Privacy Policy

Last updated: 12 May 2026

“KnowYourGenes” (also “KYG”) is a brand operated by BFG Market Consult Private Limited (CIN U74999DL2010PTC207582, registered office SU 18, Pitam Pura, Delhi 110034). References in this policy to “KnowYourGenes”, “KYG”, “we”, “us” and “our” mean BFG Market Consult Private Limited operating under the KnowYourGenes brand.

We operate the website knowyourgenes.in and the related mobile/web application (together, the “Platform”), through which we offer genetic testing via doorstep self-collection kits couriered to your address across India. We do not currently offer at-home phlebotomist or any in-person sample-collection service.

This Privacy Policy explains what personal information, sensitive personal information and genetic data we collect, how we use it, who we share it with, how long we keep it, and the rights you have over it. It is published in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Consumer Protection (E-Commerce) Rules, 2020.

1. Scope

This policy applies to everyone who:

visits knowyourgenes.in or any KYG sub-domain,
creates a KYG account,
orders a kit, registers a kit, or sends a sample to our partner lab,
receives or accesses a KYG report, or
interacts with KYG support, marketing or counselling channels.

By using the Platform or booking a service, you confirm that you have read and understood this policy. If you are booking on behalf of another individual, you confirm you are authorised to share their information with us and to receive communications about them.

2. What we collect

We collect only what is necessary for the services you have asked for, fraud prevention, statutory compliance, and improving the Platform.

A. Identifiers and contact details

Full name, date of birth, sex assigned at birth, gender, email, mobile number, postal address with pincode.

B. Account and transaction data

Login credentials (passwords are hashed; we never see them in plaintext), order history, cart contents, coupon use, billing details, payment status. Card and bank details are handled by Razorpay and never stored on KYG servers.

C. Health and lifestyle questionnaire data (“Health Information”)

Self-reported medical history, family history, current medications, allergies, dietary habits, lifestyle factors, and any context you choose to share with a counsellor.

D. Genetic data (“Genetic Data”)

The biological sample (saliva or buccal swab) you self-collect using the kit we ship, the DNA sequence variants generated from it, and the downstream interpretive output. Genetic Data is “sensitive personal information” under the SPDI Rules and is treated as such.

E. Device and usage data

IP address, browser, device, operating system, referrer, pages visited, session timing, and crash logs. Collected via first-party analytics (and Google Analytics 4 if you have not opted out) for product analytics and security.

F. Location data

The pincode and full address required to ship the kit and schedule the reverse pickup. We do not track real-time location of users.

G. Communications

Records of your interactions with our care team, WhatsApp messages, emails, and consultation notes from genetic counsellors.

3. How we use your information

We use the information collected to:

Fulfil the test you have ordered — dispatch your kit, arrange the reverse pickup, route the sample to our partner NABL-accredited lab, and deliver your report.
Provide pre-test and post-test genetic counselling, where chosen.
Process payments, issue invoices, and process refunds.
Send transactional updates (booking confirmation, agent en-route, sample collected, report ready) over WhatsApp, SMS, email, or push notification.
Send marketing communications, only where you have given explicit, separate consent, and only between 09:00 and 21:00 IST. You can withdraw consent at any time from your account preferences or by replying STOP to a message.
Investigate suspected misuse, fraud, or violation of our Terms of Service.
Comply with legal obligations and regulatory requests.
Improve the Platform, in aggregated and de-identified form.

We do NOT use your Genetic Data, Health Information, or contact details for any of the following:

To set or influence the price of any product or service offered to you;
To market insurance, lending, or financial products to you;
To train any third-party AI/ML model;
To sell to any data broker or marketing list, anonymised or otherwise.

4. Legal basis (DPDP Act)

We process your personal data under one of the following bases:

your consent, recorded explicitly at the point of collection;
the performance of the contract you have entered into by booking a test;
compliance with a legal obligation we are subject to;
protection of your vital interests (in the rare case of a clinically significant finding requiring follow-up).

Wherever consent is the basis, you may withdraw it through your account or by writing to grievance@knowyourgenes.in. Withdrawal does not affect processing already lawfully carried out.

5. How we handle samples and genetic data

A. Sample handling

Each kit is labelled with a unique de-identified accession number (the “kit code”). When you register the kit in your KYG account, that code is linked to your identity in our database - but the physical sample that travels to the lab carries only the code, not your name or address. Only the KYG operations team and the lab’s reporting pathologist can re-link the accession number to your identity.

B. Storage

Samples are stored at our partner NABL-accredited lab for a maximum of 60 days from receipt, after which the residual sample is destroyed under the lab’s biomedical waste protocol, unless you have separately consented to a longer hold for re-analysis.

C. Genetic Data storage

Raw sequencing data and the variant call file (“VCF”) are stored on KYG-controlled servers hosted in India, encrypted at rest (AES-256) and in transit (TLS 1.2+). Access is restricted to authorised KYG personnel on a need-to-know basis and is audit-logged.

D. Retention

By default, your Genetic Data and report are retained for as long as you maintain an account with us, so you can re-access your report at any time. You may at any time:

download your report and have your Genetic Data deleted;
close your account, on which we delete your Genetic Data and Health Information within 60 days and retain only the statutory minimum (invoice records, audit logs) required by Indian tax and consumer protection laws.

E. No research use without separate consent

We will not use your Genetic Data for research, publication, or aggregated dataset products unless you give a separate, explicit, opt-in consent through the Research Participation form. Research consent is independent of using our service and can be withdrawn at any time.

6. Sharing

We share your information only with:

The NABL-accredited partner lab that processes your sample (de-identified by accession number; the lab does not get your name/address).
The genetic counsellor or clinician you have chosen to consult, if any.
Razorpay, our payment gateway, for processing payments.
Shipping / logistics partners (e.g., Delhivery / Shiprocket) to the extent of name, phone and address required to deliver the kit to you and reverse-pick the sample from you. The kit and reverse-shipment carry only a de-identified accession number; the courier does not see Genetic Data.
Communication providers (WhatsApp Business API provider, SMS gateway, email provider) for transactional and consented marketing messages.
Hosting and infrastructure providers (cloud and CDN) under standard data-processing agreements.
Law enforcement, regulators, and courts, only where we are legally compelled, and only to the minimum extent required.

In the event KYG is acquired by, merged with, or sells assets to another entity, your information may be transferred as part of that transaction. We will notify you in advance and you will retain the right to delete your data before the transfer takes effect.

We do NOT sell your information. We do not share your Genetic Data or Health Information with insurers, employers, lenders, or advertisers.

7. International transfers

Your data is stored and processed in India. If we ever need to transfer it outside India (for example, to a cloud region outside India), we will do so only to countries not restricted by the Central Government under section 16 of the DPDP Act, and under appropriate contractual safeguards.

8. Security

We follow the “reasonable security practices” standard prescribed by the SPDI Rules. Concretely:

TLS 1.2+ on all public endpoints;
AES-256 at-rest encryption for Genetic Data and report files;
Role-based access control with audit logging for staff;
Two-factor authentication on internal admin systems;
Annual third-party security review;
Documented breach-response plan with notification to affected users and the Data Protection Board within the statutory window.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and the Data Protection Board as required by the DPDP Act.

9. Your rights

You have the right to:

Access the personal data we hold about you;
Correct inaccurate or outdated information;
Have your Genetic Data and Health Information deleted (we retain only what statute requires);
Withdraw any consent you have given, at any time;
Nominate another person to exercise these rights in the event of your death or incapacity;
File a grievance with our Grievance Officer (details below);
Escalate to the Data Protection Board of India if your grievance is not resolved.

To exercise any of these rights, write to privacy@knowyourgenes.in. We will respond within 30 days.

10. Cookies

We use first-party cookies for session management and remembering preferences, and Google Analytics 4 for traffic analytics. Tracking cookies (advertising / retargeting pixels) are loaded only after you accept them via the cookie banner. You can withdraw cookie consent at any time from the footer “Cookie Preferences” link.

11. Children

Our services are not intended for individuals under the age of 18. A genetic test may be ordered for a minor only by their parent or legal guardian, who provides consent on the minor’s behalf in accordance with the DPDP Act.

12. Third-party links

Our Platform may link to third-party sites (e.g., blog citations, research papers). This Privacy Policy does not apply to those sites. We encourage you to read their policies.

13. Changes to this policy

We will update this policy as our services and the law evolve. The “Last updated” date at the top reflects the latest version. Material changes (for example, a new category of data or new sharing relationship) will be notified in advance by email or in-app banner at least 14 days before they take effect.

14. Grievance Officer & Contact

Grievance Officer: [to be appointed before launch]
BFG Market Consult Private Limited (operating the KnowYourGenes brand)
SU 18, Pitam Pura, Delhi 110034, India
CIN: U74999DL2010PTC207582
Email: grievance@knowyourgenes.in
Phone: +91 11 4000 0000(Mon–Sat, 09:00–19:00 IST)

For privacy-specific questions, you may also write to privacy@knowyourgenes.in.