Vivabioma™ Privacy Policy

This Policy explains what personal data we process, for what purpose, on what legal basis, for how long, and what your rights are. It is part of the contract along with the Legal Terms, Informed Consent, and Cookie Policy.

Informed Consent details the treatment of the sample, the microbiome profile, and voluntary options, and prevails over this Policy in those matters.

1. Who is responsible

Data controller: GENELINK, S.L., owner of the Vivabioma™ brand. NIF B98649494. Address: calle Arquitecto Mora 5, 2nd floor, door 4, 46010 Valencia, Spain. Health authorization No. 11540 from the Ministry of Health of the Generalitat Valenciana.

• General contact: info@vivabioma.com · Phone: +34 960 090 596
• Privacy and exercise of rights: lopd@tellmegen.com
• Data Protection Officer: dpo@tellmegen.com
• Supervisory authority: Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country of residence.

Vivabioma and tellmeGen are brands of GENELINK, S.L. and share certain corporate systems and privacy channels. This does not imply that the data from both services are combined: that combination requires the specific voluntary authorization provided for in the Informed Consent.

The service is organized from Spain and we apply Regulation (EU) 2016/679, Organic Law 3/2018 and the applicable Spanish regulations, without prejudice to the local rules of your country of residence.

2. Who this Policy applies to

2.1 Applies to those who visit the Web, create an account, hire our services, participate in research, or communicate with our support team.

2.2 A microbiome report does not reveal hereditary information about your relatives, but it can reflect shared habits, diet, or living conditions. It is up to you to decide with whom you share your reports.

3. What data do we process and where does it come from

3.1 Data categories:

• Account and contact: name and surnames, email, encrypted password, date of birth, sex if provided, address, phone, language, and country.
• Biological sample: feces collected with our kit.
• Analysis data: sequencing and quality control technical data, microbiome profile, estimated functions, indices and resulting reports.
• Questionnaire responses on diet, habits, symptoms, and well-being. Optional questions are identified as such; omitting them may limit the content that depends on them.
• Hiring and payments: orders, invoicing, extensions and transaction metadata. We do not store full card numbers.
• Platform Usage: accesses, reports consulted, downloads, functions used, metrics and data collected via cookies.
• Customer service communications and incident records.
• Documentation proving legal representation or support measures, when contracting for a minor or a person requiring support.

3.2 Origin. The data comes from you or is generated during the provision of the service. We do not acquire personal data from external sources to profile you.

4. Nature of incidental human data and DNA

4.1 This service analyzes the genetic material of the microorganisms present in your sample, not your genome. The microbiome profile is not, in itself, personal genetic data in the sense of the Regulation.

4.2 Nevertheless, the profile, combined with your responses and the purpose of the service, may reveal information relating to your health and indirectly identify you. For this reason, we treat it with the level of protection appropriate for special categories of data as long as it constitutes personal data.

4.3 A stool sample contains human cells and fragments of human DNA may be incidentally captured during sequencing. Its handling is limited to filtering, quality control, security, and disposal in accordance with the technical cycle. They are not interpreted for traits, kinship, predisposition, or genetic identity, and are not part of regular reports or exports.

5. What we use your data for and on what legal basis

• Register the sample, sequence, filter, generate, host, and update your reports: contract execution (Art. 6.1.b) and explicit consent for health-related data and other special categories, including incidental human fragments (Art. 9.2.a).
• Create and manage your account, logistics, access to reports, and extensions: contract execution (Art. 6.1.b).
• To attend to their rights and requests for access and portability: legal obligation (Art. 6.1.c).
• Verify identity, legal representation, and support measures, and prevent unauthorized analysis: compliance with applicable legal obligations (Art. 6.1.c) and, where no specific obligation exists, legitimate interest in preventing illicit or fraudulent uses (Art. 6.1.f). The preservation of proof of consent and representation is also covered by Art. 9.2.f.
• Improve the service and guarantee its security, prevent fraud and defend claims, through aggregated or anonymized analysis whenever possible: legitimate interest (Art. 6.1.f), with the right to object.
• Fulfill legal obligations regarding taxes, commerce, health, quality, and product surveillance, and respond to authorities' requests: legal obligation (art. 6.1.c).
• Research and development, including the training of artificial intelligence models, in the areas described in paragraph 20 of the Informed Consent: your specific and separable consent (Articles 6.1.a and 9.2.a). The combination of data with another GENELINK service requires separate and additional consent.
• Professional Access: your specific consent provided by activating it.
• Transactional and support communications: contract execution (Art. 6.1.b).
• Electronic commercial communications: your consent or, for products and services similar to those already contracted, the legitimate interest provided for in the regulations on information society services, with the possibility of unsubscribing with each shipment.

When the processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of the prior processing. When it is based on our legitimate interest, you may object and we will consider your particular situation; the balancing analysis is available to you by writing to dpo@tellmegen.com.

6. Research, development and artificial intelligence

6.1 Participation is voluntary, separable, and revocable, and does not condition the service or its price. It is authorized through a single checkbox that includes internal research and improvement, external scientific projects, and research and development with commercial collaborators, under the terms of section 20 of the Informed Consent.

6.2 This authorization does not allow combining your Vivabioma data with that of another GENELINK service, such as tellmeGen. That combination requires a separate, specific, and additional consent, which is not requested today in the registration process.

6.3 When you authorize it, we may use pseudonymized or anonymized data from the authorized categories to develop, train, validate, audit, and improve analytical models and artificial intelligence systems for microbiome interpretation, report enhancement, and the development of new products and services.

6.4 Projects use the minimum data necessary, exclude direct identifiers except when justified, and are subject to confidentiality, access control, prohibition of re-identification, contractor agreement, and ethical evaluation when appropriate.

6.5 These authorizations pertain to data, not to the physical sample. Any researcher's use of the sample itself requires separate consent and the applicable project, collection, or biobank regime.

6.6 You can withdraw any of the authorizations with the same ease with which you granted it. The withdrawal prevents new inclusions and ends future treatments based on it, but it does not affect treatments already lawfully performed, publications already made, irreversibly anonymized data, or already trained models, from which your data cannot be individually extracted.

7. Minors and persons with support measures

7.1 Our services are aimed at adults: contracting requires 18 years or older and a minor cannot register or contract by themselves. The service is not available for children under three years old.

7.2 When contracting for a minor or for a person with support measures, the holder of parental authority, guardianship, or support must prove it documentarily in accordance with the Informed Consent. We do not begin the analysis until we verify it, and in reports for minors, the resistome and personalized recommendations are not issued.

7.3 The supporting documentation is kept solely as proof of entitlement and to prevent unauthorized analysis, with restricted access, and is not used for any other purpose.

7.4 Data on minors is only included in research when there is specific authorization from the legal representative and with the additional safeguards the project requires.

7.5 Upon reaching 18 years of age, the interested person may request ownership of their account and exercise all their rights independently.

8. Automated decisions

8.1 The generation of your reports is an automated process: our software identifies the microorganisms present, estimates functions, and calculates indices by associating them with the contents of our knowledge base, developed by our scientific team from literature.

8.2 This processing does not produce legal effects on you or significantly affect you in a similar way, as the report is informative and does not in itself determine any health decision.

8.3 In any case, you may request an explanation and review of your report by a member of our team by writing to lopd@tellmegen.com, express your point of view, and contest the result.

9. The biological sample

9.1 Your sample is used exclusively to provide the contracted service and for associated quality controls.

9.2 It is normally destroyed between 60 and 120 days from the issuance of its results and, in any case, before six months, unless there is an ongoing quality incident or a different legal obligation that we will communicate to you.

9.3 Not stored in biobank or transferred to third parties for other purposes.

10. Conservation, extensions, and blocked archive

• Account and contract: during the relationship and, afterwards, during the applicable statutes of limitations.
• Invoicing and accounting: within the deadlines required by commercial and tax regulations.
• Biological sample: in accordance with section 9.
• Microbiome Profile, Technical Data and Reports: as long as your account is active, so you can consult them, compare them and request extensions.
• Technical and safety records: between 12 and 24 months, proportionally to their purpose.
• Supporting documentation for representation and registration of consent acceptance: as long as liability can be incurred.
• Research: according to the project duration or until the authorization is withdrawn, with the exceptions of section 6.6.

10.1 If you request the deletion of your technical data, extensions and reinterpretations will no longer be possible without a new sample. We will warn you before carrying out the deletion.

10.2 When you request the deletion or closure of your account, the information that we must retain due to legal, health, quality, tax obligations, or for defense against claims, is blocked, with restricted access, unused for any other purpose, and is deleted upon the expiration of the applicable period.

10.3 Backups are deleted or overwritten according to their ordinary cycles, with a maximum target of 90 days from operational deletion.

11. Recipients, supervisors, and deputy supervisors

11.1 We do not sell or rent individually identifiable data. We may communicate data to the following categories of recipients:

• Metagenomic sequencing laboratories, which receive the coded sample.
• Infrastructure, hosting, storage, and security providers.
• Gateways and payment providers.
• Logistics operators.
• Support, communication, and analytics tools.
• Research collaborators, when you have authorized it and with pseudonymized or anonymized data.
• Authorities and public bodies, when there is a legal obligation.

11.2 All processors are bound by contract pursuant to Article 28 of the Regulation, with appropriate technical and organizational measures. A change of processor shall not expand the purposes or reduce their rights.

11.3 You can request the specific list of current managers and sub-managers at any time, with their location and function, by writing to lopd@tellmegen.com.

12. International transfers

12.1 The analysis and storage of your data are carried out in the European Economic Area, with providers from the categories identified in section 11.1.

12.2 If any ancillary function involves processing outside the European Economic Area, we will apply appropriate safeguards: an adequacy decision from the European Commission, standard contractual clauses with impact assessment and complementary measures, or binding corporate rules. The transfer will be identified in that same list.

12.3 You can request information about the warranties applied and, where applicable, a copy of them, by writing to dpo@tellmegen.com.

13. Professional Access

13.1 You can authorize an identified professional to consult specific categories of your reports for the period shown to you. Activation requires a separate action and can be revoked at any time.

13.2 Revocation prevents new access, but does not eliminate copies that such professional may have already lawfully downloaded or incorporated into their documentation.

13.3 The professional is responsible for their qualification, their professional secrecy, and the subsequent use of information, unless the file identifies them as a professional hired directly by GENELINK.

14. Commercial communications

We may send you information about Vivabioma products or services when you have consented to it or when they are similar to products or services you have already contracted. You may object at any time, simply and free of charge, from the link included in each communication or by writing to lopd@tellmegen.com.

15. Cookies and advertising

15.1 We use technical and analytical cookies and, only with your consent, advertising cookies. On the first level of the panel, you can accept, reject, or configure your preferences, and change them whenever you want. The detail is in the Cookie Policy.

15.2 For analytics and advertising purposes, we share information with our partners, including Google, in accordance with Google's EU User Consent Policy. You can find out how Google uses information from sites that use its services on the Google privacy and terms page.

15.3 These tools do not access your sample, your analysis data, or the content of your reports in any case.

16. Security and data breaches

16.1 We apply technical and organizational measures appropriate to the risk: encryption in transit and at rest, pseudonymization, role-based access control, logging and monitoring, perimeter and application protection, incident management, and privacy by design and by default. We have carried out a data protection impact assessment.

16.2 No information system is completely immune to risks. If a security breach occurs that poses a high risk to your rights, we will inform you without undue delay, indicating the nature of the incident, its possible consequences, and the measures taken.

17. Your rights

17.1 You may exercise the rights of access, rectification, erasure, restriction of processing, data portability, and objection, withdraw the consents you have given, and not be subject to decisions based solely on automated processing with legal or similar effects.

17.2 To exercise them, write to lopd@tellmegen.com or by postal mail to GENELINK, S.L. (reference: Data Protection), calle Arquitecto Mora 5, floor 2, door 4, 46010 Valencia, Spain. We may ask you to prove your identity.

17.3 We will respond within one month, extendable by two more months if the request is complex or if we receive a high number of requests, informing you of the extension within the first month.

17.4 The exercise is free of charge, except for manifestly unfounded or excessive requests, in particular for repetitive ones, for which a reasonable fee may be charged or the action refused, with justification.

17.5 You may file a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.

18. Change of control and business succession

18.1 GENELINK may be subject to corporate transactions such as a merger, a spin-off, financing, a contribution of a business line, or the total or partial transfer of the business, including the separate transfer of the Vivabioma brand.

18.2 In the prior negotiation and audit phases, only strictly necessary aggregated, statistical, or pseudonymized data may be shared, under confidentiality, minimization, and access control agreements. Individually identifiable files or microbiome profiles attributable to a specific person will not be provided in any case.

18.3 If the operation materializes, the acquiring entity will be subrogated as data controller and will be bound by the Informed Consent and by this Policy, without expanding the purposes. We will communicate this to you without undue delay and, whenever possible, before you begin to process your data.

18.4 For materially different purposes, the new controller shall inform you and obtain a valid legal basis or, where appropriate, a new consent.

18.5 In the event of insolvency or liquidation, your data may only be transferred in the framework of service continuity and with equivalent guarantees; otherwise, it will be deleted or anonymized, except for archives subject to mandatory retention. These rules do not alone authorize an autonomous sale of personal data or samples.

19. Changes to this Policy and proof of consent

19.1 We may update this Policy due to legal, technical, or service changes. Each version has a code and date, and you can request the version history from lopd@tellmegen.com.

19.2 If the change expands the purposes, data categories, or recipients, or affects any of your consents, we will inform you before it takes effect and, where appropriate, we will ask for your affirmative action. We will not apply new purposes to data already collected without that basis.

19.3 We keep proof of each consent given, with the version of the text shown to you, your fingerprint, the date, and the time. You can view and download it from your account.

20. Contact

For any questions regarding this Policy, you can write to lopd@tellmegen.com or, for matters requiring the intervention of the Data Protection Officer, to dpo@tellmegen.com.