Privacy and your data at Kantesti

What we keep, for how long, and how to use your rights.

Last reviewed:

A lab report with a small shield on its corner and a small key beside it, inside a glass card
Your reports are protected, and you can ask what we keep

What this page is

This page explains in plain language how Kantesti handles your personal data. The binding text is our Privacy Policy. If the two ever differ, the Privacy Policy applies.

Kantesti Ltd is responsible for your personal data (the controller).

What we collect and why

Kantesti helps you understand your lab results online with an informational report, not a diagnosis. To provide the service, we work with:

  • your account details, such as your email address;
  • the lab report you upload as a PDF, JPG or PNG file, including any personal details printed on it;
  • details you add yourself, such as your age or the language you want for your report;
  • the report we create for you, and its audio summary if you use Kantesti Voice;
  • if you use a DNA report, the report created from your DNA file;
  • if you use the Supplement Advisor, your answers to its short questionnaire;
  • if you use the family history tool, the health information you enter about your relatives;
  • if you buy a premium report, the details needed to complete the purchase.

We use this data to provide the service you ask for, for example to create and deliver your report.

The Privacy Policy gives the full list, including technical data and cookies.

Upload only your own lab report, or the lab report of a child in your care as their parent or legal guardian.

You must be at least 18 years old to use Kantesti on your own.

A lab report whose results table glows, with small badges for language and audio next to it, while the personal header area is faded
Your results are what the report is built from

How long we keep it

  • On the free plan, uploaded lab report files are deleted after 90 days at the latest.
  • On a paid plan, uploaded lab report files are kept while your subscription is active and are deleted within 90 days after it ends.
  • Your Kantesti reports are kept for the same periods as your uploaded files, unless you ask us to delete them earlier.
A timeline with four steps: a document is uploaded, becomes a report, is kept in a tray, and then dissolves into dots
  1. Upload
  2. Report created
  3. Kept
  4. Deleted
From upload to deletion

Audio summaries and DNA files

  • The audio summary from Kantesti Voice plays only inside your web report and is not offered as a download. It is deleted on a fixed schedule, or when you delete the report.
  • If you use a DNA report, the raw DNA file is not stored.
A report card with a play button and sound wave, locked with a padlock, with a schedule clock beside it
Your audio summary stays inside your report

Your rights

If the GDPR or the UK GDPR applies to you, you have the right to:

  • get a copy of your personal data (access);
  • have wrong data corrected (rectification);
  • have your data deleted (erasure);
  • limit how we use your data (restriction);
  • receive your data in a common format, or have it sent to another service (portability);
  • object to certain uses of your data (objection);
  • not be subject to a decision based only on automated processing that has legal or similarly significant effects on you;
  • where we rely on your consent, withdraw it at any time.

Some rights have legal limits. The Privacy Policy explains them.

Eight tiles with symbols: an eye, a pencil, a bin, a pause sign, a box with an outgoing arrow, a raised hand, a gear with a slash and a form with a returning arrow
  1. Access
  2. Rectification
  3. Erasure
  4. Restriction
  5. Portability
  6. Objection
  7. No solely automated decisions
  8. Withdraw consent
Your rights under data protection law

How to get a copy or ask for deletion

  1. For any privacy request, email .

  2. Write from the email address you use with Kantesti, and say which right you want to use. Name the report by its date, not by its medical content.
  3. We may ask you to confirm your identity first. This protects your data from people who pretend to be you.

Where the GDPR or the UK GDPR applies, we must reply within one month. In complex cases this can be extended by up to two more months, and you will be told why.

Please do not attach lab reports or other health details to your email. If we need more information to find your data, we will ask you.

An envelope with a check mark linked by a dotted path to a report that dissolves into dots, with a calendar beside it
One email is enough to start a deletion request

Contacts and supervision

  • You can complain to a data protection authority. In the UK, this is the ICO. In the European Union and the European Economic Area, it is the authority where you live or work, or where you think the problem happened. You can also contact us first if you wish; we would be glad to help.
An envelope with a shield joined by a dotted path to a simple building with a shield on its front
You can contact us or a data protection authority