Privacy Policy

Holobiont AI (the dashboard and the API) is operated by Biohacker Center Platform OÜ (registry code 16795881), registered in Estonia at Tööstuse 43-100, 10411 Tallinn, Estonia (“Holobiont”, “we”, “us”).

For your account data as a user of the platform, we are the controller. For the content your organisation processes on the platform, such as chat conversations, attachments, biomarker and supplement catalogues, and the data your apps send through the API about your own end users, your organisation is the controller and we act as its processor, on its instructions. A data processing agreement is available on request through our contact page. For keeping the platform secure, billing, and improving the service, we are an independent controller.

• Account data: name, email address, optional WhatsApp number and profile picture, your role and organisation membership, a hashed password, and optional two-factor authentication data.
• Organisation data: company details you enter (such as name, address and VAT ID), the users you invite, and API keys. We store only a SHA-256 digest of each API key, never the key itself.
• Content: chat conversations and their attachments, your biomarker and supplement catalogues, food analyses, and the data your apps send through the API. Conversations are shared with the members of your organisation. The documents in the knowledge library (and the text, search passages and knowledge-graph facts we derive from them) are managed by the library’s owner and readable by every organisation on the platform; they are not meant to contain personal data.
• Usage and billing data: records of AI usage and its cost, plan and credit balance, and payment records.
• Security data: sign-in and session information, and IP addresses used to apply rate limits and prevent abuse.

• To provide the platform and operate your account and your organisation’s content: performance of a contract (GDPR Art. 6(1)(b)).
• To keep the platform secure, prevent abuse, and improve it: legitimate interest (Art. 6(1)(f)).
• To meet accounting and tax obligations: legal obligation (Art. 6(1)(c)).

Biomarker results, food records and other health information are special-category data under GDPR Art. 9. When your organisation or its apps send such data about end users to Holobiont, your organisation is responsible for having a lawful basis (normally the end user’s explicit consent) and for informing them. We process it only to provide the requested analysis, storage and retrieval.

Answers, document processing, image reading and food analysis are produced by AI models reached through our own model router. By default we use models we host ourselves (including the text embeddings that power search). More demanding requests are sent to Microsoft Azure OpenAI (Sweden), and search results are ranked by Cohere, which receives the question and the candidate passages. We do not use your content to train AI models.

AI output can be incomplete or wrong. Holobiont provides information, not medical advice; see the Terms of Service.

Our databases, search index, knowledge graph, file storage, model router, self-hosted models and nutrition database run on infrastructure we operate. We use these sub-processors:

• Microsoft Azure OpenAI (Sweden): AI language and vision models.
• Cohere: ranking of search results.
• Cloudflare: network delivery and protection of the dashboard, the API and the model router.
• Brevo (France): transactional email such as invitations, sign-in links and password resets.
• Stripe: payments. We do not store your card details.

Transfers of personal data outside the EEA rely on an adequacy decision (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses.

We use a strictly necessary cookie to keep you signed in, and your browser’s storage for interface preferences such as whether the sidebar is collapsed. We do not use advertising or analytics trackers.

Traffic is encrypted in transit. Passwords are stored as salted hashes, API keys and one-time sign-in links only as digests, and two-factor authentication is available for every account. Access to content is limited to the members of the organisation it belongs to.

We keep your account data while your account is active. Content is kept until your organisation deletes it: deleting a conversation deletes its messages and attachments, and deleting a library document also deletes its search passages, knowledge-graph facts and stored file. Files attached to a message that was never sent are deleted automatically. Usage and billing records are kept for as long as accounting and tax law require.

For your own account data you have the right to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. To exercise them, use our contact page. End users whose data an organisation processes on Holobiont should contact that organisation first; we will assist it. You may also lodge a complaint with the Estonian Data Protection Inspectorate or your local data protection authority.