Promethease Privacy Policy (last update: April 15 2025)

MyHeritage

MyHeritage Ltd. (https://www.myheritage.com) (“MyHeritage”) has acquired Promethease. See blog post from September 2019.

By using the Promethease service, you acknowledge that Promethease is owned by MyHeritage and any information you provide to Promethease is governed by this Privacy Policy and also by the MyHeritage Terms and Conditions and Privacy Policy (together, the “MyHeritage Terms") (in case of any contradiction between this Privacy Policy and the MyHeritage Terms, the latter shall prevail).

You are able to delete your accounts permanently from Promethease and/or MyHeritage, at any time. Deleting one account (e.g. from Promethease or from MyHeritage), will not automatically delete the other account. If you don’t need any of those accounts, you need to delete each account separately.

This privacy policy governs how MyHeritage may process or use your personal data. You can contact us at privacy@myheritage.com if you have any questions or concerns regarding your privacy on Promethease.

Promethease

Promethease (the “Website”) is a literature retrieval system that creates a personal report (a “Report”) based on a raw DNA data file (“DNA Data File”) uploaded by the user, using the scientific and medical literature cited in SNPedia, our online genomic analysis wiki that is investigating human genetics (“SNPedia”). Promethease is a platform for genetic analysis, that allows its users to: (i) upload DNA Data Files generated by different DNA testing service providers; (ii) create a private account; and (iii) generate a one-time Report that will be emailed to the user's account email address. DNA Data Files and Reports are deleted immediately from Promethease after the Report is sent to the email address that the user provided.

Promethease is a service for a personal, private and informational use only and may not be used in connection with any clinical purpose and/or commercial or research endeavors. Illegal and/or unauthorized use of Promethease is prohibited.

Your privacy is important to us. We want to do it right. The system was designed to maximize your privacy.

By using Promethease and uploading a DNA Data File, you consent to the collection and use by us of your DNA Data File in accordance with this Privacy Policy.

WHAT PERSONAL DATA WILL WE COLLECT AND PROCESS?

If you upload a DNA Data File and create an account, your DNA Data File and your email address, full name, gender, country of residence and age will be processed by us.

If you make a payment to use Promethease, we use the Stripe service for billing and therefore we do not store your credit card information on Promethease; it is stored by Stripe and we do not have access to it.

Reports generated by Promethease are based on SNPedia. When you look at SNPedia with your web browser, the pages you’ve requested are part of the SNPedia web server logs. This makes it possible to match a set of genotypes to a given IP address. Since most users will eventually click through from their Promethease report into SNPedia, and use their web browser to look at the full details of some of their genotypes, this too may leak information about a user’s genotypes and IP address into server logs.

STORAGE OF PERSONAL INFORMATION

DNA Data Files and Reports: DNA Data Files uploaded to Promethease are used solely for generating your personal one-time Report. You are required to create a password protected account with your email address and personal information. Once your Report is generated and emailed to you as an attachment, your DNA Data File and the generated Report are immediately and permanently deleted from our servers. Promethease does not store DNA Data Files or Reports after this process is completed, and therefore, you will not be able to regenerate or retrieve your Report or retrieve your DNA Data File again in the future. Please ensure you securely store your emailed Report.

If you upload a DNA Data File but you do not continue and generate a Report, the DNA Data File is automatically deleted after 24 hours. As soon as a Report has been generated (typically 10 minutes) the uploaded DNA Data File is deleted.

Note: All previously stored DNA Data Files were permanently deleted from our servers on April 8, 2025. Promethease no longer offers storage of DNA Data Files.

Account information: We retain your account information for as long as you have an account with Promethease.

RIGHTS; LICENSE

We do not claim any ownership rights in your DNA Data File and genome and it belongs to you only.

By uploading your DNA Data File, you grant us a temporary, limited, revocable, royalty-free, world-wide license to process and use your DNA Data File for the purpose of providing you with the service. i.e., for generating your personal Report. Your DNA Data File is immediately deleted once the Report is emailed to you.

By uploading DNA Data Files to Promethease, you acknowledge that you acquire no rights in any research or commercial products that may be developed by us (whether or not they relate to the said DNA Data Files).

WHAT ARE THE PURPOSES OF USING YOUR PERSONAL DATA?

i)               To provide you with the service.

ii)              To communicate with you. We may communicate with you for the purpose of informing you of changes or additions to the service or of any of our products and services or to seek feedback from you on the service.

iii)             For internal business purposes. To improve Promethease or to develop new products and services, we may use personal data you provided or that we collected during the use of the services for internal data analysis.

iv)             In case of legal necessity: We may process your personal information to comply with legal obligations, such as accommodating individual rights requests, or when required of us by law, or to defend our legal interests.

SECURITY

When you provide us with any personal data, that personal data may be transferred to and stored by us in our secure data centers which may provide a different level of protection for personal data than in your country of residence. By providing us with personal data, you specifically consent to the transfer and processing of personal data and its storage in our data centers. By using services, you consent to have your personal data transferred to and processed in the United States and you acknowledge that your personal data may be used as described herein.

All traffic is encrypted via https, and we take industry standard security measures to ensure the privacy protection of the personal data provided by you. We have implemented commercially reasonable security measures in place to attempt to protect users' data under our control. However, we cannot guarantee unauthorized use. You acknowledge that you provide your personal data at your own risk.

You hereby acknowledge and agree that: (1) we will email you the Report to the email you provided, we are not responsible for the security and integrity of the mailing services; (2) storing your Reports on your personal device will create a copy that is not protected by our security and privacy settings; (3) such storage of your Reports shall all be made at your own risk; and (4) we shall not have any control over the Reports and shall not be liable to you or to any third party in connection with any such storage. After emailing the Report to you, Promethease deletes all copies of your DNA Data Files and Reports from its servers.

WILL WE DISCLOSE ANY OF YOUR PERSONAL DATA TO THIRD PARTIES?

We will never sell or license your DNA information to insurance companies under any circumstances. Your personal data (including the DNA Data Files and/or the Reports) will never be sold, licensed or otherwise shared by us with any other third parties without your explicit informed consent, except in the very specific scenarios described below:

1.    To third parties providing services on our behalf, like processing payments from you by Stripe or storing data on the Amazon cloud. The use of the personal data by such third parties is limited in scope and subject to contractual protections. Such parties are prohibited from using it for any other purposes other than providing us or you with the required services. With respect to processors outside Europe, we attempt to ensure adequate safeguards for your personal data, as required by applicable law.

2.    In business transfers. In the event that MyHeritage, or substantially all of its assets or stock, are acquired, transferred, disposed of (in whole or part and including in connection with any merger, bankruptcy or similar proceedings), personal information including DNA Data Files will be one of the transferred assets. In such an event, your personal information would remain subject to the promises made in the pre-existing Privacy Policy prior to the event.

EMAILS

We may send to you the following types of emails:

i)               Transactional emails. Emails that are sent following a purchase of a Report. For example, if you make a payment, you will receive an email with a confirmation that your payment was received, or the charge has failed.

ii)              Results emails. Emails that deliver your generated Report as an attachment.

You cannot unsubscribe from transactional and notification emails, and by providing your email address you give your consent to receive such emails as necessary.

iii)             Announcement emails. Emails concerning the service that announce new features, promotions and offers. 

LEGAL GROUNDS FOR PROCESSING

Under EU data protection law, all processing of personal information is justified by a "condition" for processing. In the majority of cases, any processing will be justified on the basis that:

1.    As is necessary for the performance of a contract with you, in this case, your usage of our services;

2.    As is necessary for our legitimate commercial interests subject to your interests and fundamental rights (e.g. analytics which we carry out of your use of the service)

3.    The processing is necessary for us to comply with a relevant legal obligation.

In addition, the processing of "special category data" is only permitted where a relevant exemption exists. Special category data includes genetic information. The special category data is processed on the basis of your explicit consent. Where the basis of processing is your consent, you have the right to withdraw your consent, and therefore prevent that processing, at any time.

CHILDREN

If you are a child under the age of 18, you must not use our service. We will not knowingly contact or engage with children under the age of 18. If you have reason to believe that a child has provided us with their personal information, please contact us at the address given above and we will endeavor to delete that personal information from our databases.

MODIFICATIONS

Your use of Promethease constitutes your agreement to follow and be bound by this Privacy Policy. We reserve the right to update or modify this Privacy Policy at any time. For this reason, we encourage you to review this Privacy Policy whenever you use the service.

If we decide to modify our Privacy Policy, we will issue an updated version of this Privacy Policy with an updated date legend (and notify you via email or by other appropriate means if the changes are material) so that you will be aware of what information we collect, how we use it and under what circumstances we disclose it in accordance with applicable law. If you do not consent to the Privacy Policy or to any changes thereto and as a result you would like us not to use or hold your information in accordance with the revised terms, you may delete your account.

Whenever this Privacy Policy is modified in substance, the label "updated" will be displayed prominently next to the "Privacy Policy" link in the footer of the Website pages. The "updated" label will be removed after 30 days.

Use of the Website following any changes constitutes your acceptance of the revised Privacy Policy then in effect. 

YOUR RIGHTS UNDER THE GDPR

You have the right to request access to your personal data that we process, and further have such personal data rectified or erased. 

If you feel like your data protection rights under the GDPR have been violated, you may lodge a complaint at the supervisory authority in the Member State in which you reside, or alternatively with the ICO.

US PRIVACY RIGHTS

Based on the applicable data protection laws in the state of your residence, you may have certain data subject rights. These rights vary, but they may include the following rights, which may be subject to certain exemptions:

• Right to Know: the right to confirm whether or not we are processing your personal information and to know what personal information we process about you;
• Right to Access: the right to a portable (where technically feasible) copy of the personal information we process about you;
• Right to Delete: the right to request deletion of the personal information that we process about you and to have such information deleted or its processing restricted, subject to certain exceptions; and
• Right to Correct: to ask that we correct inaccuracies in your personal information, taking into account the nature of personal data and purposes of processing such information.

Additionally, California residents have the right to request certain information about our practices with respect to their personal information. In particular, you have the right to request that we disclose any or all of the following information to you about our processing of your personal information:

• Specific pieces of your personal information that we've collected
• The categories of personal information we have collected
• The sources from which we collected personal information
• The business or commercial purposes for which we collected personal information
• The categories of third parties with which we disclosed personal information
• The categories of personal information that we've disclosed to third parties for business purposes

California residents are entitled to ask us for a notice describing what categories of personal customer information we share with third parties or corporate affiliates for those third parties or corporate affiliates' direct marketing purposes. We do not share your personal information with third parties or corporate affiliates for their direct marketing purposes.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

Any request should be in writing and addressed to us by email at promeathease@myheritage.com. We will make every effort to resolve all requests that we receive. However, if you are dissatisfied with our response to a request, you may have the right to appeal or lodge a complaint.

If you do not agree to this Privacy Policy, please do not use the service.