UNITED STATES OF AMERICA 

FEDERAL TRADE COMMISSION 

WASHINGTON, D.C. 20580 

Office ofthe Secretary 

September 6, 2023 

John Davisson, Director of Litigation & Senior Counsel 

Suzanne Bernstein, Law Fellow 

Electronic Privacy Info1mation Center 

1519 New Hampshire Ave. NW 

Washington, DC 20036 

Re: JHealth.io Inc., also d/bla Vitagene, Inc., File No. 1923170 

Dear Mr. Davisson and Ms. Bernstein: 

Thank you for your comment regarding the Federal Trade Commission's ("FTC" or 

"Commission") proposed consent agreement in the above-titled proceeding against lHealth.io 

Inc., also d/b/a Vitagene, Inc. ("Vitagene"). The Commission has placed your comment on the 

public record pursuant to rnle 4.9(b)(6)(ii) ofthe Commission 's Rules of Practice, 16 C.F.R. § 

4.9(b)(6)(ii). Your comment discusses impo1i ant issues, and we have given it serious 

consideration. 

EPIC's comment suppo1is the proposed consent agreement, focusing in particular on the 

importance ofprivacy and security protections for consumers' sensitive health and genetic data. 

EPIC's comment highlights in paiiicular the proposed order's mandated data security program 

and mandated repo1i ing of "Covered Incidents" to the Commission. The comment emphasizes 

the impo1i ance of addressing unauthorized exposure of consumers' health info1m ation both 

through enforcement ofSection 5 ofthe FTC Act, 15 U.S.C. § 45(a), and through the 

Commission's Health Breach Notification Rule, 16 C.F.R. Part 318. 

We appreciate EPIC's suppo1i ofthe proposed consent agreement. The Commission will 

continue to use both its unfairness and deception authority under Section 5 of the FTC Act and 

the Health Breach Notification Rule, as appropriate, to protect consumers' privacy. This matter 

is a case in point. The Commission 's complaint against Vitagene alleges that the company 

engaged in deceptive and unfair practices in violation of Section 5. Specifically, the complaint 

alleges that Vitagene misrepresented its data security and privacy practices involving consumers' 

genetic info1mation (regai·ding industry security standards, storing DNA results with identifying 

info1mation, data deletion, and saliva sample destruction) and made unfair material retr·oactive 

changes to its privacy policy regai·ding shai·ing ofconsumers' sensitive personal info1mation 

with third paiiies. 
 

 

 

 

 

 

 

 

The proposed consent agreement is specifically tailored to hold Vitagene accountable for 

its violative conduct and to require better prospective practices. Specifically, the proposed 

consent agreement requires Vitagene to instruct third parties that received genetic samples to 

destroy them and to obtain consumers’ affirmative express consent before disclosing their 

personal information to third parties. Under the proposed order, Vitagene must notify the 

Commission of any “Covered Incident,” which includes any exposure of consumers’ health 

information without authorization. In addition to requiring Vitagene to pay monetary relief that 

the Commission intends to use to provide partial redress for consumers, the proposed consent 

agreement mandates that Vitagene implement a comprehensive security program that includes 

strong safeguards to protect the security, confidentiality, and integrity of consumers’ personal 

information and is subject to assessments by an independent third party. The proposed consent 

agreement prohibits Vitagene from misrepresenting its privacy and security practices, including 

(among other things) the extent to which it meets or exceeds industry standards, stores 

individually identifiable health information, deletes or destroys samples or information, or has 

received approval or authorization from a government agency for its claims, products, or 

services. 

The Commission is committed to enforcing compliance with its orders, including the 

order in this proceeding. If Vitagene violates the Commission’s final order, the Commission 

may seek civil monetary penalties of over $50,000 per violation pursuant to Section 5(l) of the 

FTC Act. If, in the future, you have specific information suggesting that Vitagene is not 

maintaining reasonable privacy or security of user information, please contact the FTC at (877) 

382-4357, or file a report online at https://reportfraud.ftc.gov. 

The Commission has determined that the public interest would best be served by issuing 

the complaint and Decision and Order in the above-titled proceeding in final form without any 

modifications. The final Decision and Order and other relevant materials are available from the 

Commission’s website at http://www.ftc.gov. It helps the Commission’s analysis to hear from a 

variety of sources in its work, and it thanks you again for your comment. 

By direction of the Commission. 

April J. Tabor 

Secretary 

2