Indiana § 24-4-24-9 - Acts of consumer genetic testing provider requiring consent of consumer

§ 24-4-24-9. Acts of consumer genetic testing provider requiring consent of consumer

Sec. 9. (a) A consumer genetic testing provider that performs, or causes to be performed, genetic testing on an individual's biological material may not take any of the following actions unless the provider has solicited and received the individual's freely given, specific, informed, and unambiguous consent to the action:

(1) Perform, or cause to be performed, any testing or analysis of the individual's biological material that is not requested by the individual except as required to comply with state and federal law.

(2) Use the individual's biological material for any use other than the genetic testing requested by the individual.

(3) Subject to section 10(b) of this chapter, provide access by a third party to:

(A) the individual's biological material; or

(B) data, other than deidentified data, resulting from genetic testing performed on the individual's biological material.

(4) Retain the individual's biological material for more than thirty (30) days after the performance of the genetic testing requested by the individual, except as required to comply with state or federal law.

(5) Retain data, other than deidentified data, resulting from genetic testing performed on the individual's biological material for more than thirty (30) days after the completion of the service except as required to comply with state and federal law.

(6) Disseminate advertising or marketing communications to the individual based on the individual's genetic testing results.

(7) Provide information regarding the individual's:

(A) solicitation and use of the provider's genetic testing services; or

(B) use of the provider's:

(i) website; or

(ii) other remote or virtual services;

associated with the provider's genetic testing services;

to a third party to enable the third party to disseminate advertising or marketing communications to the individual.

(b) A provider's solicitation of an individual's consent to an action described in subsection (a) must:

(1) describe the action in terms that are sufficiently clear and concise as to be reasonably understandable by a person of ordinary intelligence; and

(2) solicit the individual's consent to the action separately from a solicitation of the individual's consent to any other action described in subsection (a).

(c) Consent to an action under subsection (a) is not freely given, specific, informed, and unambiguous if the consent is provided by any of the following means:

(1) The individual's inaction.

(2) The individual's acceptance of:

(A) general or broad terms of service; or

(B) any other document requiring agreement by an individual using the provider's services;

containing information unrelated to the action under subsection (a).

(3) The individual closing, muting, pausing, or hovering a computer cursor over a piece of content.

(4) The individual's communication of consent through an Internet user interface that is designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice.

As added by P.L.233-2025, SEC.2.