Privacy Policy — HumanGens
Last updated: 9 October 2026
This policy explains what personal data HumanGens collects, why, who we share it with and the rights you have. It applies to the HumanGens app (web, Android and iPhone) and to the website humangens.com.
This English version is the authoritative text of this Privacy Policy (see the Terms and Conditions, clause 16). Any translation is provided for convenience only.
1. Who we are
HumanGens Ltd ("HumanGens", "we", "us") is the data controller for the personal data described in this policy.
- Registered in England and Wales, company number 17419350
- Registered office: Moulton Park Business Centre, Office G10A, Red House Road, Northampton NN3 6AQ, United Kingdom
- Privacy contact: info@humangens.com
2. What data we collect
2.1 Account data
Your email address (or a nickname, if you sign up without an email), your password (stored only as an encrypted hash), your profile name and, if you set them, your security questions (the answers are stored only as a hash).
2.2 Health and genetic data (special category data)
This is the most sensitive information we handle. It is collected only because you choose to add it, and only with your explicit consent:
- Laboratory results, scans, specialist reports and other medical documents you upload or type in.
- Medical conditions, medication, procedures and family history you tell us about.
- Genetic data, if you upload a raw DNA file (for example from 23andMe, Ancestry or MyHeritage).
- Data from your watch, ring or phone that you allow us to read through Apple Health or Health Connect, such as sleep, heart rate, heart rate variability, steps, weight and temperature.
- Your answers to questionnaires and your habit, exercise and nutrition records.
- Your messages to the in-app health assistant.
2.3 Payment data
Payments are processed by Stripe. We receive confirmation of each payment, the amount and the product bought. We never see or store your full card number.
2.4 Location data
If you use the Environment features, the postcode or approximate location you enter is used to look up public data such as air quality, weather and local risks. Your IP address is used once at start-up to suggest the language of your reports; we do not store it against your account.
2.5 Technical and usage data
Basic records of how the app is used (for example, which reports were generated and when, and errors), the device token needed to send you notifications if you allow them, and the data you send through the contact form on the website (name, email, message, IP address and browser type).
3. Why we use your data and our legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Storing and analysing your health and genetic data to show your results and generate the reports you ask for | Your explicit consent (Article 9(2)(a)) and the performance of our contract with you (Article 6(1)(b)) |
| Running your account, credits, subscription and payments | Performance of a contract (Article 6(1)(b)) |
| Sending notifications and alerts you have switched on | Your consent (Article 6(1)(a)) |
| Answering messages and support requests | Legitimate interest in replying to you (Article 6(1)(f)) |
| Keeping the service secure, preventing fraud and improving it | Legitimate interest (Article 6(1)(f)) |
| Keeping accounting and tax records | Legal obligation (Article 6(1)(c)) |
We do not use your health or genetic data for advertising, and we do not sell your data to anyone.
You can withdraw your consent at any time by deleting the data concerned or your whole account (see section 8). Withdrawing consent does not affect processing that took place before.
4. Artificial intelligence
To read your documents, answer your questions and write your reports, the relevant data is sent to an AI provider (Anthropic or Google, see section 5). These providers process it on our behalf to produce the answer and, under their business terms, do not use it to train their models.
AI output can contain mistakes. It is general information, not a diagnosis, and no decision with legal or similarly significant effects is made about you by automated means.
5. Who we share data with
We use the following service providers ("processors"). They act only on our instructions and under contracts that require them to protect your data.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in and server functions | European Union |
| Anthropic | AI analysis and report writing | United States |
| Google (Gemini API) | AI analysis for some tasks | United States |
| Google (Firebase Cloud Messaging) | Delivering push notifications (no health data in the message) | United States |
| Stripe | Payments | United Kingdom, EU and United States |
| Resend | Account emails, such as inactivity notices | United States |
| SiteGround | Hosting of the website and app files (no health data is stored there) | European Union |
The app and website also contact some services directly from your device. They receive your IP address and the specific request, but never your health data:
- ipwho.is, to suggest a report language based on your country.
- Google Fonts, to load the typefaces used in the app and website.
- Public data services used by the Environment features (postcodes.io, Open-Meteo, the Environment Agency, data.police.uk, USGS and Zippopotam), which receive the postcode or location you entered.
- Open Food Facts, if you look up a food product.
We may also disclose data if the law requires it, or to protect the rights and safety of our users or others.
6. International transfers
Some providers process data outside the UK. When they do, we rely on the safeguards UK law requires, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where the provider is certified under it.
7. How long we keep your data
- While your account is active, we keep your data so the service can work and show your history.
- If you delete your data or your account, health and genetic data is erased from our database immediately and from backups within 30 days.
- Inactive accounts: after 12 months without activity we email you (where we have your email), and if there is still no activity 30 days later the account and its data are deleted.
- Payment and accounting records are kept for 6 years, as UK tax law requires.
- Contact form messages are kept for up to 2 years.
8. Your rights
Under UK data protection law you have the right to:
- Access the data we hold about you.
- Correct data that is wrong.
- Erase your data.
- Receive your data in a portable format: the app lets you do this yourself from My account → "Download my data".
- Object to or restrict some processing.
- Withdraw your consent at any time.
You can delete your data directly in the app from My account → "Delete all my data from this device". This erases it from your device and from our database. Your sign-in details are kept so you can come back; if you also want your sign-in account removed, write to us and we will do it.
For any other request, email info@humangens.com. We reply within one month.
9. Security
Data is encrypted in transit (HTTPS) and at rest. Access rules in the database ensure that only you, and authorised HumanGens staff when needed for support, can reach your information. Keys to the AI services are kept on our servers and are never exposed in your browser. Payments are handled entirely by Stripe.
10. Cookies and local storage
The website does not use advertising or analytics cookies. The app stores data on your device (browser storage) only to keep you signed in, remember your settings and work offline; this is strictly necessary for the service. If we ever add analytics or marketing cookies, we will ask for your consent first.
11. Children
HumanGens is for adults aged 18 and over. We do not knowingly collect data from children.
12. Changes to this policy
We may update this policy. If the changes are significant, we will tell you in the app or by email before they take effect. The date at the top shows the latest version.
13. How to complain
If you are unhappy with how we handle your data, please contact us first at info@humangens.com. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection authority: ico.org.uk