Sends faxes, in Kentucky

Destruction of customer's records, KRS 365.725 · Read the law's page

• Applies to a business: a sole proprietorship, partnership, corporation, limited liability company, association, or other entity, whether or not operated for profit, including an entity that destroys records. It does not include a bank, credit union, savings association, or association as KRS 365.720 defines each by reference to federal banking law and KRS Chapter 286.
• When you dispose of, other than by storage, any customer's records that are not required to be retained, take reasonable steps to destroy, or arrange for the destruction of, the portion of the records containing personally identifiable information, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or indecipherable through any means.

Genetic Information Privacy Act, 2022 Ky. Acts ch. 169, sec. 1 · Read the law's page

• If you are a direct-to-consumer genetic testing company, make available to a Kentucky consumer a high-level privacy policy overview and a prominent, publicly available privacy notice that covers at least your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices (KRS 311.705(2)(a)).
• Obtain a consumer's initial express consent that clearly describes the uses of the genetic data collected through the product or service and says who has access to the results and how the data may be shared (KRS 311.705(2)(b)1.).
• Obtain separate express consent before transferring or disclosing a consumer's genetic data to any person other than your vendors and service providers, or using it beyond the primary purpose of the testing and inherent contextual uses (KRS 311.705(2)(b)2.).
• Obtain separate express consent before retaining any biological sample after the initial testing service the consumer requested (KRS 311.705(2)(b)3.).
• Obtain informed consent in compliance with the Federal Policy for the Protection of Human Subjects before transferring or disclosing a consumer's genetic data to third parties for research, or using it in research under your control for publication or generalizable knowledge (KRS 311.705(2)(b)4.).
• Obtain express consent before marketing to a consumer based on the consumer's genetic data, or before a third party markets to a consumer because the consumer ordered or bought a genetic testing product or service. Customized content on your own websites, applications or services is not marketing (KRS 311.705(2)(b)5.).
• Require valid legal process before disclosing a consumer's genetic data to law enforcement or any other government agency, unless the consumer gives express written consent (KRS 311.705(2)(c)).
• Develop, implement and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use or disclosure (KRS 311.705(2)(d)).
• Let a consumer access their genetic data, delete their account and genetic data, and request and obtain destruction of their biological sample (KRS 311.705(2)(e)).
• Do not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent (KRS 311.705(3)).