Privacy Policy

Holohabits is operated by Biohacker Center Platform OÜ (registry code 16795881), Tööstuse 43-100, 10411 Tallinn, Estonia (“Holohabits”, “we”, “us”). The same entity operates this website, the practitioner platform and the Holohabits mobile app.

Where you work with a practitioner, your practitioner is the controller of your consultation and we process your data on their instructions. For the website, the mobile app, platform security and anonymised statistics we act as an independent controller. We have not appointed a statutory Data Protection Officer; for any privacy request use our contact page.

The website (holohabits.com). Pages you view and information you enter in the contact form (name, email, topic, message). Analytics and advertising tags load only with your consent. See the cookie policy.

The practitioner platform (your test, your report, your consultation):

• Customer information: name, email, phone, and the country and billing details attached to your order.
• Biomarker data and lifestyle information: your biomarker results, allergies, diet, sleep and lifestyle answers, your Western Lifestyle Index, and the interpretation your practitioner writes. This is special-category data under Art. 9.
• Consultation records: appointments, notes your practitioner records, and the plans generated for you.

The Holohabits mobile app. The app signs you in anonymously through Firebase. You access your account with a recovery code instead of a password. It processes your nickname, date of birth, gender and country; your biomarker values once you link a test; habit and challenge activity; anything you post to a tribe; push notification tokens; and any photo, document or voice note you send to the AI assistant, including photographs of meals, of yourself, and of lab reports.

• Art. 6(1)(b): contract. Fulfilling your order, running your account, delivering your results and operating the app.
• Art. 9(2)(a): explicit consent. Processing your biomarker data and lifestyle information: analysing your sample, syncing your results, practitioner access, AI-assisted interpretation, and delivery by email. You can withdraw consent at any time. Withdrawal does not affect processing already carried out.
• Art. 6(1)(f): legitimate interests. Platform and app security, fraud prevention, aggregated anonymised statistics, and answering you when you contact us.
• Art. 6(1)(c): legal obligation. Accounting and tax records for purchases.
• Art. 6(1)(a): consent. Non-essential cookies, advertising tags and marketing email.

On the practitioner platform, AI models help interpret your biomarker values. Your name, email and identifiers are removed before any model call. The model receives biomarker values and clinical context. The analysis supports professional judgement rather than replacing it, and it is not a medical diagnosis. There is no automated decision-making producing legal or similarly significant effects.

For chat messages, attachments and personalised guidance in the Android and iPhone apps and the mobile web version, see the AI coach section below.

When you use the chat, we send your message, any files or photos you attach, and your profile (date of birth, gender and country), habits, challenges and biomarker results to our AI coach so it can answer you.

Holohabits Mobile App for Android and iPhone. The AI coach runs on servers operated by Hololife Center OÜ, Estonia, on our behalf. No third-party AI provider receives your data when you use the AI coach in these apps.

Mobile web version. When you use the AI coach in the mobile web version, we share the information described above with third-party AI providers so the coach can answer you. See the service providers listed under Who we share it with.

Retention: chat messages for as long as your account is active; technical logs for 30 days; anonymised usage statistics for 7 years. Deleting your account deletes your messages.

We use processors under data-processing agreements. Our EU-based processors include Microsoft Azure OpenAI (Sweden) for AI processing on the practitioner platform and in the mobile web version, Brevo (France) for transactional email, and Qdrant (EU) for search (query embeddings only). Our databases and file storage are self-hosted on our own premises.

Depending on what you use, we may also involve: Google Firebase (EU region) for the mobile app’s authentication, database and push notifications; Google Analytics, Google Ads and Meta for website measurement and advertising, only with your consent; Google Calendar and Zoom for scheduling and consultations; Vimeo for storing our training videos; Sentry (United States) for technical crash and error monitoring; Klaviyo (United States) for marketing email; and Cohere and Tavily for search and retrieval. Purchases are fulfilled through the HOLOLIFE Center store, which handles your payment details under its own policy. We do not receive your card number.

We will give notice before adding or replacing a sub-processor that handles your data, and you may object.

Biomarker data is processed in the EU. Recipients outside the EEA, including Sentry and Klaviyo in the United States, receive data under an adequacy decision (the EU-US Data Privacy Framework) or Standard Contractual Clauses.

Transfers to Sentry in the United States require only technical data for crash and error monitoring, with no identifiable personal information required. We disable default collection of personal information and remove request and user details before sending monitoring events to Sentry.

We limit access by role and encrypt data in transit. We use token-based authentication, with two-factor authentication available. We remove identifiers before platform AI calls and exclude biomarker data and consultation notes from third-party calendar events. We log staff access to customer records and apply the retention periods below.

We keep your customer information and biomarker data while your account is active. You have the right to request access to and erasure of your personal information and biomarker data at any time.

Access-audit logs are kept for 730 days. Consent records are kept as proof of consent, and accounting records for as long as tax law requires. These records may be retained after an erasure request.

You have the right of access, rectification, erasure, portability, restriction, objection, and withdrawal of consent at any time. To exercise them, contact your practitioner or use our contact page; we provide export and erasure of your record. To delete your account, see deleting your account. Erasure removes your customer information and biomarker data, subject to the retention periods above. Where you have separately agreed with an event or programme organiser that something stays published, that agreement governs what remains.

You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn) or with the supervisory authority where you live.

We update this notice when our data processing changes. The date at the top shows when it was last updated.