be requested from Innovagenome S.r.l. at the contact details indicated in this Policy.

Some providers of digital, cloud, communication, payment, automation, technical support, bioinformatics or artificial intelligence services may process personal data outside the European Economic Area.

In such cases, Innovagenome S.r.l. adopts, where necessary, appropriate safeguards provided by applicable legislation, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, supplementary measures or other instruments recognised by the GDPR.

The user may request further information on data transfers by writing to the contact details indicated in this Policy.

Personal data are retained for the time necessary to achieve the purposes for which they were collected and, subsequently, for the period required by legal obligations or necessary to protect the rights of Innovagenome S.r.l., of the user or of third parties.

In general:

* account data are retained until account deletion or for the period necessary to manage the relationship with the user;

* data relating to orders, payments, invoices and administrative documents are retained for the periods required by tax, accounting and civil law;

* data relating to kits, shipments, samples and analysis status are retained for the time necessary to perform the service and manage any disputes, complaints or legal obligations;

* genetic and genomic data, technical results and reports are retained for the time indicated in the service, consent, reserved area or applicable terms, and in any case for the period necessary to manage the relationship, make the reports available, protect rights and comply with applicable obligations;

* biological samples are retained, destroyed or managed according to the laboratory procedures, service terms and any consents provided;

* data relating to support requests are retained for the time necessary to manage the request and for any protection needs;

* data processed for marketing are retained until consent is withdrawn or the user objects, without prejudice to any further retention obligations;

* technical and security logs are retained for limited periods, proportionate to the purposes of system security and operation.

At the end of the retention periods, data are deleted, anonymised or aggregated, unless retention is necessary for legal obligations or for the establishment, exercise or defence of legal claims.

The websites and platforms of Innovagenome S.r.l. may use cookies and similar technologies to ensure the operation of the services, improve the browsing experience, measure performance and, subject to consent where necessary, carry out marketing or profiling activities.

For further information, the user may consult the Cookie Policy available on the website.

Innovagenome S.r.l. may send commercial communications, newsletters, service updates, promotions or informational contents only where permitted by applicable legislation.

Where required, such communications are sent on the basis of the user’s consent.

The user may withdraw consent or object to receiving promotional communications at any time, by using the unsubscribe link included in the communications received or by writing to the contact details indicated in this Policy.

Innovagenome S.r.l. services are generally addressed to adults.

Where a service is also intended for minors or concerns minors’ data, processing will take place with the involvement of the person exercising parental responsibility, where required by applicable legislation, and according to the specific conditions indicated in the relevant service, form or informed consent.

The user who enters data relating to a minor declares that they are entitled to do so and that they have the necessary authority to request the service.

Innovagenome S.r.l. may use automated systems, algorithms, bioinformatic software or artificial intelligence tools to analyse genetic/genomic data and generate results, classifications, reports or informational contents consistent with the purchased service.

Unless otherwise specified, Innovagenome S.r.l. does not use the user’s personal data for decisions based solely on automated processing that produce legal effects concerning the user or similarly significantly affect the user.

The automated tools used within the services have an analytical, bioinformatic, organisational, informational or support function and do not replace the assessment of a qualified healthcare professional where necessary.

The user may exercise, within the limits and under the conditions provided by the GDPR, the following rights:

* right of access to personal data;

* right to rectification of inaccurate data;

* right to erasure of data in the cases provided by law;

* right to restriction of processing;

* right to object to processing;

* right to data portability, where applicable;

* right to withdraw consent, without affecting the lawfulness of processing carried out before withdrawal;

* right not to be subject to decisions based solely on automated processing in the cases provided by law.

To exercise their rights, users may write to:

**Innovagenome S.r.l.**

Privacy e-mail: [privacy@innovagenome.com](mailto:privacy@innovagenome.com)

Certified e-mail: [innovagenome@pec.it](mailto:innovagenome@pec.it)

Innovagenome S.r.l. may request additional information to verify the identity of the requester before responding to the request.

Some rights may be limited in the cases provided by law, for example where data retention is necessary for legal obligations, protection of rights, security, data integrity or management of disputes.

The user has the right to lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority if they believe that the processing of their personal data is carried out in breach of applicable legislation.

Innovagenome S.r.l. adopts technical and organisational measures appropriate to the risk, taking into account the nature of the data processed, in particular where health-related and genetic/genomic data are involved.

Such measures may include, by way of example, authentication systems, access control, protection of credentials, separation of roles, pseudonymisation or coding of samples where applicable, server security measures, backups, technical logs, encryption where applicable, internal procedures, access limitation and instructions to authorised persons.

For genetic/genomic data, raw analysis data, technical files, reports and any annexes available in the reserved area, Innovagenome S.r.l. adopts, where applicable, protection and encryption protocols for data during transmission and/or storage, as well as access control measures aimed at limiting consultation to authorised persons only and solely for the purposes connected with the provision of the service.

Despite the adoption of security measures, no IT system can be considered completely immune from risks. Users are invited to keep their credentials carefully and to promptly report any unauthorised or suspicious access.

Innovagenome websites and platforms may contain links to third-party websites, services, platforms or tools.

Innovagenome S.r.l. is not responsible for the ways in which such parties process users’ personal data when they act as independent Data Controllers. Users are invited to consult the respective privacy notices.

Innovagenome S.r.l. may amend or update this Privacy Policy to adapt it to regulatory, technical, organisational or service-related changes.

The updated version will be published on the relevant websites or platforms, indicating the date of the last update.

In the event of substantial changes, Innovagenome S.r.l. may provide specific notice to users in a manner proportionate to the nature of the changes.

Unless otherwise indicated, this Privacy Policy applies to the following websites, domains, brands and services, including digital services:

* Innovagenome;

* NowGenome;

* ExploraGenome;

* BimboGenome;

* GenomeSport;

* reserved areas and kit registration portals;

* Innovagenome genetic and genomic services;

* any partner websites or affiliated channels through which Innovagenome services are purchased or activated.

Innovagenome S.r.l. may use the following categories of suppliers:

* hosting and web infrastructure;

* no-code/database/web app platforms;

* online forms and data collection tools;

* payment systems;

* operational automation and integrations;

* e-mail, certified e-mail, SMS and notifications;

* couriers and shipping providers;

* analysis laboratories;

* bioinformatic tools;

* report generation tools;

* artificial intelligence or digital support tools;

* healthcare professionals and consultants;

* analytics tools;

* customer care tools;

* legal, tax, accounting and technical consultants.

Depending on the requested service, users may be asked to provide specific consents or acknowledgements, including:

* acknowledgement of this Privacy Policy;

* acceptance of the terms and conditions of the service;

* consent to the processing of health-related data, where necessary;

* explicit consent to the processing of genetic/genomic data, where necessary;

* informed consent relating to the genetic/genomic test, where applicable;

* consent to marketing;

* consent to receive communications through specific channels;

* authorisation to transmit data to laboratories, professionals, partners or facilities involved in the service;

* any specific consents for particular services, minors, third parties, welfare, companies or professionals.