Privacy Policy

WinDNA Life Sciences Private Limited (CIN U15300MH2019PTC334645), registered office at A-1402, Ekta Bhumi Garden-III, Duttapada Road, Borivali East, Mumbai 400066, is the Data Fiduciary for personal data processed through this website and our testing, counselling and wellness services. This policy explains what we collect, why, how long we keep it, and the rights you have under the Digital Personal Data Protection Act, 2023 and the rules made under it.

What we collect

• Identity and contact details: name, phone number, email address and delivery address.
• Order and kit details: the test you choose, kit barcode, dispatch and registration records, and payment confirmation (card details are handled by the payment provider and never stored by us).
• Health and lifestyle information: details you share in questionnaires, kit registration or counselling sessions.
• Biological samples and derived data: saliva or stool samples and the genetic or microbiome findings derived from them, delivered to you as a report.
• For a child's test: the child's details together with the identity and consent of the parent or legal guardian.
• Website usage: essential cookies and basic analytics, as described in our Cookie Policy.

Why we process it

• To deliver your test, prepare and explain your report, and provide counselling and personalised guidance.
• To register and track your kit and respond to your enquiries.
• To meet legal, accounting and record-keeping obligations.
• With your separate consent, to send you preventive health education and updates. You may opt out at any time.

We do not use your genetic or health data for advertising, and we do not share it with insurers or employers.

Consent and how to withdraw it

Health and genetic data is processed only on the basis of your explicit consent, taken when you order or register a kit. You may withdraw consent at any time by writing to the Grievance Officer below. Withdrawal stops further processing from that point; it does not affect processing already lawfully completed, and we may need to retain certain records where the law requires it.

Children

A test for a person under 18 years is processed only with verifiable consent from a parent or legal guardian, and only for the purpose of preparing and explaining that child's report. We do not track children's behaviour or direct advertising at them.

Who we share data with

• Partner laboratories: NABL-accredited laboratories receive your sample identified by barcode only. Your name and contact details are not shared with the laboratory.
• Clinicians and counsellors: qualified professionals who review your report and provide guidance, bound by confidentiality.
• Service providers: providers that host our website, process form submissions, deliver kits and send transactional messages, each restricted to the purpose we specify.
• Legal requirements: where disclosure is required by law or a competent authority.

We do not sell personal data.

Where your data is stored

Personal data, samples and reports are stored and processed in India. Our systems are hosted in Mumbai. We do not transfer your personal data outside India.

How long we keep it

• Biological samples: retained for a maximum of six months from receipt, after which they are destroyed.
• Reports: your PDF report is retained for two years from the date of issue so that we can support you with follow-up questions and counselling. Raw genetic data is not stored on WinDNA systems.
• Account, order and enquiry records: retained for as long as needed to serve the purpose or as required by law, whichever is longer.

When data is due for erasure, we will notify you at least 48 hours in advance so that you can download your report or ask us to retain it.

Your rights

• Access: a summary of the personal data we hold about you and how it has been processed.
• Correction and updating: of inaccurate or incomplete data.
• Erasure: of your personal data, unless retention is required by law.
• Nomination: you may nominate a person to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal: as set out below.

To exercise any of these rights, write to the Grievance Officer. We may ask you to verify your identity before acting on a request.

Grievance redressal

If you have a question or concern about how your personal data is handled, please contact:

We acknowledge every grievance within 48 hours and aim to resolve it within 30 days. In no case will our response exceed the period permitted under the Digital Personal Data Protection Rules. If you are not satisfied with our response, you have the right to approach the Data Protection Board of India.

Security and data breaches

We apply appropriate technical and organisational safeguards, including access controls, encryption in transit, and barcode-based pseudonymisation of samples. In the unlikely event of a personal data breach, we will notify the Data Protection Board of India and affected individuals in the manner and time the law requires.

Changes to this policy

We may update this policy as our services or the law change. The date below shows the current version. Material changes affecting how your health or genetic data is used will be notified to you directly.

Last updated October 2026. Questions about this policy? Write to grievance@windna.in or reach us via our contact page.