(1)A direct-to-consumer genetic testing company shall:
(1)(a) provide to a consumer:
(1)(a)(i) essential information about the company's collection, use, and disclosure of genetic data; and
(1)(a)(ii) a prominent, publicly available privacy notice that includes information about the company's data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices;
(1)(b) obtain a consumer's initial express consent for collection, use, or disclosure of the consumer's genetic data that:
(1)(b)(i) clearly describes the company's use of the genetic data that the company collects through the company's genetic testing product or service;
(1)(b)(ii) specifies who has access to test results; and
(1)(b)(iii) specifies how the company may share the genetic data;
(1
Free access — add to your briefcase to read the full text and ask questions with AI
(1) A direct-to-consumer genetic testing company shall:
(1)(a) provide to a consumer:
(1)(a)(i) essential information about the company's collection, use, and disclosure of genetic data; and
(1)(a)(ii) a prominent, publicly available privacy notice that includes information about the company's data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices;
(1)(b) obtain a consumer's initial express consent for collection, use, or disclosure of the consumer's genetic data that:
(1)(b)(i) clearly describes the company's use of the genetic data that the company collects through the company's genetic testing product or service;
(1)(b)(ii) specifies who has access to test results; and
(1)(b)(iii) specifies how the company may share the genetic data;
(1)(c) if the company engages in any of the following, obtain a consumer's:
(1)(c)(i) separate express consent for:
(1)(c)(i)(A) the transfer or disclosure of the consumer's genetic data to any person other than the company's vendors and service providers;
(1)(c)(i)(B) the use of genetic data beyond the primary purpose of the company's genetic testing product or service; or
(1)(c)(i)(C) the company's retention of any biological sample provided by the consumer following the company's completion of the initial testing service requested by the consumer;
(1)(c)(ii) informed consent in accordance with the Federal Policy for the Protection of Human Subjects, 45 C.F.R. Part 46, for transfer or disclosure of the consumer's genetic data to a third party for:
(1)(c)(ii)(A) research purposes; or
(1)(c)(ii)(B) research conducted under the control of the company for the purpose of publication or generalizable knowledge; and
(1)(c)(iii) express consent for:
(1)(c)(iii)(A) marketing to a consumer based on the consumer's genetic data; or
(1)(c)(iii)(B) marketing by a third party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service;
(1)(d) require valid legal process for the company's disclosure of a consumer's genetic data to law enforcement or any government entity without the consumer's express written consent;
(1)(e) develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use, or disclosure; and
(1)(f) provide a process for a consumer to:
(1)(f)(i) access the consumer's genetic data;
(1)(f)(ii) delete the consumer's account and genetic data; and
(1)(f)(iii) destroy the consumer's biological sample.
(2) Notwithstanding Subsection (1)(c)(iii), a direct-to-consumer genetic testing company with a first-party relationship to a consumer may, without obtaining the consumer's express consent, provide customized content or offers on the company's website or through the company's application or service.