Law Enforcement & Government Agency Disclosure Policy

Last Updated: April 1st, 2026, effective April 15th, 2026

‍

1. Purpose and Scope

This Law Enforcement & Government Agency Disclosure Policy (“Policy”) governs how Genomelink, Inc. (“Genomelink,” “we,” “us,” or “our”) responds to requests for consumer genetic data made by law enforcement agencies, government agencies, regulatory bodies, and other governmental actors.

This Policy is established pursuant to the Maryland Genetic Information Privacy Act (Md. Code, Com. Law § 14-4405(a)), which mandates that direct-to-consumer genetic testing companies establish documented legal policies and processes for disclosing genetic data to law enforcement or another government agency without a consumer’s express written consent. This Policy also reflects industry best practices as articulated by the Future of Privacy Forum (FPF) and the practices of leading consumer genetic testing companies.

This Policy applies to:

• All forms of consumer genetic data held by Genomelink, including raw sequence data, genotypic and phenotypic information, inferences derived from genetic data, DNA Match data (including shared DNA segments, match lists, and relationship predictions), and associated account information;
• All requests for such data originating from law enforcement agencies, government agencies, courts, and any other governmental or quasi-governmental authority, whether domestic or foreign; and
• All Genomelink employees, contractors, and service providers who may receive or handle such requests.

This Policy governs Genomelink’s response to involuntary law enforcement requests — that is, situations where a government agency seeks access to consumer genetic data without the consumer’s advance consent, typically through a court order, subpoena, or search warrant. This is distinct from, and should be read alongside, Genomelink’s consent-based data sharing practices described in the Privacy Policy.

This document focuses on the involuntary law enforcement disclosure framework. For a complete picture of how Genomelink handles genetic data, including consent-based third-party transfers and research sharing, please refer to the Genomelink Privacy Policy. In the event of any conflict between this Policy and the Privacy Policy on matters of law enforcement disclosure, this Policy controls. Additionally, the Genomelink Terms of Use (Section 19) explicitly prohibit law enforcement agencies, their employees, and their contractors from using the Services for law enforcement purposes, investigative genetic genealogy, surveillance, or any form of criminal investigation. The Terms of Use (Section 21) also set forth detailed DNA Match Feature Terms, including prohibited uses, anti-harassment provisions, and data deletion procedures that apply in conjunction with this Policy.

‍

2. Genomelink’s Core Commitment

Genomelink is fundamentally committed to protecting the privacy and security of our users’ genetic data. Genetic information is among the most sensitive categories of personal data — it is permanent, uniquely identifying, and can reveal intimate details about health, ancestry, family relationships, and biological relatives who have never interacted with Genomelink.

Our Foundational Position on Involuntary LE Requests

Genomelink will NOT voluntarily disclose consumer genetic data to law enforcement or government agencies without a consumer’s explicit written consent.

We will scrutinize all requests, require valid legal process, challenge overbroad or legally deficient demands, notify affected users wherever legally permissible, and produce only the minimum data necessary to comply with valid legal obligations.

‍

3. What Genomelink Will and Will Not Do

3.1 We will NOT

• Voluntarily provide genetic data or account information to law enforcement or government agencies without a valid legal demand;
• Add consumer genetic data to any public law enforcement database or investigative genetic genealogy database without the consumer’s separate express consent (see Section 4 for the DNAsolves opt-in program);
• Comply with informal requests, phone calls, or letters that do not constitute legally valid process;
• Disclose genetic data to foreign governments or international agencies without a valid legal order recognized under U.S. law; or
• Transfer Maryland residents’ genetic data to DNAsolves or any other forensic genealogy database, under any circumstances.

3.2 We will ONLY disclose under the following conditions

• A valid court order, judicially-issued search warrant, or subpoena that meets all applicable legal requirements under federal and Maryland law; For Genetic Information (as defined in the Privacy Policy), Genomelink requires a valid search warrant specifically authorizing the collection of genetic data. For non-genetic personal information (such as name, email address, or IP address), Genomelink may comply with a valid court order or subpoena. This tiered approach reflects the heightened sensitivity of genetic data relative to other categories of personal information;
• A valid legal demand from a federal agency accompanied by appropriate legal authorization;
• When explicitly required by an applicable statute or regulation, and only to the extent legally required; or
• With the express written consent of the consumer whose data is being requested.

Maryland-Specific Prohibition (§14-4405(d))

Under Md. Code, Com. Law § 14-4405(d), Genomelink will NOT disclose consumer genetic data — even under legal process — to:

• Any entity offering health insurance, life insurance, disability insurance, or long-term care insurance; or
• Any employer of the consumer.

This prohibition applies regardless of the form of legal process presented. In addition, as stated in the Genomelink Privacy Policy, Genomelink maintains an absolute, company-wide prohibition on disclosing Genetic Information to any insurance company, employer, or entity that uses data for insurance underwriting, employment decisions, or risk assessment purposes. This prohibition applies to all users regardless of state of residence and regardless of whether the user provides consent. This company-wide policy exceeds the requirements of Maryland law and aligns with the protections of the Genetic Information Nondiscrimination Act (GINA), Indiana HB 1521, and other state genetic privacy statutes.

‍

4. The DNAsolves Opt-In Program

While Genomelink’s default position is to protect user data from involuntary law enforcement access, we also recognize that some users may wish to voluntarily contribute their genetic data to help solve crimes and identify missing persons. For those users, Genomelink offers an optional program through which they may contribute their genetic data to DNAsolves, a forensic genealogy database operated by Othram, Inc. DNAsolves is specifically designed to assist law enforcement with investigative genetic genealogy — identifying suspects or unidentified remains in criminal investigations by matching crime-scene DNA against a database of voluntarily contributed profiles.

Participation in the DNAsolves program is categorically different from the involuntary law enforcement disclosures governed by this Policy. Key distinctions:

• Trigger: User actively opts in; no law enforcement contact with Genomelink
• Consent: Separate, express written consent required before enrollment
• Genomelink’s role: Data transfer to Othram/DNAsolves database upon opt-in
• Consumer control: User may opt out and request data deletion from DNAsolves at any time
• Governing framework: §14-4404 (consent-based third-party transfer); Privacy Policy

DNAsolves Program — Key Facts for Consumers

What it is: A forensic genealogy database operated by Othram, Inc., used exclusively to assist law enforcement in identifying suspects and unidentified human remains.

How enrollment works: Participation is opt-in only. Genomelink obtains separate express written consent before transferring any user’s genetic data to DNAsolves. Enrollment is never triggered automatically or as a default.

What happens to your data: Once transferred, your genetic data resides in the DNAsolves database. Law enforcement may access the database to search for genetic relatives of crime-scene DNA profiles. You will not receive personal genealogy results from DNAsolves — the database is designed exclusively for forensic use.

How to opt out: You may withdraw from the DNAsolves program at any time by submitting a deletion request at https://privacy.genomelink.io/privacy-request. Upon withdrawal, Genomelink will request deletion of your data from the DNAsolves database and will cease any future transfers.

4.1 Maryland Residents — DNAsolves Program Unavailable

Effective April 1, 2026, the DNAsolves opt-in program is not available to Maryland residents. This restriction reflects Genomelink’s assessment of Maryland’s genetic data privacy framework, including:

• The Maryland Online Data Privacy Act (MODPA), which restricts the processing and transfer of sensitive data — including genetic data — to what is strictly necessary to provide the requested product or service, and flatly prohibits the sale of sensitive personal data regardless of consent;
• The Maryland Genetic Information Privacy Act’s (§14-4403) requirement to provide consumers with clear and complete information regarding all data disclosure practices; and
• The heightened scrutiny applicable to genetic data transfers that have a direct law enforcement purpose.

For Maryland Residents

The DNAsolves opt-in program is not available to you. Genomelink will not transfer Maryland residents’ genetic data to DNAsolves or any other law enforcement genealogy database, with or without consent.

If you previously enrolled in the DNAsolves program before April 1, 2026: Genomelink has withdrawn your data from the DNAsolves database and submitted a deletion request to Othram as of that date. You do not need to take any action. If you wish to verify the status of your data deletion, you may submit a request at https://privacy.genomelink.io/privacy-request. If you have questions, contact info@genomelink.io.

This restriction applies in addition to, and does not limit, your rights under the Maryland Genetic Information Privacy Act and the Maryland Online Data Privacy Act.

‍

5. Process for Handling Law Enforcement Requests

5.1 Receipt and Initial Review

All law enforcement and government agency requests for consumer data must be submitted in writing. Verbal requests, informal inquiries, or requests submitted through unofficial channels will not be honored. Upon receipt of a written request, Genomelink will:

1. Route the request immediately to the Legal & Privacy Team;
2. Log the request in the Law Enforcement Request Register (date, agency, type of process, data requested, and resolution);
3. Acknowledge receipt to the requesting agency in writing; and
4. Initiate legal review within 3 business days.

5.2 Legal Sufficiency Review

The Legal & Privacy Team will assess whether the legal process presented is valid and legally sufficient. This review includes:

• Confirming the request originates from an authorized law enforcement or government agency;
• Verifying the request complies with applicable federal and Maryland state law, including constitutional requirements;
• Assessing whether the scope of data requested is proportionate and narrowly tailored;
• Confirming no applicable prohibition applies (e.g., the insurer/employer prohibition under Maryland law and Genomelink’s company-wide prohibition on disclosure to insurers and employers); and
• Consulting outside legal counsel where appropriate.

Genomelink will challenge, in court where necessary, any request that we determine is legally deficient, overbroad, unconstitutional, or otherwise invalid. We will exhaust available legal remedies to protect consumer privacy before complying with any contested demand.

5.3 Consumer Notification

Genomelink will notify the affected consumer(s) promptly — and in advance of any disclosure, where legally permissible — when we receive a law enforcement request for their genetic data. Notification will be provided by email to the address associated with the consumer’s account.

Notification may be delayed or withheld only if:

• We receive a lawful non-disclosure order (e.g., a gag order accompanying a National Security Letter or court order) that legally prohibits disclosure; or
• We reasonably determine that notification would obstruct a legitimate ongoing investigation involving imminent risk of serious harm to a person.

If notification is initially prohibited, we will notify the consumer at the earliest point at which notification becomes legally permissible.

5.4 Data Minimization

If Genomelink determines that a law enforcement request is legally valid and must be complied with, we will:

• Disclose only the minimum data necessary to respond to the specific legal demand;
• Not proactively include additional data beyond what is expressly required by the legal process; and
• Produce data in a format that limits secondary use beyond the stated investigative purpose, to the extent practicable.

5.5 Documentation and Record-Keeping

Genomelink will maintain a complete and accurate record of all law enforcement requests received, including the requesting agency, type of legal process, specific data requested, our legal assessment and response, whether and what data was disclosed, and whether consumer notification was provided. These records will be maintained for a minimum of five (5) years.

‍

6. Emergency and Exigent Circumstances

Genomelink recognizes that law enforcement may occasionally present requests in circumstances they characterize as emergencies. Genomelink will evaluate such claims critically and independently. An agency’s characterization of a situation as an “emergency” does not, by itself, bypass this Policy or waive any applicable legal requirements.

In genuine exigent circumstances involving an imminent threat of death or serious bodily injury, Genomelink may, at its sole discretion, disclose limited non-genetic account information (e.g., name, contact information) to assist the responding agency, consistent with applicable law. Any such disclosure will be:

• Limited to the minimum information necessary;
• Documented in the Law Enforcement Request Register;
• Followed by formal written legal process from the agency within 5 business days; and
• Notified to the consumer at the earliest legally permissible opportunity.

Genomelink will not provide genetic data (raw sequence data, genotypic/phenotypic information, or derived inferences) on an emergency or exigent basis without valid legal process.

‍

7. Consumer Rights Related to Law Enforcement Requests

Right to Delete

Consumers may request deletion of their account and genetic data at any time through their Genomelink account settings or by submitting a request at https://privacy.genomelink.io/privacy-request. Upon verified deletion, Genomelink will no longer have data to produce in response to future law enforcement requests. Genomelink will honor deletion requests within 30 days, subject to any legal hold obligations under valid legal process received prior to the deletion request.

Right to Destroy Biological Sample

Consumers may request destruction of any retained biological sample at any time. Upon such request, Genomelink will destroy the sample within 30 days, consistent with applicable state law.

Right to Notification

Subject to applicable legal constraints (including court-issued non-disclosure orders), Genomelink will notify consumers when their genetic data is the subject of a law enforcement request, prior to any disclosure wherever possible.

Right to Withdraw from DNAsolves

Users who have opted into the DNAsolves program may withdraw at any time by submitting a deletion request at https://privacy.genomelink.io/privacy-request. Upon withdrawal, Genomelink will request deletion of your data from the DNAsolves database and will cease future transfers. Maryland residents are not enrolled in DNAsolves and no withdrawal action is needed.

Consent-Based Disclosure

A consumer may provide explicit written consent for Genomelink to disclose their genetic data to a specific law enforcement agency for a specific purpose. Such consent must be given voluntarily, must describe the specific data to be disclosed and the receiving agency, and may be revoked at any time prior to actual disclosure.

‍

8. Transparency Reporting

Genomelink will publish an annual Transparency Report that includes confirmation that no Maryland residents are enrolled and that no Maryland residents’ data has been transferred to DNAsolves.

‍

9. Applicable Legal Framework

This Policy has been developed with reference to the following legal authorities and best practices:

Md. Code, Com. Law § 14-4403 — Requires DTC genetic testing companies to provide consumers with clear and complete information regarding all data collection, use, disclosure, transfer, security, and retention/deletion practices — primary basis for DNAsolves disclosure obligation.

Md. Code, Com. Law § 14-4404 — Requires separate express consent for each third-party transfer of genetic data — governs DNAsolves opt-in enrollment.

Md. Code, Com. Law § 14-4405(a) — Requires DTC genetic testing companies to establish legal policies and processes for disclosing genetic data to law enforcement without consumer consent — primary basis for this Policy.

Md. Code, Com. Law § 14-4405(d) — Prohibits disclosure of genetic data to insurers or employers of the consumer, even under legal process.

Maryland Online Data Privacy Act (MODPA) — Restricts processing/sharing of sensitive data (including genetic data) to what is strictly necessary; flatly prohibits sale of sensitive data — basis for DNAsolves exclusion for Maryland residents.

California GIPA (Cal. Civ. Code § 56.18) — Governs genetic data handling for California consumers; requires express consent for all collection, use, and disclosure.

Fourth Amendment, U.S. Constitution — Protects against unreasonable searches and seizures; forms constitutional floor for evaluating LE requests.

Electronic Communications Privacy Act (18 U.S.C. § 2701 et seq.) — Governs law enforcement access to electronic communications and stored data.

Genetic Information Nondiscrimination Act (GINA) — Federal prohibition on use of genetic information in health insurance and employment. Additionally, Genomelink complies with genetic privacy statutes in multiple states beyond Maryland and California, including but not limited to: Alaska, Arizona, Florida, Georgia, Illinois (GIPA), Indiana (HB 1521), Kentucky, Louisiana, Montana, New York, South Dakota, Tennessee, Texas, and Utah. Each state imposes varying requirements on consent, disclosure, and data handling. See the Genomelink Privacy Policy (Section 13.5) for a consolidated summary of state-specific genetic privacy rights.

FPF Best Practices for Consumer Genetic Testing Services (2018) — Voluntary industry best practices including transparency reporting, valid legal process requirements, and consumer notification for law enforcement access.

‍

10. Internal Roles and Responsibilities

Legal & Privacy Team — Primary owner of all law enforcement request handling, legal review, consumer notification, and transparency reporting.

Customer Support / Operations — Routes any law enforcement inquiries received through non-legal channels immediately to the Legal & Privacy Team; manages user-facing DNAsolves opt-in/opt-out flows in coordination with Legal.

Engineering / Data Team — Executes approved data pulls; enforces Maryland user exclusion from DNAsolves data pipelines; maintains technical capability to isolate and extract specific consumer data subsets; implements geo-based controls for DNAsolves enrollment.

CEO / Executive Team — Notified of all law enforcement disclosures; final approval required for any disclosure not clearly covered by unambiguous valid legal process.

Outside Legal Counsel — Engaged for contested requests, challenges to legal process, non-disclosure orders, or requests involving national security.

‍

11. Policy Review and Updates

This Policy will be reviewed at least annually by the Legal & Privacy Team and updated to reflect:

• Changes in applicable federal or state law governing genetic data privacy or law enforcement access;
• Changes to Genomelink’s partnerships, including any changes to the DNAsolves program or similar programs;
• Changes in Genomelink’s data practices or product offerings;
• Material changes in judicial interpretation of relevant constitutional or statutory provisions; or
• Emerging best practices in the consumer genetic testing industry.

Material updates to this Policy will be disclosed to consumers via Genomelink’s website and privacy notice. The version history of this Policy will be maintained by the Legal & Privacy Team.

‍

12. Contact

Questions about this Policy — from consumers, law enforcement agencies, or internal staff — should be directed to:

Genomelink Legal & Privacy Team
Email: info@genomelink.io

‍