Web Design in Huntsville for DNA Test Kits Sold Under Alabama’s Genetic Privacy Act

Updated November 2026 · Written and maintained by the Progression Agency strategy team

A customer orders a saliva kit, and the checkout shows one box: I agree to the terms. Since October 1, 2024, the Alabama Genetic Data Privacy Act has asked a genetic testing company for much more than that box: notices shown up front, consents taken once at order, consents taken every time, and research consent under federal human subjects rules. Web design in Huntsville for a startup on the HudsonAlpha campus that sells tests to the public starts with those tiers, each placed where a customer meets it. Progression’s team works from New York, designs Huntsville sites remotely, and travels for an on-site session when a client asks.

One checkbox that tries to say yes to everything

A customer orders a saliva kit for ancestry and wellness reports. The checkout asks for one thing: a box that says I agree. Behind that box sit the terms, the privacy policy, research use and marketing.

The Act turns that one box into separate permissions, and a site has a place for each. Section 3 lists notices, initial consents, consents taken every time, informed consent for research, written consent before an insurer or employer sees anything, and the controls a customer can use afterward.

• One box cannot carry notices, consents and research use together.
• Each permission has its own place on the site.
• The order of the screens matters as much as the wording.
• Counsel decides whether the Act covers the company at all.

Web design in Huntsville for what the Act calls a genetic testing company

The Alabama Genetic Data Privacy Act defines a genetic testing company as any person, other than a health care provider, that directly solicits a biological sample from a consumer for analysis in order to provide products or services that disclose information such as genetic links to certain populations by ethnicity or geography, probable relationships to others from matching DNA, or wellness recommendations tied to genetic markers. A consumer is any individual who is an Alabama resident.

The Act does not apply to everyone. Section 5 excludes covered entities and business associates under the federal health privacy rules, noncommercial collection and research by colleges and universities and the entities they own or run, and samples lawfully obtained by law enforcement in a criminal investigation. Health care providers fall outside the definition of a genetic testing company. The plain advice is to confirm with counsel whether the company is covered before the site is drawn.

HudsonAlpha says its campus sits in Cummings Research Park, where more than 1,100 people work across the institute and more than 45 associate companies. HudsonAlpha’s Locate page also says Alabama is home to more than 550 bioscience companies. For a startup in that setting, web design in Huntsville begins with the Act’s definitions, because they decide which screens a site needs.

Does a clinic that orders tests for patients count?

Health care providers are outside the definition. Whether a particular business is covered is a question for counsel.

Does the Act cover only Alabama customers?

It speaks of consumers who are Alabama residents. A site that sells to people in many states should ask counsel how the Act applies.

Four notices a customer sees before the kit ships

Section 3(a)(1) says a company must prominently display, in plain language, complete information about how it collects, uses, keeps and discloses genetic data. The Act lists four items.

The complaint line links the Attorney General’s Consumer Complaint page by name. The plain advice is that the overview sits where a customer decides to buy and the full notice sits one click away, so no one has to hunt for either.

• Put the overview on the product page and the order page.
• Keep the full notice one click from the overview.
• Show the research notice next to the overview.
• Link the complaint page in the footer and the account area.

The Act’s consent tiers, each drawn as its own screen

Each tier has its own screen, its own wording and a place on the path. The table gives the section, when the customer meets it, the element that asks and what it stays apart from.

Order screen: four permissions before payment

Section 3(a)(2) asks for the consumer’s initial express consent to use the sample and data for the product ordered, to identify who may have access, including a contractor, to retain the sample and data for future testing, and to acknowledge that the company may later seek consent to transfer. The order screen gives each one a box.

Prompts that come back each time the use changes

Express consent is taken every time the company transfers the sample or discloses data to a third party other than a contractor for a reason other than fulfilling an order, uses the sample or data for another purpose, or markets to the consumer based on genetic data. Each time is a new prompt, with a choice that is easy to decline.

Research consent under the Common Rule

Informed consent in compliance with 45 C.F.R. Part 46 is needed to transfer a sample or disclose data for independent third-party research, or for research the company sponsors for product development, scientific publication or promotion of the company. It has its own screen and never rides on the order.

Insurers and employers wait for written consent

Section 3(c) bars disclosure to a person issuing health, life, disability or long-term care insurance, or to an employer or prospective employer, without express written consent. A signed form that names the recipient is the plain way to hold that line.

• Give every tier its own screen.
• Never pre-tick a box.
• Keep research consent apart from the order.
• Send a dated confirmation after each choice.

Pricing a consent-led test kit site

A kit site is a business site with an order screen, an account area and a set of fixed texts. The market figures below cover the web work around them. Pricing depends on scope and is set in the written proposal.

Progression’s listed build prices

These are the fixed-scope prices on our website design and development page. Each is a starting price, and the proposal sets the final scope.

A test kit sells through a checkout, so most of these sites sit near the ecommerce builds. Our ecommerce website design page covers catalogs and checkouts in general.

When a follow-up email counts as marketing under the Act

Section 3(a)(3)(c) asks for express consent each time the company markets to the consumer based on genetic data, or lets a third party market to the consumer based on the consumer having bought a genetic testing product. Marketing does not include customized content or offers on the company’s own websites, applications or services with the first-party relationship.

The plain advice is to keep ad platform pixels and audience exports off results pages and order pages unless that consent exists. A retargeting list built from kit buyers is the kind of thing the Act speaks to. Every retargeting question goes to counsel.

Do ads on the company’s own site count?

The Act says customized content or offers on the company’s own websites, applications or services with the first-party relationship are not marketing. Counsel can say where the line falls for a given offer.

• Keep pixels off results and order pages.
• Keep audience exports off any list built from kit buyers.
• Treat offers on the company’s own site as a separate question.
• Send every retargeting question to counsel.

Access, delete, destroy and revoke, one tap each

Section 3(a)(5) asks for a process for the consumer to access genetic data, delete the account, request destruction of the sample and data, and revoke any consent. If a customer asks for destruction, the company complies as soon as reasonably possible and no more than 30 days after the request.

If a customer revokes a consent that led to a transfer to a third party, the company secures the return of the sample and the data as soon as reasonably possible, and no more than 60 days after the revocation. The plain advice is self-serve buttons in the account area, a dated confirmation email, and a request log the team can read.

Can a customer change a choice later?

Yes. Revoking any consent given is one of the four controls, and the account area is where the customer finds it.

• Put the four controls in the account area.
• Send a dated email for each request.
• Keep a log of requests and replies.
• Review the log against the 30 and 60 day limits.

Labs and contractors named where the customer can find them

The order screen tells the customer who may have access to the sample, data and results, including a contractor. Section 4 says the contract with a contractor, including a laboratory, bars use, retention or disclosure for any other purpose, and the contractor carries the same confidentiality obligation.

The plain advice is a short panel titled something like who handles your sample, and its wording matches the contracts. This page names no laboratory and no vendor, and a site’s panel names the ones it uses.

• Name each contractor on the panel.
• Match the panel to the signed contracts.
• Update the panel when a contractor changes.
• Keep the panel one click from the order screen.

A transparency page for law enforcement requests

Section 3(b) lets a company disclose genetic data under valid legal process and says it may publish a transparency report on the number and types of requests it receives. How to respond to any request goes to counsel.

A transparency page is a plain table of counts by request type and period. It is optional under the Act, and it tells customers the company keeps count.

Is a transparency report required?

The Act says a company may publish one. Whether to do so is a decision for the company and its counsel.

• Decide with counsel whether to publish a report.
• Count requests by type and period.
• Keep the page short and dated.
• Send any individual request to counsel.

Who enforces the Act, and where a complaint starts

Section 6 says any consumer may report a violation to the Consumer Division of the Office of the Attorney General. The Division may enforce the Act by a civil action to enjoin a practice or to recover a civil penalty of up to $3,000 for each violation, and the penalty and costs may be waived after full restitution.

The Attorney General’s Consumer Complaint page gives a Consumer Hotline at 1-800-392-5658 or 334-242-7335, and says complaints are processed in the order received. The Consumer Interest Division does not give legal advice. The Act is Act 2024-384, now Chapter 43 of Title 8 of the Code of Alabama 1975.

• Link the Attorney General’s complaint page.
• Describe how to file a complaint in plain words.
• Send legal questions to counsel.
• Keep the tone calm and factual.

Plain wording for people sharing health information

Health information a consumer reports about themself, for use with their raw sequence data, counts as genetic data under the Act. The words on the site should be plain and respectful.

Questions about health ask only what the test needs. Labels say why a question is asked. Nothing on the site implies a result, and no example shows one. A customer who skips an optional question is not stopped.

• Ask only what the test needs.
• Say why each question is asked.
• Make optional questions optional.
• Show no sample result.

A Primer Lab founder’s launch list

HudsonAlpha describes its Primer Lab as an incubator for early-stage entrepreneurs. A founder in that setting, or anywhere, can use a short list before the kit goes on sale. Web design in Huntsville, AL covers each line.

Our biotech website design page covers sites for the wider sector. For the state view, see our SEO company in Alabama page.

Who runs the list?

Someone who did not build the site, with counsel’s coverage answer in hand.

A team that builds a kit site should hand over these six numbers on one page, so a founder can see them without reading the Act.

Frequently asked questions