Privacy policy

Company details

US enterprise

• Legal name: EPIX.AI, INC.
• Managing director: Nikolay Rumenov Vasev
• Registered address: 3500 S Dupont Hwy, Dover, Kent, DE 19901, USA
• Telephone: 800-891-7432
• Email: contact@epix.ai
• File number: 10272755
• Entity type: Corporation

Bulgarian enterprise

• Legal name: Epix.AI Ltd.
• Managing director: Nikolay Rumenov Vasev
• Registered address: bul. Cherni Vrah 51, Work Better 1.0, office 407, 1407 Sofia, Bulgaria
• Email: contact@epix.ai
• Company ID: BG207010771
• Legal form: Limited liability company

Introduction

This policy explains how Epix AI Ltd. collects, uses, stores and protects personal information through its website, mobile app and related services (together, the “Services”). We are committed to safeguarding your privacy and to complying with the GDPR, the CCPA and other applicable data protection laws.

Data controller

Epix AI Ltd. determines the purposes and means of processing personal data and is the data controller. Send enquiries and requests about your rights to contact@epix.ai.

Definitions

Personal Information is data that can identify you, alone or combined with other data. It includes:

• Registration Information: name, email, address, user ID, password and payment details given at sign-up or purchase.
• Epigenetic Information: methylation biomarkers from blood samples processed by Epix AI or its contractors.
• Self-Reported Information: data you give through questionnaires, the Services or third parties, such as health conditions, traits, ethnicity and family history.
• Sensitive Information: health data, Epigenetic Information and certain Self-Reported Information (for example racial or ethnic origin) that needs stronger protection.
• User Content: anything you create, post or upload, such as data, text, photos or videos.
• Inferences and Derived Data: assumptions, conclusions or outputs of proprietary algorithms drawn from Personal Information.
• Web-Behavior Information: usage data collected through cookies, web beacons or similar tools, such as IP address, browser type and page views.

• De-identified Information: data with identifiers removed so that individuals cannot be identified (pseudonymised).
• Aggregate Information: data combined across many users and analysed as a whole, so no individual can be identified.
• Individual-level Information: data about one person’s epigenetics, genotypes or traits that is not necessarily linked to Registration Information.

Data collection

• Directly provided data: information you give when registering, buying, completing forms or contacting us — for example Registration, Self-Reported and Epigenetic Information.
• User-authorised data: information from third-party services such as Facebook or LinkedIn, depending on your privacy settings — for example profile pictures, usernames and networks.

Cookies and similar technologies

Epix AI and its third-party providers use cookies, web beacons and similar technologies to:

• Recognise you when you use the Services
• Customise and improve your experience
• Provide security and prevent fraud
• Analyse usage and performance
• Gather demographic information
• Deliver targeted ads on the Services and third-party sites

Types of cookies we use:

• Technical cookies: support navigation and core functions.
• Session cookies: temporary, deleted when you close your browser; used for authentication and secure navigation.
• Third-party cookies: set by external domains (for example Google Analytics) for analytics or profiling, governed by those providers’ policies.
• Profiling cookies: build profiles for targeted advertising and require your explicit consent.

You can reject cookies in your browser settings, though some features may not work. Reports from these technologies may be De-identified, Individual-level or Aggregate Information. Cookie policies: Google Analytics (policies.google.com/technologies/cookies), Facebook (facebook.com/help/cookies), LinkedIn (linkedin.com/legal/cookie-policy).

How we use your information

We follow the principles of data minimisation and purpose limitation, and use Personal Information to:

• Provide and improve the Services: manage accounts, process payments, communicate, personalise content, enforce our Terms of Service, and carry out research and development such as improving our algorithms.
• Deliver epigenetic age testing results: analyse blood samples to produce biological age reports in your secure account. Reports are not for medical diagnosis or treatment.
• Facilitate research participation: with your explicit consent, tell you about third-party research opportunities, using De-identified or Aggregate Information.
• Conduct partnered research: work with third parties such as academic institutions using De-identified or Aggregate Information, anonymised to prevent re-identification.
• Develop proprietary algorithms: build algorithms from De-identified or Aggregate Information. These algorithms belong to Epix AI.
• Provide customer support: resolve issues and answer questions. Occasionally this means processing one user’s data to resolve another user’s issue.
• Run surveys and request testimonials: optional, managed in Account Settings.
• Send marketing: with your explicit consent. Unsubscribe any time via the email link or Account Settings. Non-promotional account messages are mandatory.

Sharing with third parties

Service providers receive Personal Information only for:

• Order fulfilment: payment processors handle billing.
• Shipping: distribution centres handle kit shipping and returns.
• Clinical examinations: with your consent, partners connect you with specialists.
• Data processing: secure cloud and analytics providers, under strict data protection agreements.

We do not sell your Personal Information. Third parties must follow applicable data protection law and use data only for the purposes specified.

Where data is processed

Your data may be stored and processed in the EU or other jurisdictions. We use safeguards such as Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) for cross-border transfers.

Data retention

We keep Personal Information only as long as needed for the purposes in this policy or as required by law.

• Registration Information is kept while your account is active.
• Epigenetic Information is kept for service delivery or consented research, and deleted when you delete your account — except anonymised data from completed studies.
• Legal retention periods, such as tax or health regulations, may apply.

Data breach notification

If a breach compromises your Personal Information, we will notify you and the relevant authorities within 72 hours, as the GDPR requires, describing the breach, its likely impact and the steps we are taking.

Security

• Encryption of data in transit and at rest
• Regular security audits and vulnerability assessments
• Access limited to authorised personnel
• Anonymisation of research data

No system is completely secure, but we aim to meet industry standards.

Your rights

Under the GDPR and CCPA you can:

• Access, correct or update your Personal Information
• Request deletion, restriction or portability of your data
• Object to processing on legitimate grounds
• Withdraw consent for marketing or sensitive data processing, without affecting earlier lawful processing

To exercise these rights, email contact@epix.ai or use Account Settings. Deletion requests made in Account Settings are completed within 30 days, except data kept for legal or research purposes, and we will confirm when deletion is complete.

Children’s privacy

The Services are not intended for anyone under 18. Parents or guardians may create accounts and submit samples for their children with verifiable parental consent; ask contact@epix.ai for the procedure.

Social media plugins

Plugins such as Facebook’s “Like” button may collect your IP address or the pages you visit if you interact with them, and are governed by that network’s privacy policy. Cookies are set only when you use a plugin while logged in to that network.

Linked websites

This policy does not cover third-party websites linked from the Services. Review their privacy statements before sharing personal information.

Your responsibilities

You are responsible for keeping your login details safe. Epix AI is not liable for data you release, or ask us to release, to third parties.

Changes to this policy

We may update this policy to reflect changes in our Services, data practices or the law. We will tell you about significant changes by email or in your account, and continued use of the Services means you accept them. Material changes affecting Sensitive Information require your explicit consent.