Privacy Policy

Who We Are

Tandava Wellness (“Tandava”, “we”, “us”) sells at-home DNA lifestyle kits and lifestyle design programs through tandavawellness.com. For the purposes of the UK and EU GDPR, we are the data controller for the information described on this page.

Contact details for privacy enquiries are being finalised and will be published here shortly.

What We Collect

Only what the service actually needs. We do not buy personal data from brokers, and we do not build profiles on people who have not bought from us.

Identity and contact	Your name, email address, postal address and phone number — so we can ship your kit, give you portal access, and reach you about your order.
Order and payment	What you bought, when, the amount, and the last four digits and card type. We never see or store your full card number — payments are taken by Stripe on their own pages.
Your sample and genetic results	The cheek swab you mail back, and the genetic markers our laboratory partner reads from it. See Your DNA, Specifically.
Lifestyle intake	Your answers about sleep, diet, movement, energy, stress and health history. This is what makes a result about you rather than about a genome.
Program records	If you add the Lifestyle Redesign: your Playbook, plan, session notes and check-in messages with your practitioner.
Site usage	Pages viewed, how you arrived, approximate location from your IP address, and device and browser type. Collected only if you accept statistics cookies — see Cookies And Tracking.
Messages you send us	Emails, form submissions and booking requests, plus whatever you choose to tell us in them.

Your DNA, Specifically

Genetic data is special category data under GDPR and sensitive personal information under US state privacy laws. We treat it that way.

• We only read a focused lifestyle panel. It is not a whole genome sequence and not an ancestry test.
• Your sample is processed solely to generate your results. It is not used for research, not pooled into datasets, and not kept as a biological specimen beyond what the laboratory needs to run and verify your panel.
• We will never sell, rent or trade it. Not to insurers, not to employers, not to advertisers, not to pharmaceutical companies, not to anyone. Our business model is selling you a service, not monetising your genome.
• We will not hand it over without a fight. We disclose it to law enforcement only where we are legally compelled, and we will tell you unless we are legally barred from doing so.
• You can take it with you, and you can have it erased. Your raw file is yours to download, and you can ask us to delete your genetic data at any time — see Your Rights.

We rely on your explicit consent to process genetic data, which you give when you order a kit and register your sample. You can withdraw it at any time. Withdrawing it means we can no longer provide results or a program, but it does not affect anything we lawfully did beforehand.

Why We Use It

• To deliver what you bought — shipping your kit, running your panel, building your report, giving you portal access, and running your program if you added one. Legal basis: performance of a contract; explicit consent for genetic data.
• To take payment and keep our books — including tax and accounting records. Legal basis: contract and legal obligation.
• To support you — answering your questions and fixing problems. Legal basis: contract and legitimate interests.
• To understand how the site is used — which pages work, where visitors come from, what breaks. Legal basis: consent.
• To market to you — emails you asked for, and advertising measurement. Legal basis: consent, which you can withdraw at any time.
• To keep the service safe and lawful — preventing fraud and abuse, and meeting our legal obligations. Legal basis: legitimate interests and legal obligation.

We do not make decisions about you by automated means alone that would have a legal or similarly significant effect on you. Your report is generated from your data, but the lifestyle guidance in a Redesign is written by a human practitioner.

Who We Share It With

We share personal data with service providers who need it to do a job for us, under contracts that bind them to use it only for that job. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Our laboratory partner	Processes your sample and returns your genetic results. Accredited, US-based, and contractually limited to generating your results.
Stripe	Takes payment and handles refunds. Stripe is the controller of your payment card data under its own privacy policy.
Our client portal	Hosts your account, your report, your program materials and your messages with your practitioner.
Cookiebot (Usercentrics)	Records and stores your cookie choices, so we can prove what you consented to and when.
Google Analytics	Site usage statistics. Loaded only after you accept statistics cookies.
Calendly	Books consultations. Takes the name, email and any details you enter on its booking page.
Email and CRM provider	Sends order updates and, if you opted in, marketing email.
Shipping carriers	Your name and address, to get the kit to you and the sample back.
Advertising platforms	Where you accept marketing cookies, we may share a pseudonymous identifier to measure which ads led to a purchase. Never your genetic data, your intake answers or your health information.

We may also disclose personal data where we are legally required to, to protect our rights or someone’s safety, or to a buyer if the business is sold — in which case this policy continues to apply until you are told otherwise.

Cookies And Tracking

When you first arrive, a banner asks what you are willing to allow. Nothing beyond what is strictly necessary to run the site is loaded until you choose — if you decline, analytics and advertising scripts are never downloaded at all, not merely switched off.

You can change your mind whenever you like, and the banner will come back:

The Four Categories

• Necessary — security, load balancing and remembering your cookie choice. These cannot be switched off.
• Preferences — remembering settings like your region or chosen options.
• Statistics — how the site is used, in aggregate. This is what loads Google Analytics.
• Marketing — measuring and targeting advertising.

Every Cookie We Set

This list is generated by an automated scan of the site and updates itself, so it does not go stale between policy revisions:

Do Not Track And Global Privacy Control

We honour the Global Privacy Control signal where your browser sends one, treating it as an opt-out of sale and of targeted advertising. There is no agreed standard for Do Not Track headers, so we do not respond to those separately — use the banner instead.

How Long We Keep It

• Your account, report and program materials — for as long as you have an account, so you keep access to what you paid for. Delete your account and we delete these.
• Your genetic results — the same, and we will delete them sooner on request.
• Your physical sample — destroyed by the laboratory after your panel is run and verified.
• Order and payment records — seven years, because tax law requires it. This is the one thing we cannot delete early.
• Cookie consent records — twelve months, as evidence of what you chose.
• Analytics data — fourteen months, then automatically deleted.
• Support emails — three years.

Your Rights

Wherever you live, you can ask us to:

• Show you what we hold about you.
• Give you a copy in a portable format, including your raw genetic file.
• Correct anything that is wrong.
• Delete it, subject only to records we are legally required to keep.
• Restrict or object to a particular use, including any processing based on legitimate interests.
• Withdraw consent — for cookies, for marketing, or for processing your genetic data.
• Opt out of sale, sharing, targeted advertising and profiling. We do not sell or share personal information, so there is nothing to opt out of, but the right stands.
• Not be treated worse for exercising any of this.

We respond to requests within 30 days. We may need to verify who you are first — for genetic data we will be careful about this, which is in your interest. An authorised agent may act for you with written permission.

If you are in the EEA or the UK and you think we have got this wrong, you can complain to your national data protection authority. We would rather you came to us first so we can fix it.

How We Protect It

Our platform is independently audited: HIPAA third-party validated, SOC 2 Type II attested and GDPR compliance audited. Sensitive records are encrypted at rest with AES-256, and everything in transit moves over TLS 1.3. Access to genetic data and program records is limited to the people who need it to serve you, and it is logged.

No system is perfect. If a breach ever affects your personal data, we will tell you and the relevant regulator within the time the law requires.

International Transfers

We are based in the United States and our laboratory partner is US-based, so if you order from outside the US your data will be transferred there. Where we move personal data out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum, and we assess each provider before using it. Ask us and we will tell you which safeguard applies to a particular transfer.

Children

Tandava Wellness is for adults. We do not knowingly collect personal data from anyone under 18, and we do not test minors. If you believe a child has given us data, email us and we will delete it.

Changes

When we change this policy we update the date at the top. If a change materially affects how we handle your data, we will email you about it before it takes effect rather than quietly reposting the page.

Contact Us

Contact details for questions, requests and complaints will be published here shortly.

Tandava Wellness reads lifestyle tendencies. Nothing here, and nothing in your results, is a medical diagnosis.