Privacy Notice

1. Data controller

Aimosti Oy (Business ID 3630145-4, VAT number FI36301454)
Ristikkotie 16, 90420 Oulu, Finland

2. Contact person for the register

Raine Laurila, info@aimosti.com.

3. Purposes and legal bases

Producing your report from the genomic file you upload: contract (GDPR Art. 6(1)(b)) and explicit consent for special-category data (Art. 9(2)(a)).
Interpretation and findings: covered by that same explicit processing consent (Art. 9(2)(a)). It authorises interpretation across every report module (clinical findings, carrier status, pharmacogenomics, traits, ancestry, risk factors and the exploratory readings), including sensitive, predictive findings such as APOE, which stay hidden behind a deliberate in-report reveal you control.
Payments and accounting: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
Account: contract (Art. 6(1)(b)).
Marketing email: we email account holders now and then about our own reports and offers, unless they opt out at signup or later. Every email has an unsubscribe link, and you can change your choice on the consent page.
Referral and campaign attribution, including calculating commission owed to a referral partner: legitimate interest (Art. 6(1)(f)). See section 16.
Service improvement and research using de-identified data: consent (Art. 6(1)(a)).
Security, logging, fraud and abuse prevention: legitimate interest (Art. 6(1)(f)).

4. Categories of personal data

Identity: email, password hash (argon2id) or Google sign-in identifier, locale, timestamps.
Genetic raw data (special category, Art. 9): your uploaded variant file (VCF/gVCF) and, for the Deep Read add-on, an aligned-reads file (BAM/CRAM). Uploaded directly to EU object storage (Helsinki, Finland).
Normalised variant file: a small, panel-restricted file derived from your upload, retained only while you hold an active re-analysis subscription (so we can re-run the analysis as the science updates); otherwise it is purged within about 30 days of your analysis. Section 8 has the full retention schedule.
Ancestry marker extract (special category, Art. 9): your genotypes at about 91,000 ancestry-informative positions, read from your uploaded file. This is what your ancestry composition is calculated from, and keeping it is what lets us recalculate that composition as our reference panel improves, without asking you to upload your genome again. Unlike the normalised variant file above, these positions are spread across your whole genome rather than restricted to the report panel. It is kept and deleted on exactly the same schedule as that file.
Derived health-related findings (Art. 9): clinical findings, carrier status, pharmacogenomics, traits, ancestry and coverage. Stored as a frozen snapshot in your report.
Consent audit trail: an append-only (immutable) history of every grant and withdrawal, including the consent group, the consent-text version, IP address, user-agent and timestamp.
Payment metadata: user/analysis reference, SKU, payment rail, transaction id, status and paid-at time. Card and billing data are held by our payment processor, not Aimosti.
Session: a signed aimosti_session cookie containing only your user identifier.
Server logs: your IP address, browser user agent, the pages you request (including any campaign tags in the address) and the page you came from, how long each took to answer, together with your account if you are signed in, kept on our own servers in Finland for 90 days for security and operations.
Referral attribution: the campaign or partner code that brought you to us, and, if you registered through a referral partner's link, a record linking your account to that partner so their commission can be calculated (see section 16).
First-party analytics: which pages are read and where readers arrive from, recorded on our own servers. It sets no cookie and stores no identifier for a visitor who is not signed in (see section 14; our server logs, above, are a separate record). While you are signed in, we record which pages your account has opened and when, so we can see whether the product is working for the people who bought it. We keep those records for 12 months, we do not record your IP address or device with them (our server logs, above, are a separate record and do hold your IP address), they are never shared with anyone, and deleted if you ask us to erase your account. Legal basis: our legitimate interest in improving the product (Art. 6(1)(f) GDPR).

5. Sources of data

Data comes from you (uploads and forms), from Google sign-in (if you use it), and from our payment processor as payment confirmation.

When you upload, you confirm you are 18 or older and that the data is your own or data you are legally authorised to process (see our Terms).

Checking your file before you pay. The file check reads your file in your browser. The file is not uploaded. If you are signed in, your browser sends us only what the check found: the file type, reference build, chip vendor and number of samples (never the sample names). We record that result with your account so we can see which files people bring. If the check cannot recognise a file, your browser also sends a description of it, so we can find out which files we fail to read: the ending of its name (such as .zip or .pdf, never the name itself), a size range, the file type your browser reports, the kind of container it is, and the layout of its first two lines with every letter replaced by "a" and every digit by "9". If you are not signed in, the same result and description go to our first-party analytics without any identifier. None of it contains your genotypes or anything else written in the file. Your genome is only uploaded after you choose to buy a report.

6. Recipients and processors

We use the following processors, each under a data-processing agreement (DPA):

Hetzner: hosting and object storage, Finland (genetic and health data).
Cloudflare: CDN, WAF, access control, and the Turnstile anti-bot check.
Google: sign-in (OAuth).
Stripe: card payment processing and tax calculation (we remain the seller and remit the tax ourselves). Receives your card, billing and transaction data, including billing country to calculate the applicable VAT; we never see your full card details. No genetic or health data is ever shared with Stripe.
Zoho ZeptoMail: transactional email, EU.

We never sell your personal data and never use your genetic data to train any model.

7. Transfers outside the EU/EEA

Genetic and health-related data is processed and stored in Finland and does not leave the EU. Some providers (Google, Cloudflare, Stripe) are US-parented; any transfers of the limited data they process rely on the EU Standard Contractual Clauses (SCCs) or a valid adequacy decision. As a general rule, your genetic data remains within the EU and is never shared with any of them. Our analytics involves none of them: it runs on our own servers in Finland, so no reading you do on this site is reported to a third party at all.

8. Retention periods

Genetic raw data (VCF/gVCF): deleted after analysis, by default within about 7 days.
Aligned reads (BAM/CRAM): deleted immediately after the coverage computation, on success or failure.
Normalised variant file: kept while you hold an active re-analysis subscription. This is what lets us re-run your analysis when sources update. Without a subscription it is purged within about 30 days of your analysis; if you cancel, it is deleted once your paid period ends. Cancelling the subscription is how you end this retention.
Ancestry marker extract: kept on exactly the same terms as the normalised variant file above (while you hold an active re-analysis subscription, otherwise purged within about 30 days of your analysis, and deleted once your paid period ends if you cancel). Your ancestry composition itself stays in your report snapshot either way, so deleting the extract does not take the result away from you.
Findings and report snapshot: kept for the life of your account. Even if a re-analysis subscription lapses, we keep your last snapshot: only new updates stop, and your report stays yours. You can request deletion at any time, or delete your account, which erases your data with it.
Signed-in page views: which pages your account opened and when, kept for 12 months, then deleted. Deleted outright if you ask us to erase your account.
Server logs (IP address, browser user agent, pages requested and the page you came from, timings): kept for 90 days for security and operations, then deleted. If you ask us to erase your account, lines already written are not removed early: they are deleted when their 90 days run out.
Consent audit trail: retained as evidence of compliance.
Payment and accounting data: retained for the period required by Finnish accounting law (approx. 6 years) even after an erasure request (GDPR Art. 17(3)(b)).
Account deletion: when you delete your account we erase your genome data, reports, uploaded files, and direct identifiers; we retain a de-identified record of your orders and consents (no genetic data) to defend payment disputes (GDPR Art. 17(3)(e)) and to meet the accounting-retention rules above.

9. Your rights

You have the right to access your data, rectify inaccuracies, request erasure, restrict or object to processing, data portability, and to withdraw consent (withdrawal does not affect the lawfulness of processing before it). You can manage and withdraw your consents in the in-app consent view. Other rights are exercised by emailing info@aimosti.com.

10. Right to lodge a complaint

If you have any concern about how we handle your data, please contact us first at info@aimosti.com: we want to put it right. You also retain the statutory right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

11. Automated decision-making and profiling

Automated genomic analysis produces information in the form of attributed literature matches. It is not an automated decision under GDPR Art. 22 producing legal or similarly significant effects on you.

12. Whether providing data is mandatory

Uploading a genome file is necessary to receive a report. If you do not provide it, the service cannot be delivered.

13. Security

Data is encrypted in transit, processed and stored in the EU, access-controlled, and can be deleted on request.

14. Cookies

We use an essential aimosti_session cookie. Our analytics runs on our own servers in Finland, reports to no one else, and sets no cookie. Optional advertising cookies are used only with your consent, and we honour Global Privacy Control. There is no cookie banner: see our Cookies & consent page, where you can review or change your advertising choice at any time.

15. Advertising measurement

To measure and improve our advertising we use, with your consent (Art. 6(1)(a) GDPR), a client pixel and a server-to-server conversions API from our advertising partner Reddit (an independent controller for this purpose; see our Cookies & consent page for our current advertising partners). We share a Reddit click identifier, your IP address and user-agent, and the fact that one of these happened: a page view, a view of our sample report or our prices, a file check in which your browser recognised your file, a registration, or a purchase. For the file check we share only that it happened, never what the file was. For a purchase, we share its value and currency only. We never share your email content, your genome, any health data, or the product you bought. You can withdraw consent at any time via Cookies & consent.

We also measure purchases that follow a click on our Google Ads, under the same choice. This runs only between our server and Google: there is no Google tag on this site, and your browser sends Google nothing. It covers purchases only, and only when the billing address is outside the EU/EEA, the UK and Switzerland. For such a purchase we send Google (an independent controller for this purpose) the Google click identifier your visit arrived with, the time of the purchase, its value and currency, and an order reference. We send no IP address, no email address and nothing about the product, and Google may use it to count and bid on our ads, not to personalise the ads you see.

Separately, and regardless of your advertising choice, we record in our own systems which campaign or link referred you to us, to measure the effectiveness of our marketing. Its legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Where that link belongs to a referral partner, section 16 sets out what the partner is and is not told.

16. Referral partners

Some of the links that bring people to us belong to independent referral partners, who earn a commission when someone arriving through their link buys a report. If you registered through such a link, we store the partner's code against your account. A commission can arise on purchases you make within 365 days of that point; the record itself is kept with our accounting data under section 8.

What the partner is shown is not you. Their panel gives them counts (link clicks, registrations, sales) and, for each sale, only the date and the amount they earned. We never disclose your name, your email, your account, the file you uploaded, your report, or anything derived from your genome to a referral partner. They act as an independent party, not as our processor, and we send them no personal data about you.

The legal basis for keeping the attribution record is legitimate interest (Art. 6(1)(f) GDPR): paying the correct partner for a referral we actually received. If you would rather we did not hold it, email info@aimosti.com and we will detach your account from the partner; this does not affect your report or your access.

If you apply to become a referral partner, we store your application (your contact and business details and what you told us about your channels) so we can assess it and reply. The legal basis is steps taken at your request before entering a contract (Art. 6(1)(b) GDPR). We do not use it for anything else, and we delete it if you ask us to at info@aimosti.com.

17. Partner view and partner genomes

The partner view puts two adults' carrier results side by side. It can be set up two ways.

Each person with their own account. Each of you uploads your own file and accepts the invitation from inside your own account. Nothing is shared before you accept, and either of you can withdraw it at any time. Until it is accepted, the invitation holds the invited person's email address; one that is never accepted is deleted 30 days after its link stops working (14 days after it was sent, or when it is cancelled, whichever comes first).
One person adds the other's genome. The person adding them uploads the partner's file, after the partner has confirmed from a one-time link in an email, valid for 14 days. Nothing of the partner's genome is uploaded or read before they confirm.

When one person adds the other's genome, this is what happens to the partner's data.

Before the partner has answered. The partner's email address and the name the person typed for them are held on the request, and we send the consent-request email to that address. If nobody confirms, the request is deleted 30 days after its link stops working.
Consent is the partner's own. The legal basis is explicit consent (Art. 9(2)(a)), given by the partner themself. Their consents (essential processing, sharing carrier results, and the optional couple outlook) are recorded under the account we hold for them, with the IP address and browser they used.
What the person who added them sees. Only the couple view: carrier results, and the couple outlook only if both of you switch it on. They never see the partner's full report. Emails about a failed or finished reading of the partner's file go to the person who uploaded it.
The full report is the partner's. They read it by setting a password; the link to do so is valid for 7 days, and the forgot-password page sends it again. Once they set a password the account is their own, and the couple view carries on as an ordinary pair until either of you withdraws.
An erase link. The confirmation email and the email that says the genome has been read carry a permanent link that shows what we hold and erases all of it in one step. No account is needed. The consent-request email has no such link, because no account exists yet. After the partner sets a password, that link points them to log in, and erasure is done from the account's own settings.
Ending the pair early. If the pair ends before the partner has set a password, whether either side ends it or the person who added them deletes their account, we erase the partner's genome, their report and the account we hold for them. The consent records are kept, with the IP address and browser recorded, to establish or defend legal claims (GDPR Art. 17(3)(e)).
Retention. As for any genome: the uploaded file is purged within 7 days, and the report is kept until it is erased. The normalised variant file and the ancestry marker extract are deleted 30 days after the analysis, because a partner added this way has no subscription that would keep them longer.

18. Updates

We will notify you of material changes to this notice. Last updated: 18 Oct 2026.