Genomly Privacy Policy

Version of: [DATE — fill in before publishing] Controller: [LEGAL ENTITY / NAME — fill in] Data contact: [EMAIL — fill in]

⚠️ DRAFT. Written from the app's actual behaviour (verified against the source code), but it needs review by a lawyer. Section 3 must be updated whenever the code changes — Apple checks stated behaviour against real behaviour.

1. The short version

Your DNA file and all of your analysis results stay on your device. We do not upload your genetic test file to our servers and we do not store it.

Some data does leave your device when you use the analysis features. Exactly what, when, and to whom is set out below, in full. If it matters to you that nothing leaves the device at all, do not use the analysis and translation features.

2. What data we process

CategoryExample
Account dataemail address, password (as a hash)
Genetic datatest file, gene variants for the analysed traits
Health datalaboratory test results, lifestyle information
Technical datageneration job records, error messages

Genetic data and health data are a special category, and we treat them accordingly.

3. Where each thing lives

3.1. Stays on your device only

This data is never sent to our servers and is not available to us. If you delete the app or clear your data in Settings, it is gone for good — we hold no copy and cannot restore it.

3.2. Sent to our server

WhatWhenHow long it is kept
Email address and password hashat registrationuntil you delete your account
Gene variants for the analysed traitswhen an analysis startsup to 24 hours
Laboratory test valueswhen an analysis startsup to 24 hours
Lab results filewhen you upload itnot stored
AI provider access keyon every AI requestnot stored
Generated textafter generation, and on translationup to 24 hours
Generation job recordsduring generation24 hours (successful), 7 days (failed)

A note on those periods. Everything listed above as "up to 24 hours" is not kept separately — it is held inside the generation job record, which exists so that you can close the app while an analysis runs and collect the result later. Those records are deleted automatically: successful ones after 24 hours, failed ones after 7 days. No action is needed from you.

All such records are also deleted immediately if you delete your data or your account in Settings.

Your genetic test file is never sent to our server — not temporarily, and not as part of a job.

3.3. Shared with third parties

With whomWhat is sharedWhen
Anthropic, OpenAI or Google (whichever you choose)gene variants, lab values, the lab results file, text to translatewhen an analysis or translation starts
Googleemail address and profile nameonly if you sign in with Google
RapidAPI (ExerciseDB)exercise namewhen workout illustrations are shown
Wikipediafood namewhen you request information about a food

Sharing with the AI provider is required for the analysis features to work: without it the material cannot be generated. The provider's handling of that data is governed by its own privacy policy.

No health or genetic information is sent to Wikipedia or RapidAPI — only the name of an exercise or a food.

4. Why we do this (legal bases)

We do not use your data for advertising, do not sell it, and do not share it with third parties for purposes other than those described in this Policy.

5. Your rights

You may:

Requests: [EMAIL — fill in]

6. Security

No system is perfectly secure, and we cannot guarantee the security of data transmitted over the internet.

7. Children

The app is intended for people aged 18 and over. We do not knowingly collect data from children. If you become aware that a child's data has reached us, write to the address above and we will delete it.

8. Retention

The periods are set out in section 3.2. Account data is kept until you delete the account. After deletion, the data is removed and cannot be recovered.

The analysis material you see in the app is stored on your device. We hold no copy of it: if you delete the app, it cannot be restored — including by us.

9. International transfers

AI providers and the other services named above may process data outside your country, including in the United States.

10. Changes

If this Policy changes, the version date is updated; we will notify you in the app of any significant change.

11. Contact

[EMAIL — fill in]