1. (a) A consumer genetic testing provider that performs, or causes to be performed, genetic testing on an individual's biological material shall do the following:

   1. (1) Implement commercially reasonable security measures to protect:

      1. (A) the individual's biological material; and

      2. (B) data resulting from genetic testing performed on the individual's biological material;

         from unauthorized access, destruction, use, modification, or disclosure.

   2. (2) Allow the individual access to any data resulting from genetic testing performed on the individual's biological material.

   3. (3) Provide the following:

      1. (A) A procedure by which the individual can revoke any consent provided by the individual under section 9 of this chapter. The procedure must enable the individual to communicate the revocation:

         1. (i) directly to the provider; and
         2. (ii) through one (1) or more means, at least one (1) of which must be the primary means by which the provider communicates with the individual.

      2. (B) Both:

         1. (i) notice of the existence of; and

         2. (ii) instructions regarding the use of;

            the procedure under clause (A) that are sufficiently clear and concise as to be reasonably understandable by a person of ordinary intelligence.

   4. (4) Comply with a revocation of consent by the individual not later than thirty (30) days after the individual communicates the revocation to the provider, including by:

      1. (A) destroying the individual's biological material not later than thirty (30) days after the individual revokes the individual's consent to the provider's retention of the biological material under section 9(a)(4) of this chapter; and
      2. (B) destroying any data resulting from genetic testing performed on the individual's biological material not later than thirty (30) days after the individual revokes the individual's consent to the provider's retention of the data under section 9(a)(5) of this chapter.

   5. (5) Provide a third party with access to the individual's biological material, or to data resulting from genetic testing performed on the individual's biological material, only under contractual terms that prohibit the third party from:

      1. (A) using the biological material or data for any use to which the individual has not consented under section 9 of this chapter;
      2. (B) providing another party with access to the biological material or data; or
      3. (C) retaining the biological material or data longer than the provider is authorized to retain the biological material or data under this chapter.

   6. (6) Ensure that:

      1. (A) any advertising or marketing communications sent to the individual as a result of the individual's:

         1. (i) solicitation and use of the provider's services; or

         2. (ii) use of the provider's website or other remote or virtual services;

            are clearly and prominently denoted as advertising or marketing materials; and

      2. (B) advertising or marketing communications described in clause (A) that are sent by a third party clearly and prominently:

         1. (i) identify the third party; and
         2. (ii) notify the individual that any claims made in the advertising or marketing communications have not been evaluated by the provider.

2. (b) A consumer genetic testing provider may not provide data, other than deidentified data, resulting from genetic testing performed on an individual's biological material to:

   1. (1) an insurer;
   2. (2) a person that, in the ordinary course of the person's business, provides information or data to insurers for the purposes of underwriting or rating of risks; or

   3. (3) a person that employs the individual;

      regardless of whether the individual has consented to the provider providing third parties with access to the data under section 9(a)(3) of this chapter.

3. (c) A consumer genetic testing provider may not charge a fee for the provision of biological material or for the provision of data resulting from genetic testing performed on biological material:

   1. (1) to a law enforcement agency on the basis of a search warrant; or

   2. (2) as required by a court order;

      that is more than the actual cost, not including labor costs or overhead costs, to the consumer genetic testing provider of providing the material or data.

As added by P.L.233-2025, SEC.2.