1. Introduction

1.1 Background

Direct-to-consumer (DTC) genetic testing services have proliferated worldwide, enabling individuals to access genetic information about ancestry, disease risk, and personal traits without the direct involvement of healthcare professionals [1]. Although these services promise empowerment and personalized insights, they raise serious legal and ethical questions, particularly around data privacy and the potential for genetic discrimination [2]. Globally, many consumers remain unaware of how their genetic data is handled, stored, and potentially shared with third parties, including insurers, pharmaceutical companies, or other commercial entities [3].

In Saudi Arabia, the uptake of DTC genetic tests reflects increasing public interest in personalized health solutions and ancestry exploration [4]. However, the Kingdom’s regulatory structures and policies specific to commercial genetic testing remain nascent, even as the Saudi Data & AI Authority (SDAIA) and the Ministry of Health promulgate the Personal Data Protection Law (PDPL) [5]. The amended PDPL defines genetic data and includes provisions on international transfers (Articles 1 and 29); applicability to particular consumer testing and practices requires a dated legal analysis. Ethical guidelines for genetic testing in Saudi Arabia mostly focus on clinical scenarios, with less clarity regarding consumer-based tests that often bypass healthcare providers [7].

1.2 Legal and Ethical Gaps

Prevailing ethical considerations highlight the potential for genetic data misuse when tests are offered directly to consumers [8]. Issues include informed consent, autonomy, confidentiality, and the right to not know one’s genetic predispositions [9]. In the Saudi context, additional concerns arise from socio-cultural norms that stress family privacy, religious considerations, and societal acceptance of genetic conditions [10,11]. The lack of explicit provisions under the PDPL regarding genetic data storage, re-identification risks, and cross-border data flow intensifies the risk of privacy breaches [12]. Moreover, consumers may not fully understand the implications of consenting to broad data usage, which can involve indefinite storage and secondary research [13].

Despite a growing body of international literature on DTC genetic testing, empirical data about real-world usage and privacy outcomes in Saudi Arabia remain limited. National health authorities have not systematically tracked the prevalence of DTC test usage or the scope of associated privacy breaches [14]. This lack of data hinders informed policy development and the establishment of best practices for safeguarding genetic information.

1.3 Study Aims

We undertook a retrospective observational study to quantify DTC genetic test usage among patients at four major tertiary hospitals in Saudi Arabia over a five-year period. We aimed to:

• Determine the prevalence and patterns of DTC test usage, including test types and patient demographics.

• Identify reported and documented cases of privacy breaches or concerns related to DTC genetic testing.

• Examine the association between institutional or commercial test practices (e.g., counseling, consent forms, data sharing policies) and the incidence of privacy-related complaints or breaches.

• Evaluate existing legal and ethical frameworks to highlight policy gaps that may compromise patient genetic privacy.

1.4 Significance

Findings from this study are expected to inform national regulatory bodies, including SDAIA and the Ministry of Health, on the practical implications of emerging DTC genetic services. By identifying where current policies fail to protect consumers, stakeholders can propose targeted interventions and strengthen the legal environment for genetic privacy [15]. This is especially critical as Saudi Arabia invests heavily in genomic research and personalized medicine initiatives under Vision 2030 [16]. Robust legal and ethical protections are essential to uphold patient rights and foster public trust in genetic advancements [17].

Figure 2: Assessing Legal and Ethical Gaps in Direct-to-Consumer Genetic Testing in Saudi Arabia

2. Methods

2.1 Study Design and Setting

We conducted a retrospective observational study in four leading tertiary hospitals in Riyadh, Jeddah, Dammam, and Abha. These hospitals are known referral centers for specialized care and have integrated electronic health record (EHR) systems, making them ideal for data collection [18]. The study period spanned January 2018 to December 2023. We followed the Strengthening the Reporting of Observational Studies in Epidemiology (STROBE) guidelines [19].

2.2 Inclusion and Exclusion Criteria

We included:

• Adult patients (≥18 years) who self-reported or provided records of having undergone DTC genetic testing (e.g., ancestry tests, health risk screening) from commercial providers.

• Patients with documented inquiries or complaints about privacy or data usage related to their genetic tests.

We excluded:

• Non-Saudi residents or international visitors without follow-up in these hospitals.

• Patients who underwent solely clinician-ordered genetic tests, as these typically fall under established medical guidelines rather than DTC frameworks.

2.3 Data Sources and Variables

Electronic Health Records (EHRs): We extracted clinical information (age, gender, diagnosis codes) to identify patients who referenced DTC tests in their medical history. EHR notes also recorded patient-stated concerns (if any) and whether genetic counseling was provided. Inquiry Logs and Complaints: Each hospital’s patient affairs department maintains records of complaints and inquiry logs. We captured any privacy-related complaint about DTC testing, cross-referencing with the patient’s EHR data. Commercial Test Data: Through a collaboration with selected DTC companies (approved by hospital IRB), we accessed de-identified data about test types (ancestry, health risk screening, pharmacogenetics) and presence or absence of personalized privacy policies.

Outcome Variables:

• Primary Outcome – Reported privacy breach or complaint (binary).

• Secondary Outcomes – Patient-reported concern (yes/no), type of privacy concern (data sharing with third parties, re-identification risk, unclear consent).

Predictor Variables:

• Demographics: Age, gender, region.

• Test Type: Ancestry, health screening, or both.

• Counseling: Whether formal genetic counseling was received (yes/no).

• Consent Form Completeness: Assessed by presence of a detailed privacy notice in the test kit or company portal (complete vs. incomplete).

• Data Sharing Policy: Evidence of data transfers to third parties (yes/no).

2.4 Sample Size and Rationale

We anticipated that about 3,000 patients might meet our inclusion criteria based on hospital administrative data from prior years. To detect an odds ratio of at least 1.5 for privacy breaches associated with incomplete consent forms with 80% power and α=0.05, we estimated requiring approximately 2,500 participants [20]. Ultimately, 3,542 eligible patients were included, providing sufficient power for all planned analyses.

2.5 Statistical Analysis

We performed descriptive statistics (mean, standard deviation, frequency) to summarize demographics, test type distribution, and outcomes. Chi-square tests assessed associations between categorical variables (e.g., incomplete consent forms vs. privacy complaints). Student’s t-tests or ANOVA compared group means where appropriate.

For multivariable analysis, we used logistic regression to examine predictors of privacy-related complaints or breaches (the dependent variable). We included demographics, counseling, consent form completeness, and data sharing policy as independent variables. Adjusted odds ratios (aOR) were reported with 95% confidence intervals. To address missing data (ranging from 2–6% per variable), we applied multiple imputation using chained equations [21]. Five imputed datasets were created, and estimates were pooled.

All statistical analyses were conducted using SPSS (version 27.0). A p-value <0.05 was considered significant.

2.6 Ethical Approval

The Institutional Review Board (IRB) of King Faisal University (IRB#KFU-GEN-2024-R1) granted approval. Data were obtained in a de-identified format to protect patient identity, and this retrospective study adhered to the principles of the Declaration of Helsinki. Patients were not contacted directly; we solely used archived records and complaints logs.

3. Results

3.1 Participant Characteristics

From a total of 3,542 patients, the mean age was 34.9 years (SD = 8.3), with a range of 18–76. The cohort was 54% female (n=1,913) and 46% male (n=1,629). Table 1 presents baseline characteristics. The majority (64%) underwent ancestry-focused tests, 25% used health risk screening tests, and 11% combined both.

Table 1. Baseline Participant Characteristics (N=3,542)

3.2 Privacy Concerns and Breaches

Overall, 762 patients (21.5%) raised explicit concerns about data privacy. Among these, 324 (42.5%) worried about third-party data access, 198 (26.0%) about re-identification risks, and 240 (31.5%) about broad or unclear consent forms. Privacy breach incidents—where personal data was confirmed to be shared or exposed without consent—were identified in 48 cases (1.4%). Table 2 details the types of concerns/breaches.

Table 2. Types of Privacy Concerns and Breaches

3.3 Factors Associated with Privacy Complaints

Bivariate analyses (Table 3) showed that patients who received no genetic counseling had a higher rate of privacy complaints (25.0% vs. 19.1%, p=0.012). Similarly, incomplete or ambiguous consent forms were significantly linked to privacy complaints (32.2% vs. 16.4%, p<0.001). The presence of explicit data sharing clauses with third parties was also correlated with more complaints (28.5% vs. 18.3%, p=0.004).

Table 3. Bivariate Analysis of Privacy Complaints by Key Factors

3.4 Logistic Regression for Privacy Breach/Complaint

Multivariable logistic regression (Table 4) identified incomplete consent forms (aOR 2.01, 95% CI 1.10–3.51, p=0.023) as the strongest predictor of documented privacy breach. Receiving no counseling (aOR 1.66, p=0.045) was also significant. The presence of third-party data sharing clauses more than doubled the odds (aOR 2.77, p=0.009). Age, gender, and test type were not significant predictors in the final model.

Table 4. Multivariable Logistic Regression for Privacy Breach/Complaint

3.5 Policy and Ethical Review

We evaluated institutional policies and national legal directives in light of these findings. None of the four hospitals had mandatory guidelines for verifying DTC consent forms or data-sharing policies. Patients often approached clinicians only after receiving results. While PDPL is a broad data protection regulation, it lacks specific provisions addressing commercial genetic test kits’ obligations to inform Saudi consumers about data flows or usage limitations. Interviews with legal counsel revealed that enforcement mechanisms for noncompliant companies (especially those based abroad) remain untested.

3.6 Additional Tables and Sensitivity Analysis

We performed a sensitivity analysis excluding individuals (n=302) who purchased tests but never shared results with healthcare professionals. Exclusion did not significantly alter the logistic regression results, suggesting minimal selection bias. See Table 5 for a summary of sensitivity outcomes.

Table 5. Sensitivity Analysis Excluding Non-Reporting Participants

Finally, we analyzed the timeline of complaints (Table 6). Privacy issues peaked in 2021, potentially reflecting the COVID-19 era’s accelerated telehealth and digital testing growth.

Table 6. Yearly Distribution of DTC Privacy Complaints (2018–2023)

4. Discussion

Our retrospective analysis offers a comprehensive overview of DTC genetic testing uptake and associated privacy concerns in Saudi Arabia. The prevalence of privacy-related complaints (21.5%) is consistent with global studies indicating that roughly one in five DTC consumers expresses reservations about data sharing [22]. However, the confirmed breach rate (1.4%) is notable and may reflect both underreporting and limited regulatory oversight [23].

4.1 Incomplete Consent and Ethical Implications

A key finding is that incomplete or ambiguous consent forms more than doubled the odds of a reported privacy breach (aOR 2.01). Consent processes in DTC kits often use broad language granting the company rights to store and share data for research or commercial interests [24]. Many participants indicated they did not fully read or understand these lengthy legal documents [25,26]. This gap underscores the need for standardized, culturally appropriate consent forms that explicitly outline data usage, retention, and transfer to third parties [27,28].

4.2 Role of Genetic Counseling

This study highlights that patients who received genetic counseling were less likely to file privacy complaints, suggesting counseling helps clarify the scope and risks of DTC testing [29,30]. However, counseling opportunities are not integrated into DTC services, which largely bypass the clinical framework [31]. Mandating or incentivizing counseling, even if brief, could mitigate misunderstandings and enhance informed decision-making [32].

4.3 Legal Enforcement Vacuum

Although Saudi Arabia’s PDPL is a promising step toward data protection, its enforcement in the context of genetic information remains untested, particularly for foreign-based DTC companies [33,34]. Our interviews with hospital legal advisors indicated uncertainty about extraterritorial enforcement and the lack of explicit PDPL clauses addressing genetic data [35]. Practical next steps include issuing ministerial decrees or new regulations specifying compliance criteria for DTC companies operating in Saudi Arabia [36,37].

4.4 Limitations

As a retrospective study, we relied on documented patient-reported experiences. Not all individuals with privacy concerns necessarily reported them to the hospital [38]. Additionally, we could only capture privacy breaches corroborated by evidence in hospital or company records. Our collaboration was limited to selected DTC companies willing to provide partial data, which might bias results if other companies have different practices [39]. Future prospective studies or national registries could offer more accurate figures [40].

4.5 Recommendations

Policymakers should update legal frameworks to explicitly address DTC genetic testing, including:

• Mandatory In-Country Registration: Require DTC providers to register locally and submit data-handling protocols for approval [37].

• Standardized Consent Templates: Develop legally vetted, plain-language consent forms that specify data usage and opt-out procedures [27].

• Consumer Education Campaigns: Promote genetic literacy so consumers better understand the implications of DTC testing [30].

• Counseling Integration: Encourage or mandate at least minimal genetic counseling to clarify risks and benefits [32].

• Enforcement Mechanisms: Outline clear penalties for companies that violate privacy protections, and establish pathways for extraterritorial enforcement [34,36].

5. Conclusions

This study reveals that DTC genetic testing is on the rise in Saudi Arabia, yet current legal frameworks offer insufficient protection for genetic privacy. High rates of ambiguous consent, limited counseling, and uncertain enforcement mechanisms create ethical blind spots that leave consumers vulnerable. Clear, robust regulations targeted at DTC services, coupled with improved public awareness and integrated counseling, are vital steps to safeguard genetic data in this emerging industry. As Saudi Arabia pursues transformative healthcare initiatives under Vision 2030, ensuring genetic privacy will be essential for maintaining public trust and realizing the potential benefits of personalized genomics.

References

Phillips, A.M. (2016). Only a click away—DTC genetics for ancestry, health, love…and more: A view of the business and regulatory landscape. Applied & Translational Genomics, 8, 16–22. https://doi.org/10.1016/j.atg.2016.01.001.

Turrini, M. (2021). Consumers’ perspectives on direct-to-consumer genetic testing: Systematic review. Human Genomics, 15(2), 34–48.

Allyse, M., et al. (2018). What policy direction should the United States take to regulate direct-to-consumer genetic testing? AMA Journal of Ethics, 20(9), 887–894.

Mandil, A., et al. (2022). Trends in consumer genomics in the Middle East: Challenges and opportunities. Arab Journal of Genetics, 5(1), 11–21.

SDAIA. (2022). Personal Data Protection Law. Accessed at: https://sdaia.gov.sa/pdpl

Gaskell, G., et al. (2019). Policy and regulatory issues for direct-to-consumer genetic testing in Europe: A structured review. European Journal of Human Genetics, 27(11), 1632–1640.

Al Husain, F., et al. (2021). Ethical considerations for expanded carrier screening in the Saudi context. Journal of Genetic Counseling, 30(6), 1512–1521.

Hogarth, S., Javitt, G. (2020). Regulation of direct-to-consumer genetic testing: A global perspective. Annual Review of Genomics and Human Genetics, 21, 377–395.

Chokshi, D.A., et al. (2021). Informed consent and the expanding scope of genetic testing. Nature Medicine, 27(5), 766–769.

Tayeb, H., et al. (2020). Cultural attitudes towards genetic testing in the Gulf region: A scoping review. Ethics, Medicine and Public Health, 15, 100575.

Al-Aama, J.Y. (2021). Genetic services in Saudi Arabia: An overview and a personal perspective. Journal of Community Genetics, 12(2), 207–211.

Rabieh, N., et al. (2022). Data protection in the era of precision medicine in Saudi Arabia: Current status and future directions. Global Biosecurity, 3(1), 45–55.

Lye, G., et al. (2022). Secondary uses of genetic data in commercial databases: The consumer’s perspective. BMC Medical Ethics, 23(1), 112.

Ministry of Health Saudi Arabia. (2023). National Health Transformation Program. Accessed at: https://www.moh.gov.sa/

Kaan, T., et al. (2020). Addressing the gap: Legal frameworks for DTC genetic testing in Asia. Asian Bioethics Review, 12(4), 377–395.

Kingdom of Saudi Arabia Vision 2030. (2019). Healthcare transformation strategy. Accessed at: https://vision2030.gov.sa/

Alkuraya, F.S. (2022). Genomic medicine in Saudi Arabia. Genome Medicine, 14(1), 123.

Al-Tassan, N.A., et al. (2023). Multi-institutional EHR adoption in the Saudi healthcare system. JMIR Medical Informatics, 11(2), e36547.

von Elm, E., et al. (2007). The Strengthening the Reporting of Observational Studies in Epidemiology (STROBE) statement. PLoS Medicine, 4(10), e296.

Lewis, D.K., et al. (2021). Sample size and power considerations for logistic regression in observational studies. BMC Medical Research Methodology, 21(1), 52–60.

White, I.R., Royston, P., Wood, A.M. (2011). Multiple imputation using chained equations: Issues and guidance for practice. Statistics in Medicine, 30(4), 377–399.

Bowles, N., et al. (2021). Consumer attitudes towards DTC genetic testing: A meta-analysis. Journal of Community Genetics, 12(4), 539–552.

Hazel, J.W., Slobogin, C. (2018). Who knows what, and when?: A survey of the privacy policies of direct-to-consumer genetic testing companies. Cornell Journal of Law and Public Policy, 28(1), 35–66.

Zawati, M.H., et al. (2019). International survey of privacy laws for genetic data: Implications for direct-to-consumer testing. Human Genetics, 138(10), 1239–1250.

Rodriguez, L.L., et al. (2020). Plain language summary of privacy policies: Evaluating consumer comprehension. Genetics in Medicine, 22(12), 2026–2034.

Phillips, E., et al. (2021). The missing link: Integration of genetic counseling in direct-to-consumer genetic test services. Journal of Genetic Counseling, 30(4), 1011–1020.

De Paor, A. (2020). Global governance of personal genetic data: The challenge of DTC testing. Computer Law & Security Review, 39, 105493.

Alshamari, F., et al. (2023). Proposed amendments to strengthen the PDPL for genetic data protection in Saudi Arabia. Health Policy and Technology, 12(2), 200–210.

Smith, A.C., et al. (2019). A systematic approach to evaluating DTC genetic test offerings. Genetics in Medicine, 21(8), 1721–1728.

Al-Gazali, L., et al. (2021). Genetic counseling and ethical implications: Middle East perspective. Seminars in Medical Genetics, 187(2), 145–153.

Gronowski AM, Haymond S, Master SR. Improving Direct-to-Consumer Medical Testing. JAMA. 2017 Oct 24;318(16):1613. doi: 10.1001/jama.2017.13733. PMID: 29067414.

Vrecar I, Peterlin B, Teran N, Lovrecic L. Direct-to-consumer genetic testing in Slovenia: availability, ethical dilemmas and legislation. Biochem Med (Zagreb). 2015;25(1):84-9. doi: 10.11613/BM.2015.010. PMID: 25672471; PMCID: PMC4401315.

Jia JL, Polin DJ, Sarin KY. Emerging technologies for health information in dermatology: opportunities and drawbacks of web-based searches, social media, mobile applications, and direct-to-consumer genetic testing in patient care. Semin Cutan Med Surg. 2019 Mar 1;38(1):E57-E53. doi: 10.12788/j.sder.2019.002. PMID: 31051025.

McGovern DP, Kugathasan S, Cho JH. Genetics of Inflammatory Bowel Diseases. Gastroenterology. 2015 Oct;149(5):1163-1176.e2. doi: 10.1053/j.gastro.2015.08.001. Epub 2015 Aug 7. PMID: 26255561; PMCID: PMC4915781.

Flowers E, Leutwyler H, Shim JK. Direct-to-consumer genomic testing: Are nurses prepared? Nursing. 2020 Aug;50(8):48-52. doi: 10.1097/01.NURSE.0000684200.71662.09. PMID: 32618766; PMCID: PMC7410263.

Elson SL, Furlotte NA, Hromatka BS, Wilson CH, Mountain JL, Rowbotham HM, Varga EA, Francke U. Direct-to-consumer genetic testing for factor V Leiden and prothrombin 20210G>A: the consumer experience. Mol Genet Genomic Med. 2020 Nov;8(11):e1468. doi: 10.1002/mgg3.1468. Epub 2020 Sep 16. PMID: 32940023; PMCID: PMC7667316.

Ayala-Lopez N, Nichols JH. Benefits and Risks of Direct-to-Consumer Testing. Arch Pathol Lab Med. 2020 Oct 1;144(10):1193-1198. doi: 10.5858/arpa.2020-0078-RA. PMID: 33002154.

Trent R. Direct-to-consumer DNA testing and the GP. Aust Fam Physician. 2014 Jul;43(7):436-9. PMID: 25006602.

Zehnbauer B. Direct-to-consumer genetics testing--fair comparisons? Clin Chem. 2011 Mar;57(3):369-71. doi: 10.1373/clinchem.2010.160085. Epub 2011 Jan 12. PMID: 21228257.

Roberts JS, Gornick MC, Carere DA, Uhlmann WR, Ruffin MT, Green RC. Direct-to-Consumer Genetic Testing: User Motivations, Decision Making, and Perceived Utility of Results. Public Health Genomics. 2017;20(1):36-45. doi: 10.1159/000455006. Epub 2017 Jan 10. PMID: 28068660.