Effective Date: 23 Sep 2020
Summary of Changes
This summary is intended to help you better understand the most recent changes to Ancestry’s Privacy Statement and how the changes may impact you.
The updates to the Privacy Statement apply to your use of the Services when you view, access, or otherwise use the Services. To fully understand the changes and terms that will govern your use of our Services, please read the Privacy Statement.
Specifically, the most recent changes include:
- Clarifying certain sections to address requirements under the California Consumer Privacy Act (“CCPA”) such as the categories of personal information collected, used and shared; and,
- Updating, clarifying, and simplifying existing language.
At Ancestry®, your privacy is a top priority. Ancestry is committed to being a good steward of your Personal Information (defined below), handling it in a responsible manner, and securing it with administrative, technical, and physical safeguards.
We also believe in being honest, direct and transparent when it comes to your data. Ancestry follows three guiding principles when it comes to your privacy:
- Transparency. We work hard to be transparent about what Personal Information we collect and process.
- Simplicity. We try to use easy-to-understand language to describe our privacy practices to help you make informed choices.
- Control. We give you control over the Personal Information you provide to us, including your DNA Data, and how it is used, shared, and retained.
Other Important Things for You To Understand When You Use Our Services
You always maintain ownership of your DNA and DNA Data (defined below)—you can manage and delete it as described in this Privacy Statement.
You may discover unexpected facts about yourself, your family, or your health when using our services. Once discoveries are made, we can’t undo them.
When you make new discoveries with us, you should feel confident and informed about how we use your Personal Information. Our full Privacy Statement is below and we encourage you to read it. It covers all Ancestry websites, services, and mobile apps that link to this Privacy Statement, including: Ancestry®, AncestryDNA®, AncestryHealth®, Fold3®, Newspapers.com™, Archives®, We Remember®, and Find a Grave®.
US Customers only - The AncestryHealth® Additional Privacy Statement below contains additional details for AncestryHealth® customers.
California Customers only - The California Resident Additional Privacy Statement below contains additional details for California residents required by the CCPA.
Table of Contents
Please note: Information about deceased persons is not Personal Information under this Privacy Statement.
The Personal Information required to create an account with Ancestry is limited to your name, an email address, and a password. For Archives® users only, billing information is also required for account creation.
Account creation also requires you to agree to the Ancestry Terms and Conditions and this Privacy Statement.
By creating an account you are telling us that you understand Ancestry will collect, process, and share your Personal Information (including your Genetic Information if you have taken a DNA test) as described in this Privacy Statement.
Access to Ancestry content such as archival records to help you build a family tree or to our DNA features (ethnicity estimate, etc.) requires additional personal information, including payment details, and, for the DNA test, the test code (when you activate your DNA test kit) and a saliva sample from which we can extract Genetic Information.
At any time, you can request that Ancestry delete information you have uploaded into your account, such as a family tree or your Genetic Information. You can also delete your entire account. Please see Section 10 for specific details about deleting your data.
|Credit Card/Payment Information||
|DNA Kit Activation Information||When you activate a DNA test kit, we collect:
|Profile Information||We collect the information that you provide when you voluntarily create a user profile (for example, a profile image, your name, age, or location). This information may be seen by other Users (defined in the Ancestry Terms and Conditions), so please consider limiting this information and using a username that is different from your real name to protect your privacy.|
|User Provided Content||Information you provide when you voluntarily contribute to the Services, for example, content you upload or contributions to community discussions, family trees, annotations to Ancestry records, and, information you voluntarily provide in response to our email surveys, or questionnaires available through the Services. This may include health or medical information.|
|Genetic Information||At our partner laboratories, we extract your DNA from your saliva and convert it into machine-readable biometric data (“DNA Data”), that we process to provide you an ethnicity estimate and communities suggestions. We also process your DNA Data to provide other information about you, such as your degree of connection to genetic relatives in our database and any genetic associated with certain biological, physiological, or behavioral traits, such as hair thickness and eye color or traits associated with your health and wellness.
Your DNA Data and any information derived from it such as ethnicity estimates, communities, traits, and relative matches are Personal Information and referred to as “Genetic Information”.
A Note About Your DNA and Saliva: Neither your saliva nor the extracted DNA (together referred to as “Biological Samples”) are Personal Information under this Privacy Statement. Also, after our laboratory partner has processed your Biological Samples, we store them in our bio bank for future testing at your option. Future testing may be done if you agree to our Informed Consent for Research or if you consent to other tests of your Biological Samples. Sections 8 and 10 below describe how you can control your Biological Samples. You may request that Ancestry destroy your Biological Samples by contacting Member Services.
|Note About Health-Related Information||Ancestry is not a covered entity under the Health Insurance Portability and Accountability Act (“HIPAA”), and as a result no User Provided Content nor any Family Health History (as defined in the AncestryHealth® Additional Privacy Statement) provided by you is subject to or protected by HIPAA.|
|Your Communications||Your communications with other Users through our communications features and information you provide in communications with Ancestry Member Services and support teams for our other Services, including audio and visual information (such as recordings of calls with Ancestry Member Services or information voluntarily shared when doing consumer insights research).|
|Contests and Promotions||Personal Information when you voluntarily participate in contests and special promotions we run or sponsor.|
|Find a Grave® Photos and Photo Volunteers||Metadata associated with digital photographs uploaded to Find a Grave®, including location, date and time the photo was taken. If you choose to be a photo volunteer for Find a Grave®, you provide your location to us which you can change or remove at any time.|
|Other Protected Classifications and Sensitive Data||We may collect information related to certain protected classifications such as gender or marital status.|
|Computer and Mobile Device Information||
Information about how you access our Services, including the website you visited before and after Ancestry’s site.
The Internet Protocol address of your computer, mobile device, or the proxy server that you use to access the Internet, in addition to other technical information, such as:
Ancestry may collect geolocation information from your device with your permission.
|Information Shared Through Social Media Features||
If you interact with social media through the Services, for example “Share,” “Post,” “Tweet,” “Pin,” or “Follow Us” links to sites such as Facebook, Twitter, Pinterest, Instagram, and YouTube, Ancestry will collect these interactions and whatever account information these services make available to us.
Your interactions with these features are governed by the privacy statement of the applicable third-party company.
|Information from Your Use of the Services||Information about your use of the Services, such as when you search or access records or public family trees, which pages you view, links you click, or when you add people to your tree, etc., which we may use to infer details about you as a customer and your interests to provide a better experience through, for example, search suggestions.|
|Information Category||Use Description|
|Information from Public and Historical Records||Ancestry collects records from various sources, usually from official record sources, including newspapers, as well as birth, death, and marriage records, which may contain Personal Information relating to you. Public and historical records may also contain Personal Information relating to non-Ancestry users. These records are usually made available to Users as part of the Ancestry subscription Services.|
|Information from Third Parties||
We may also receive information about you from third parties. For example, we may supplement the data we collect with demographic information licensed from third parties in order to personalize the Services and our offers to you.
If you purchase a gift subscription, we will collect Personal Information, such as the recipient’s name and email address, to complete the gift and notify the recipient.
|Information Category||Use Description|
|Personal Information (Generally)||We use your Personal Information to provide, personalize, improve, update and expand our Services. This includes:
|Communications||We use your Personal Information to communicate with you about the Services, such as when we:
|Market Products and Offers from Us or Our Business Partners.||We use some Personal Information to market products and offers from us or our business partners. This includes advertising personalized to you based on your interests.
Please note: Ancestry does not share your Genetic Information with third-party marketers, insurance companies, or employers, and we will not use your Genetic Information for marketing or personalized advertising without getting your explicit consent.
|Genetic Information||Ancestry uses your Genetic Information for the following primary purposes:
Ancestry does not share your individual Personal Information (including your Genetic Information) with third-parties except as described in this Privacy Statement or with your additional consent. We do not voluntarily share your information with law enforcement. Also, as previously explained, we will not share your Genetic Information with insurance companies, employers, or third-party marketers without your express consent.
Please note: Ancestry’s CCPA-specific disclosures can be found here. Ancestry does not sell your Personal Information.
The circumstances described below explain when sharing might occur:
|People with Whom Your Information May Be Shared / Circumstances in Which Sharing Might Occur||Description|
|Other Users or Others You May Choose to Share With||
As part of your use of the Services, you have the option to add or share information with all Users of the Service or through sharing features with individual Users and non-Users. You may have additional sharing options in some Services, for example AncestryDNA® (see below).
Information in your public profile may be seen by all other Users, as will public family tree details (we do not show living people in your tree to other Users without your permission). To see what is visible, go to your public profile.
If you choose to participate in DNA matches (when you choose to see and be seen by your DNA matches), your DNA matches can see certain information, such as your username, how they might be related to you, whether you have linked a family tree to your DNA, and either all or only shared (at your option) regions and communities. You may be offered other options for connecting with relatives or learning about familial connections.
You can share other DNA information, such as Traits, through compare and other one-to-one sharing features.
If you share details of your family history or DNA experience outside the Services, you do so at your own risk.
We work with other companies when providing and marketing the Services. As a result, these companies will have some of your information in their systems. These companies are subject to contractual obligations governing privacy, data security and confidentiality consistent with applicable laws.
These companies include our:
|Research Partners||We share your Genetic Information with research partners only when you provide us with your express consent to do so through our Informed Consent to Research.
Research partners may include commercial or non-profit organizations that conduct or support scientific research, the development of therapeutics, medical devices or related material to treat, diagnose or predict health conditions. In some circumstances, a research partner or Ancestry may have a financial interest in the research arrangement. A list of our research partners can be found here.
Ancestry does not voluntarily cooperate with law enforcement. To provide our Users with the greatest protection under the law, we require all government agencies seeking access to Ancestry customers’ data to follow valid legal process and do not allow law enforcement to use Ancestry’s services to investigate crimes or to identify human remains.
If we are compelled to disclose your Personal Information to law enforcement, we will do our best to provide you with advance notice, unless we are prohibited under the law from doing so. In the interest of transparency, Ancestry produces a Transparency Report where we list the number of valid law enforcement requests for user data across all our sites.
|Other Legal or Regulatory Process||We may share your Personal Information if we believe it is reasonably necessary to:
|If Ancestry is Acquired||If Ancestry or its businesses are acquired or transferred (including in connection with bankruptcy or similar proceedings), we will share your Personal Information with the acquiring or receiving entity. The promises in this Privacy Statement will continue to apply to your Personal Information that is transferred to the new entity.|
|A Note About Aggregated Data||Ancestry may disclose user information in an aggregated form as part of the Services or our marketing, or in scientific publications published by us or our research partners. For example, we might note the percentage of immigrants in a State that are from a particular geographic region or country. Such disclosure will never include Personal Information.|
Subject to certain exceptions, you have a right to request access to your Personal Information and to be provided with a copy of certain information including the categories of your personal information we collect and disclose; the categories of sources of such information; and the business purpose for collection in a portable form, as well as to seek to update, delete, or correct this information by using the tools described below or by contacting Ancestry. Details and options for accessing this information are listed below.
|Ancestry||You can access and update the Personal Information (such as your email address, username, profile information, etc.) that you provide to Ancestry at any time in the following sections of the privacy settings: here.|
|Related Brands||Ancestry strives to make it simple for you to manage your privacy across the Services. You can manage your privacy settings for our related brands here.|
|Mobile||You can also control your information using the settings available in our mobile applications, such as Ancestry®, AncestryDNA®, Find a Grave® and We Remember® apps.|
|Family Tree Information Download||Ancestry allows you to download your family tree information in the standard GEDCOM family tree file format in your Family Tree Settings.|
|Genetic Information Download||Your DNA Data belongs to you. You always have the option of downloading a file with your DNA Data. If you download your DNA Data, you do so at your own risk. Learn how here. For more information on what is included in your DNA Data download, go here.|
Ancestry Services are fundamentally premised on the notion that the personal voyage of self-discovery is not a one-time event and continues over lengthy periods of time—possibly lifetimes. Additionally, and with particular regard to our subscribers and DNA customers who pay fees or purchase subscriptions, the ongoing enhancement of our collections of historical records and DNA features provide benefits and insights to our Users over time. As a result, our retention practices reflect this ongoing value by retaining user accounts on our system until our Users inform us of their desire to delete their data or close their accounts.
|Information Category||Retention Period|
|Account and Profile||Ancestry will retain the Personal Information you provide while creating your account and your profile until such time as you ask us to delete it.|
|Family Tree||Due to the multi-generational significance of family trees, Ancestry will retain your family tree data as needed to provide you with continuous access, updated features, and the ability to enhance your family tree.|
|DNA||Ancestry retains your DNA Data as needed to provide you with the features and functionality you purchased (or were gifted), including continuously updated features such as DNA matches, increasingly granular ethnicity estimates and improved regions and communities, as well as new other features based on your DNA Data.|
|Related Brands||Some of our related brands (Fold3®, Newspapers.com™, Find a Grave®, We Remember® or Archives®) have their own account logins and will retain the Personal Information you provide while creating your account and your profile as needed to provide you with continuous and updated Services until such time as you ask us to delete it. You can delete these accounts at any time.|
|Usage Information||We retain usage information (e.g., visits to sites) in a depersonalized or aggregated form. Once aggregated, this information ceases to be personal and will not be subject to user deletion requests.|
You can delete your Personal Information from Ancestry at any time.
|Information Category||How To Delete|
You can delete your Personal Information from Ancestry by logging into your Account Settings.
If you have shared information with other Users (for example, by making your family trees public or by sharing your DNA Results directly with other Users), Ancestry will not be able to remove any copies of information that other Users may have retained, which can only be removed by your contacting the other User and asking them to delete it.
Please direct any request to remove information from linked archival records to the responsible archival entity.
We will consider requests for removal of Personal Information from the searchable indexes of the records we hold on a case-by-case basis in accordance with law.
|Genetic||Please note: If you request that Ancestry delete your DNA Data, we will delete all Genetic Information, including any derivative Genetic Information (ethnicity estimates, genetic relative matches, etc.) from our production, development, analytics, and research systems within 30 days.
To request the destruction of your Biological Samples, you must contact Member Services. Please note that if you have agreed to our Informed Consent to Research, we will not be able to remove your Genetic Information from active or completed research projects, but we will not use it for any new research projects.
|General||Please note that there may be some latency in deleting your Personal Information from our backup systems after it has been deleted from our production, development, analytics, and research systems. Also, our laboratory partners may retain information they receive from us in order to comply with laws or regulations that may require them to do so, such as the Clinical Laboratory Improvements Amendments regulations administered by the U.S. Food and Drug Administration. Ancestry may also retain certain information as reasonably necessary to comply with our legal obligations (including law enforcement requests), resolve disputes, maintain security, prevent fraud and abuse, as well as to comply with tax, payment industry, securities, and clinical regulatory compliance requirements.|
|Related Brands||To delete information from our related brands (Fold3®, Newspapers.com™, Find a Grave®, We Remember® or Archives®), you can always contact us at the related brand and request that your Personal Information be deleted from that service. Some Services may also have an online request form accessible from that service’s account settings menu and viewable here.|
Ancestry maintains a comprehensive information security program designed to protect our customers’ Personal Information using administrative, physical, and technical safeguards.
The specific security measures used are based on the sensitivity of the Personal Information collected. We have measures in place to protect against inappropriate access, loss, misuse, or alteration of Personal Information (including Genetic Information) under our control.
The Ancestry Security Team regularly reviews our security and privacy practices and enhances them as necessary to help ensure the integrity of our systems and your Personal Information.
We use secure server software to encrypt Personal Information (including Genetic Information), and we only partner with security companies that meet and commit to our security standards. While we cannot guarantee that loss, misuse or alteration of data will not occur, we use reasonable efforts to prevent this.
It is also important for you to guard against unauthorized access to your Personal Information by maintaining strong passwords and protecting against the unauthorized use of your own computer or device.
Any transfer of your Personal and Genetic Information between Ancestry’s Ireland-based company and Ancestry’s U.S.-based companies for processing in the United States is conducted pursuant to established transfer mechanisms such as Standard Contractual or Privacy Shield.
Please note: Although the European Court of Justice declared Privacy Shield invalid as a mechanism for EU-US transfers of Personal Information between EU countries and the United States, Ancestry and its subsidiaries, as part of our commitment to privacy, continue to commit to the Privacy Shield Principles.
You can request a copy of any standard contractual clauses relating to your Personal Information that we may have executed by contacting us using the details below.
Ancestry and its subsidiaries (namely Ancestry.com Operations Inc, Ancestry.com DNA LLC, Ancestry International DNA LLC and FindAGrave Inc.) listed in its certification on the Privacy Shield website comply with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, or Switzerland to the United States. Ancestry has certified to the Department of Commerce that it adheres to the Privacy Shield Principles and that it complies with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks. To learn more about the Privacy Shield program and to view our certification, please visit: https://www.privacyshield.gov/. If there is any conflict between the terms in this Privacy Statement and the Privacy Shield Principles, the Privacy Shield Principles shall govern.
Ancestry’s participation in the Privacy Shield applies to all personal data that is subject to the Ancestry Privacy Statement and is received from the European Union, European Economic Area, the United Kingdom, or Switzerland. Ancestry will comply with the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability in respect of such personal data. Ancestry’s accountability for personal data that it receives under the Privacy Shield and subsequently transfers to a third party is described in the Privacy Shield Principles. In particular, Ancestry remains responsible and liable under the Privacy Shield Principles if third-party agents that it engages to process the personal data on its behalf (1) do so in a manner inconsistent with the Principles and (2) Ancestry is responsible for the event giving rise to the damage.
We encourage you to contact us as detailed below should you have a Privacy Shield-related (or general privacy-related) complaint. If you are a resident of the European Union, the United Kingdom, or Switzerland and are dissatisfied with the manner in which we have addressed your concerns about our privacy practices, you may seek further assistance, at no cost to you, from JAMS, our designated Privacy Shield alternative dispute resolution provider based in the United States through the JAMS website at: https://www.jamsadr.com/eu-us-privacy-shield. As further explained in the Privacy Shield Principles, a binding arbitration option will also be made available to you in order to address residual complaints not resolved by any other means. You can learn more about this option through the Privacy Shield website at: https://www.privacyshield.gov/article?id=ANNEX-I-introduction. Ancestry is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).
We may modify this Privacy Statement at any time, but we will provide prominent advance notice of any material changes to this Statement, such as posting a notice through the Services, on our websites, or sending you an email, to provide you the opportunity to review the changes and choose whether to continue using the Services.
We will also notify you of non-material changes to this Statement as of their effective date by posting a notice through the Services, on our websites, or sending you an email.
If you object to any changes, you may delete your account as described in Section 10.
Where you have consented to data processing, your consent provides the legal basis to process your Personal Information. We rely on your explicit consent to process your Genetic Information. You have the right to withdraw consent at any time. Please note that your withdrawal of consent to collect and process your Personal Information will not affect the lawfulness of processing your Personal Information based on your consent before you withdraw your consent. To withdraw your consent, you may remove information from your account profile or your family trees, delete your DNA test results, or close your account. You can withdraw your consent to participate in scientific research in your DNA test settings if you agreed to our Informed Consent to Research in your DNA test settings.
We may also process your Personal Information on the basis of contractual necessity to perform a contract we have with you. For example, we process your credit card details when you provide them in order to use our Services or purchase access to premium features such as our DNA testing services.
We may also process your Personal Information on the basis of our legitimate interests, including processing records and similar archival content obtained from third parties, in providing and improving the Services. For example, Ancestry has a legitimate interest in understanding your login history so we can assess your interaction with our Services. We also have a legitimate interest in providing and developing interesting features to provide to our Users. We use your Personal Information to keep our Services safe and secure and we do so as is necessary to pursue your and our legitimate interests in ensuring that our Services are secure, and to protect against fraud, spam and abuse.
Where we rely on legitimate interests to process your Personal Information, you have the right to object to such processing (meaning that you can ask us to stop). You can use your Privacy Settings to control certain ways in which we process your data. You can also contact us, using the details below, to object to other forms of processing.
Ancestry may also process personal data on the basis of our legal obligations.
If you reside in the United States, Ancestry.com Operations Inc. and Ancestry.com DNA, LLC, and Ancestry Genomics Inc. are responsible for the use of your data and for responding to any requests related to your Personal Information.
If you reside outside the United States, Ancestry Ireland Unlimited Company is your data controller.
Contact information for these entities is listed at the bottom of this Statement.
Users outside of the United States may contact the Irish Data Protection Commission, or your local Data Protection Authority.
Official Correspondence Can Be Sent Either To:
Email: [email protected]; or,
|For Users Located in the United States||For Users Located Outside of the United States|
Ancestry.com Operations Inc.
Attn: Privacy Office
Ancestry Ireland Unlimited Company
Attn: Privacy Office
The Ancestry Privacy Statement describes the general privacy practices of Ancestry’s Services including the AncestryHealth® Service. More information specific to the AncestryHealth® Service is provided in this Section. You can also access Ancestry’s Privacy Center for additional details on Ancestry’s privacy practices here.
16.1. What Information Does Ancestry Collect Through Your Use of the AncestryHealth® Service?
We collect the following information from you to provide the AncestryHealth® Service, which includes Health Activation Information, Your Health History, Family Health History and DNA Data (as defined above). This information, along with other information specified in the Ancestry Privacy Statement, is collectively referred to here as your “Personal Information”.
Health Activation Information
When you activate your Health DNA kit, we may collect the following (referred to as “Health Activation Information”):
- Tube code;
- Date of Birth;
- Biological sex;
- Street Address;
- Phone number;
- Email address;
- Purpose or reason for taking the test;
- Whether you are a stem cell or bone marrow transplant recipient; and,
- Information about current and past health history of you and your family, such as doctor diagnosed conditions, carrier status, and lifestyle choices that may have an impact on your health (“Your Health History”).
Family Health History
We collect personal and health history information about your family members (“Family Health History”) which you have voluntarily contributed to your AncestryHealth® account. The information collected may include:
- Living / Deceased;
- Age of diagnosis; and,
- Additional notes provided by user.
16.2. How Does Ancestry Use Your Personal Information?
Health Activation Information
Ancestry uses your Health Activation Information to:
- Support and facilitate:
- The determination of eligibility for the AncestryHealth® Service; and,
- The patient-physician relationship with the independent physician network, which is provided as part of the AncestryHealth® Service.
- Process your AncestryHealth® kit and deliver personalized health reports to you.
Your Health History
Ancestry uses Your Health History information to:
- Provide information to the independent physician network so they may determine your eligibility for the test(s), and identify possible health issues or factors which may impact the results of your test; and,
- Deliver a personalized experience.
Ancestry may also use Your Health History information in a de-identified format to improve, update and expand the AncestryHealth® Service.
Family Health History
Ancestry may use your Family Health History information to deliver a personalized experience. Ancestry may also use your Family Health History information in a de-identified format to improve our AncestryHealth® Service and identify new product offerings.
Genetic Information and Health Reports
If the independent physician network partner approves your laboratory test, and, depending on which AncestryHealth® product you buy and whether we have your DNA Data from prior testing, Ancestry will either share your DNA Data, or send your sample for processing to our independent laboratory partner. Using your DNA Data, our independent laboratory partner will generate a test result, which Ancestry, in turn, will use to provide your health report.
Ancestry’s independent physician network will also have access to your test result and health report.
Please note: As addressed in our Privacy Statement, Ancestry commits not to share any Personal Information of AncestryHealth® Users with insurance companies, employers, or third party marketers. Ancestry does not voluntarily cooperate with law enforcement. To provide our Users with the greatest protection under the law, we require all government agencies seeking access to Ancestry customers’ data to follow a valid legal process, and do not allow law enforcement to use Ancestry’s services to investigate crimes or to identify human remains.
16.3. When Do We Share Your Information and Who Are the Recipients?
Ancestry will share your Health Activation Information, Your Health History, test results, health report, and any questions you submit through the “Submit a Question” feature with the independent physician network who has been appointed as part of the AncestryHealth® Service. The independent physician network will use this information to determine your eligibility for the test, to review and provide oversight of the health reports, as well as to assist in providing genetic counseling services to you.
16.4. Your Choices and Access to your Personal Information
You may access your AncestryHealth® results and reports at any time, through the AncestryHealth® product. You may also download your DNA data obtained from the micro-array technology used to provide you AncestryHealth® test results free of charge from your DNA test settings page. If you have purchased AncestryHealth® with next generation sequencing (“NGS”), there may be additional charges to download your NGS DNA Data once the download feature becomes available.
16.5. What Are Ancestry’s Retention Practices for the AncestryHealth® Service?
Ancestry will retain the Personal Information you provided to the AncestryHealth® Service until you tell us to delete it. This is to ensure that you always have access to your test results, health reports, and to the physician network service which is included as part of the AncestryHealth® Service. In addition, if you have purchased an update to the AncestryHealth® Service, you may be entitled to receive results to new tests as they become available, and Ancestry will need access to your Personal Information in order to provide this service.
Ancestry provides this California Resident Additional Privacy Statement (“California Statement”), applicable solely to California residents, as a supplement to our Privacy Statement, to provide information as to how you may exercise your rights under the California Consumer Privacy Act (“CCPA”). This California Statement covers all Ancestry websites, services, and mobile apps that link to this California Statement, including: Ancestry®, AncestryDNA®, AncestryHealth®, Fold3®, Newspapers.com™, Archives®, We Remember®, and Find a Grave® (throughout, collectively, as applicable “Ancestry” “we” or “our”). It applies to the Personal Information (defined above) we collect from your use of our Services and through any other means by which you engage with us.
Ancestry collects, and has collected in the 12 months prior to the effective date of this California Statement, the following categories of Personal Information:
- Identifiers, such as name, postal address, unique personal identifier, online identifier, Internet Protocol address, your mobile device identifier, email address, account name, driver’s license.
- Categories of personal information described in subdivision (e) of Section 1798.80 not covered by an existing category (medical information, physical characteristics or descriptions).
- Characteristics of protected classes under California or federal law, such as biological sex and year of birth, and, if you are an AncestryDNA® or AncestryHealth® customer, medical conditions. This also includes any other User Provided Content (defined above) you choose to share with us that is considered a legally protected class under California or federal law.
- Commercial information, such as products or services purchased, obtained, or considered or other purchasing or consuming histories or tendencies.
- Biometric information, such as DNA Data (defined above).
- Internet usage information, such as your browsing history, search history, and information regarding your interaction with our sites and advertisements (also described above).
- Geolocation data, such as location of your device or computer and any metadata associated with digital photographs uploaded to Find a Grave®, including the location, date, and time the photo was taken.
- Sensory data, such as audio, electronic, and visual information (e.g., recordings of calls with Ancestry Member Services or information you voluntarily share when doing consumer insights research with us).
- Inferences derived from Personal Information, such as to suggest familial relationships and to create consumer profiles for the purposes of research, product development and marketing. Please note as stated in Section 17.6 below, we do not sell your Personal Information.
Note that some categories of information are collected only if you use certain of our Services.
17.2 Business Purposes
Ancestry uses the categories of Personal Information described in Section 17.1 for the following business purposes:
- Providing, personalizing, improving, updating, and expanding Ancestry’s Services;
- Communicating to you about the Services; and
- Marketing new products and offers from us or our business partners based on your interests.
17.3 Categories of Sources of Personal Information
Ancestry collects, and has collected in the 12 months prior to the effective date of this California Statement, categories of Personal Information described in Section 17.1 from the following categories of sources:
- You, our user/visitor—this source of Personal Information depends on your use of the Services, including your User Provided Content (defined above);
- Our affiliates, including, but not limited to our related brands: AncestryDNA®, AncestryHealth®, Fold3®, Newspapers.com™, Archives®, We Remember®, and Find a Grave®;
- Public records;
- Historical records; and,
- Third parties.
17.4 Categories of Third-Parties with Whom We Share Personal Information
Ancestry shares, and has shared in the 12 months prior to the effective date of this California Statement, with the following categories of third parties the correlating categories of Personal Information:
|Categories of Third-Parties with whom We Share Personal Information||The Categories of Personal Information We Share|
|Other Ancestry Users (if you shared your Personal Information on Ancestry||
|Our affiliates, including, but not limited to our related brands: AncestryDNA®, AncestryHealth®, Fold3®, Newspapers.com™, Archives®, We Remember®, and Find a Grave®||
|Service Providers - AncestryHealth®||
|Service Providers - all other Ancestry brands||
|Research Partners||Refer to the Informed Consent to Research for information on what is shared with research partners, which may include:
|Law Enforcement or Other Regulatory Bodies||We do not voluntarily share your Personal Information with law enforcement or regulatory bodies. We require a valid legal process as described in Section 7 above before we would provide any data to law enforcement. For information on what data has been shared, see our bi-annual Transparency Report.|
17.5 Exercising Your Rights Under CCPA.
17.5.1 Exercising Your Rights Under CCPA. The CCPA gives California consumers the right to request that we disclose what Personal Information we collect, use, disclose, or sell. This includes the right to request the categories of Personal Information we have collected about them, the categories of sources of Personal Information, the business purpose for collecting Personal Information, the categories of third parties with whom we share categories of Personal Information, and the specific pieces of Personal Information we have collected about the requestor.
If you are submitting a request to know on your own behalf, there are two ways to make your request: online or by email.
To submit your request to know online:
- Log into your Ancestry account.
- Go to your Account Settings.
- Click on “Help”, then click “Download account data” and follow those instructions.
For your convenience, here are step-by-step instructions on how to download your account data.
To email your request to know, email us at [email protected]. We are required to verify your identity before providing you with a copy of your data. We will require you to provide proof of identity and California address (e.g., you may be required to provide a copy of your government ID, which will be used solely to verify your identity and address).
Please note: In response to a request to know under the CCPA, we will not provide unique biometric information to you. Your DNA Data belongs to you and you may download it at any time. If you download your DNA Data, you do so at your own risk. Learn how here.
If you are an “Authorized Agent” pursuant to the CCPA and are submitting a request to know on behalf of one of our users, see Section 17.5.3 below.
17.5.2 Right to Delete. The CCPA gives California consumers the right to request that we delete your Personal Information.
If you are submitting a request to delete on your own behalf, there are two ways to make your request: online or by email. Note that to delete your Personal Information, you must delete your account and that once an account deletion request is completed, this process is irreversible. Your information (including, but not limited to, family trees, records, photos, DNA Data and AncestryHealth® results) will be permanently deleted.
To submit your request for deletion online:
- Log into your Ancestry account.
- Go to your Account Settings.
- Click on “Help”, then click “Delete Account” and follow those instructions.
For your convenience, here are step-by-step instructions on how to delete your account.
To email your request to delete, email us at [email protected]. We are required to verify your identity before we delete your data. We will require you to provide proof of identity and California address (e.g., you may be required to provide a copy of your government ID, which will be used solely to verify your identity and address).
If you are an “Authorized Agent” pursuant to the CCPA and are submitting a request to know on behalf of one of our users, see Section 17.5.3 below.
17.5.3 Authorized Agents. The CCPA allows California residents to use “authorized agents” to make requests to know and requests for deletion. To use an authorized agent, email us at [email protected]. Note that even if a consumer chooses to use an authorized agent for a request, the consumer will still need to work directly with us to provide items 3 and 4 below:
- Proof that the authorized agent is registered with the Secretary of State to conduct business in California.
- Signed permission from the consumer allowing the authorized agent to act on the consumer’s behalf.
- Verification of the consumer’s identity (to be made directly by the consumer to us). We will require proof of identity and California address (e.g., a copy of your government ID, which will be used solely to verify your identity and address).
- Confirmation that the consumer provided the authorized agent permission to submit the request to be confirmed directly by the consumer to us.
Please note: In response to a request to know under the CCPA, we will not provide unique biometric information about the consumer to an authorized agent or to the consumer. If the consumer wants to download DNA Data, see Section 17.5.1 above.
17.7 Non-discrimination. We will not discriminate against you for exercising any of your rights under the CCPA.
17.8 California’s Shine the Light Law. California Civil Code Section 1798.83, known as the “Shine the Light” law, permits Users who are California residents to request and obtain from us a list of what Personal Information (if any) we disclosed to third parties for their direct marketing purposes in the preceding calendar year and the names and addresses of those third parties. Requests may be made only once a year and are free of charge. Under Section 1798.83, Ancestry currently does not share any Personal Information with third parties for their own direct marketing purposes.
17.9 Annual Reporting. Click to see our annual, global Right to Know/Subject Access and Right to Delete requests.
17.10 Contact Us. If you have questions about our CCPA or California-related privacy policies or practices, please contact us at [email protected].