Privacy Policy
Last updated: 2026-10-20
Effective: 2026-05-30
Why Varia Doesn't Store Your Data
Your DNA file is read in your browser, on your device. It is never uploaded, and Varia's servers keep no copy of it or of your results.
This is deliberate. The safest place for your genome is the one Varia never has. Data that is never collected cannot be sold, subpoenaed, leaked, or lost in a breach. This is privacy by architecture, not a promise we ask you to trust.
Each visit, you reload your file and rescan. It runs entirely on your device and takes seconds. We chose this over storing your genome, even encrypted, because no stored copy is ever as safe as no copy at all.
Varia has no accounts. On our side, Varia keeps nothing about you unless you subscribe to The Variant newsletter, which stores your email address with our newsletter provider. Never your genome. Never your results.
Quick Summary
Your genome is never stored on our servers. Varia has no accounts. The scanner runs in your browser. Your DNA file is read locally and never uploaded to our servers. Your scan results stay on your device unless you generate a PDF, which sends the interpreted results (not your file) and any name you typed for the report to our PDF service for the time it takes to build the document. Your browser keeps a summary of your most recent scan in its local storage, on your device, and you can clear it. We collect your email address only if you subscribe to The Variant newsletter when that surface is offered. We do not collect payment information. We do not sell, share, or trade your information. You have specific rights depending on which state or country you live in, all documented below.
What This Policy Covers
This policy describes how Kairos Studios LLC ("Varia," "we," "us," or "our"), operator of variagenome.com, handles personal information of users who visit our website, use the Varia genome analysis service, generate PDF reports, or otherwise interact with us. It covers all surfaces of the Varia service, including the dashboard, PDF generation, and customer support.
How Varia Processes Your Genome Data
This is the most important section of this policy, so it appears first.
Your raw genome file never leaves your computer. When you open or load a raw DNA file (a VCF, a 23andMe or AncestryDNA export, or a similar consumer genome file), the Varia scanner runs entirely in your browser. The file is read locally on your device, matched against the Varia variant database (which is loaded into your browser as part of the application), and interpreted. At no point is the raw genome file transmitted to Varia's servers, to any third-party service, or to any other destination outside your computer. You can verify this in your browser's developer tools: open the Network tab before you load your file, then run a scan, and you will see that no genome data appears in any outbound request.
Your scan results stay on your device by default. The interpretation Varia produces (which variants you have, what they're associated with according to the literature, the curated explanations) is rendered into your browser session as you view your dashboard. By default, these results are not transmitted off your device. They exist in your browser's memory while you view them, and your browser also saves a summary of your most recent scan in its local storage on your device (see Data retention).
Your scan results are not stored server-side. Varia does not keep your scan results on our servers. If you want a portable artifact of your current results, generate a PDF. You can always perform a new scan, which is free, and the result will reflect the current state of the Varia database.
Generating a PDF transmits your scan results to our PDF generator. When you choose to generate a PDF (the Varia Genomic Brief), Varia transmits the interpreted scan results to a Cloudflare Worker, which forwards them to our PDF generation service (hosted on Render). The PDF is generated, returned to your browser, and the scan results are not retained server-side after PDF generation completes. We have verified by code audit that the Cloudflare Worker holds the scan results in memory only for the duration of the forward step; the Render PDF generator processes them in memory only with logging disabled; our analytics events record only whether a report had any findings and roughly how long it was, never scan content; and our error monitoring tool (Sentry) is configured to disable session replay and to scrub PDF-endpoint network breadcrumbs to method and status code only. The raw genome file is, as always, never transmitted at any point in this flow.
What We Collect
Email address. We collect your email address only if you choose to subscribe to The Variant newsletter or join a waitlist when that surface is offered. Your email address is passed to Beehiiv, which hosts the newsletter, and Resend sends a one-time confirmation email to it. Email is never required to run a scan or to view your results.
No account or scan record. Varia has no accounts, sign-in, passwords, or one-time codes, and keeps no server-side record of you, of when you scanned, or of which database version you used. Catalog changes, including authority reclassifications, are published on the Methodology page. Your browser, not our servers, compares the catalog version from your last local scan to the current catalog.
Payment information. Varia is free. We do not collect payment card details, and we do not use a payment processor.
Service usage telemetry. We use TelemetryDeck, a privacy-focused analytics provider, to understand how users interact with the Varia service. TelemetryDeck does not use cookies, assigns no persistent identifier, and does not collect personally identifying information. Each visit uses a random identifier that ends when you close the tab. It is kept in your browser tab's session storage, is not linked to your email, your DNA file or your results, and is hashed before it is sent. The events we record are limited to a defined allowlist published openly in our code repository. Examples include scan completion events, dashboard navigation events, and PDF generation events. No genome data, scan results, or personal identifiers are included in these events.
Error reports. We use Sentry to capture application errors so we can debug and fix them. Sentry session replay is explicitly disabled in our configuration, which means no recording of your browser activity is captured. Error reports include the error message, the application state at the time of the error, and the browser environment information (browser type, version). Sensitive content in error context is scrubbed before transmission. Error reports carry the same random per-visit identifier and no other identifier.
Newsletter preferences. If you subscribe to The Variant newsletter, we collect your email address and your subscription status. Beehiiv hosts the newsletter and handles delivery, open tracking, and unsubscribe processing. You can unsubscribe at any time using the link in any newsletter issue.
Information we explicitly do not collect. We do not collect, transmit, or retain your raw genome data. We do not store your scan results (variants, genotypes, or interpretive content) on our servers; scan results stay on your device. We do not collect your demographic information (age, race, ethnicity, gender, ancestry). We do not collect your medical history, your physician's information, or your insurance information. We do not collect your location beyond what is incidentally visible in network metadata (IP address) during normal HTTPS connections, which is used only for security and rate-limiting purposes and not retained beyond operational windows. We do not collect browsing history outside the Varia service. We do not fingerprint your browser for tracking.
No Varia Account
Varia has no accounts. There is no sign-up, sign-in, password, or one-time code, and no server-side profile of you. Every part of Varia, including the scan, your dashboard, and the Genomic Brief, works without one.
We never store your DNA or your results. Your genome file is read and analyzed entirely in your browser and is never transmitted to or stored by us. Your variant findings and interpretations are generated on your device and are not retained on our servers.
What stays in your browser. An optional first name you give when you open your full results, your acceptance of the Terms, and your display preferences are kept in your browser's local storage, on your device. When you generate a PDF, the report asks for a name to print on it, filled in with that first name; you can type any name or leave it off, and whatever you enter leaves your device only to be printed on the PDF. You can remove all of these by clearing this site's data in your browser.
How We Use What We Collect
We use the information we collect strictly for the following purposes:
To provide the Varia service to you, including generating PDFs you request and sending The Variant newsletter if you subscribe when that surface is offered. To operate the service (rate limiting, abuse prevention, error monitoring, performance optimization, security). To communicate with you about support requests, service updates, and material changes to this policy. To comply with applicable legal obligations.
We do not use your information for cross-context behavioral advertising. We do not profile you for marketing purposes beyond the limited scope of The Variant newsletter (which contains only content you opted into receiving). We do not train machine learning models on your information.
Data Retention
Scan results: Varia retains no scan results on our servers. On your device, your browser holds your results while you view them and saves a summary of your most recent scan (the variant IDs found, their tiers, and call-quality fields; never your raw file) in its local storage, so it can show what changed on your next scan. That summary stays until you clear this site's data in your browser. If you switch browsers or devices, you can perform a new scan, which is free.
Preferences: the optional first name you gave when you opened your full results, your acceptance of the Terms, and your display preferences stay in your browser's local storage until you clear this site's data.
Email addresses: Varia keeps no email list on its own servers. Your email address is held by Beehiiv for as long as you stay subscribed (see below), and Resend keeps a delivery record of the confirmation email under its own policy. You can request deletion of your email at any time.
Telemetry and error reports: retained for up to 90 days for operational purposes.
Newsletter subscription records: retained as long as you remain subscribed. Unsubscribed records are retained for 30 days to honor your unsubscribe request and then deleted, except for the minimum metadata required to prevent re-subscription without your consent (your email and the fact that you unsubscribed).
Security
We use industry-standard security measures to protect your information. All connections to Varia use HTTPS with TLS 1.2 or higher. Stored data is encrypted at rest. Access to production systems is restricted and logged. We do not store your raw genome data or your scan results, which is the most consequential security posture: the data we don't have, we can't lose.
No system is perfectly secure. If we become aware of a security incident affecting your information, we will notify affected users in accordance with applicable law.
Your Federal Rights
Genetic Information Nondiscrimination Act (GINA). GINA is a federal law that prohibits discrimination based on genetic information in health insurance (Title I) and employment (Title II). GINA does not currently extend to life insurance, disability insurance, or long-term care insurance. Varia does not share your genetic information, scan results, or any other information with any insurer, employer, or related entity, in any context, for any purpose. We are aware of GINA and we operate consistent with its protections.
Children's Online Privacy Protection Act (COPPA). Varia is not intended for users under 13 years of age, and we do not knowingly collect personal information from children under 13. Varia is not intended for users under 18 in any capacity. If you believe we have collected information from a child under 13 in error, contact us at [email protected] and we will delete it.
Your State-Specific Rights
This section addresses the rights of users who reside in states with comprehensive consumer privacy laws or specific genetic privacy laws. State law is evolving rapidly, and we update this section as new laws take effect.
California (CCPA / CPRA / CalGINA). California residents have the right to know what personal information we collect, to access and receive a copy of that information, to correct inaccurate information, to delete that information, to opt out of any sale or sharing of personal information (we do not sell or share), and to limit the use of Sensitive Personal Information (SPI). Genetic information is classified as SPI under CPRA. Because Varia processes your genetic data only on your device and only to provide the service you have requested, our use of SPI is already limited to the necessary purpose. California residents also benefit from CalGINA, which extends GINA's protections to additional contexts within California.
Virginia (VCDPA). Virginia residents have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of processing for targeted advertising or sale. Genetic data is classified as sensitive data under VCDPA, and processing requires opt-in consent, which you provide by opening your genome file in Varia and using the service.
Colorado (CPA). Colorado residents have rights of access, correction, deletion, portability, and opt-out (targeted advertising, sale, profiling with legal effects). Genetic data is classified as sensitive data, requiring affirmative consent.
Connecticut (CTDPA). Connecticut residents have rights consistent with VCDPA and CPA, including specific protections for sensitive data including genetic information.
Utah (UCPA + Utah Genetic Information Privacy Act). Utah residents have rights of access, deletion, and opt-out under UCPA. The Utah Genetic Information Privacy Act (2021) imposes additional informed consent requirements on direct-to-consumer genetic testing companies. Varia operates with explicit informed consent when you load your genome file and through this privacy policy. You can delete your email at any time.
Texas (TDPSA). Texas residents have rights consistent with the VCDPA/CPA/CTDPA framework, including sensitive data protections.
Florida (FDBR + HB 833 + §760.40). Florida residents have rights under the Florida Digital Bill of Rights consistent with other state privacy laws. Florida HB 833 (2020) and Florida Statutes §760.40 prohibit the use of genetic information in life insurance, long-term care insurance, and disability income insurance underwriting decisions in Florida. Varia does not share your information with insurers in any capacity.
Massachusetts (MGL c.111 §70G). Massachusetts requires informed consent for genetic testing. While Varia is not "testing" your genes (we interpret data you provide from testing already performed), we operate as if §70G applies, and your consent is captured when you load your genome file and through acceptance of this policy and the Varia Terms of Service.
Other states with genetic privacy laws. Alaska (AS 18.13), Arizona (ARS §12-2801), Vermont, New Jersey, and other states have specific genetic information privacy statutes. Varia's general posture honors the principles of these statutes: informed consent when you load your genome file, no disclosure to third parties beyond named service providers operating under contractual restrictions, individual ownership of genetic information, and deletion rights on request.
To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law (typically 30 to 45 days). We may need to verify your identity before processing certain requests.
International Users
Varia is operated from the United States. At present, the Varia service is intended for users in the United States only. Users in the European Union, the United Kingdom, and other jurisdictions with stringent data export requirements are not the intended audience for this V1 release.
If you are in the EU or UK and are using Varia, please be aware that your data is processed in the United States, and you are responsible for understanding the implications under your local law. We expect to expand to additional jurisdictions in future versions with appropriate compliance posture for each.
How to Exercise Your Rights
For any privacy-related request (access, correction, deletion, portability, opt-out, complaint, or general question), contact [email protected]. If your request concerns the newsletter, identify yourself with the email address you subscribed with, and describe the request. We will respond as soon as practicable, and in any event within the timeframe required by applicable law.
If you have a complaint we have not resolved to your satisfaction, you may also contact your state attorney general's office. Residents of states with dedicated privacy enforcement bodies (such as the California Privacy Protection Agency) may also contact those agencies directly.
Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or in applicable law. Material changes will be communicated through a notice on the Varia website. The "Last updated" date at the top of this policy reflects the most recent revision.
Contact
For privacy-related inquiries: [email protected]
For general support: [email protected]
For postal correspondence: Kairos Studios LLC, 82 Wendell Ave, STE 100, Pittsfield, Berkshire County, MA 01201, USA