Privacy Policy — Rescript Genetics

Effective Date: June 7, 2026 · Last Updated: July 29, 2026

Notice: This Privacy Policy is provided as a good-faith statement of our current data practices. It has not yet been reviewed by licensed legal counsel. Rescript Genetics intends to replace this document with a professionally reviewed and jurisdiction-specific privacy policy prior to full commercial operation. Questions? Contact us at support@rescriptgenetics.com.

1. Who We Are

Rescript Genetics LLC, a Wyoming limited liability company ("Rescript Genetics," "we," "us," or "our"), operates the website at rescriptgenetics.com and provides a precision wellness service that analyzes raw DNA data files to generate personalized supplement protocols. We are not a healthcare provider, medical clinic, or covered entity under HIPAA.

Our contact information: support@rescriptgenetics.com | rescriptgenetics@gmail.com

2. The Data We Collect

2.1 Information You Provide Directly

Identity data: First name, last name
Contact data: Email address
Health characteristics: Age, biological sex, weight
Health goals: Free-text description you enter
Medications and supplements: Optional free-text list of current prescriptions, over-the-counter medications, and supplements you voluntarily disclose. Used only to help you prepare questions for your pharmacist or physician — never used to screen for interactions.
Lab results: Blood panel values you voluntarily paste or upload
Payment data: Processed entirely by Stripe — we never see or store your card number

2.2 Genetic Data

You may upload a raw DNA data file exported from 23andMe, AncestryDNA, MyHeritage, FamilyTreeDNA, or similar services. This file contains your genetic information — specifically single nucleotide polymorphisms (SNPs) — which is among the most sensitive categories of personal data.

What we do with your genetic file:

Your file is transmitted securely over HTTPS to our processing server
The server extracts only the specific SNPs relevant to supplement analysis (312 targeted variants across 18 pathways)
The raw file is never written to permanent storage
The extracted SNP data is passed to an AI model to generate your report
After your report is generated, the extracted data is permanently deleted from our servers
We do not retain, sell, license, or share your genetic data with any third party for any purpose other than generating your report

2.3 Technical and Consent Data Collected Automatically

IP address — logged by our server infrastructure and recorded as part of your consent log (see below)
Browser type and version (user-agent string)
Pages visited and timestamps
Error logs

Consent logs: At the moment you submit your analysis, we record the following in our secure database for legal compliance purposes: your email address, IP address, browser type, the date and time you provided consent, and which consent acknowledgments you checked. This record is retained permanently as evidence of informed consent and is not used for any marketing or analytical purpose.

We do not use tracking cookies, advertising pixels, or behavioral analytics tools.

3. How We Use Your Data

Purpose	Data Used	Legal Basis
Generate your personalized supplement protocol	Genetic data, health data, symptoms, medications, labs	Your explicit consent
Deliver your report by email	Email address, report content	Contract performance
Create your Fullscript supplement account	Name, email address	Your explicit consent
Process your payment	Payment data (handled by Stripe)	Contract performance
Maintain consent records	Email, IP, timestamp, checkbox states	Legal obligation / legitimate interest
Practitioner quality review of supplement protocol	Generated wellness report (retained 21 days, then auto-deleted)	Legitimate interest / quality assurance
Maintain scientific methodology records	Citation reference log linked by report ID (no genetic data)	Legitimate interest / legal compliance
Respond to your inquiries	Email address, inquiry content	Legitimate interest
Comply with legal obligations	As required by applicable law	Legal obligation

What we will NEVER do with your data:

Sell, rent, or trade your personal or genetic data to any third party
Use your genetic data for advertising or marketing profiling
Share your data with insurance companies, employers, or government agencies (unless compelled by valid legal process)
Use your data to train AI models without your explicit additional consent
Retain your raw genetic file beyond the current processing session

4. Third-Party Service Providers

We use the following third-party services to operate Rescript Genetics. Each receives only the minimum data necessary to perform their function:

Provider	Purpose	Data Shared	Their Privacy Policy
Anthropic	AI analysis of genetic data	Extracted SNP summary, health data, medications (if disclosed)	anthropic.com/privacy
Fullscript	Supplement dispensary — creates a patient account and supplement plan on your behalf	Name, email address, supplement protocol	fullscript.com/privacy
Railway	Server hosting and processing	All data passes through their infrastructure	railway.app/legal/privacy
Stripe	Payment processing	Payment data only	stripe.com/privacy
Resend	Email delivery	Email address, report content	resend.com/privacy
Ionos	Website hosting	Standard web traffic data	ionos.com/terms-gtc/privacy

None of these providers are authorized to use your personal or genetic data for any purpose other than providing services to Rescript Genetics.

5. Data Retention

Raw genetic file: Never stored — processed in memory and discarded immediately after SNP extraction
Extracted SNP data: Held in server memory for the duration of analysis, permanently deleted after your report is generated
Medications/supplements you disclosed: Deleted from server memory at the same time as your genetic data — immediately after report generation
Your report: Emailed to you and retained in our secure internal systems for up to 21 days to facilitate practitioner quality review of your supplement protocol. After 21 days your report is automatically and permanently deleted from our systems. This copy does not contain your raw genetic file or full SNP data.
Consent logs: Retained permanently for legal compliance (email, IP, timestamp, checkbox states — no genetic data)
Scientific methodology records: A record of which published peer-reviewed studies informed the supplement recommendations in your report is retained indefinitely as part of our internal methodology documentation. This record is linked to your report by a unique report identifier and contains no genetic data, raw SNP data, or personal health information.
Email address and name: Retained in email delivery logs for up to 90 days, then deleted
Payment records: Retained by Stripe per their standard retention policy (typically 7 years for financial compliance)
Server access logs: Retained for up to 30 days for security and debugging purposes

6. Your Rights

Regardless of your location, we commit to honoring the following rights:

Right to access: Request a copy of any personal data we hold about you
Right to deletion: Request deletion of your personal data. Raw genetic data is deleted immediately after report generation. Your wellness report is automatically deleted after 21 days. Consent logs are retained for legal compliance and cannot be deleted. Scientific methodology records contain no personal data. To request early deletion of your retained report, contact support@rescriptgenetics.com.
Right to correction: Request correction of inaccurate personal data
Right to object: Object to our processing of your data
Right to data portability: Receive your data in a machine-readable format
Right to withdraw consent: Withdraw consent at any time (this will not affect processing already completed)

To exercise any of these rights, contact us at support@rescriptgenetics.com. We will respond within 30 days.

7. Illinois Residents (GIPA)

If you are an Illinois resident, the Illinois Genetic Information Privacy Act (GIPA) provides you with specific rights regarding your genetic information. By uploading your DNA data, you provide written consent (as required by GIPA) for Rescript Genetics LLC to collect and use your genetic information for the specific purpose of generating your personalized wellness protocol. We will not disclose your genetic information to any employer, insurer, or other entity for any discriminatory purpose. You may withdraw this consent at any time by contacting us at support@rescriptgenetics.com, though withdrawal cannot undo processing already completed.

8. California Residents (CCPA/CPRA)

Notice at Collection (California): At the time of collecting your personal information, we are required to disclose the following: we collect identifiers (name, email, IP address), health characteristics (age, sex, weight), genetic data, wellness goals, and optionally, medications and supplements. This information is used solely to generate your wellness report and create your supplement account on Fullscript. We do not sell your personal information.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

The right to know what personal information is collected about you
The right to know whether your personal information is sold or disclosed and to whom
The right to opt out of the sale of your personal information — we do not sell personal information
The right to non-discrimination for exercising your privacy rights
The right to correct inaccurate personal information
The right to limit use of sensitive personal information — genetic data is classified as sensitive personal information under CPRA

To submit a CCPA/CPRA request, contact us at support@rescriptgenetics.com.

9. Genetic Information Nondiscrimination

The Genetic Information Nondiscrimination Act (GINA) prohibits discrimination based on genetic information in health insurance and employment. We fully support the intent of GINA. We will never share your genetic information with health insurers, life insurers, disability insurers, employers, or any entity that could use it in a discriminatory manner.

10. Data Security

We implement the following technical and organizational measures to protect your data:

All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS)
Genetic data is processed in volatile server memory and never written to permanent disk storage
API keys and credentials are stored as encrypted environment variables, never in code
Access to production systems is restricted to authorized personnel only
We conduct periodic security reviews of our infrastructure

No system is perfectly secure. In the event of a data breach that affects your personal information, we will notify affected users within 72 hours of discovery and take immediate steps to contain and remediate the breach.

11. Children's Privacy

Rescript Genetics is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at support@rescriptgenetics.com and we will delete it.

12. Scope of Service — US Residents Only

Rescript Genetics operates in the United States. This service is currently available to United States residents only. If you are located in the European Union, United Kingdom, or other jurisdiction with specific data protection laws (including GDPR), please do not use this service at this time. We intend to expand availability and compliance to additional jurisdictions in the future.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. For material changes, we will notify users by email if we have your contact information. Your continued use of the service after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related questions, concerns, or requests:

Rescript Genetics LLC
Email: support@rescriptgenetics.com
Website: www.rescriptgenetics.com

We aim to respond to all privacy inquiries within 5 business days.