(a) A direct–to–consumer genetic testing company shall provide a consumer with clear and complete information regarding the company’s policies and procedures for collecting, using, or disclosing genetic data, including: (1) A high–level overview of the company’s privacy policy that includes basic and essential information about how the company collects, uses, and discloses genetic data; and (2) A privacy notice that, at a minimum, includes information about the company’s data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices. (b) The information required to be provided under subsection (a) of this section shall be: (1) Made publicly available; and (2) Placed in a prominent area of the direct–to–consumer genetic testing company’s website.
Maryland Legal Code