Privacy Notice

This Privacy Notice explains how Kinsame Technologies Ltd (Kinsame, we, us or our) handles personal information in connection with DNA1.com and the DNAQ image-based kinship indication service (Service). It should be read with the DNA1.com Website EULA and Product Delivery Terms (Terms). The Service is intended for Users and participants in Australia and New Zealand.

1. Who is responsible for the Service and your information

Kinsame Technologies Ltd, company number 516686649, of 6 Ha'Pninna St., Ra'anana, Israel, owns and operates DNA1.com, the underlying technology and the system used to generate the image-based kinship indication report (Report). Kinsame is responsible for the personal information it collects through DNA1.com and for the processing used to provide the Service.

Genomics for Life Pty Ltd ACN 163 460 937, of Unit 1, 11 Parkview Street, Milton QLD 4064, Australia, trading through the DNAQ brand (GFL), is Kinsame's independent authorised distributor. GFL markets the Service, receives payment and supplies or makes available the Token used to access the Service. GFL's handling of information it collects through its own purchase and genetic-testing services is governed by its own privacy notice.

2. What information we collect

Depending on the order and your interactions with us, Kinsame may collect:

• the Token and order reference;
• the User's contact and delivery details, including the email address used to receive the Report;
• relationship and order information supplied for the child and alleged biological parent or parents;
• photographs submitted for each participant;
• image-derived facial features, measurements, representations or embeddings generated from those photographs for the analysis;
• suitability-review notes and information about replacement images;
• participant consent, parental responsibility, guardianship and authority records or evidence;
• the Report and associated confidence information;
• security, access and technical logs, and device/browser information reasonably required to operate and protect the Website; and
• support correspondence, privacy requests, complaints and records needed to respond to them.

3. How we collect information

We collect information directly from the User through DNA1.com when the User redeems a Token, completes declarations, uploads photographs, supplies order details or contacts support. Information about a participant may therefore be submitted by another person, such as a parent, guardian or another adult participant, but only where that person has the authority and consents required by the Terms and applicable law.

The Service also creates new information during processing, including suitability-review notes, image-derived facial features or embeddings, confidence information and the Report.

4. Why we collect and use the information

Kinsame collects, holds, uses and discloses personal information only as reasonably necessary to:

• validate the Token and administer the order;
• verify that photographs are suitable and, where necessary, request replacement photographs or authority information;
• perform the requested image-based facial comparison and generate the Report;
• securely deliver the Report and provide Service support;
• verify and document participant consent, parental responsibility or other lawful authority;
• prevent fraud, covert or non-consensual testing, Token misuse and other prohibited conduct;
• maintain, secure, troubleshoot and audit the Website and Service;
• respond to privacy, access, correction, deletion, security and complaint requests;
• comply with applicable law and lawful requirements; and
• establish, exercise or defend legal claims.

Submitted photographs and image-derived facial data are not used to train or improve a general AI model. Kinsame may improve the security, reliability and operation of the Website using information that does not include submitted photographs or image-derived facial data, or information that has been lawfully de-identified so that it is no longer personal information.

5. Biometric processing, human review and automated analysis

The Service analyses facial resemblance across photographs of a child and the alleged biological parent or parents required by the upload instructions. A human reviewer first checks whether submitted photographs appear suitable. Kinsame's AI-supported technology then compares image-derived facial features and produces a confidence-rated indication of whether a biological parent-child relationship appears plausible.

The output is an image-based kinship indication only. It is not a DNA test, genetic test, medical test or identity-verification service and it does not establish or disprove legal or biological parentage. Facial resemblance is not conclusive and a result may be incorrect or inconclusive.

There is no non-biometric version of the DNA1 Service. A person who does not want to participate in biometric processing should not use the Service or have their photograph submitted. If a definitive or legally recognised result is required, an accredited DNA test is the preferred method and may be available separately from GFL.

6. Consent, authority and children

Before any photograph is uploaded, the User must read the participant information presented by the Website and complete the applicable consent and authority declarations. Each adult participant must freely, specifically and expressly consent to the collection and processing of their photograph and image-derived facial features for the Service. For a participant under 18, consent must be provided by a person with lawful parental responsibility or guardianship, and the child shown in the photographs must be at least four years old.

Kinsame may request reasonable evidence of identity, authority, guardianship or participant consent, particularly where a dispute, withdrawal request or safeguarding concern arises. The Service must not be used for covert, secret or non-consensual testing.

7. Who may receive or access information

Access is restricted to people and organisations that reasonably need the information for the purposes described in this Notice. These may include:

• authorised Kinsame personnel involved in suitability review, technical operation, information security, customer support, privacy and complaint handling, or legal compliance;
• approved service providers that host, secure, transmit, back up or otherwise process information on Kinsame's behalf, subject to appropriate confidentiality, security and privacy safeguards;
• GFL, but ordinarily only for the Token, order-fulfilment status and information reasonably necessary for customer support, purchase administration or legal compliance; GFL will not ordinarily receive photographs, image-derived facial data or the Report unless the participant authorises that disclosure or it is required by law or reasonably necessary to resolve a specific complaint;
• professional advisers, insurers, auditors, regulators, courts or public authorities where reasonably necessary and lawful; and
• another person where the relevant participant has authorised the disclosure or the disclosure is otherwise required or permitted by applicable law.

We do not sell participant photographs, image-derived facial data or Reports.

8. Australian hosting and access from Israel or other countries

The Website, servers and primary infrastructure used for the Service are physically located in Australia. For a New Zealand participant, this means their information is transferred to and stored in Australia.

Kinsame is headquartered in Israel. Authorised Kinsame personnel may remotely access Australian-hosted information from Israel only where reasonably necessary to conduct or support the suitability review and analysis, maintain or secure the Service, provide technical or customer support, handle a complaint or privacy request, or comply with law. This remote access does not change the primary Australian storage location.

Kinsame applies controls appropriate to the sensitivity of biometric information, including role-based and least-privilege access, confidentiality obligations, personnel training, access logging, secure encrypted connections and controls designed to prevent unnecessary local downloading, copying or onward disclosure.

If Kinsame discloses personal information to a separate overseas recipient or permits an overseas service provider to access it, Kinsame will limit the information and access to what is reasonably necessary and will use contractual, technical and organisational safeguards designed to ensure appropriate protection. Where Australian Privacy Principle 8 applies, Kinsame will take reasonable steps in the circumstances to ensure the overseas recipient does not breach the applicable Australian Privacy Principles. Where New Zealand IPP 12 or rule 12 of the Biometric Processing Privacy Code 2025 applies, Kinsame will use a permitted transfer basis and safeguards intended to provide comparable protection.

Known overseas Kinsame personnel access is from Israel. If additional overseas recipients or access locations become likely and it is practicable to identify them, Kinsame will update this Notice or otherwise notify affected individuals as required. Information accessed or held overseas may also be subject to lawful requests under the laws applicable in that jurisdiction; Kinsame will assess such requests and disclose information only where legally required or otherwise lawfully permitted.

9. How we protect information

Kinsame uses technical and organisational measures appropriate to the sensitivity of the information, including access restriction, encryption in transit, logging, personnel controls, incident-management procedures and secure deletion. Where appropriate, Kinsame also uses authentication controls, restricted administrative privileges and monitoring designed to detect unauthorised access or misuse.

No internet, cloud or email system can be guaranteed to be completely secure. Users should keep Tokens, delivery email accounts, download links and Reports confidential and should contact support promptly if unauthorised access, loss, disclosure or misuse is suspected.

10. Retention and deletion

Raw photographs, image-derived facial features or embeddings, working files and the Report are retained only for the period reasonably required to provide and support the single order and, in any event, for no longer than four months after delivery of the Report, unless a shorter period is required by law or the information is reasonably required to address a complaint, security incident or legal claim.

Kinsame may delete those materials earlier upon a valid request where deletion is legally required and reasonably practicable. Deletion from backup systems may occur through the ordinary secure backup cycle, during which the information will remain restricted from ordinary use.

Limited Token, transaction, consent, authority, security, complaint, deletion and legal-compliance records may be retained for longer where reasonably necessary or required by applicable law. Those longer-term records will not include photographs or image-derived facial data unless retention of those materials is specifically necessary and lawful.

11. Access, correction, withdrawal and deletion requests

Subject to applicable law, a participant may ask Kinsame to confirm whether it holds their personal information, request access to that information, and request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. Kinsame may need to verify identity and authority before acting on a request, particularly where a request concerns a child or another participant.

A participant may withdraw consent before analysis is completed by contacting support immediately. Kinsame will stop further processing and delete affected information where required and reasonably practicable. Withdrawal does not invalidate processing already lawfully completed and does not require deletion of records that must lawfully be retained, including records reasonably necessary for a complaint, security incident or legal claim.

Where applicable law provides a right to deletion or another privacy remedy, Kinsame will assess and respond to the request in accordance with that law. Some information cannot be corrected in the ordinary sense because it records an event, a completed analysis or a system-generated output; in those cases Kinsame may attach or record a correction statement where appropriate and required.

12. Privacy and security incidents

Kinsame maintains processes to investigate suspected loss, unauthorised access, use, modification or disclosure of personal information. Where an incident is likely to require notification under applicable law, Kinsame will make the required notification and take reasonable remedial steps. Kinsame may coordinate with GFL where the incident affects the purchase or customer-support process.

13. Complaints

Privacy or security enquiries and complaints should be sent to support@dna1.com. Please include enough information to identify the relevant order and explain the concern, but do not send participant photographs through ordinary email unless Kinsame specifically requests a secure method.

Kinsame will acknowledge a complaint promptly and aims to provide a substantive response within 30 days. If more time is reasonably required, Kinsame will explain why and provide an update.

If an Australian privacy complaint remains unresolved, an individual may be able to complain to the Office of the Australian Information Commissioner (OAIC). If a New Zealand privacy complaint remains unresolved, an individual may be able to complain to the Office of the Privacy Commissioner of New Zealand. Nothing in this Notice limits any right to approach a regulator, court or tribunal where applicable law permits it.

14. Australia and New Zealand privacy frameworks

For Australian participants, Kinsame will handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles to the extent they apply to Kinsame and the relevant processing. This Notice is intended to provide transparent information about the kinds of personal information handled, the purposes of handling, access and correction, complaints and likely overseas access or disclosure.

For New Zealand participants, Kinsame will handle biometric information in accordance with the Privacy Act 2020 and the Biometric Processing Privacy Code 2025 to the extent they apply, including requirements concerning necessity and proportionality, transparency, fairness, security, accuracy, retention, use, disclosure, access, correction and overseas transfer.

15. Changes to this Privacy Notice

Kinsame may update this Notice to reflect changes to the Service, information-handling practices or applicable law. The current version will be published at https://dna1.com/privacy. A material change affecting an accepted order will not be applied in a way that unlawfully reduces a participant's rights or changes the agreed purpose of biometric processing without any consent or notice required by law.

16. Contact details

← Back to the test