Privacy Policy

Holohabits is operated by Biohacker Center Platform OÜ (registry code 16795881), Tööstuse 43-100, 10411 Tallinn, Estonia (“Holohabits”, “we”, “us”). The same entity operates this website, the practitioner platform and the Holohabits mobile app.

Where you work with a practitioner, your practitioner is the controller of your consultation and we process your data on their instructions. For the website, the mobile app, platform security and anonymised statistics we act as an independent controller. We have not appointed a statutory Data Protection Officer; for any privacy request use our contact page.

The website (holohabits.com). Pages you view, and whatever you type into the contact form (name, email, topic, message). Analytics and advertising tags load only if you accept them — see the cookie policy.

The practitioner platform (your test, your report, your consultation):

• Account data — name, email, phone, and the country and billing details attached to your order.
• Health-related data — your biomarker results, allergies, diet, sleep and lifestyle answers, your Western Lifestyle Index, and the interpretation your practitioner writes. This is special-category data under Art. 9.
• Consultation records — appointments, notes your practitioner records, and the plans generated for you.

The Holohabits mobile app. The app signs you in anonymously through Firebase — there is no password, and your account is held by a recovery code. It processes your nickname, date of birth, gender and country; your biomarker values once you link a test; habit and challenge activity; anything you post to a tribe; push notification tokens; and any photo, document or voice note you send to the AI assistant, including photographs of meals, of yourself, and of lab reports.

• Art. 6(1)(b) — contract. Fulfilling your order, running your account, delivering your results and operating the app.
• Art. 9(2)(a) — explicit consent. Everything touching health data: analysing your sample, syncing your results, your practitioner reading them, AI-assisted interpretation, and delivery by email. You can withdraw this at any time, and withdrawal does not affect processing already carried out.
• Art. 6(1)(f) — legitimate interests. Platform and app security, fraud prevention, aggregated anonymised statistics, and answering you when you contact us.
• Art. 6(1)(c) — legal obligation. Accounting and tax records for purchases.
• Art. 6(1)(a) — consent. Non-essential cookies, advertising tags and marketing email.

On the practitioner platform, AI models help interpret your biomarker values. Your name, email and identifiers are removed before any model call — the model receives biomarker values and clinical context, not you. The analysis supports professional judgement rather than replacing it, and it is not a medical diagnosis. There is no automated decision-making producing legal or similarly significant effects.

In the mobile app, the assistant works differently and you should know how. To answer you in context, it receives your profile (nickname, date of birth, gender, country), your biomarker values, and any photo, document or voice note you attach to a message. Do not send the assistant anything you would not want processed — including photographs of documents that identify other people.

We use vetted processors under data-processing agreements. Health-data processing is EU-hosted: Microsoft Azure OpenAI (Sweden) for AI analysis, Brevo (France) for transactional email, and Qdrant (EU) for search (query embeddings only). Our databases and file storage are self-hosted on our own premises.

Depending on what you use, we may also involve: Google Firebase (EU region)for the mobile app’s authentication, database and push notifications; Google Analytics, Google Ads and Meta for website measurement and advertising, only with your consent; Google Calendar and Zoom for scheduling and consultations; Vimeo for video; Sentry (United States) for crash and error monitoring; Klaviyo (United States) for marketing email; and Cohere and Tavily for search and retrieval. Purchases are fulfilled through the HOLOLIFE Center store, which handles your payment details under its own policy — we never see your card number.

We will give notice before adding or replacing a sub-processor that handles your data, and you may object.

Health-data processing is EU-based. Recipients outside the EEA — currently Sentry and Klaviyo in the United States — receive data under an adequacy decision (the EU-US Data Privacy Framework) or Standard Contractual Clauses.

Role-based access control and least-privilege data minimisation; encryption in transit; token-based authentication with two-factor available; identifiers stripped before platform AI calls; health data kept out of third-party calendar events; audit logging of staff access to client records; and retention limits.

We keep your data while your account is active. Access-audit logs are kept for 730 days. Consent records are kept as proof of consent, and accounting records for as long as tax law requires. Health data has no shorter automatic limit today — it is kept until you ask us to erase it, which we would rather state plainly than imply a schedule we do not run.

You have the right of access, rectification, erasure, portability, restriction, objection, and withdrawal of consent at any time. To exercise them, contact your practitioner or use our contact page; we provide export and erasure of your record. Erasing your record removes your personal and health data; where you have separately agreed with an event or programme organiser that something stays published, that agreement governs what remains.

You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn) or with the supervisory authority where you live.

We update this notice when the processing behind it changes, and the date at the top always reflects the current version.