This Policy explains what personal data we process, for what purpose, on what legal basis, for how long, and what rights you have. It is part of the contract together with the Legal Terms, the Informed Consent and the Cookie Policy.
The Informed Consent details the processing of the sample, the microbiome profile, and the voluntary options, and prevails over this Policy in those matters.
Data controller: GENELINK, S.L., owner of the Vivabioma™ brand. NIF B98649494. Address: calle Arquitecto Mora 5, 2nd floor, door 4, 46010 Valencia, Spain. Health authorization no. 11540 from the Ministry of Health of the Generalitat Valenciana.
Vivabioma and tellmeGen are brands of GENELINK, S.L. and share certain corporate systems and privacy channels. This does not imply that the data from both services are combined: such a combination requires the specific voluntary authorization provided for in the Informed Consent.
The service is organized from Spain and we apply Regulation (EU) 2016/679, Organic Law 3/2018 and the applicable Spanish regulations, without prejudice to the local rules of your country of residence.
2.1 Applies to those who visit the Website, create an account, contract our services, participate in research, or communicate with our support team.
2.2 A microbiome report does not reveal hereditary information about your relatives, but it may reflect shared habits, diet, or cohabitation. It is up to you to decide with whom you share your reports.
3.1 Data categories:
3.2 Origin. The data comes from you or is generated during the provision of the service. We do not acquire personal data from external sources to profile you.
4.1 This service analyzes the genetic material of the microorganisms present in your sample, not your genome. The microbiome profile is not, in itself, genetic data of yours in the sense of the Regulation.
4.2 However, the profile, together with your answers and the purpose of the service, may reveal information relating to your health and identify you indirectly. For this reason, we treat it with the level of protection appropriate for special categories of data while it constitutes personal data.
4.3 A stool sample contains human cells and during sequencing, fragments of human DNA may be incidentally captured. Their processing is limited to filtering, quality control, security, and deletion in accordance with the technical cycle. They are not interpreted to determine traits, kinship, predisposition, or genetic identity, and they are not part of the reports or ordinary exports.
When processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of the previous processing. When it is based on our legitimate interest, you may object and we will evaluate your particular situation; the balancing analysis is available to you by writing to dpo@tellmegen.com.
6.1 Participation is voluntary, separable, and revocable, and does not condition the service or its price. It is authorized through a single checkbox that includes internal research and improvement, external scientific projects, and research and development with commercial collaborators, under the terms of section 20 of the Informed Consent.
6.2 This authorization does not allow your Vivabioma data to be combined with that of another GENELINK service, such as tellmeGen. Such combination requires separate, specific, and additional consent, which is not requested today in the registration process.
6.3 When you authorize it, we may use pseudonymized or anonymized data from the authorized categories to develop, train, validate, audit, and improve analytical models and artificial intelligence systems for microbiome interpretation, report improvement, and the development of new products and services.
6.4 Projects use the minimum data necessary, exclude direct identifiers unless justified, and are subject to confidentiality, access control, prohibition of re-identification, contract with the collaborator, and ethical evaluation when applicable.
6.5 These authorizations refer to data, not to the physical sample. Any research use of the sample itself requires separate consent and the applicable project, collection, or biobank regime.
6.6 You can withdraw any authorization with the same ease with which you granted it. Withdrawal prevents new inclusions and terminates future processing based on it, but does not affect lawfully processed data, publications already made, irreversibly anonymized data, or already trained models, from which your data cannot be individually extracted.
7.1 Our services are aimed at adults: hiring requires you to be 18 years of age or older, and a minor cannot register or make a booking on their own. The service is not available for children under three years of age.
7.2 When booking for a minor or for a person requiring support, the parent, guardian, or supporter must provide documentary proof in accordance with the Informed Consent. We do not commence analysis until this has been verified, and the resistome and personalized recommendations are not issued in reports for minors.
7.3 The supporting documentation is kept solely as proof of authorization and to prevent unauthorized analysis, with restricted access, and is not used for any other purpose.
7.4 Minors' data is only included in research when there is specific authorization from the legal representative and with the additional safeguards required by the project.
7.5 Upon reaching the age of 18, the interested party may request ownership of their account and exercise all their rights independently.
8.1 The generation of your reports is an automated process: our software identifies the microorganisms present, estimates functions and calculates indexes by associating them with the contents of our knowledge base, developed by our scientific team from the literature.
8.2 This processing does not produce legal effects on you or affect you significantly in a similar way, as the report is informative and does not in itself determine any health decision.
8.3 In any case, you can request an explanation and a review of your report by a member of our team by writing to lopd@tellmegen.com, expressing your point of view and challenging the result.
9.1 Your sample is used exclusively to provide the contracted service and for associated quality controls.
9.2 It is normally destroyed between 60 and 120 days from the issuance of your results and, in any case, before six months, except in the event of an ongoing quality incident or a different legal obligation, which we will inform you of.
9.3 It is not stored in a biobank nor transferred to third parties for other purposes.
10.1 If you request the deletion of your technical data, extensions and reinterpretations will no longer be possible without a new sample. We will warn you before proceeding with the deletion.
10.2 When you request the deletion or close your account, information that we must retain due to legal, health, quality, tax obligations, or for defense against claims is blocked, with restricted access, not used for any other purpose, and is deleted upon expiration of the applicable period.
10.3 Backups are deleted or overwritten according to their ordinary cycles, with a maximum objective of 90 days from operational deletion.
11.1 We do not sell or rent individual-level identified data. We may communicate data to the following categories of recipients:
11.2 All processors are contractually bound pursuant to Article 28 of the Regulation, with appropriate technical and organizational measures. A change of provider does not extend the purposes or reduce your rights.
11.3 You can request the specific list of current processors and sub-processors at any given time, with their location and function, by writing to lopd@tellmegen.com.
12.1 Your data analysis and storage are carried out in the European Economic Area, with providers from the categories identified in section 11.1.
12.2 If any ancillary function involves processing outside the European Economic Area, we will apply appropriate safeguards: an adequacy decision from the European Commission, standard contractual clauses with impact assessment and supplementary measures, or binding corporate rules. The transfer will be identified in that same list.
12.3 You can request information about the safeguards applied and, where applicable, a copy of them, by writing to dpo@tellmegen.com.
13.1 You may authorize an identified professional to consult specific categories of your reports for the duration shown to you. Activation requires a separate action and can be revoked at any time.
13.2 Revocation prevents further access, but does not delete copies that such professional may have already lawfully downloaded or incorporated into their documentation.
13.3 The professional is responsible for their authorization, their professional secrecy, and the subsequent use of the information, unless the file identifies them as a professional hired directly by GENELINK.
We will be able to send you information about Vivabioma products or services when you have consented to it or when they are products or services similar to those you have already contracted. You can object at any time, simply and free of charge, from the link included in each communication or by writing to lopd@tellmegen.com.
15.1 We use technical and analytical cookies and, only with your consent, advertising cookies. On the first level of the panel, you can accept, reject, or configure your preferences, and change them whenever you want. The details are in the Cookie Policy.
15.2 For analytical and advertising functions, we share information with our partners, including Google, in accordance with Google's EU User Consent Policy. You can check Google's privacy and terms page to see how it uses information from sites that use its services.
15.3 These tools do not access your samples, your analysis data, or the content of your reports under any circumstances.
16.1 We apply technical and organizational measures appropriate to the risk: encryption in transit and at rest, pseudonymization, role-based access control, logging and monitoring, perimeter and application protection, incident management, and privacy by design and by default. We have carried out a data protection impact assessment.
16.2 No information system is completely immune to risks. If a security breach occurs that poses a high risk to your rights, we will notify you without undue delay, stating the nature of the incident, its possible consequences, and the measures taken.
17.1 You may exercise your rights of access, rectification, erasure, restriction of processing, portability, and objection, withdraw the consents you have granted, and not be subject to decisions based solely on automated processing with legal or similar effects.
17.2 To exercise them, write to lopd@tellmegen.com or by postal mail to GENELINK, S.L. (reference: Data Protection), calle Arquitecto Mora 5, 2nd floor, door 4, 46010 Valencia, Spain. We may ask you to prove your identity.
17.3 We will respond within one month, extendable by two additional months if the request is complex or if we receive a large number of requests, informing you of the extension within the first month.
17.4 Exercise is free of charge, except for manifestly unfounded or excessive requests, particularly due to their repetitive nature, in which case a reasonable fee may be applied or the action refused, with justification.
17.5 You may file a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.
18.1 GENELINK may be subject to corporate operations such as a merger, demerger, financing, contribution of a business line, or the total or partial transfer of the business, including the separate transfer of the Vivabioma brand.
18.2 In the preliminary negotiation and audit phases, only strictly necessary aggregated, statistical, or pseudonymized data may be shared, under confidentiality, minimization, and access control agreements. Individually identifiable records or microbiome profiles attributable to a specific person will not be provided in any case.
18.3 If the operation materializes, the acquiring entity will be subrogated as the data controller and will be bound by the Informed Consent and by this Policy, without expanding the purposes. We will inform you without undue delay and, whenever possible, before it begins to process your data.
18.4 For materially different purposes, the new controller must inform you and obtain a valid legal basis or, where appropriate, a new consent.
18.5 In the event of bankruptcy or liquidation, your data may only be transferred within the framework of service continuity and with equivalent guarantees; otherwise, it will be deleted or anonymized, except for archiving for mandatory retention. These rules do not authorize, on their own, an autonomous sale of personal data or samples.
19.1 We can update this Policy due to legal, technical or service changes. Each version has a code and date, and you can request the version history from lopd@tellmegen.com.
19.2 If the change expands the purposes, data categories or recipients, or affects any of your consents, we will inform you before it takes effect and, where appropriate, we will request a new affirmative action. We will not apply new purposes to data already collected without that basis.
19.3 We retain proof of each consent given, with the version of the text shown to you, its fingerprint, date and time. You can view and download it from your account.
For any questions regarding this Policy, you can write to lopd@tellmegen.com or, for matters requiring the intervention of the Data Protection Officer, to dpo@tellmegen.com.
Get a special 5% discount on your first kit.