Your data, on demand.

Five rights, one form, a 30-day clock. Whether you're a patient in California, a buyer in Berlin, or anywhere in between, this is where you submit access, deletion, correction, portability, and opt-out requests. We honour them across all U.S. state laws and GDPR — at the same SLA, regardless of where you live.

SLA30 calendar days AuthenticationAccount login or notarized ID Cost$0 · always

— Pick a right

Five rights. Click one to see scope.

— Right to access

See everything we have

Copy of all personal data we hold tied to your account, in JSON + a human-readable PDF.

— Right to delete

Erase my account

Permanent deletion. We retain only what regulators require us to keep (order records, 7 years).

— Right to correct

Fix what's wrong

Update name, address, contact info, or attestations. Goes live in your account within 24 hours.

— Right to port

Take it elsewhere

Machine-readable export of all your account data, COA history, and order records in standard JSON.

— Right to opt out

Stop the marketing

No more email or SMS marketing. Transactional messages (order, shipping, COA) continue.

— Right to withdraw consent

Revoke permissions

Revoke any consent you previously gave (analytics cookies, scientific advisory survey, etc.).

— What happens after you submit

From request to resolution.

Submit

You complete the form. We email a ticket ID immediately and start the 30-day clock.

Day 0

Authenticate

If you submitted from a logged-in account, you're authenticated. Otherwise we send a verification email or — for sensitive requests — ask for notarized ID.

Day 0–2

Acknowledge

Within 10 days, a privacy officer confirms receipt, scope, and the expected resolution date.

By day 10

Resolve

Access requests: data exported and emailed. Deletion: confirmed in writing. Corrections: live in your account.

By day 30

Audit log

Every DSR request and resolution is logged for 24 months in our compliance audit trail. You can request a copy of your own log.

Permanent

Submit a request.

The form auto-populates with the right you picked. We'll route it to the privacy officer within one business day.

Right being exercised Full name Email on file Jurisdiction Notes (optional)

— Request received A privacy officer will email within 10 days.
Save this ticket ID — it's your reference for the 30-day clock.

DSR-2026-0000

— Legal coverage

What law covers what right.

Law	Who it covers	Rights granted	Element MD SLA
GDPR	EU / EEA residents	Access · delete · correct · port · object · restrict	30 days · extendable +60
UK-GDPR	UK residents	Same as GDPR	30 days
CCPA / CPRA	California residents	Access · delete · correct · port · opt-out · limit sensitive use	45 days · extendable +45
VCDPA	Virginia residents	Access · delete · correct · port · opt-out	45 days
CPA	Colorado residents	Access · delete · correct · port · opt-out	45 days
CTDPA	Connecticut residents	Access · delete · correct · port · opt-out	45 days
PIPEDA	Canadian residents (federal)	Access · correct · withdraw consent	30 days
Element MD default	Everyone else	Same six rights as above	30 days