aimosti

Privacy Notice

1. Data controller

Aimosti Oy (Business ID 3630145-4, VAT number FI36301454)
Ristikkotie 16, 90420 Oulu, Finland

2. Contact person for the register

Raine Laurila, info@aimosti.com.

3. Purposes and legal bases

  • Producing your report from the genomic file you upload: contract (GDPR Art. 6(1)(b)) and explicit consent for special-category data (Art. 9(2)(a)).
  • Interpretation and findings: covered by that same explicit processing consent (Art. 9(2)(a)). It authorises interpretation across every report module (clinical findings, carrier status, pharmacogenomics, traits, ancestry, risk factors and the exploratory readings), including sensitive, predictive findings such as APOE, which stay hidden behind a deliberate in-report reveal you control.
  • Payments and accounting: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
  • Account: contract (Art. 6(1)(b)).
  • Marketing email: consent (Art. 6(1)(a)), withdrawable at any time.
  • Referral and campaign attribution, including calculating commission owed to a referral partner: legitimate interest (Art. 6(1)(f)). See section 16.
  • Service improvement and research using de-identified data: consent (Art. 6(1)(a)).
  • Security, logging, fraud and abuse prevention: legitimate interest (Art. 6(1)(f)).

4. Categories of personal data

  • Identity: email, password hash (argon2id) or Google sign-in identifier, locale, timestamps.
  • Genetic raw data (special category, Art. 9): your uploaded variant file (VCF/gVCF) and, for the Deep Read add-on, an aligned-reads file (BAM/CRAM). Uploaded directly to EU object storage (Helsinki, Finland).
  • Normalised variant file: a small, panel-restricted file derived from your upload, retained only while you hold an active re-analysis subscription (so we can re-run the analysis as the science updates); otherwise it is purged within about 30 days of your analysis. Section 8 has the full retention schedule.
  • Ancestry marker extract (special category, Art. 9): your genotypes at about 91,000 ancestry-informative positions, read from your uploaded file. This is what your ancestry composition is calculated from, and keeping it is what lets us recalculate that composition as our reference panel improves, without asking you to upload your genome again. Unlike the normalised variant file above, these positions are spread across your whole genome rather than restricted to the report panel. It is kept and deleted on exactly the same schedule as that file.
  • Derived health-related findings (Art. 9): clinical findings, carrier status, pharmacogenomics, traits, ancestry and coverage. Stored as a frozen snapshot in your report.
  • Consent audit trail: an append-only (immutable) history of every grant and withdrawal, including the consent group, the consent-text version, IP address, user-agent and timestamp.
  • Payment metadata: user/analysis reference, SKU, payment rail, transaction id, status and paid-at time. Card and billing data are held by our payment processor, not Aimosti.
  • Session: a signed aimosti_session cookie containing only your user identifier.
  • Referral attribution: the campaign or partner code that brought you to us, and, if you registered through a referral partner's link, a record linking your account to that partner so their commission can be calculated (see section 16).
  • First-party analytics: which pages are read and where readers arrive from, recorded on our own servers in Finland. With your consent this uses one first-party cookie holding a random id; decline and there is no cookie and no identifier (see section 14).

5. Sources of data

Data comes from you (uploads and forms), from Google sign-in (if you use it), and from our payment processor as payment confirmation.

When you upload, you confirm you are 18 or older and that the data is your own or data you are legally authorised to process (see our Terms).

Checking your file before you pay. When you check a file in your browser before buying, your browser sends only the first part of that file: its header, not your genome. We read it in memory to detect the file type, reference build and the report it supports, then discard it: the header is never written to storage, never logged with your data, and no account record is created from it. Your genome itself is only ever uploaded after you choose to buy a report.

6. Recipients and processors

We use the following processors, each under a data-processing agreement (DPA):

  • Hetzner: hosting and object storage, Finland (genetic and health data).
  • Cloudflare: CDN, WAF, access control, and the Turnstile anti-bot check.
  • Google: sign-in (OAuth).
  • Stripe: card payment processing and tax calculation (we remain the seller and remit the tax ourselves). Receives your card, billing and transaction data, including billing country to calculate the applicable VAT; we never see your full card details. No genetic or health data is ever shared with Stripe.
  • Zoho ZeptoMail: transactional email, EU.
  • Bunny Fonts: EU-based font delivery, no cookies.

We never sell your personal data and never use your genetic data to train any model.

7. Transfers outside the EU/EEA

Genetic and health-related data is processed and stored in Finland and does not leave the EU. Some providers (Google, Cloudflare, Stripe) are US-parented; any transfers of the limited data they process rely on the EU Standard Contractual Clauses (SCCs) or a valid adequacy decision. As a general rule, your genetic data remains within the EU and is never shared with any of them. Our analytics involves none of them: it runs on our own servers in Finland, so no reading you do on this site is reported to a third party at all.

8. Retention periods

  • Genetic raw data (VCF/gVCF): deleted after analysis, by default within about 7 days.
  • Aligned reads (BAM/CRAM): deleted immediately after the coverage computation, on success or failure.
  • Normalised variant file: kept while you hold an active re-analysis subscription. This is what lets us re-run your analysis when sources update. Without a subscription it is purged within about 30 days of your analysis; if you cancel, it is deleted once your paid period ends. Cancelling the subscription is how you end this retention.
  • Ancestry marker extract: kept on exactly the same terms as the normalised variant file above (while you hold an active re-analysis subscription, otherwise purged within about 30 days of your analysis, and deleted once your paid period ends if you cancel). Your ancestry composition itself stays in your report snapshot either way, so deleting the extract does not take the result away from you.
  • Findings and report snapshot: kept for the life of your account. Even if a re-analysis subscription lapses, we keep your last snapshot: only new updates stop, and your report stays yours. You can request deletion at any time, or delete your account, which erases your data with it.
  • Consent audit trail: retained as evidence of compliance.
  • Payment and accounting data: retained for the period required by Finnish accounting law (approx. 6 years) even after an erasure request (GDPR Art. 17(3)(b)).
  • Account deletion: when you delete your account we erase your genome data, reports, uploaded files, and direct identifiers; we retain a de-identified record of your orders and consents (no genetic data) to defend payment disputes (GDPR Art. 17(3)(e)) and to meet the accounting-retention rules above.

9. Your rights

You have the right to access your data, rectify inaccuracies, request erasure, restrict or object to processing, data portability, and to withdraw consent (withdrawal does not affect the lawfulness of processing before it). You can manage and withdraw your consents in the in-app consent view. Other rights are exercised by emailing info@aimosti.com.

10. Right to lodge a complaint

If you have any concern about how we handle your data, please contact us first at info@aimosti.com: we want to put it right. You also retain the statutory right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

11. Automated decision-making and profiling

Automated genomic analysis produces information in the form of attributed literature matches. It is not an automated decision under GDPR Art. 22 producing legal or similarly significant effects on you.

12. Whether providing data is mandatory

Uploading a genome file is necessary to receive a report. If you do not provide it, the service cannot be delivered.

13. Security

Data is encrypted in transit, processed and stored in the EU, access-controlled, and can be deleted on request.

14. Cookies

We use an essential aimosti_session cookie. Optional analytics and advertising cookies are used only with your consent, and we honour Global Privacy Control. Our analytics runs on our own servers in Finland and reports to no one else. See our Cookies & consent page, where you can review or change your choice at any time.

15. Advertising measurement

To measure and improve our advertising we use, with your consent (Art. 6(1)(a) GDPR), a client pixel and a server-to-server conversions API from our advertising partner Reddit (an independent controller for this purpose; see our Cookies & consent page for our current advertising partners). We share a Reddit click identifier, your IP address and user-agent, and the fact that a page view, registration, or purchase occurred. For a purchase, we share its value and currency only. We never share your email content, your genome, any health data, or the product you bought. You can withdraw consent at any time via Cookies & consent.

Separately, and regardless of your advertising choice, we record in our own systems which campaign or link referred you to us, to measure the effectiveness of our marketing. Its legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Where that link belongs to a referral partner, section 16 sets out what the partner is and is not told.

16. Referral partners

Some of the links that bring people to us belong to independent referral partners, who earn a commission when someone arriving through their link buys a report. If you registered through such a link, we store the partner's code against your account. A commission can arise on purchases you make within 365 days of that point; the record itself is kept with our accounting data under section 8.

What the partner is shown is not you. Their panel gives them counts (link clicks, registrations, sales) and, for each sale, only the date and the amount they earned. We never disclose your name, your email, your account, the file you uploaded, your report, or anything derived from your genome to a referral partner. They act as an independent party, not as our processor, and we send them no personal data about you.

The legal basis for keeping the attribution record is legitimate interest (Art. 6(1)(f) GDPR): paying the correct partner for a referral we actually received. If you would rather we did not hold it, email info@aimosti.com and we will detach your account from the partner; this does not affect your report or your access.

If you apply to become a referral partner, we store your application (your contact and business details and what you told us about your channels) so we can assess it and reply. The legal basis is steps taken at your request before entering a contract (Art. 6(1)(b) GDPR). We do not use it for anything else, and we delete it if you ask us to at info@aimosti.com.

17. Updates

We will notify you of material changes to this notice. Last updated: 1 Sep 2026.