Legal

Privacy Policy

Last updated: 24 August 2026 · Version 2026-08-24

Summary of key points

What information do we process? The information needed to manage your account and your activity in the Services and, when you give us your explicit consent, your health and biomarker data, which we use to generate your profile and your personalised recommendations. On the website, we process the details you submit to join the early-access waitlist.

Do we process sensitive personal information? Yes. Your health data is a “special” or “sensitive” category of personal data under the General Data Protection Regulation (GDPR). We process it only with your explicit consent, requested separately, and you can withdraw that consent at any time without affecting the lawfulness of earlier processing.

On what legal basis do we process your information? Depending on the purpose, we rely on the performance of our contract with you, on your consent, on our legitimate interest in improving and protecting the service, or on compliance with legal obligations. We never sell your personal information and never use it for third-party advertising.

Who do we share your information with? Only with the providers that serve us under contract and with the competent authorities when the law requires it.

How do we protect your information? Through encryption, access control and incident-response procedures, in line with European cybersecurity legislation.

What are your rights? You can access your information, rectify it, request its erasure, restrict it, object to its processing, request its portability, or withdraw your consent at any time, by contacting us or from within the application itself.

1. Who we are and how you can contact us

The controller of your personal data is Helix AI Algorithm S.L., with tax identification number (NIF) B22738272, registered office at Plaça de Pau Vila 1, Palau de Mar, Pier 01, Office 2B, 08039 Barcelona, Spain, and registered with the Barcelona Mercantile Registry in Section 8, Sheet B-640445, Entry 1.

Helix provides biomarker analysis, tracking dashboards, personalised recommendations and a conversational coach powered by artificial intelligence, for wellness, prevention and educational purposes (see section 16).

For any privacy question, or to exercise your rights, write to info@helixai.life. Full company information is also published in our Terms and Conditions.

2. What does this Policy apply to?

This is the single Helix Privacy Policy. It covers every product and service we offer, show or make available:

• The website at helixai.life and its public subdomains (the “Website”), including the Helix early-access waitlist.
• The Helix Longevity mobile application (the “App”), distributed through the App Store and Google Play, and the account-based services provided through it.
• Our communications with you, including support requests and messages you send us about any of the above.

Some processing happens only in the App, and some only on the Website. We indicate this where relevant.

3. What information do we collect?

In short: what you give us directly (profile, habits, lab reports you upload), what is generated when you use the service (results, technical data), what you submit through the waitlist, and — only if you turn it on — data from a device or health app you connect.

3.1. Information you give us directly

• Identification and contact: name, email address and access credentials (the password is stored encrypted).
• Profile and lifestyle: age, biological sex, height, weight, and your answers to questionnaires about habits, sleep, nutrition, physical activity, recovery and goals.
• Health and biomarker data (with your explicit consent): results of lab reports you upload to the platform, physiological markers, and the health information you choose to share.
• Files and metadata: the documents or images you select for upload, along with file name, format, size, processing status and extraction results.
• Chat content: the messages you send to the AI coach, which may include health information you decide to share.
• Communications: your preferences, survey responses, consent records and support messages.

3.2. Information generated when you use the Services

• Service results: scores, indices and recommendations generated by our system from your data.
• Technical and usage data: IP address, device and app identifiers, device model, operating system, language, app version, usage events, security events, and error and performance logs.
• Transaction data: your subscription status, product identifier and purchase-validation information, when paid features are offered. We do not store complete payment-card numbers, and we do not receive them from the app stores.

3.3. Connected-device data (optional, and only if you turn it on)

If you voluntarily connect a health device or platform (for example, Apple Health or Health Connect), and only after granting the permissions on your device, we will read — in read-only mode — the categories you authorise (activity, sleep, heart rate and similar). It is entirely optional: the Services work without connecting any device, and you can revoke access at any time from the settings. This integration is not available in the currently released application.

3.4. Website and early-access waitlist

The Website is informational and does not require an account. If you choose to join the early-access waitlist, we collect:

• Waitlist details: your name, email address, the areas of interest you select, the version of this Privacy Policy shown to you when you joined, and the time of your consent.
• Communications: the content of messages you send us and the information needed to respond.
• Technical and security data: the information normally contained in HTTP and infrastructure logs, such as IP address, browser type, requested URL, timestamps, and error or security events.

Joining the waitlist is voluntary. A name, a valid email address, at least one selected interest and your consent to the requested updates are needed to join; without them we cannot add you, although you may still browse the Website. We do not collect health data through the Website, and we ask you not to submit health information, medical records, identification documents or other sensitive personal data through the waitlist or the general contact address.

All the personal information you provide to us must be truthful, complete and up to date; please let us know if it changes.

4. What device permissions do we request?

In short: file access so you can upload your lab reports, and — when those features are released — camera and notification access. You can always manage them from your phone settings.

The App lets you select documents or files using your device's document picker. We may also request access to the camera and to your device storage so that you can photograph or upload your lab reports, and to notifications so that we can tell you about your progress and remind you about your plan. Granting these permissions is voluntary: you can revoke them at any time from your device settings, although some functions will stop being available if you do. Camera, photo-library and notification access are not requested in the currently released application.

5. What do we use your information for?

In short: to create and manage your account, generate your recommendations, provide the wellness chat, manage your subscription, run the waitlist, improve the service and communicate with you — never to sell it and never for third-party advertising.

• Create and manage your account. We process your identification and contact data so that you can register, sign in and keep your account active.
• Generate your profile and your personalised recommendations. We process your health, biomarker and lifestyle data to calculate your wellness indicators and offer recommendations adapted to your situation.
• Provide the wellness chat service. We process the content of your conversations with the AI coach to give you contextualised answers and follow up on your questions.
• Answer your enquiries and provide support. We process the content of your support messages and communications to resolve your questions and any incidents with the service.
• Manage your subscription, billing and cancellations. We process your transaction data to handle payments, renewals, cancellations and refunds.
• Manage the early-access waitlist. We process the details you submit through the Website to keep you on the waitlist and send you the Helix updates you selected.
• Improve the Services and keep them stable. We process technical and usage data to detect errors, analyse performance and prioritise product improvements.
• Protect the security of your account and prevent fraud. We process technical and usage data to detect unauthorised access, suspicious activity or misuse of the platform.
• Send you our own commercial communications. Only if you give us your consent, we process your contact data to send you news about Helix. You can unsubscribe whenever you want.
• Comply with our legal obligations. We process strictly the data needed to meet tax, commercial or other requirements imposed on us by law, and to establish or defend legal claims.

We do not sell your personal data and we do not transfer it to third parties for commercial or advertising purposes. We do not process other categories of sensitive data (ethnic origin, religion, sexual orientation, political affiliation) and we ask you not to include them in the chat or in the questionnaires.

6. What legal bases do we rely on?

In short: performance of the contract to provide the service and support you, your explicit consent for health data and the chat, your consent for the waitlist and marketing, our legitimate interest in improving and protecting the product, and legal obligations where the law requires it.

7. Do we process sensitive personal information?

Yes. Health data is a special category of personal data (Art. 9 GDPR). We process it only with your explicit consent, which we request separately and granularly when you create your account, and which you can withdraw at any time from the App or by writing to us.

If you withdraw your consent, we will stop processing your health data and stop generating personalised recommendations. Withdrawal does not affect the lawfulness of earlier processing. Please bear in mind that the personalised service cannot be provided without this data.

Do not upload another person's health information unless you are legally authorised to do so and the App expressly supports that use.

8. Do we use AI services to process your data?

In short: yes, to generate your profile and to run the wellness chat. Your data is processed inside the EU, it is never used to train third-party models, and we always tell you when content has been generated by AI.

8.1. How we use AI

We use artificial intelligence, machine learning and similar technologies to analyse your information, extract values from the material you submit, and generate personalised wellness content. This constitutes profiling (Art. 4(4) GDPR): we do not take automated decisions with legal or similarly significant effects on you (Art. 22 GDPR); the generated content is informational, and you can always request human intervention, an explanation of a result, or challenge it.

8.2. Where and how your data is processed with AI tools

The artificial-intelligence models we use run through Google Cloud (Vertex AI), configured in its European region. This means that your data is processed and stored within the European Economic Area, without this processing requiring an international transfer. Google does not use your data to train its models. We apply encryption and access control, and we are bound by the Google Cloud Data Processing Addendum (DPA).

8.3. The wellness chat

• From first use, we tell you that you are speaking with an artificial-intelligence system and not with a person, in accordance with Art. 50 of Regulation (EU) 2024/1689 (the AI Act).
• Your messages are transmitted encrypted to our servers and from there to the AI model to generate the response.
• We minimise the information sent: we exclude your direct identifiers (name, email) from the context received by the model, which works with pseudonymised identifiers.
• The chat history is saved in your account to give you continuity; you can delete it from the App or by requesting erasure.
• The AI coach is not a healthcare professional and can make mistakes. For any symptom or medical question, consult your doctor.

9. Who do we share your information with?

In short: we do not sell your data. We share it only with providers that work for us under contract, with Apple and Google to handle payments, and with authorities when the law obliges us to.

• Service providers under contract (processors). They work following our instructions and in accordance with Art. 28 GDPR, for tasks such as hosting, artificial-intelligence infrastructure, authentication, security, diagnostics, analytics, communications and subscription management. Our current core infrastructure provider is Google Cloud. The list in force can be requested at info@helixai.life.
• Apple and Google. As independent controllers, they process sign-in information and the payments for subscriptions made through their stores, under their own policies.
• Public authorities. Only where a law or a binding decision obliges us to.
• Professional advisers. Lawyers, accountants and other advisers bound by confidentiality, when we need their support.

We do not sell your personal data and we do not transfer it to third parties for commercial or advertising purposes.

10. International data transfers

Our primary infrastructure for the App, the Website and the waitlist is configured in the European Economic Area. Some providers may make support or ancillary services available from other countries. Where a transfer outside the EEA occurs, we rely on an applicable adequacy decision or on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required.

11. How long do we keep your information?

We keep each category of data only for as long as is necessary for the corresponding purpose:

After the applicable period, data is deleted or irreversibly anonymised.

12. How do we protect your information?

We apply technical and organisational measures proportionate to the risk of processing health data: encryption of communications (TLS) and of data at rest, role-based access control and least privilege, pseudonymisation where possible, backups, separation of environments, access logging and incident-response procedures, in line with Regulation (EU) 2019/881 (Cybersecurity Act) and, where applicable, Directive (EU) 2022/2555 (NIS 2). No system is infallible; if a security breach occurred with a high risk to your rights, we would notify you and report it to the AEPD in accordance with Arts. 33 and 34 GDPR.

13. Do we collect information from minors?

We do not knowingly collect or request personal data from people under 18, and we do not market using such information. By using the Services, you declare that you are at least 18 years old.

If we detect, or are notified, that we have collected data from a person under 18, we will deactivate the account and delete that data within a reasonable period. If you become aware that this may have happened, write to us immediately at info@helixai.life.

14. What are your rights and how do you exercise them?

In short: access, rectification, erasure, portability, restriction and objection, plus withdrawing your consent whenever you want, by writing to us or from within the App itself.

14.1. Exercise a data-protection right

You can exercise your rights of access, rectification, erasure, portability, restriction of processing and objection at any time, as well as withdraw your consent, by writing to info@helixai.life with the subject Helix privacy request, from the email address associated with your account where possible. State the right you want to exercise, and do not include passwords, lab reports or health details in the initial message.

We may ask for proportionate information to verify your identity. We will respond within a maximum of one month, extendable by two further months in complex cases (we would tell you). Exercising a right is free unless a request is manifestly unfounded or excessive.

14.2. Withdraw health-data consent

You can withdraw your consent to future health-data processing by emailing info@helixai.life. Withdrawal does not affect processing that was lawful before it, but the features that require health information will no longer work. If you also want existing information erased, say so clearly or use the account-deletion process.

14.3. Marketing and waitlist communications

We only send early-access or product updates for the topics you selected. You can withdraw your consent at any time using the unsubscribe method included in an email or by writing to info@helixai.life. Withdrawal does not affect processing that was lawful beforehand. We may still send essential account, security, transaction or service messages.

14.4. Device permissions and connected services

You can review and change device permissions at any time from your device settings. If connections to external health platforms or devices are introduced, you will be able to revoke them from the App settings, and this section will explain how.

14.5. Review or delete your account

You can also review, modify or delete your account directly from the App: open the Profile area and use the account deletion control. If you cannot sign in, you can instead use the external process at Delete a Helix Account.

When you delete your account, we deactivate it and remove your data from our active databases in accordance with the periods in section 11. We may keep certain information blocked where the law obliges us to (for example, billing) or while it is necessary to prevent fraud, resolve an incident or handle a claim.

14.6. Complaints

If you believe we have not handled your rights correctly, please write to us first so we can try to resolve it. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or with the supervisory authority where you live or work.

15. Do we use cookies and tracking technologies?

In short: the Website does not currently set analytics or advertising cookies; the App uses equivalent identifiers. We do not automatically respond to the browser's “Do Not Track” signal, because there is still no single technical standard for interpreting it.

The Website does not currently require Helix cookies and does not set analytics or advertising cookies. It does load font files from Google Fonts, which means your browser connects to Google to retrieve them. Our servers and hosting infrastructure process ordinary HTTP request information for delivery, reliability and security. You can consult the detail in our Cookie Policy. If we introduce non-essential cookies, we will update that Policy and request your consent before activating them. The App uses equivalent identifiers and SDKs, described in sections 3.2 and 9.

“Do Not Track” preferences. Some browsers and operating systems include a “Do Not Track” (DNT) signal to indicate that you do not want your browsing activity monitored. As of today there is no uniform technical standard for recognising and interpreting this signal, so, like most services, we do not respond to it automatically or to equivalent mechanisms. If a generally adopted standard emerges in the future, we will update this Policy to reflect it.

16. Helix is not a medical service

Helix offers wellness, prevention and educational information and recommendations. We do not provide healthcare services, we do not make diagnoses, and we do not replace the consultation, diagnosis or treatment of a healthcare professional. Always consult your doctor before taking decisions that affect your health, and never ignore medical advice because of something you have read in Helix. For urgent symptoms or an emergency, contact the emergency services available in your location; in Spain and across the European Union, call 112.

17. How does this Policy change?

We may update this Policy to reflect changes in the Services, in our providers or in the applicable legislation. The version in force will always be published on the Website and in the App with its effective date and version identifier. The identifier changes only when the substance changes, not for typo fixes or restyling. If a change is material, we will notify you with reasonable advance notice through the App or by email and, where necessary, we will ask for your consent again.

18. Contact

For any question about this Policy or about your data:
Helix AI Algorithm S.L.
Plaça de Pau Vila 1, Palau de Mar, Pier 01, Office 2B
08039 Barcelona, Spain
info@helixai.life