Privacy
GDPR status.
Effective
Genetic data is special-category data under Article 9. Each purpose needs consent under Article 6(1)(a) and explicit consent under Article 9(2)(a). Consent is separate, named, and revocable.
On this page
EU and UK launch gate
The hosted service is not offered to people in the EU or UK. The same holds for the rest of the EEA. Nobody can newly choose one of these countries as where they live. Accounts that chose one before 26 September 2026 keep their own results. Family features, embryo storage, and embryo analysis remain off there. This is a launch restriction, not a claim of GDPR compliance.
The controller is Mario Diego, an individual, reached at privacy@inherit.bio. A postal contact has not been published. A named data protection officer has not been appointed. Neither an EU Article 27 representative nor a UK representative has been appointed. Their names, working contacts, and postal addresses must appear here before launch.
The same gate requires published impact-assessment summaries for Family and Embryo Analysis. It also requires a checked map of every destination country and the transfer method for each destination. Missing facts cannot be replaced with assumed names, addresses, or regions.
Purpose and legal-basis table
The table covers every registered purpose_key. The two legal bases apply when that purpose handles genetic or genome-derived data. A grant for one row does not enable any other row.
| purpose_key | Purpose | Consent | Genetic consent |
|---|---|---|---|
| reports.monogenic | Single-gene reports | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
| reports.polygenic | Statistical risk reports | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
| ancestry | Ancestry estimates | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
| copilot.local | Copilot on a model you host | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
| copilot.cloud | Copilot on one named cloud model | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
| family.heritability | Family heritability views | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
| family.portrait | Family Portrait | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
| export.share-link | Share-link exports | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
| raw.export | Raw-data exports | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
| embryo.analysis | Embryo Analysis | Article 6(1)(a): consent | Article 9(2)(a): explicit consent |
Withdrawal stops new processing for that purpose. It does not undo lawful work completed before withdrawal. The product must explain any retention required by law or a live dispute hold.
Processing outside these purposes has its own legal basis. Running your account and sending its service email rests on our contract with you, under Article 6(1)(b). The research digest email rests on your consent, under Article 6(1)(a). Keeping proof of your consents rests on a legal duty, under Article 6(1)(c). Security logs, the adult age check, and refusing connections from places under a full United States embargo rest on legitimate interests, under Article 6(1)(f). You may object to those.
Your rights and response time
You may request access, correction, deletion, restriction, or portability. You may object where that right applies. You may also withdraw consent and complain to the authority that oversees data protection where you live or work.
Use the product’s export and deletion controls or email privacy@inherit.bio. We must respond without undue delay and within one month. A complex request, or several requests, may take up to two more months. We must tell you within the first month if an extension is needed and explain why.
Processors and transfers
Every processor is in the United States. A cloud model receives genome-derived context only after separate consent that names one provider and the data classes sent.
- Supabase holds the database and files in the United States. It uses standard contractual clauses.
- Vercel hosts the app in the United States. It is certified under the Data Privacy Framework, with the UK extension.
- Resend sends email from the United States. It is listed under the Data Privacy Framework, with the UK extension. Its terms also include standard contractual clauses.
- The cloud model you name is in the United States for the Anthropic, OpenAI and xAI presets. Its transfer method is not yet settled.
This list names each actual destination country and its transfer method. A current transfer review must support each published claim. That review is drafted but not yet approved, so no EU or UK launch may rely on this list yet.
Impact assessments
My Genome, Copilot and export have a drafted impact assessment that is not yet approved. Its summary will appear here once a reviewer approves it.
Family and Embryo Analysis need their own impact assessment before any EU or UK launch. Public summaries must describe the data flow, risks, safeguards, remaining risk, reviewer, and review date. No such summary is published today, so those features remain unavailable in both territories.