PRIVACY POLICY
Privacy Policy
Welcome to Biorenix.
At Biorenix Ltd (”Biorenix”, “we”, “our”, or “us”), we are committed to protecting your privacy and handling your personal information with transparency, integrity, and the highest standards of security.
This Privacy Policy explains how we collect, use, store, disclose, and protect your personalinformation when you:
• visit our website;
• create or use a Biorenix account;
• use our mobile application;
• interact with our AI-powered services;
• complete health or wellness questionnaires;
• use voice features;
• purchase products or subscriptions; or
• otherwise interact with our services (collectively, the “Services”).
Because Biorenix provides AI-assisted health and wellness services, some of the information we process may include health-related information that is considered a special category of personal data under applicable data protection laws. We process this information only where permitted bylaw and with appropriate safeguards.
This Privacy Policy has been prepared to comply with applicable privacy and data protection laws, including:
• The UK General Data Protection Regulation (UK GDPR)
• The EU General Data Protection Regulation (EU GDPR)
• The UK Data Protection Act 2018
• Applicable consumer protection legislation
• Apple App Store Review Guidelines
• Google Play User Data Policy
Please read this Privacy Policy carefully before using our Services.
By creating an account or using our Services, you acknowledge that you have read and understoodthis Privacy Policy.
1. Definitions
For the purposes of this Privacy Policy, the following terms have the meanings set out below.
Account means your registered Biorenix user account.
AI Services means the artificial intelligence features provided within the Biorenix platform, icluding our AI Assistant and related functionality.
Applicable Data Protection Laws means all laws governing the processing of personal data that apply to Biorenix, including the EU GDPR and UK GDPR.
Controller means the organisation that determines the purposes and means of processing personal data. For the purposes of this Privacy Policy, Biorenix Ltd is the Data Controller unless otherwise stated.
Health Information means any information relating to your physical or mental health, symptoms, medical history, medications, supplements, blood test results, lifestyle, nutrition, wellness questionnaires, or similar information you choose to provide through our Services.
Personal Data means any information relating to an identified or identifiable natural person, as defined under applicable data protection laws.
Processing means any operation performed on personal data, including collection, recording, organisation, storage, use, disclosure, transmission, deletion, or destruction.
Processor means a third party that processes personal data on behalf of Biorenix.
Services means the Biorenix website, mobile applications, AI-powered services, subscriptions, products, customer support, and all related digital services provided by Biorenix.
Special Category Data means sensitive personal data that receives additional legal protection under the GDPR, including health-related information.
User, “you”, or “your” means any individual who accesses or uses the Services.
2. Who We Are
Biorenix Ltd is a health technology company that develops AI-assisted wellness solutions designed to support individuals in making informed lifestyle, nutrition, and wellness decisions.
Our Services combine digital technology, artificial intelligence, educational content, wellness programmes, and nutritional products to provide personalised guidance based on the information you choose to share with us.
Biorenix does not provide emergency medical services. Our AI Services are intended to support andeducate users and are not a substitute for professional medical advice, diagnosis, or treatment.
Data Controller
Biorenix Ltd
112 High Street
Haleigh, Ipswich
IP7 5EL
London, United Kingdom
Email: privacy@biorenix.com
Website: https://www.biorenix.com
If you have any questions regarding this Privacy Policy or how your personal data is processed, please contact us using the details above.
3. Scope of this Privacy Policy
This Privacy Policy applies to all personal data processed by Biorenix through our Services, including:
• the Biorenix website;
• the Biorenix mobile application;
• your Biorenix account;
• AI-powered features and services;
• voice transcription features;
• health and wellness questionnaires;
• subscription and payment services;
• customer support communications;
• newsletters and service-related communications; and
• any other products or services that reference this Privacy Policy.
This Privacy Policy applies regardless of whether you access our Services through a desktop computer, mobile device, tablet, or other supported device.
This Privacy Policy does not apply to third-party websites, applications, or services that are not owned or controlled by Biorenix, even if they are accessible through links within our Services. We encourage you to review the privacy policies of those third parties before providing any personal information.
4. Personal Data We Collect
The personal data we collect depends on how you interact with our Services and the features you choose to use.
Account Information
When you create a Biorenix account, we may collect:
• Full name
• Email address
• Postal address
• Country of residence
• Age
• Gender
Authentication and account management are securely provided through Memberstack.
We do not store your password in our own systems.
Health and Wellness Information
To provide personalised wellness recommendations and AI-assisted guidance, you may choose to provide information including:
• Existing health conditions
• Symptoms
• Lifestyle information
• Nutrition and dietary habits
• Supplement usage
• Medications
• Wellness questionnaire responses
• Blood test results
• Treatment history
• Personal wellness goals
• Progress updates
Providing health-related information is voluntary. However, certain features may not function correctly without sufficient information to generate personalised recommendations.
AI Interaction Data
When you communicate with our AI Assistant, we process the information you actively submit in order to generate personalised responses.
This information may include questions, health information, lifestyle information, uploaded content, and other information you voluntarily provide during your interaction with the AI Services.
To help monitor system reliability and performance, we use Langfuse as our AI observability platform.
Langfuse does not receive or store the content of your conversations.
Instead, Langfuse receives only limited pseudonymised technical metadata, including:
• Internal pseudonymous user identifier
• Session identifier
• AI model information
• Token usage
• Request timing
• Cost metrics
Conversation content (including prompts and AI responses) is not transmitted to Langfuse.
Langfuse metadata is retained for a maximum of 30 days.
If you delete your Biorenix account, associated Langfuse metadata is automatically and permanently deleted as part of the account deletion process.
Voice Processing
If you choose to use voice functionality, your speech is processed through Google Cloud Speech-to-Text solely for the purpose of converting speech into text.
Voice recordings are not permanently stored.
Audio is deleted immediately after transcription has been completed.
5. Special Category (Health) Data
Certain information you provide through our Services constitutes Special Category Personal Data under the General Data Protection Regulation (GDPR).
This includes information relating to your physical or mental health, symptoms, nutrition, medications, supplements, blood test results, treatment history, wellness questionnaires, and similar health-related information.
We process this information only where one or more legal grounds apply, including:
• your explicit consent;
• where processing is necessary to provide the Services you have requested;
• where otherwise permitted under applicable law.
Health information is used exclusively to provide personalised wellness guidance and to deliver the features you choose to use.
We do not sell your health information.
We do not use your health information for advertising.
We do not share your health information with third parties except where necessary to operate the Services, comply with legal obligations, or where you have specifically instructed or authorised us to do so.
Health information is protected using industry-standard technical and organisational securitymeasures appropriate to its sensitivity.
6. Payment Information
If you purchase a subscription, product, or other paid Service, all payment transactions are securelyprocessed by Stripe.
Biorenix does not collect or store your full payment card details.
Depending on your subscription, we may process and store the following billing information:
• Stripe Customer ID
• Stripe Subscription ID
• Subscription status
• Subscription plan
• Billing currency
• Payment status
• Renewal and billing dates
• Transaction reference numbers
Stripe acts as an independent payment service provider and processes payment information inaccordance with its own Privacy Policy and applicable payment security standards, including PCIDSS.
7. Technical Information and Firebase Services
To operate, secure, and improve our Services, we automatically collect certain technical informationwhen you use our website or mobile application.
This information may include:
• Device type and model
• Operating system and version
• Application version• Browser type
• IP address• Device identifiers
• Language preferences
• Time zone
• Diagnostic information
• Crash reports
• Performance information
• Security logs
The Biorenix mobile application also uses Firebase services provided by Google to supportessential application functionality.
These services currently include:
• Firebase Core – application configuration and core platform services.
• Firebase Cloud Messaging – secure delivery of notifications that are necessary for application functionality.
• Firebase Crashlytics – identification, diagnosis, and resolution of software errors toimprove application stability and security.Firebase services are used solely to operate, maintain, secure, and improve the performance of ourServices.Firebase is not used to sell your data or to build advertising profiles based on your healthinformation.
8. How We Use Your Personal Data
We process personal data only where necessary to provide and improve our Services.
Depending on how you use Biorenix, your information may be used to:
• create and manage your account;
• authenticate your identity;
• provide personalised AI-assisted wellness guidance;
• generate responses through our AI Services;
• process subscriptions and payments;
• provide customer support;
• respond to your enquiries;
• maintain the security of our systems;
• detect fraud, abuse, and unauthorised access;
• improve the reliability, safety, and functionality of our Services;
• comply with legal and regulatory obligations;
• communicate important service updates; and
• exercise or defend legal claims where necessary.
We process only the minimum amount of personal data reasonably required for each purpose.
We do not sell your personal information.
We do not sell your health information.
We do not use your health information for advertising.
We do not use your personal information to train OpenAI models.
Where possible, technical and operational data are pseudonymised or aggregated to reduce theamount of identifiable information processed.
9. Legal Basis for Processing
Where required by applicable law, Biorenix processes personal data only where a valid legal basis exists.
Depending on the circumstances, our legal bases include:
Performance of a Contract
We process personal data where necessary to provide the Services you request, including:
• creating and maintaining your account;
• providing AI-powered functionality;
• delivering subscriptions and products;
• processing payments; and
• providing customer support.
Consent
We rely on your consent where required by law, including for:
• processing Special Category (health) data where applicable;
• optional communications;• certain cookies and similar technologies; and
• optional features requiring your permission.
You may withdraw your consent at any time where consent is the legal basis for processing.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Legitimate Interests
Where appropriate, we process personal data based on our legitimate interests, including to:
• maintain and improve our Services;
• protect the security of our systems;
• prevent fraud and misuse;
• investigate incidents;
• improve reliability and performance; and
• ensure the continued operation of our business.
When relying on legitimate interests, we carefully balance those interests against your rights andfreedoms.
Legal Obligations
We may process personal data where necessary to comply with applicable laws, regulations, court orders, tax requirements, accounting obligations, or lawful requests from competent public authorities.
10. Third-Party Service Providers
To deliver, operate, maintain, and secure our Services, Biorenix works with carefully selected third-party service providers (“Processors”). These providers process personal data only on our behalf, under contractual obligations, and only to the extent necessary to perform the services they havebeen engaged to provide.
Our current service providers include: - table needs adjustments
Provider Purpose
Memberstack Stripe User authentication, account management, and subscriptionmanagementSecure payment processing and subscription billingOpenAI AI-powered functionality and response generationLangfuse AI observability using pseudonymised operational metadataonlyVoice transcription servicesGoogle Cloud Speech-to-TextFirebase Core Mobile application infrastructureFirebase CloudMessagingFirebase Crashlytics Delivery of service-related push notificationsCrash reporting, diagnostics, and application stability
Each provider processes personal data in accordance with applicable data protection laws and underappropriate contractual safeguards.
We carefully assess our providers to ensure they maintain appropriate technical and organisationalsecurity measures.
11. International Data Transfers
Some of our service providers may process personal data outside your country of residence.
Where personal data is transferred internationally, Biorenix implements appropriate safeguards toensure that your information remains protected in accordance with applicable data protection laws.
These safeguards may include:
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• the UK International Data Transfer Agreement (IDTA), where applicable;
• adequacy decisions adopted by competent authorities; or
• other legally recognised transfer mechanisms.
Our primary production infrastructure is hosted on Microsoft Azure in the West Europe region.
Where third-party providers process data in other jurisdictions, appropriate legal safeguards areapplied where required.
12. Data Security
Protecting your personal information is one of our highest priorities.
Biorenix maintains technical and organisational security measures designed to protect personal dataagainst accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorisedaccess.
Our security measures include, where applicable:
• HTTPS/TLS encryption for all data transmitted between your device and our Services;
• AES-256 Transparent Data Encryption (TDE) for data stored in our production database;
• Encryption of production backups;
• Secure storage of API keys, credentials, and secrets using Microsoft Azure Key Vault;
• Role-based access controls and least-privilege access principles;
• Authentication and authorisation controls;
• Continuous monitoring of system availability and security;
• Security logging and incident investigation procedures;
• Regular software updates and security maintenance.
Although we apply industry-standard security practices, no method of electronic transmission orstorage can be guaranteed to be completely secure.
Accordingly, while we take reasonable steps to protect your information, we cannot guaranteeabsolute security.
In the event of a personal data breach, Biorenix will respond in accordance with applicable law,including notifying competent supervisory authorities and affected individuals where required.
13. Data Retention
We retain personal data only for as long as it is necessary to fulfil the purposes described in thisPrivacy Policy, comply with legal obligations, resolve disputes, enforce our agreements, and protectour legitimate business interests.
Retention periods vary depending on the type of information processed.
Examples include:
• Account information: retained while your account remains active.
• Health and wellness information: retained while required to provide the Services, unlessdeleted earlier following account deletion or a valid deletion request.
• Langfuse operational metadata: retained for a maximum of 30 days.
• Voice recordings: deleted immediately after successful transcription.
• Payment and billing information: retained only as required by applicable accounting, tax,and financial reporting laws.
When information is no longer required, it is securely deleted, anonymised, or irreversiblydestroyed using appropriate technical procedures.
14. Account Deletion
Biorenix gives users full control over their personal data.
You may delete your Biorenix account at any time directly from the Account or Settings sectionwithin the mobile application.
When you request account deletion, the process is fully automated and does not require manualintervention by Biorenix.
Subject to any legal obligations requiring limited retention of certain records (such as accounting ortax records), account deletion will result in the permanent deletion of your associated personal datafrom our production systems, including:
• Your Biorenix account
• Personal profile information
• Health and wellness information
• AI-related operational metadata stored in Langfuse
• Account information stored in Memberstack
Voice recordings are never retained and therefore require no additional deletion.
Certain payment and financial transaction records may be retained where required by applicableaccounting, taxation, or other legal obligations.
Once personal data has been permanently deleted, it cannot be recovered.
15. Your Privacy Rights
Depending on your country of residence and applicable law, you may have the following rightsregarding your personal data:
• The right to access your personal data.
• The right to request correction of inaccurate or incomplete information.
• The right to request deletion of your personal data.
• The right to restrict certain processing activities.
• The right to object to processing based on legitimate interests.
• The right to withdraw consent where processing is based on consent.
• The right to receive a copy of your personal data in a structured, commonly used, andmachine-readable format.
• The right to request the transfer of your personal data to another service provider where technically feasible.
• The right to lodge a complaint with your local data protection authority.
Biorenix will respond to valid requests within the time periods required by applicable law.
Where permitted by law, we may request reasonable proof of identity before processing certainrequests to protect your privacy and the security of your account.
16. Cookies and Similar Technologies
Our website uses cookies and similar technologies to provide essential functionality, improve user experience, maintain security, and understand how our Services are used.
Cookies may be used to:
• maintain secure user sessions;
• remember user preferences;
• improve website functionality;
• analyse website performance;
• detect fraud and security threats.
Where required by applicable law, non-essential cookies will only be placed after obtaining your consent through our cookie consent banner.
You may manage or withdraw your cookie preferences at any time through the cookie settings available on our website or through your browser settings.
17. Children’s Privacy
The Services are intended for individuals who are legally permitted to use them under the lawsapplicable in their country of residence.
Biorenix does not knowingly collect personal data from children where parental consent is requiredby law.
If we become aware that personal data has been collected from a child in violation of applicablelaw, we will take appropriate steps to delete such information as soon as reasonably practicable.
Parents or legal guardians who believe that a child has provided personal data to Biorenix maycontact us using the contact details provided in this Privacy Policy.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our Services, applicablelaw, technology, or business operations.
When material changes are made, we will update the Last Updated date shown at the beginning ofthis Privacy Policy.
Where required by applicable law, we will also notify users through the website, the mobile aplication, email, or other appropriate communication channels before the changes take effect.
We encourage users to review this Privacy Policy periodically to remain informed about how we protect personal data.
19. Contact Us
If you have any questions about this Privacy Policy, your personal data, or your privacy rights,please contact us.
Biorenix Ltd
London, United Kingdom
Email: privacy@biorenix.com
Website: https://www.biorenix.com
If you are not satisfied with our response, you may also have the right to lodge a complaint with the competent data protection authority in your country of residence.
20. Final Statement
Protecting your privacy is fundamental to our mission.
Biorenix is committed to processing personal data lawfully, fairly, and transparently while maintaining appropriate technical and organisational safeguards designed to protect your information.
We continually review and improve our privacy and security practices to ensure that your personalinformation remains protected as our Services evolve.
Thank you for placing your trust in Biorenix.
