REC-4 · Version 1.0
Effective from: 2026-10-06
| Version | 1.0 |
|---|---|
| Effective from | 2026-10-06 |
This Notice explains how Generation Lab Inc. ("Generation Lab", "we", "us") collects and uses personal data in connection with BioNoise™ and the Generation Lab EU Portal in the European Union and European Economic Area. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR").
Generation Lab maintains an informational website in the European Union for the sole purpose of providing corporate information and publishing legally required documentation, including these Terms of Service, the Privacy Notice and other regulatory notices. The website does not facilitate the purchase or ordering of BioNoise™, and does not provide functionality for consumer account registration or access to the BioNoise™ service.
Any Generation Lab website addressed to users in the United States is not directed at users in the European Union, European Economic Area, or the United Kingdom, and this Notice does not apply to it.
Where you are given a short privacy summary at the point your sample is collected, that summary is a shorter layer of this Notice. This is the full version.
Generation Lab Inc. is the controller for the personal data described in this Notice.
| Controller | Generation Lab Inc. |
|---|---|
| Registered address | 1701 Old Bayshore Highway, Burlingame, CA 94010, United States |
| US federal tax identification number (EIN) | 93-1761203 |
| Privacy contact | eu-privacy@generationlab.com |
Because Generation Lab is not established in the European Union, we have appointed a representative under Article 27 GDPR.
| EU representative | Ria Pardeep, Workstreet, Bahnhofstraße 8, 30159 Hanover, Germany. ria@workstreet.com |
|---|
You may contact our representative directly on any matter relating to the processing of your personal data and the exercise of your rights.
Data protection officer: Art Christian Navarro; Email: art@workstreet.com
This Notice covers two groups of people:
Where a section applies to only one group, it says so.
The clinic that collects your sample has its own relationship with you and provides its own privacy information. This Notice covers Generation Lab’s processing only.
| Category | Examples |
|---|---|
| Identity data | Name, date of birth, sex |
| Registration data | Kit ID, date of registration, collection details |
| Biological sample | The blood sample collected from you, and any material derived from it during laboratory analysis |
| Genetic and health data | DNA methylation data generated from your sample |
| Report data | The age-related informational estimate and the report produced for you |
| Consent records | The record of your consent and of any withdrawal |
| Category | Examples |
|---|---|
| Identity and contact data | Name, email address, role, clinic |
| Account data | Credentials, access and session logs |
| Correspondence | Support requests and related messages |
We currently do not collect behavioural tracking data, usage analytics, or marketing preference data in connection with the EU service.
This Section is provided under Article 14 GDPR, which applies where we obtain personal data from a source other than you.
Where the provider registers a kit on your behalf, we receive your identity data from that provider rather than directly from you. We receive DNA methylation data from the laboratory that analyses your sample. We do not obtain personal data about you from any other source, and we do not acquire personal data from data brokers or public sources.
| Purpose | Data used | Article 6 basis | Article 9 basis |
|---|---|---|---|
| Registering a kit and linking the sample to you | Identity, registration data | Consent, Art. 6(1)(a) | Explicit consent, Art. 9(2)(a) |
| Analysing your sample and generating methylation data | Sample, genetic data | Consent, Art. 6(1)(a) | Explicit consent, Art. 9(2)(a) |
| Generating your report and making it available | Genetic data, report data | Consent, Art. 6(1)(a) | Explicit consent, Art. 9(2)(a) |
| Handling support requests, complaints and safety reports | Identity, registration data, correspondence | Legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f) | Legal claims, Art. 9(2)(f) |
Your explicit consent is the basis on which we process your genetic and health data. You may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it. If you withdraw consent, we will stop processing your data for the purposes above and, on request, erase it as described in Section 10.
We do not use your genetic or health data to develop, train or refine our algorithms or reference datasets.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and administering your Portal account | Identity and contact data, account data | Contract, Art. 6(1)(b) |
| Securing the Portal and preventing unauthorised access | Account data, access and session logs | Legitimate interests, Art. 6(1)(f) |
| Responding to support requests | Identity and contact data, correspondence | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Recipient | Role | What they receive |
|---|---|---|
| The provider that collected your sample | Independent party in its own relationship with you | Your registration data and your report |
| Eurofins Genomics Denmark A/S, Smedeskovvej 55, 8464 Galten, Denmark | Processor (laboratory) | Your biological sample, identified by Kit ID, and the methylation data generated from it |
| Professional advisers, auditors and insurers | Recipients | Only what is necessary, and under a duty of confidence |
| Regulators, supervisory authorities and law enforcement | Recipients | Only where required by law |
Our distributor does not receive your identity data, your sample or your report.
Every processor acting on our behalf is bound by a written data processing agreement under Article 28 GDPR. We do not sell personal data.
Generation Lab Inc. is established in the United States. After a laboratory located in the European Union (EU)/European Economic Area (EEA) completes the analysis of your biological sample, the resulting DNA methylation data is transferred to Generation Lab Inc. in the United States solely for the purpose of generating your BioNoise™ report.
Your biological sample is analysed and destroyed by the laboratory within the EEA. It is not transferred to Generation Lab Inc. or to any other recipient.
The United States is not the subject of a general adequacy decision under Article 45 GDPR. We therefore rely on Standard Contractual Clauses adopted by the European Commission, together with a transfer impact assessment, as the safeguard for that transfer under Article 46 GDPR.
Our staff in the United States access your registration data, your methylation data in order to produce your report and to support the service. Access is limited to personnel who need it for those purposes and is subject to the protections described in Section 12.
You may obtain a copy of the safeguards in place by contacting us at eu-privacy@generationlab.com.
| Data | Retention period |
|---|---|
| Biological sample | Biological sample | Destroyed by the laboratory, together with any material derived from it during analysis, within 30 days of analysis being completed, unless retention is required by law. |
| Methylation data | 7 years |
| Report data | 7 years |
| Identity and registration data | 7 years |
| Consent records | For as long as we process your data, and 6 years afterwards, as evidence of consent under Article 7(1) GDPR |
| Data | Retention period |
|---|---|
| Portal account data (incl. Identity and contact, account data) | For the duration of the account and 90 days post-closure. |
We keep personal data only for as long as necessary for the purposes described in this Notice, unless a longer period is required by law. Where you withdraw consent or ask us to erase your data, we act on that request as described in Section 10, subject to any legal obligation to retain particular records.
Your report is produced by an algorithm that compares your DNA methylation pattern against a reference dataset. Each individual calculation is not reviewed by a person.
This is not a decision that produces legal effects concerning you, or that similarly significantly affects you, within the meaning of Article 22 GDPR. The output is informational, is provided for general wellness and personal awareness purposes, and does not determine access to any service, benefit, treatment or entitlement.
If you request further information, we will explain in clear and understandable terms how your report was generated, including the personal data used, the general analytical process and what the report represents. To protect our intellectual property and the security of our systems, we do not disclose proprietary algorithms, source code, mathematical models, reference datasets or other confidential technical information.
Subject to the conditions and exemptions in the GDPR, you have the right to:
To exercise any of these rights, contact us at eu-privacy@generationlab.com or contact our representative using the details in Section 1. We will respond within one month, and will tell you if we need longer, as permitted by Article 12(3) GDPR.
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you live or work, or where you believe an infringement has occurred. A list of authorities is available from the European Data Protection Board.
The Generation Lab EU Portal uses only cookies that are strictly necessary to keep you signed in and to maintain the security of your session. These are exempt from the consent requirement under Article 5(3) of Directive 2002/58/EC.
We do not use analytics, advertising or tracking cookies on the EU Portal, and we do not share any data with advertising networks.
We apply technical and organisational measures appropriate to the sensitivity of the data, including:
No system is completely secure. If a personal data breach occurs, we will notify the competent supervisory authority as required by Article 33 GDPR and, where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay under Article 34.
BioNoise™ is intended for adults aged 25 years and older.
Portal accounts are available only to persons aged 18 or over.
We may update this Notice. The version number and effective date at the top show the current version. Where a change is material, we will notify you as required by law.
| Privacy queries and rights requests | eu-privacy@generationlab.com |
|---|---|
| EU data protection representative | Ria Pardeep, ria@workstreet.com |
| General support | eu-support@generationlab.com |