Legal
Privacy Policy
1. Who we are
This Privacy Policy explains how Helisoma (“Helisoma”, “we”, “us”), the data controller, collects and uses your personal data when you use the Helisoma website and application (the “Service”).
Controller: Helisoma. Contact: hello@helisoma.com. Data protection contact: hello@helisoma.com.
2. The data we collect
- Account data — your name, email address, and password (stored hashed). If you sign in with Google, we receive your name, email, and Google account identifier.
- Genetic data (special category) — you provide a raw DNA file (e.g. from 23andMe, Nebula, Genotek). Your browser reads the file on your own device to extract the small set of genetic markers our reports use, and only those markers are sent to us. The raw file itself is never uploaded to us or stored by us. We keep only the extracted markers and the trait reports and interpretations we generate from them. If you use the free analysis on our landing page without an account, the same applies, and the extracted markers are held for at most one hour (so you can create an account without re-uploading) and then deleted automatically; the analysis shown to you is computed on the fly and is not stored.
- Usage and device data — anonymous page-view counts that cannot identify you are always collected (no cookies, no IP; see §6). With your consent we also collect pages viewed, actions taken, approximate location, browser and device type, and similar analytics data linked to a persistent identifier (see §6).
- Communications — messages you send us (e.g. support requests).
3. How we use your data and our legal bases
Under the GDPR we rely on the following legal bases:
- Your explicit consent (Art. 9(2)(a)) — to process your genetic data in order to generate your reports and provide genetics-informed coaching. You give this consent before your file is read and can withdraw it at any time (see §9).
- Performance of a contract (Art. 6(1)(b)) — to create and maintain your account and provide the Service you signed up for.
- Consent (Art. 6(1)(a)) — for non-essential cookies and analytics (§6).
- Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, improve our product, and keep anonymous cookie-free visit statistics (§6), balanced against your rights.
4. Connecting AI assistants (Claude, ChatGPT, Gemini)
You can choose to connect a third-party AI assistant to your account so it can read your genome report and answer your questions. This connection is optional and started by you. When you authorize it, Helisoma transmits your genome report data — at your direction — to the AI platform you selected (for example Anthropic’s Claude, OpenAI’s ChatGPT, or Google’s Gemini) through our connector.
From that point the platform processes your data under its own privacy policy and terms, as an independent controller. We do not control how it uses your data once it reaches them, and depending on that provider’s terms and your settings there, it may retain or use your data to improve or train its models. Please review the provider’s policy before connecting. You can revoke a connection at any time from your account settings.
5. Who we share data with
We do not sell your personal data. We share it only with:
- Service providers (processors) acting on our instructions — e.g. cloud hosting, database, email delivery, and analytics providers — bound by data-processing agreements.
- Analytics providers — Google (Google Analytics 4) and Mixpanel, Inc. Mixpanel processes the anonymous cookie-free visit counts described in §6 on EU servers for everyone; cookie-based analytics (both providers) runs only if you accept analytics cookies (see §6). If you use Google sign-in, Google also processes data for authentication.
- Payment processing — Stripe, Inc., to take your one-time payment. We do not receive or store your card details.
- AI platforms you connect — only the data you direct them to read (see §4).
- Authorities — where required by law, or to protect rights and safety.
A current list of processors is available on request at hello@helisoma.com.
6. Cookies and analytics
We use strictly necessary cookies to run the Service (e.g. your login session); these do not require consent.
Anonymous visit statistics (no cookies). To know how many people visit our pages, we count page views in a way that cannot identify you: nothing is stored on your device (no cookies, no local storage), your IP address is not recorded or used to derive your location, and each visit appears under a random identifier that exists only in your browser's memory and is gone when you leave. This measurement is processed by Mixpanel on EU servers. We rely on our legitimate interest (Art. 6(1)(f)) in understanding overall traffic for this minimal, cookie-free counting, and it stays on even if you reject analytics cookies.
Full analytics (only with your consent). To understand how the Service is used across visits, we also use Google Analytics 4 (Google) and Mixpanel (Mixpanel, Inc.), which use cookies or similar identifiers and record page views and interactions such as clicks. We do not use session recording or screen replay. These analytics cookies load only after you accept them in our cookie banner. If you reject them, only the anonymous cookie-free counting described above continues. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer.
7. International transfers
Some providers (such as Google, Mixpanel and Stripe) may process data outside the European Economic Area / United Kingdom, including in the United States. Where this happens, we rely on appropriate safeguards such as the UK extension to the EU-US Data Privacy Framework, the EU Standard Contractual Clauses, and the UK International Data Transfer Addendum.
8. How long we keep your data
We never receive or store your raw DNA file: it is read on your own device, and only the markers our reports use are sent to us. We keep those extracted markers and your generated reports for as long as your account is active. If you delete your genetic data or your account, we delete the extracted markers and generated reports within 30 days. Markers sent for the free landing-page analysis without an account are deleted automatically after at most one hour unless you create an account and claim them in that time. We keep transaction and tax records for 6 years to meet UK accounting and tax law (HMRC), even after account deletion; these do not include your genetic data.
9. Your rights
Under the EU GDPR and UK GDPR you have the right to:
- access a copy of your personal data;
- rectify inaccurate data;
- erase your data (“right to be forgotten”);
- restrict or object to processing;
- data portability;
- withdraw consent at any time (including consent to process genetic data), without affecting prior lawful processing;
- lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ICO); in the EU, your local data protection authority.
To exercise any right, email hello@helisoma.com. You can delete your genetic data and account yourself at any time in the app’s account settings.
10. Security
We use technical and organizational measures to protect your data, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.
11. Children
The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect data from children.
12. Changes to this policy
We may update this policy. We will post the new version here and update the “Last updated” date, and for material changes we will notify you by email or in the app.
13. Contact
Questions about this policy or your data? Email hello@helisoma.com.