Privacy Policy

The data controller is Gene-Cortex.com Ltd, registered in England and Wales.

For all privacy enquiries and to exercise your rights, contact our Data Protection Officer:

We aim to respond to all data subject requests within one calendar month (extendable by up to two further months for complex requests, with notification to you).

Genomic sequence data and copy number variant (CNV) coordinates may constitute “special category data” (health data or genetic data) under UK GDPR Article 9. We rely on the following conditions for processing where applicable:

• Article 9(2)(a) — Explicit consent: where you choose to opt in to model improvement or research use of de-identified analysis outputs.
• Article 9(2)(j) — Scientific research: for aggregated, de-identified analysis of variant interpretation patterns to improve clinical decision support, subject to appropriate safeguards.

You must not submit patient-identifiable data to the Service. All genomic coordinates must be fully de-identified before submission. We are not responsible for any PII inadvertently included in submitted data.

Where we rely on legitimate interests, we have conducted a balancing test and determined that our interests do not override your fundamental rights. You may object to processing on legitimate interests grounds (see section 9).

• Creating and managing your account and authenticating you;
• Running CNV evidence retrieval and AI interpretation analysis;
• Calculating and deducting analysis credits from your balance;
• Processing payments and sending receipts via Stripe;
• Detecting and preventing fraud, abuse, and security incidents;
• Maintaining audit trails for clinical governance purposes;
• Sending transactional emails (password reset, subscription renewal notices);
• Improving the Service via aggregated, de-identified usage analytics.

We do not use your personal data for automated decision-making with legal or similarly significant effects (within the meaning of UK GDPR Article 22) without human review. AI-generated interpretations are decision support tools, not automated decisions.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We may disclose data where required by law, court order, or to protect the rights, safety, or property of Gene-Cortex.com or its users.

After the applicable retention period, personal data is securely deleted or irreversibly anonymised.

Some of our processors are located outside the UK/EEA (notably OpenAI, Stripe, and Vercel in the USA). Where we transfer personal data internationally we rely on:

• UK International Data Transfer Agreements (IDTAs) or approved EU Standard Contractual Clauses (SCCs) as adopted under UK law;
• An adequacy decision by the UK Secretary of State (where applicable).

Copies of the relevant transfer mechanisms are available on request by emailing [email protected].

Under UK GDPR you have the following rights:

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — ask us to correct inaccurate data.
• Erasure (Art. 17) — request deletion of your data (“right to be forgotten”) where no overriding legal basis applies.
• Restriction (Art. 18) — ask us to pause processing in certain circumstances.
• Portability (Art. 20) — receive your data in a structured, machine-readable format (applies to data processed by contract or consent).
• Objection (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)) — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at [email protected]. We will respond within one month. We may ask you to verify your identity before processing your request. Exercising these rights is free of charge.

You may also exercise some rights directly in your account settings (e.g., account deletion, data export).

The Service is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will take steps to delete it.

We use strictly necessary cookies for session management and authentication. We also use privacy-respecting analytics (with IP anonymisation and without cross-site tracking) to understand aggregate usage patterns.

No third-party advertising cookies are set. You can control cookie preferences from your browser settings; note that disabling strictly necessary cookies will prevent you from logging in.

We implement technical and organisational measures appropriate to the risk, including:

• Encryption of data at rest (AES-256) and in transit (TLS 1.2+);
• Bcrypt hashing of passwords (never stored in plaintext);
• Role-based access controls and least-privilege database permissions;
• Audit logging of all sensitive operations;
• Regular security review and dependency updates.

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please disclose it responsibly to [email protected].

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have processed your personal data unlawfully:

We would, however, appreciate the opportunity to address your concerns before you approach the ICO — please contact us first at [email protected].

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent in-app notice at least 14 days before they take effect. The effective date at the top of this page reflects the date of the last revision. Continued use of the Service after the effective date constitutes acceptance of the revised policy.