These challenges are of particular relevance for patients with chronic genetic diseases such as thalassemia and hemophilia, due to the hereditary, lifelong, and familial nature of the data associated with them. This study examines the legal and ethical challenges of genetic data privacy of these patients within the Iranian health care system.The findings indicate that, despite the general recognition of medical data confidentiality and human dignity in Iranian laws and upstream policy documents, the Iranian legal system lacks a clear and independent definition of “genetic data” as well as a protective framework proportionate to the specific characteristics of such data, including their predictive, immutable, and intergenerational nature. Ambiguity surrounding the scope of informed consent, the failure to distinguish therapeutic consent from data-oriented consent, the absence of explicit prohibitions on genetic discrimination in areas such as insurance and employment, and the weakness of binding data security standards and institutional liability mechanisms constitute the main legal challenges identified in this study. Furthermore, bioethical analysis reveals that traditional rules of medical confidentiality are insufficient to address emerging conflicts, such as the tension between public health interests and the individual’s right to genetic silence, the ethical responsibility to disclose genetic risks to relatives, and the research-based or quasi-commercial use of genetic data. Effective protection of the genetic data privacy of these patients requires targeted legislative reform, recognition of genetic data as ultra-sensitive data, the design of a multilayered consent regime, and the establishment of ethical data governance within the Iranian health care system.