Privacy Policy

1. Introduction

Biome Health, Inc. (“Biome,” “we,” “our,” or “us”) is committed to protecting your privacy and maintaining the confidentiality of your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and related services (collectively, the “Service”). By using the Service, you acknowledge that you have received this Privacy Policy. Before we send personal data to a third-party AI provider, we provide an in-app disclosure describing the data involved and ask for your permission.

2. Scope and Healthcare Privacy Status

3. Information We Collect

3.1 Information You Provide

We collect information you voluntarily submit to us, including:

• Contact Information: Name, email address, phone number, and mailing address
• Health Information: Medical history, current health conditions, medications, allergies, symptoms, and other health-related data you provide through intake forms or the app
• Genetic Information: When you purchase genome or DNA testing, information associated with your testing order may include your biological sample, genotype or sequence data, variant files, genetic findings, reports, and the identifiers needed to connect the sample and results to your account
• Wearable Health Data: If you choose to connect a compatible wearable device, we may collect health and fitness measurements such as heart rate, heart rate variability, respiratory rate, SpO2, skin temperature, sleep, recovery, strain, and related device diagnostics
• Apple Health and HealthKit Data: If you authorize Apple Health access, we may receive the specific health and fitness data types shown in Apple's permission flow, including authorized activity, workout, heart, sleep, respiratory, body-measurement, and nutrition data. We do not use HealthKit data for advertising or marketing
• Content You Submit and AI Outputs: Messages, prompts, conversation history, feedback, photographs, documents, health records, laboratory results, and other content you choose to submit, together with responses and other content generated by AI-enabled features
• Account Information: Credentials used to create and authenticate your account
• Payment Information: Credit or debit card details and billing address, processed securely through our third-party payment processor
• Communications: Messages, feedback, and other correspondence you send to us

3.2 Information Collected Automatically

When you use the Service, we may automatically collect:

• Device Information: Browser type, operating system, device model, and unique device identifiers
• Bluetooth Device Information: If you enable local wearable sync in the mobile app, we may collect Bluetooth connection status, device model, battery level, local sync status, and diagnostics needed to sync your own device
• Usage and Product Analytics Data: Pages and app screens viewed, features used, interactions with the Service, time spent, navigation patterns, onboarding progress, purchase and subscription activity, referral activity, sharing actions, and related timestamps. Some analytics events may provide limited health-related context, such as the category of an onboarding step, whether a weight-related goal exists, or whether a health-related feature was used. These events do not contain the underlying contents of medical records, genetic results, messages, uploaded documents, photographs, or raw health measurements
• Log Data: IP address, access times, error reports, and referring URLs
• Location Data: General geographic location derived from your IP address

3.3 Cookies and Analytics Technologies

We use essential cookies and similar technologies to operate the Service, maintain sessions, secure transactions, and remember preferences.

We use PostHog for product analytics on our website and mobile application. PostHog may receive device and browser information, operating system and app version, usage events, session identifiers, IP address, general location derived from IP address, and purchase or subscription information. When you sign in or submit contact information, we may associate this analytics information with your account identifier, email address, first name, and last name.

Analytics events may indicate that you viewed or completed a particular onboarding step or used a health-related feature. We do not use PostHog to store the contents of medical records, genetic results, messages, uploaded documents, photographs, or raw health measurements. We do not use PostHog session replay. We use PostHog to understand and improve our own Service, not for third-party advertising or to track your activity across services operated by other companies.

Separately, we may use advertising and attribution technologies, including Meta Pixel, to measure advertising performance and attribute purchases. These providers may receive website activity, device and browser information, advertising identifiers, purchase-attribution information, and, where applicable, contact identifiers in hashed form. We do not send raw genetic data, genetic findings, medical intake answers, or health records to advertising providers. You can control cookies through your browser and use the privacy and advertising controls offered by the applicable provider.

If raw Bluetooth diagnostic streams are enabled for troubleshooting or research, they stay on your device unless you choose to share diagnostics with us or opt in to a separate support or research workflow.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Import, organize, display, and summarize health information you submit or authorize us to receive
• Generate automated health and wellness information
• Display standardized wellness tracks and protocols
• Answer questions through AI-enabled features
• Provide links to independent retailer or brand websites when requested
• Fulfill genome and DNA testing orders, coordinate kit delivery and laboratory processing, connect samples to orders, and generate the results and files you request
• Send transactional communications including order confirmations, shipping updates, and account notifications
• Send promotional communications about products and services, where you have opted in
• Detect, investigate, and prevent fraud or unauthorized activity
• Analyze usage patterns to improve user experience and develop new features
• Measure onboarding and purchase funnels, diagnose product problems, and evaluate how people navigate and interact with the Service
• Sync health measurements from compatible wearable devices you choose to connect
• Comply with legal and regulatory obligations

Biome does not use this information to provide clinician review, medical diagnosis, prescribing, or treatment. No clinician reviews individual AI responses or wellness protocols before they are displayed.

5. Use of Artificial Intelligence

Biome uses artificial intelligence and other automated systems to:

• Generate chat responses and other automated health and wellness information
• Analyze meal and health entries
• Extract, organize, summarize, and explain information in photographs and documents you submit
• Generate bloodwork explanations and health summaries

Biome currently uses the following third-party AI provider:

• Google Cloud: We use Google Cloud Vertex AI to provide AI-enabled analysis and generated content. Models and AI services available through Google Cloud may be developed by Google, Anthropic, OpenAI, Groq, or other providers. The models used may vary by feature and service availability

With your permission, the information sent to an AI provider may include:

• Messages and conversation history
• Photographs and documents you choose to analyze
• Relevant profile and health information, including your name, age, biological sex, health goals and concerns, medications, allergies, health conditions, laboratory or genetic results, and authorized Apple Health or wearable measurements

We collect this information from content you enter, record, or upload and from health services you choose to connect. The AI provider processes it on Biome's behalf to provide the applicable AI-enabled feature.

Before Biome sends personal data to a third-party AI provider, the app asks for your permission. If you do not grant permission, Biome will not send your personal data to an AI provider.

AI output is generated automatically. No physician, clinician, or pharmacist reviews each input or output before it is shown. AI output may be incomplete, inaccurate, misleading, outdated, or inappropriate.

Biome does not use AI to prescribe treatment or make legal or similarly significant decisions about a user. AI responses, wellness protocols, and summaries are informational and are not clinical decisions.

We may add or replace AI providers over time. We will identify current third-party AI providers in this Privacy Policy before they process personal data.

6. How We Share Your Information

We do not sell your personal information. We do not rent or share your information with third parties for their own marketing purposes.

Genetic data. We do not sell, license, or disclose your individual genetic data or any genetic data that identifies you. We do not use identifiable genetic data to train artificial-intelligence models, to target advertising, or for research without your separate, express consent. We may create and use aggregated or de-identified data, which cannot reasonably be linked to you, for any lawful purpose; we maintain such data only in de-identified form, do not attempt to re-identify it, and contractually require any recipient to do the same. We disclose genetic data to government agencies or law enforcement only when compelled by valid legal process, and we notify you before disclosure where the law permits.

We may share your information in the following circumstances:

• Connected Health Services: At your direction, we may receive information from wearable providers and other health-data services you choose to connect so that we can import or synchronize requested data
• External Retailers and Affiliate Partners: When you select an external purchase link, the destination may receive the requested URL, an affiliate identifier where applicable, and standard connection information such as your IP address and browser or device information. Biome may receive compensation for qualifying purchases. The destination's own terms and privacy policy apply
• Sequencing and Laboratory Partners: When you purchase genome or DNA testing, we share the contact, shipping, order, sample, and genetic information necessary for kit fulfillment, sample processing, sequencing or genotyping, secure analysis, and delivery of your requested results
• Analytics Providers: We use PostHog to process product-usage and analytics information for us. This may include device and app information, usage events, session and account identifiers, contact information associated with an analytics profile, purchase activity, and limited health-related interaction metadata. We do not use PostHog session replay or provide PostHog with the contents of medical records, genetic results, messages, uploaded documents, photographs, or raw health measurements
• Advertising and Attribution Providers: We may share website and purchase-attribution information with providers such as Meta. We do not share raw genetic data, genetic findings, medical intake answers, health records, or PostHog analytics profiles with advertising providers
• AI Service Providers: With your permission, we share the information described in Section 5 with Google Cloud. Models and AI services available through Google Cloud may be developed by Google, Anthropic, OpenAI, Groq, or other providers. The models used may vary by feature and service availability. We will identify any additional third-party AI service provider in this Privacy Policy before we share personal data with it
• Service Providers: We work with third-party companies that help us operate the Service, including payment processors, cloud hosting providers, email delivery services, and customer support tools. These providers may access your information only as needed to perform their functions. We require third-party service providers that receive personal data from us to process it only for the services they provide to Biome and to provide the same or equivalent privacy and security protections described in this Privacy Policy
• With Your Consent: We may share information when you give us explicit permission
• Legal Requirements: We may disclose information if required by law, subpoena, court order, or government regulation
• Safety and Rights: We may share information, other than genetic data, when we believe it is necessary to protect the rights, property, or safety of Biome, our users, or others
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity

7. Text Messaging

If you opt in to receive text messages from us, we may send you transactional messages (such as order updates and appointment reminders) and, where separately consented to, promotional messages about our products and services.

• Message frequency may vary. Message and data rates may apply.
• You may opt out of text messages at any time by replying STOP to any message or by contacting us at hello@biome.you.
• Your opt-in consent to receive text messages and the phone number you provide for that purpose will not be shared with any third parties for their own marketing use. This data is shared only with service providers who facilitate message delivery on our behalf.

8. Data Retention

We retain your information only as long as reasonably necessary to fulfill the purposes described in this policy and to comply with legal obligations. Our general retention periods are:

• Account Information: Retained while your account is active. After account closure or deletion, we delete or de-identify account information unless limited information must remain for security, fraud prevention, dispute resolution, transactions, or legal compliance
• Consumer Health and Wellness Data: Retained while needed to provide the Service or until you delete the data or your account, unless a specific legal obligation requires longer retention
• AI Conversations and Outputs: Retained to provide conversation history and requested features until deleted by you or with your account, subject to legal, security, provider-retention, and backup limitations
• Genetic Data, Results, and Samples: Biome retains order records, generated results, and files made available through your account while needed to provide the Service, until you request deletion, or as required by law. A genomic processing provider may retain genomic files, DNA samples, and sequencing deliverables for up to 90 days after delivery. Collection devices and residual samples may be destroyed earlier. You may request earlier deletion, subject to processing, legal, security, and backup limitations
• Transaction Records: Up to 7 years for tax and accounting compliance
• Communications: Up to 3 years from the date of correspondence
• Device, Analytics, and Usage Data: Up to 13 months
• Legal and Compliance Records: Limited contract-acceptance, consent, transaction, fraud-prevention, dispute-resolution, and legal-compliance records may remain after account deletion for up to seven years or another period required by law

When retention periods expire, we securely delete or de-identify your information. If immediate deletion is not possible (for example, data stored in backup archives), we isolate the information from further processing until deletion can be completed.

9. Consumer Health Data

Some information we handle is consumer health data under Washington's My Health My Data Act, Nevada's consumer health data law, and similar laws. This section is our consumer health data privacy policy under those laws.

Categories we collect: health information you choose to share with us, such as health conditions, symptoms you describe in conversations, medications, allergies, and intake answers; laboratory results and health records you upload; genetic information and genetic findings; wearable and Apple Health measurements; the contents of AI conversations and inferences contained in AI responses; and health-related usage events described in Section 3.

Sources: you; devices and services you connect; our sequencing and laboratory partners; and AI providers processing your requests on our behalf.

Purposes: to provide, operate, secure, and improve the Service; to generate the automated health and wellness information you request; to fulfill testing orders; to communicate with you; and to comply with law.

Sharing: only with the service providers, AI providers, sequencing and laboratory partners, and other recipients described in Section 6, and as required by law. We do not sell consumer health data or provide it to data brokers, insurers, or employers. We do not share genetic data, genetic findings, intake answers, or health records with advertising providers.

Your rights: you may confirm whether we collect or share your consumer health data, access it, obtain a list of the third parties with whom we have shared it, withdraw consent to future collection or sharing, and request deletion, by emailing hello@biome.you. We will not discriminate against you for exercising these rights. If we deny a request, you may appeal as described in Section 10.

10. Your Rights

Under applicable privacy laws, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request that we delete your personal information, subject to legal retention requirements
• Genetic Data: Request information about the genetic data associated with your account and request deletion where available, subject to fulfillment status, technical limitations, and legal retention requirements. California residents may also request destruction of their biological sample within 30 days of revoking consent
• Restriction: Request that we limit how we use your information
• Data Portability: Request a copy of your information in a structured, machine-readable format
• Objection: Object to certain uses of your information
• Communication Preferences: Request that we contact you through a specific channel or at a specific address
• Appeal: Where applicable, appeal if we decline all or part of your request to access, correct, or delete your information
• Authorized Agent: Where applicable, authorize another person to submit a privacy request on your behalf

You can initiate deletion of your account and associated personal information in the mobile app's settings. You may also exercise your rights by contacting us at hello@biome.you. Some information may be retained where required by law or temporarily isolated in backup archives as described above. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

If we decline all or part of your request, you may appeal by replying to our decision or emailing hello@biome.you with the subject line “Privacy Appeal.” We may verify your identity or an authorized agent's authority before processing a request or appeal.

11. Opt-Out Procedures

Marketing Emails

You can unsubscribe from marketing emails at any time by clicking the “unsubscribe” link at the bottom of any marketing email, or by emailing us at hello@biome.you.

Text Messages

Reply STOP to any text message or contact us at hello@biome.you.

Product Analytics

You may object to or request restriction or deletion of analytics information associated with your account by contacting hello@biome.you with the subject line “Analytics Privacy Request.”

AI Processing

You may withdraw your permission for future sharing with third-party AI providers from the AI Features control in the app's Settings when that control is available, or by emailing hello@biome.you with the subject line “Withdraw AI Permission.” After permission is withdrawn, a future AI request requires you to grant permission again before Biome sends personal data to a third-party AI provider. Withdrawal does not affect processing that occurred before it was completed.

Information Sharing

To opt out of certain information sharing practices, email us at hello@biome.you with the subject line “Opt Out” and specify which types of sharing you wish to opt out of.

12. Automated Decision-Making

We may use automated processes for purposes such as fraud detection, security monitoring, and generating personalized content and health insights based on your data.

Biome does not use automated systems to prescribe treatment or make decisions about you that produce legal or similarly significant effects. No physician, clinician, or pharmacist reviews AI output before it is displayed. You may contact hello@biome.you with questions about automated processing or to exercise applicable privacy rights.

13. Data Security

We use safeguards designed to protect personal, health, and genetic information against unauthorized access, acquisition, use, alteration, and disclosure. No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Security Incidents and Breach Notification

If we learn of suspected unauthorized access, acquisition, use, or disclosure of personal information, we will investigate and take steps appropriate to the circumstances. If an incident requires notification, we will notify affected individuals, regulators, and other parties as required by applicable law.

15. Third-Party Links

The Service may contain links to third-party websites, applications, or services that are not operated by us. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party services before providing them with your information.

The same applies to any genetic data, health records, or other information you download or export from the Service and provide to other software, websites, artificial-intelligence tools, or services: their privacy practices govern their handling of it, and Biome is not responsible for how they use, retain, or disclose it.

16. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe we have collected information from your child, please contact us and we will promptly delete it.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the revised policy on this page and updating the “Last Updated” date above. For material changes, we will provide additional notice via email or a prominent notice within the Service.

If a change introduces a materially different use or disclosure of sensitive health or genetic information, we will request any consent required by applicable law before applying that change to affected information.

We will update the AI-provider list in Section 5 before allowing a new third-party AI provider to process personal data. If the change also introduces a materially different use or category of personal data, we will provide additional notice and request any additional permission required.

18. Contact Us

If you have questions about this Privacy Policy, your rights, or our privacy practices, please contact us at:

Biome Health, Inc.
131 Continental Dr, Suite 305
Newark, DE 19713
Email: hello@biome.you

To appeal a privacy decision, email hello@biome.you with the subject line “Privacy Appeal.”