Privacy Policy

Language: English | Français

Effective date: July 22, 2026

1. Who is responsible for your information

1001635490 Ontario Inc., carrying on business as PuppyGenes, is responsible for personal information under its control. PuppyGenes provides at-home dog DNA wellness tests, accounts and reports, and the optional Genie AI feature.

The person exercising the highest authority within 1001635490 Ontario Inc. acts as our Privacy Officer. The Privacy Officer may be contacted at:

539 Barry Drive, Pickering, Ontario L1V 5M4
416-315-6352
support@puppygenes.com

This Policy explains what we collect, why, with whom it is processed, how long we retain it, and your choices and legal rights. We treat linked dog-genetic and report information as sensitive in our practices because of its nature and the customer account context, without suggesting that every item of canine data is necessarily personal information about a human under every law.

2. Information we collect

Depending on how you use the Service, we collect:

Account and contact information: name, email address, hashed password, shipping address, province or territory, language choice, consents, and account and support history.
Transaction information: order number, seller or sales channel, product, payment status, refunds, shipment and delivery information. Full payment-card numbers are handled by the applicable payment processor and are not stored by PuppyGenes.
Dog information: name, self-reported breed, birthdate or estimated age, weight, sex, and notes you choose to provide.
Physical sample: the cheek swab submitted using the kit and its internal sample identifier.
Derived laboratory and report data: depending on the product, breed or ancestry estimates, trait and genetic-marker results, diversity measures such as a coefficient of inbreeding, laboratory quality information, and report history.
Technical and usage information: device and browser information, truncated or full IP address depending on the configured tool, sign-in and security events, pages or features used, referring information, diagnostics, errors, and cookie or similar-technology choices.
Support communications: messages and files you send to customer support.
Genie information, if enabled: your prompts, Genie's responses, feedback, safety or abuse flags, and only the report excerpts and technical context reasonably needed to generate and safeguard a response.

We collect information directly from you; from the retail seller, payment and shipping providers; from our laboratory; automatically through the Service; and, for Genie, from your messages and the relevant report context already in your account.

3. Purposes

We use the information only for identified and reasonable purposes, including:

creating and securing accounts, recording consent, and authenticating users;
activating kits, linking internal sample identifiers, processing samples, and producing, delivering, validating, and updating purchased reports;
administering orders, delivery, support, returns, refunds, and transactional notices;
operating, maintaining, debugging, protecting, and monitoring the Service;
detecting and investigating unauthorized use, fraud, safety concerns, and security incidents;
complying with law and establishing, exercising, or defending legal claims;
generating and safeguarding a Genie response when you separately enable Genie; and
conducting external research only when you separately opt in.

We may use aggregate or irreversibly anonymized information that no longer identifies an individual for statistics, validation, research, and product improvement as permitted by law. Without the separate optional AI-improvement consent described below, we use identifiable Genie content only to generate the requested response and as reasonably necessary for security, abuse prevention, support, troubleshooting, or complaint handling. We do not use identifiable Genie content for broader PuppyGenes product evaluation or improvement without a future purpose-specific consent. A selected model provider's use of identifiable Genie content and the relevant report excerpts transmitted with it to develop, improve, update, or train AI models for broader use—including evaluation for that purpose—is a distinct optional purpose. The practices that may apply are described in section 5 and in the separate Genie consents.

4. Consent and essential versus optional processing

At activation, we separately present the information needed to understand sample processing, the U.S. laboratory transfer, retention, and the consequences of withdrawal. Processing necessary to analyze a submitted sample and deliver a requested report cannot be completed if that consent is withdrawn before analysis ends.

Genie is optional. Before first use, we ask for express consent separately from these documents. The consent identifies the information transmitted, recipient categories, purposes, processing outside Québec or Canada, material residual risks, limited human review, retention, and how to withdraw. A second, off-by-default consent separately covers a selected model provider's use of identifiable Genie prompts, relevant report excerpts transmitted with them, and responses to develop, improve, update, or train AI models for broader use beyond what is necessary to provide and protect the requested response. You may decline either optional use and still access your report; declining the second choice does not prevent you from using Genie.

External research is also optional and subject to a distinct, off-by-default consent. Refusing research does not affect the purchased Service. We do not condition the Service on consent to a secondary purpose that is not necessary.

You may withdraw consent prospectively, subject to reasonable notice and legal or contractual restrictions. We explain any material consequence before giving effect to withdrawal. Withdrawal cannot undo processing already lawfully completed.

5. Genie and AI providers

When you use Genie, PuppyGenes sends the message as you write it, the report excerpts reasonably relevant to the question, and limited technical information needed to route and protect the request to OpenRouter and the selected model provider. We do not add your name, email address, payment information, or account credentials as separate prompt fields. If you type personal information in your message, however, it will be included.

The current gateway, permitted model families and identified providers, their purposes, known processing locations, content-retention practices, material unknowns, and date last verified appear at puppygenes.com/privacy/providers. We currently permit Anthropic models such as Claude Opus and xAI models such as Grok, but may change a permitted model if the replacement meets our privacy and safety requirements. A model developer and the operator serving a particular endpoint may differ; the provider page describes eligible endpoint operators where known. AI processing may occur outside Québec and Canada, including in the United States and other countries identified on the provider page. Foreign laws may permit government, court, or law-enforcement access in circumstances that differ from Canadian law.

We use Genie information to generate the requested response and as reasonably necessary to operate and secure the feature, prevent abuse, troubleshoot a problem, respond to your support request, or address a complaint. PuppyGenes personnel may review a limited conversation where reasonably necessary for one of those purposes. Access is limited to the information reasonably needed for the task. Selected provider personnel may also conduct limited human review for a disclosed security, abuse-prevention, support, or legal purpose.

AI-provider practices differ by provider, model, endpoint, and account setting. We keep OpenRouter prompt/response logging and OpenRouter's own improvement use off for all Genie requests. For a customer who does not select the optional AI-improvement consent, we also route only to endpoints whose advertised policy says prompt content is not used to train models. A provider may still retain limited content for a disclosed security, abuse-prevention, support, or legal purpose. OpenRouter retains request metadata that does not contain prompt or response content. OpenRouter also states that it samples a small number of prompts for anonymous input categorization used for reporting and model ranking. When OpenRouter's input/output improvement setting is off, it states that the categorization is stored without association to an account or user ID and is performed using a zero-data-retention model. This limited platform categorization is separate from the optional provider model-training use described below.

If you separately select the optional AI-improvement consent, the selected model provider may retain and use identifiable prompts, the relevant report excerpts transmitted with them, and responses to develop, improve, update, or train AI models that may serve other users, including evaluating the content and results for that purpose, as described on the provider page. That choice applies prospectively while enabled and may be withdrawn for future prompts. The terms governing PuppyGenes' use of the selected endpoint do not reduce PuppyGenes' obligations under applicable law.

We may change a model or provider to maintain quality, availability, cost, or safety. If a change creates a materially new purpose or risk, we will provide additional notice or obtain new consent where required by law.

PuppyGenes retains visible Genie conversations while your account is open, until you delete them. We schedule deleted conversations for removal from active PuppyGenes systems, ordinarily within 30 days. AI gateways and model providers retain information under the current practices identified on our provider page and the terms governing PuppyGenes' use of the selected endpoint. Those periods can differ and may exceed PuppyGenes' active-system period; where no contractual maximum is available, the provider page says so. On a verified request, we will delete or request deletion where the applicable service makes that available. If you selected the optional AI-improvement consent, information already incorporated into aggregate, deidentified, evaluation, improvement, or model-training materials may not be retrievable or reversible. A documented legal, safety, abuse-prevention, or security hold may also apply where permitted by law.

You may disable Genie or withdraw either Genie consent prospectively through the available account control or by contacting support@puppygenes.com. Disabling Genie does not itself delete earlier conversations; use the conversation-deletion control or contact us to request deletion.

Genie provides educational explanations; it does not make decisions about your eligibility, price, employment, credit, insurance, refund rights, or access to a human service. If we later use personal information to make a decision based exclusively on automated processing, we will provide the notices, explanation, correction process, and human-review opportunity required by law before doing so.

6. Service providers and disclosures

We disclose or make information available only as reasonably necessary to:

The U.S. laboratory: the physical sample, a coded internal sample identifier, and information reasonably necessary for analysis and quality control. We limit direct customer identifiers to what is necessary and disclosed at activation.
Hosting and authentication providers: account, report, security, and Service data needed to host and secure the platform. The primary application database is hosted through Supabase in the Canada (Central) ca-central-1 region. Supabase and its subprocessors may perform limited support, security, backup, or infrastructure processing elsewhere.
AI gateway and model providers: the limited Genie information described in section 5, only when Genie is enabled.
Payment, commerce, and marketplace providers: transaction and contact data needed to administer an order, payment, refund, tax, or fraud check. Full card details are controlled by the payment processor.
Shipping and communications providers: address and contact information needed for delivery and Service messages.
Analytics, monitoring, and support providers: limited technical, usage, diagnostic, or support information according to our configuration and your applicable choices.
Professional advisers, insurers, and transaction counterparties: only as reasonably necessary under confidentiality obligations for advice, insurance, financing, due diligence, a merger, reorganization, or sale of the relevant business.
Authorities or other persons permitted by law: where required by valid legal process, to protect rights and safety, investigate fraud or a security incident, or as otherwise permitted or required by law.

We review legal demands, disclose only what we reasonably determine is required, and notify you where legally permitted and appropriate. We do not voluntarily provide individual-level dog-genetic data to law enforcement, insurers, or advertisers for their own purposes.

Our current material service-provider list is available at puppygenes.com/privacy/providers. We require written safeguards and purpose, confidentiality, incident-notice, retention, deletion, and verification terms where required by law. PuppyGenes remains accountable for personal information transferred to a processor for processing on our behalf.

7. Current no-sale practice, future optional programs, and research

We do not currently sell personal information, physical samples, raw dog-genetic data, or individual-level derived genetic data. We do not share individual-level data with insurers or advertisers for their own underwriting or advertising.

We disclose information to an external research partner only under a separate express opt-in and appropriate written safeguards. We remove direct identifiers and apply reasonable technical and contractual measures to reduce re-identification risk before disclosure. Deidentified information may still carry residual re-identification risk and is not called anonymous unless it has been irreversibly anonymized in accordance with applicable law.

If we later offer a commercial data program, we will first provide a separate, plain-language notice identifying the information, the recipient or recipient category, the commercial purpose, material risks, whether PuppyGenes or another party receives compensation, and how to refuse or withdraw. We will obtain any express consent required by law. Participation will be optional and will not be a condition of receiving a purchased report. Accepting the Terms or this Policy does not constitute consent to a future commercial data program.

8. Cross-border processing

The physical sample and internal sample identifier are sent to our laboratory in the United States for analysis. Genie providers may process the limited information described in section 5 in the countries listed on our provider page. Other providers may process limited information outside your province or Canada where needed to supply their service.

Before communicating personal information outside Québec, or entrusting a person or body outside Québec with collecting, using, communicating, or keeping it on our behalf, we assess the relevant factors required by law and use a written agreement that reflects the assessment. Information outside Canada may be subject to foreign lawful-access regimes. Contact the Privacy Officer for information about our service-provider categories or relevant processing locations.

9. Retention and destruction

We use a retention schedule based on purpose, sensitivity, legal requirements, and reasonable security and dispute needs:

physical swabs: retained or destroyed by the laboratory according to the practices and purposes disclosed at activation and on our service-provider page. You may ask us to forward a request to the laboratory to destroy any remaining sample, subject to completed processing and a documented legal, safety, or quality-control hold;
account and derived report data: while the account remains open, followed by scheduled removal from active systems, ordinarily within 30 days after a valid deletion request or account closure, subject to limited legal exceptions;
Genie conversations and provider logs: the periods in section 5;
unsuccessful or abandoned activation information: up to 12 months, unless a shorter period is appropriate or a longer period is legally required;
transaction, consent, fraud-prevention, complaint, and legal records: only for the applicable statutory limitation, tax, audit, or dispute period; and
restricted backups: not used for ordinary business purposes and aged out under the configured backup lifecycle, ordinarily within 180 days after deletion from active systems, subject to documented technical and legal exceptions.

We instruct applicable processors to delete or return information when their purpose ends, subject to lawful exceptions. We destroy personal information or irreversibly anonymize it when the purposes are complete and retention is no longer required. We do not represent deletion as complete until the applicable active-system, provider, and backup periods have expired.

10. Your rights and choices

Subject to applicable law, you may:

access personal information we hold about you and learn how it is used and to whom it has been disclosed;
correct inaccurate or incomplete information;
obtain computerized personal information collected from you in a structured, commonly used technological format where the portability right applies;
withdraw consent prospectively and manage optional Genie, research, marketing, cookie, and analytics choices;
ask us to close your account and delete information that is no longer required; and
ask a question or challenge our compliance.

Use available dashboard controls or contact support@puppygenes.com. We may verify your identity and will respond within the period required by law. If we refuse or limit a request, we will explain the legal reason and available recourse. An authorized person may submit a request where permitted by law.

Marketing messages include an unsubscribe mechanism. Service, security, order, and report-availability messages are not marketing and may continue while needed to provide the Service.

11. Analytics, cookies, and privacy settings

We use Vercel Analytics for configured site-quality analytics, performance monitoring, and diagnostics. Our provider page identifies what each tool does and whether it uses cookies or similar technology. We configure optional privacy-affecting features off by default where Québec law requires the highest level of confidentiality without user intervention. Where consent is required, you may accept or reject non-essential analytics and later change your choice through the site's cookie banner or “Privacy Choices” link when one is displayed.

We do not currently use technical or usage information for behavioural advertising or to make decisions about credit, employment, insurance, or eligibility.

12. Security and privacy incidents

We use administrative, technical, and physical safeguards appropriate to the sensitivity, amount, format, and location of the information. These include access controls, credential protection, secure transmission, logging and monitoring, vendor controls, staff confidentiality measures, and documented incident procedures as appropriate to our systems. No safeguard can guarantee absolute security.

We assess, contain, and mitigate privacy incidents. Where PIPEDA applies, we notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible where there is a real risk of significant harm and maintain required breach records. For Québec personal information, we promptly notify the Commission d'accès à l'information and affected individuals where an incident presents a risk of serious injury, and we maintain the required confidentiality-incident register.

13. Children

The Service and accounts are intended only for people who have reached the age of majority in their province or territory. We do not knowingly create accounts for or collect personal information directly from minors. If we learn that this has occurred, we will suspend the account, investigate, and delete the information unless law requires another response.

14. Governance and changes to this Policy

We maintain a privacy-governance program proportionate to our activities, including roles and responsibilities, complaint and rights-request procedures, retention and destruction rules, incident management, employee access controls, service-provider oversight, and privacy impact assessments where required. Information about these policies and practices is available from our Privacy Officer and is published where required by law.

We may clarify or update this Policy as our Service or law changes. We post the effective date and give active customers advance notice of a material change as required by law. We will not rely on a Policy update alone to use personal information for a materially new purpose where new consent is required.

15. Complaints and regulators

Contact our Privacy Officer first so we can investigate and respond:

Privacy Officer
1001635490 Ontario Inc. / PuppyGenes
539 Barry Drive, Pickering, Ontario L1V 5M4
416-315-6352
support@puppygenes.com

You may also contact the Office of the Privacy Commissioner of Canada or, for a matter within its jurisdiction, the Commission d'accès à l'information du Québec.