Legal
Privacy Policy
1. Who we are
This Privacy Policy explains how [COMPANY_LEGAL_NAME] (“Helisoma”, “we”, “us”), the data controller, collects and uses your personal data when you use the Helisoma website and application (the “Service”).
Controller: [COMPANY_LEGAL_NAME], [REGISTERED_ADDRESS]. Contact: hello@helisoma.com. Data protection contact: [DPO_OR_PRIVACY_CONTACT].
2. The data we collect
- Account data — your name, email address, and password (stored hashed). If you sign in with Google, we receive your name, email, and Google account identifier.
- Genetic data (special category) — the raw DNA file you upload (e.g. from 23andMe, Nebula, Genotek), the genetic markers we derive from it, and the trait reports and interpretations we generate.
- Usage and device data — pages viewed, actions taken, approximate location, browser and device type, and similar analytics data (only with your consent — see §6).
- Communications — messages you send us (e.g. support requests).
3. How we use your data and our legal bases
Under the GDPR we rely on the following legal bases:
- Your explicit consent (Art. 9(2)(a)) — to process your genetic data in order to generate your reports and provide genetics-informed coaching. You give this consent before uploading your file and can withdraw it at any time (see §9).
- Performance of a contract (Art. 6(1)(b)) — to create and maintain your account and provide the Service you signed up for.
- Consent (Art. 6(1)(a)) — for non-essential cookies and analytics (§6).
- Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, and improve our product, balanced against your rights.
4. Connecting AI assistants (Claude, ChatGPT, Gemini)
Helisoma lets you connect AI assistants to your account so they can read your genome report and answer your questions. When you authorize such a connection, the third-party AI platform you choose (for example Anthropic’s Claude, OpenAI’s ChatGPT, or Google’s Gemini) receives your genome report data at your direction and processes it under its own privacy policy and terms, as an independent controller. We do not control how those platforms use data once it reaches them. You can revoke a connection at any time from your account settings.
5. Who we share data with
We do not sell your personal data. We share it only with:
- Service providers (processors) acting on our instructions — e.g. cloud hosting, database, email delivery, and analytics providers — bound by data-processing agreements.
- Google LLC — if you enable analytics, for website/app analytics (see §6); and, if you use Google sign-in, for authentication.
- AI platforms you connect — only the data you direct them to read (see §4).
- Authorities — where required by law, or to protect rights and safety.
A current list of processors is available on request at hello@helisoma.com.
6. Cookies and analytics
We use strictly necessary cookies to run the Service (e.g. your login session); these do not require consent. We also use Google Analytics 4 to understand how the Service is used. Analytics and any other non-essential cookies load only after you accept them in our cookie banner. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer.
7. International transfers
Some providers (such as Google Analytics) may process data outside the European Economic Area / United Kingdom, including in the United States. Where this happens, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
8. How long we keep your data
We keep your account and genetic data for as long as your account is active. If you delete your genetic data or your account, we delete the raw file, derived markers, and generated reports within [RETENTION_PERIOD, e.g. 30 days], except where we must retain limited records to meet legal obligations.
9. Your rights
Under the EU GDPR and UK GDPR you have the right to:
- access a copy of your personal data;
- rectify inaccurate data;
- erase your data (“right to be forgotten”);
- restrict or object to processing;
- data portability;
- withdraw consent at any time (including consent to process genetic data), without affecting prior lawful processing;
- lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ICO); in the EU, your local authority, or our lead authority [LEAD_SUPERVISORY_AUTHORITY].
To exercise any right, email hello@helisoma.com. You can delete your genetic data and account yourself at any time in the app’s account settings.
10. Security
We use technical and organizational measures to protect your data, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.
11. Children
The Service is not directed to, and may not be used by, anyone under [MINIMUM_AGE, e.g. 18]. We do not knowingly collect data from children.
12. Changes to this policy
We may update this policy. We will post the new version here and update the “Last updated” date, and for material changes we will notify you by email or in the app.
13. Contact
Questions about this policy or your data? Email hello@helisoma.com.