Legal

Privacy Policy

Effective date: July 2, 2026 · Last updated: October 28, 2026

1. Who we are

This Privacy Policy explains how Helisoma (“Helisoma”, “we”, “us”), the data controller, collects and uses your personal data when you use the Helisoma website and application (the “Service”).

Controller: Helisoma. Contact: [email protected]. Data protection contact: [email protected].

2. The data we collect

• Account data — your name, email address, and password (stored hashed). If you sign in with Google, we receive your name, email, and Google account identifier.
• Genetic data (special category) — you provide a raw DNA file (e.g. from 23andMe, Nebula, Genotek). Your browser reads the file on your own device to extract the small set of genetic markers our reports use, and only those markers are sent to us. The raw file itself is never uploaded to us or stored by us. We keep only the extracted markers and the trait reports and interpretations we generate from them. If you use the free analysis on our landing page without an account, the same applies, and the extracted markers are held for at most one hour (so you can create an account without re-uploading) and then deleted automatically; the analysis shown to you is computed on the fly and is not stored.
• Usage and device data — anonymous page-view counts that cannot identify you are collected unless you opt out (no cookies; your IP address is used only to look up your approximate location and is not stored; see §6). If you have an account, we also count a few key account events without cookies (see §6). With your consent we also collect pages viewed, actions taken, approximate location, browser and device type, and similar analytics data linked to a persistent identifier (see §6).
• Communications — messages you send us (e.g. support requests).
• Reminder emails: if you ask us to remind you about your DNA file without creating an account, we keep your email address and the page you asked from, send you one reminder a week later, and then delete the address. The reminder is cancelled, and the address deleted, if you analyze a file on our site or create an account first; you can also ask us to cancel it by email at any time. We send nothing else to that address.

3. How we use your data and our legal bases

Under the GDPR we rely on the following legal bases:

• Your explicit consent (Art. 9(2)(a)) — to process your genetic data in order to generate your reports and provide genetics-informed coaching. You give this consent before your file is read and can withdraw it at any time (see §9).
• Performance of a contract (Art. 6(1)(b)) — to create and maintain your account and provide the Service you signed up for.
• Consent (Art. 6(1)(a)) — for non-essential cookies and analytics (§6), and for reminder emails you ask for (§2).
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, improve our product, keep anonymous cookie-free visit statistics, and count key account events (§6), balanced against your rights.

4. Connecting AI assistants (Claude, ChatGPT, Gemini)

You can choose to connect a third-party AI assistant to your account so it can read your genome report and answer your questions. This connection is optional and started by you. When you authorize it, Helisoma transmits your genome report data — at your direction — to the AI platform you selected (for example Anthropic’s Claude, OpenAI’s ChatGPT, or Google’s Gemini) through our connector.

From that point the platform processes your data under its own privacy policy and terms, as an independent controller. We do not control how it uses your data once it reaches them, and depending on that provider’s terms and your settings there, it may retain or use your data to improve or train its models. Please review the provider’s policy before connecting. You can revoke a connection at any time from your account settings.

5. Who we share data with

We do not sell your personal data. We share it only with:

• Service providers (processors) acting on our instructions — e.g. cloud hosting, database, email delivery, and analytics providers — bound by data-processing agreements.
• Analytics providers — Google (Google Analytics 4) and Mixpanel, Inc. Mixpanel processes the anonymous cookie-free visit counts and the key account events described in §6 on EU servers; cookie-based analytics (both providers) runs only if you accept analytics cookies (see §6). If you use Google sign-in, Google also processes data for authentication.
• Error monitoring: Functional Software, Inc. (Sentry), to find and fix crashes. When something breaks, it receives a technical error report: what failed, the page or API address without its query string, and your browser and device type. It never receives your DNA file, your genetic markers, your name, email, IP address or cookies, and nothing is stored on your device.
• Payment processing — Stripe, Inc., to take your one-time payment. We do not receive or store your card details.
• AI platforms you connect — only the data you direct them to read (see §4).
• Authorities — where required by law, or to protect rights and safety.

A current list of processors is available on request at [email protected].

6. Cookies and analytics

We use strictly necessary cookies to run the Service (e.g. your login session); these do not require consent.

Anonymous visit statistics (no cookies). To know how many people visit our pages, we count page views in a way that cannot identify you: nothing is stored on your device (no cookies, no local storage), your IP address is used only to look up your approximate location (country and city) and is then discarded, never stored, and each visit appears under a random identifier that exists only in your browser's memory and is gone when you leave. This measurement is processed by Mixpanel on EU servers. We rely on our legitimate interest (Art. 6(1)(f)) in understanding overall traffic for this minimal, cookie-free counting. You can switch it off: choose “Reject non-essential” in our cookie banner (or later through the “Cookie settings” link in the footer), and we stop counting your visits in that browser. If your browser sends a Global Privacy Control signal, we treat it the same way unless you accept analytics cookies. Visits counted before you opt out stay in the anonymous totals.

Key account events (no cookies). If you have an account, our server tells Mixpanel when a few key things happen: your account is created (with the page and website you arrived from, and any campaign tags in the link), a DNA file is added, your report is unlocked, you connect an AI assistant or it reads your report, and you download a PDF report. Each event is linked to your random account ID, never to your name, email address or any genetic result, and nothing is stored on your device for it. When an event comes from your browser, your IP address is used to look up your approximate location and is then discarded. We rely on our legitimate interest (Art. 6(1)(f)) in knowing which parts of the Service work. You can object at any time by writing to [email protected], and we will stop.

Full analytics (only with your consent). To understand how the Service is used across visits, we also use Google Analytics 4 (Google) and Mixpanel (Mixpanel, Inc.), which use cookies or similar identifiers and record page views and interactions such as clicks. We do not use session recording or screen replay. These analytics cookies load only after you accept them in our cookie banner. If you reject them, nothing beyond strictly necessary cookies runs: neither analytics cookies nor the cookie-free counting described above. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer.

7. International transfers

Some providers (such as Google, Mixpanel, Sentry and Stripe) may process data in a country other than the one you live in, including the United States. Where data protection law requires it, we rely on appropriate safeguards such as the Data Privacy Framework and Standard Contractual Clauses.

8. How long we keep your data

We never receive or store your raw DNA file: it is read on your own device, and only the markers our reports use are sent to us. We keep those extracted markers and your generated reports for as long as your account is active. If you delete your genetic data or your account, the extracted markers are deleted immediately and permanently, the moment you confirm. Reports are not stored: they are built from your markers each time you open or download one, so once the markers are gone no report can be rebuilt. Markers sent for the free landing-page analysis without an account are deleted automatically after at most one hour unless you create an account and claim them in that time. An email address left for a file reminder is deleted when the reminder is sent, about 7 days later, or earlier if the reminder is cancelled. We keep transaction and tax records for 6 years to meet our accounting and tax obligations, even after account deletion; these do not include your genetic data.

9. Your rights

Depending on where you live, data protection laws such as the GDPR give you the right to:

• access a copy of your personal data;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to processing;
• data portability;
• withdraw consent at any time (including consent to process genetic data), without affecting prior lawful processing;
• lodge a complaint with your local data protection authority.

To exercise any right, email [email protected]. You can delete your genetic data and account yourself at any time in the app’s account settings.

10. Genetic and health data privacy

These commitments apply to everyone who uses Helisoma, and they follow privacy laws such as the California Consumer Privacy Act, Washington’s My Health My Data Act, and the genetic privacy laws of California and Illinois.

• Your genetic data is consumer health data. We collect it only with your consent, given before your file is read, and use it only to build your reports and answer your questions. We never sell it, never use it for advertising, and never share it with employers, insurers, or data brokers. We disclose it only to service providers that store and process it for us, to an AI assistant you choose to connect (see §4), or when the law requires it.
• No samples. We never receive a saliva or blood sample. We work only with the DNA file you already have.
• No sale, no targeted advertising. We do not sell your personal data and do not use or share it for targeted advertising. We honor Global Privacy Control signals (see §6).
• Your rights. You can ask what personal data we hold and how we use it, get a copy, correct it, or delete it, and you can withdraw your consent to the processing of your genetic data at any time. You can also delete your genetic data and account yourself in the app’s account settings. We will not treat you differently for using any of these rights.
• How to ask. Email [email protected] from the address on your account, so we can confirm it is you. Someone you authorize in writing can also ask on your behalf.

In the last 12 months we collected the categories of data listed in §2 (identifiers such as your name and email, genetic data, website activity, approximate location, and messages you send us) for the purposes in §3, and disclosed them only to the recipients in §5.

11. Security

We use technical and organizational measures to protect your data, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.

12. Children

The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect data from children.

13. Changes to this policy

We may update this policy. We will post the new version here and update the “Last updated” date, and for material changes we will notify you by email or in the app.

14. Contact

Questions about this policy or your data? Email [email protected].