Version 2026-09, effective 01.09.2026
1. Controller and Data Protection Officer
1.1 The controller within the meaning of Art. 4(7) GDPR for the website www.arcensus-diagnostics.com (“Website”), the platform portal.arcensus-diagnostics.com (“Portal”) and the Arcensus services is Rolfs Consulting und Verwaltungs (RCV) GmbH, Leibnizstrasse 58, 10629 Berlin, Germany; Commercial Register Local Court (Amtsgericht) Charlottenburg, Berlin, HRB 224347 B; VAT ID DE337852332; Managing Director Prof. Dr. med. Arndt Rolfs; e-mail [email protected] (“RCV”, “we”).
1.2 Data Protection Officer: HeyData, reachable at [email protected] or by post at the above address with the addition “Data Protection Officer”.
2. Scope and our role
2.1 This Privacy Policy applies to (a) visitors of the Website and users of the Portal; (b) customers, healthcare professionals, distributors and their staff (business contacts); (c) patients whose samples and data are processed for the Services.
2.2 Where a healthcare professional, laboratory or distributor orders Services for a patient, that organisation is the controller for the patient’s data and RCV acts as processor under a Data Processing Agreement pursuant to Art. 28 GDPR. Where a patient orders Services directly via the Portal, and for website use, accounts, invoicing and marketing, RCV is the controller. Where a patient has given a separate consent for research or commercial secondary use of pseudonymised data, RCV is the controller for that processing.
3. Data we process
3.1 Registration and account data
Name, date of birth, sex, address, e-mail address, telephone number, billing and shipping address, payment data (processed by the payment provider, see section 6), account credentials, order history, communication with support.
3.2 Health and genetic data
Clinical information and symptoms (HPO terms), family history, medication (for pharmacogenomic reports), optional ancestry/ethnic background, sample identifiers, sequencing data (FASTQ/BAM/VCF), variant annotations and the diagnostic report. Before providing information about a family member, please ensure you are entitled to do so.
3.3 Usage data
IP address, date and time of access, pages viewed, referring URL, browser type and version, operating system, device identifiers and cookie identifiers (see section 7).
3.4 Business contact data
Name, function, employer, business contact details and correspondence of healthcare professionals, distributors and suppliers.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
| Providing the Website and Portal, IT security, log files | Usage data | Art. 6(1)(f) GDPR – legitimate interest in a secure and functional service |
| Account creation, order processing, invoicing, customer support | Registration and account data | Art. 6(1)(b) GDPR – performance of a contract |
| Performing genomic analysis and issuing the diagnostic report | Health and genetic data | Art. 9(2)(a) GDPR – explicit consent (Informed Consent); for physician-ordered testing additionally Art. 9(2)(h) GDPR in conjunction with national law (GenDG) |
| Re-analysis included in the product | Genetic and health data | Art. 6(1)(b), Art. 9(2)(a) GDPR |
| Reporting of secondary findings, carrier status, pharmacogenomic findings | Genetic data | Art. 9(2)(a) GDPR – separate optional consent items (B1, B8, B9) |
| Scientific research with pseudonymised data | Pseudonymised genetic and health data | Art. 6(1)(a), Art. 9(2)(a) GDPR – separate optional consent (B2) |
| Commercial secondary use of pseudonymised data (e.g. licensing of de-identified datasets to pharmaceutical companies) | Pseudonymised genetic and health data | Art. 6(1)(a), Art. 9(2)(a) GDPR – separate optional consent (B3) |
| Quality assurance, validation, accreditation audits | Pseudonymised data | Art. 6(1)(c), (f), Art. 9(2)(h), (i) GDPR |
| Newsletter and marketing e-mails | E-mail address, name | Art. 6(1)(a) GDPR – consent; revocable at any time |
| Analytics and marketing cookies | Usage data | Art. 6(1)(a) GDPR and § 25(1) TDDDG – consent via consent manager |
| Business communication with partners | Business contact data | Art. 6(1)(b), (f) GDPR |
| Compliance with statutory retention and reporting duties | All categories as required | Art. 6(1)(c) GDPR |
5. Recipients
5.1 Sequencing partner laboratory: CeGaT GmbH, Paul-Ehrlich-Str. 23, 72076 Tübingen, Germany (accredited under ISO 15189 and CAP), which receives the pseudonymised sample and returns sequencing data. Sample remnants and data at the partner laboratory are destroyed within 30 working days after processing.
5.2 Hosting and IT: Amazon Web Services EMEA SARL, region eu-central-1 (Frankfurt, Germany), under a data processing agreement; bioinformatics pipeline services provided by Bioklar UG (Varklar) under a data processing agreement, processing pseudonymised data only.
5.3 Payment providers (section 6), e-mail and newsletter providers (section 7.6), courier services for collection kits (name, address, tracking data).
5.4 The ordering healthcare professional or distributor, who receives the diagnostic report. Where the patient has ordered directly, the report is provided to the patient via the Portal and, where required by national law, to the physician named by the patient.
5.5 Research and commercial partners: only pseudonymised data, only within the scope of the separate consent (B2/B3), only under written agreements that prohibit re-identification and impose GDPR-equivalent standards.
5.6 Authorities, courts and professional advisers where legally required or necessary to establish, exercise or defend legal claims.
6. Payments
Payments in the Portal are processed by Stripe Payments Europe Ltd., Dublin, Ireland (privacy policy: stripe.com/privacy) and PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg (privacy policy: paypal.com/privacy). RCV does not store full payment card numbers. Business customers are invoiced; bank details are processed for payment reconciliation.
7. Cookies, tracking and communication tools
7.1 Technically necessary cookies (session, login, security, cookie-consent status) are set on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR. All other cookies and tracking technologies are loaded only after consent given in the consent manager. Consent can be revoked at any time via “Cookie settings” in the footer.
7.2 Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland): analysis of website usage with IP anonymisation and data processing agreement. Google may transfer data to Google LLC, USA, on the basis of the EU-US Data Privacy Framework and standard contractual clauses. Retention of user-level data: 14 months.
7.3 Newsletter: sent via Intuit Mailchimp (The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Atlanta, GA 30308, USA) on the basis of the EU-US Data Privacy Framework and standard contractual clauses. Double opt-in; the newsletter contains a tracking pixel to measure opening and click rates. Consent can be revoked via the unsubscribe link in every newsletter or by e-mail to [email protected].
7.4 Social media links (LinkedIn, X, YouTube) are plain links without plugins; no data is transmitted to the platform until the link is clicked. If a platform’s embedded content is displayed on the Website (e.g. YouTube videos), it is loaded only after consent (two-click solution).
8. International transfers
Samples and genetic data are processed exclusively in Germany. Data are transferred to countries outside the European Economic Area only (a) to the ordering healthcare professional or distributor in the patient’s country as recipient of the report; (b) to the service providers named in section 7 on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission with supplementary measures; or (c) with the data subject’s explicit consent. A copy of the applicable safeguards can be requested at [email protected].
9. Storage periods
- Account and registration data: for the duration of the account and thereafter for the statutory retention periods (commercial and tax law: 6 to 10 years).
- Sequencing data and diagnostic reports: for the duration of the account and for at least 10 years after the last report in accordance with medical record-keeping and laboratory accreditation requirements; thereafter deletion, unless the patient has consented to longer storage for research.
- Sample remnants: destroyed at the partner laboratory within 30 working days after processing.
- Pseudonymised research/commercial datasets: for the duration of the consent; withdrawal does not affect studies started before the withdrawal.
- Usage data and log files: 30 days, unless required for security investigations.
- Newsletter data: until revocation of consent.
- Business contact data: for the duration of the business relationship and the statutory retention periods.
10. Security
RCV operates an information security management system and implements technical and organisational measures pursuant to Art. 32 GDPR, including pseudonymisation of samples and sequencing data, encryption in transit (TLS) and at rest (AES-256), role-based access control with multi-factor authentication, logging, regular penetration testing and vulnerability assessments, and contractual obligations of all processors. Reports are made available only via the encrypted Portal. Users are responsible for keeping their credentials confidential and for the consequences of sharing reports or genetic data with third parties.
11. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Consents can be withdrawn at any time with effect for the future (Art. 7(3)); the lawfulness of processing before the withdrawal is not affected. Withdrawal of the consent to genetic analysis before the sample has been analysed stops the analysis; withdrawal after the report has been issued leads to deletion of the data subject to the retention periods in section 9. Requests: [email protected] or the postal address in section 1.1. Identity verification may be required.
You have the right to lodge a complaint with a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, or the authority at your place of residence.
12. Minors
The Website and Portal are not directed at persons under 18. Genetic testing of minors is performed only on the order of a physician, where medically indicated, and with the consent of the legal representative in accordance with the Informed Consent. Minors may access their own genetic data upon reaching the age of majority.
13. Account deletion
Users may request deletion of their account at [email protected]. RCV confirms the request to the registered e-mail address; after confirmation the account is closed and personal data are deleted, subject to (a) statutory retention periods (section 9); (b) pseudonymised data already included in research or commercial datasets under a separate consent, which cannot be removed from completed studies; and (c) data required to establish, exercise or defend legal claims.
14. Changes to this Privacy Policy
RCV may update this Privacy Policy to reflect changes in law, technology or the Services. The current version is published on the Website with its version number and effective date. Registered users are informed of material changes by e-mail.