Data protection policy

Key definitions

• Aggregate Information: data pooled from multiple users and analysed as a whole, so no individual can be identified.
• De-identified Information (pseudonymised): data with Registration Information and other identifiers removed, so the person cannot be identified.
• Individual-level Information: data about one person’s epigenetics, genotypes, diseases or other traits, which may or may not be linked to Registration Information.

Personal Information is data that can identify you alone or combined with other data. We collect:

• Registration Information: name, email, address, user ID, password and payment details.
• Genetic Information: data from sequencing and analysing biological samples, including genetic variants and genomic data.
• Epigenetic Information: methylation biomarker data from blood samples processed by Epix AI or its contractors.
• Self-Reported Information: health conditions, traits, ethnicity, family history and survey responses you provide.
• Sensitive Information: health, genetic predisposition, epigenetic and certain self-reported data (including racial and ethnic origin), which needs heightened protection.
• User Content: material you create, post or upload, such as text, music, photos, videos and messages.
• Inferences and Derived Data: information derived from other Personal Information, including outputs of our proprietary algorithms.
• Web-Behavior Information: usage data from log files, cookies, web beacons and similar tools, such as device identifiers, IP address, browser type and page views.
• Social media features and widgets: buttons such as Facebook “Like” or “Share” may collect your IP address and page visits, governed by that service’s privacy policy.
• Third-party services: data from sites such as Facebook or LinkedIn used within the Services, such as profile pictures, networks and usernames, depending on your settings.
• Customer service: information from support interactions, used to answer enquiries, investigate breaches and improve the Services.
• Genetic and epigenetic testing information: DNA predisposition and methylation biomarker data generated during analysis.

Cookies and similar technologies

We and our third-party providers use cookies, web beacons and similar tools to:

• Recognise you when you use the Services
• Customise and improve your experience
• Provide security and prevent fraud
• Analyse usage and performance
• Gather demographic information
• Deliver Services and features
• Measure marketing campaigns
• Serve targeted ads on our site and third-party sites

You can reject cookies in your browser settings, though some features may not work. Reports from these tools may be De-identified, Individual-level or Aggregate Information.

How we use your information

We use and share Personal Information under the principles of data minimisation and purpose limitation.

• To provide and improve our Services: open and manage accounts, process payments, communicate, fulfil requests such as referrals, improve the website and app, enforce our Terms of Service, prevent illegal activity and security risks, and carry out research and development including quality control and algorithm development.
• To process and deliver testing results: you create an account, register your kit and send a blood sample to our contracted laboratory. Reports may be updated as science advances, are available in your secure account, and are not for medical diagnosis or treatment.
• To facilitate research participation: if you opt in, we tell you about third-party research opportunities. Individual-level genetic, epigenetic or self-reported information is never shared without your explicit, informed consent.
• To conduct partnered research: with non-profits and academic institutions, using Aggregate and/or De-identified Individual-level data as described in the consent documents, with robust anonymisation.
• To develop proprietary algorithms: from De-identified or Aggregate Information. These algorithms are Epix AI’s intellectual property and are never used to re-identify anyone.
• To provide customer support: occasionally processing one customer’s data to resolve another’s issue, only as far as required.
• To run surveys and request testimonials: optional, managed in Account Settings.
• To send marketing: product and promotional emails or notifications; unsubscribe any time. Non-promotional account messages are mandatory.

Sharing with third parties

• Order fulfilment: payment processors handle billing and card information.
• Shipping: distribution centres manage kit shipping, returns and sample processing.
• Clinical examinations: with your consent, partners connect you with specialists based on identified health risks.
• Data processing: secure cloud and analytics providers under strict data protection agreements.

Providers must comply with data protection law and use data only for the purposes specified. We do not sell your Personal Information to third parties.

Cross-border data transfers

Data may be stored and processed in the EU or other jurisdictions with different data protection laws. We use Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) to comply with the GDPR and other regulations.

Data breach notification

If a breach may compromise your Personal Information, we will notify you and the relevant authorities within 72 hours, as required by the GDPR and other laws.

Account access and management

You can access your data through your secure account and update or correct it in Account Settings. Extra identity checks may be needed if you lose access.

Sharing outside Epix AI

You may choose to share your information with others, including on social networks. Once shared, we are not responsible for how third parties use it. In multi-profile accounts, please protect the privacy of the other people on the account.

Account deletion

Request deletion in Account Settings and confirm by email. Deletion is irreversible and completed within 30 days, except data kept for legal or research purposes. We will confirm when it is done.

Data retention

• Registration Information is kept while your account is active.
• Genetic and Epigenetic Information is kept for service delivery and consented research, and deleted with your account — except anonymised data in completed studies.
• Legal retention periods, such as tax or health regulations, may apply.

Security

• Encryption of data in transit and at rest
• Regular security audits and vulnerability assessments
• Access limited to authorised personnel
• Anonymisation of research data

No system is completely secure, but we aim to meet industry standards.

Your responsibilities

Keep your login details safe. Epix AI is not liable for data you release, or ask us to release, to third parties.

Children’s privacy

The Services are not intended for anyone under 18. Parents or guardians may create accounts and submit samples for children with verifiable parental consent, and take responsibility for the security and accuracy of that data.

Linked websites

This policy does not cover third-party sites we link to. Review their privacy statements before sharing personal information.

Direct marketing

Electronic marketing requires your explicit consent under the GDPR and other regulations. You can withdraw consent at any time in Account Settings or via the unsubscribe link. Where permitted, marketing may also rely on legitimate interests.

Changes to this policy

We may update this policy to reflect changes to our Services, data practices or the law. We will tell you about significant changes by email or in your account. Material changes affecting Sensitive Information require your explicit consent.