Privacy policy

We collect and process the following types of personal data:

• Identity & Contact Information: Name, email address, phone number.
• Analytics & Usage Data: IP address, device details, browsing behavior (collected via Google Analytics and similar tracking tools).

Some of this data is strictly necessary for providing our services (for example, creating an account or fulfilling user requests). If you choose not to provide the required data, you may be unable to access certain features or services. Providing other data (such as information for marketing communications) is voluntary, and you can opt out at any time.

Pheno AB, company reg. no. 559499-9129, is the data controller responsible for processing your personal data.

If you have any questions about this Privacy Policy or your personal data, you can contact us at:

• Email: team@pheno.health
• Address: Pheno AB, Döbelnsgatan 16B, 113 58 Stockholm, Sweden
• Web Form: https://www.pheno.health/contact

(Please mention “Data Protection” in your query.)

Pheno AB is registered in Sweden and acts as the data controller for all personal data processed via this website and platform.

Under GDPR, we process personal data based on the following legal bases:

• Consent – For marketing communications and optional data collection.
• Legitimate Interest – For improving our services, security, and fraud prevention.
• Contractual Obligation – For fulfilling service agreements.
• Legal Compliance – When required by law.

Examples:

• Identity & Contact Data: Processed primarily to fulfill service agreements (contractual obligation) and, with your consent, for marketing communications.
• Analytics & Usage Data: Processed under our legitimate interest to improve the website and user experience.

We use the data we collect for the following purposes:

• To provide and improve our services – Including website performance optimization.
• Marketing & Communication – Sending relevant updates, promotions, and content (with user consent).
• Analytics & Research – Understanding user behavior to enhance user experience.
• Security & Fraud Prevention – Detecting, investigating, and preventing unauthorized access or breaches.

Pheno Leagues is an optional, invitation-only feature (currently a pilot) where you compete with friends or colleagues in private leagues. Nothing about you is shown in a league until you join it yourself.

• What other players see. A player name (alias) you choose, your companion avatar and ring — never your real name. Per league, you choose how much of your result is shown: score, rank and development; rank and development (the default); or development only. In bio-age leagues this may include the difference between your biological age (PhenoAge) and your actual age — never the biological age itself. In wearables leagues it may include your weekly step or active-minute totals, daily bars and the brand of your device. Blood results, biomarkers and other health data are never shared.
• Legal basis. Your explicit consent (GDPR Article 9(2)(a)), given separately for each league when you join and recorded with the version of the text you agreed to. You can withdraw at any time by changing your visibility or leaving the league.
• “You vs everyone”. We compare your result anonymously with all Pheno members who have taken a test in the last 24 months, whether or not they play. Only you see your own placing. Nobody else’s data or position is ever shown, and the comparison is not shown at all until at least 100 members are in it.
• League chat. Chat is off until you turn it on for a league. Messages are seen by the other members of that league who use the chat, and are not filtered. Any member can report a message: the league owner sees which message was reported and why (never by whom), and Pheno is notified and may remove it. Push notifications never show message text.
• League links. If you open a league link before signing in, we store the league code in a first-party cookie (pheno_league, 30 days) so the invitation is waiting for you after sign-in. It contains no personal data and is deleted once used.
• Anonymous link counts. To see whether league invitations work, we count how many times league invitation pages are opened and how many sign-ups or sign-ins start from them, as one anonymous total per day. The count stores no user, league, IP address or cookie and cannot be linked to you.

On our marketing website (www.pheno.health) we use cookies and tracking technologies such as Google Analytics to collect anonymized usage data. You can manage cookie preferences through your browser settings.

Inside the application (app.pheno.health) we do not use advertising or third-party analytics cookies. The application relies only on strictly necessary cookies and local storage required for functionality and security — for example authentication and session handling. The application also uses Vercel Web Analytics and Speed Insights, which set no cookies and measure page views and page performance (see Section 6). The first-party product analytics described in Section 5a are separate and can be paused at any time.

In addition to the cookies described above, Pheno operates its own first-party product analytics inside the application. These analytics are used solely to understand how the platform is used so we can improve performance, fix bugs, and prioritise features. They are kept entirely separate from your clinical data, AI conversation content, and the Pheno Score.

• Lawful basis. GDPR Article 6(1)(f) — legitimate interest in operating and improving the product.
• What is captured. Session metadata (a reduced user-agent — browser family, OS family, device class — and the country code derived from your request, never the IP address); page-view route templates with dynamic segments replaced by placeholders such as :id; and a strict allow-list of named events (for example onboarding step started, result viewed, chat message sent) with bucketed properties only. We never store the text of your questions, answers, or chat responses.
• What is NOT captured. These product analytics use no third-party analytics SDK, no session replay, no IP addresses, no query strings, no clinical data, no biomarker values, and no free-text content.
• Retention. Raw rows are deleted after 90 days. Aggregated rollups (daily totals, retention cohorts, funnel steps) are kept for up to 24 months and never contain a user identifier. A small per-user engagement summary is kept for the lifetime of your account and removed when you delete the account.
• Opt-out. You can pause product analytics at any time from Profile → Notifications → Pause product analytics. The toggle takes effect immediately on both the client and the server, and no further events are recorded for your account.
• DSAR. On request via team@pheno.health we will export (Article 15 / 20) or delete (Article 17) the analytics rows associated with your account. Aggregated rollups do not contain identifiers and are therefore not included in DSAR responses.

An admin-internal descriptive summary may be generated from this metadata to help our product team understand the shape of usage. The summary is descriptive only, never used for clinical decisions, and never surfaced back to you. See Section 12. Automated Decision-Making or Profiling — this summary does not produce legal or similarly significant effects.

When you join the waitlist or create an account, we record where you first came from, so we can see which of our own posts and campaigns work.

• What we store. The campaign labels in the link you followed (for example utm_source=instagram), the first page you landed on, the referring website’s address without any query string, the time of that first visit and, if you choose to answer, how you heard about Pheno. No IP address, device identifier or health data.
• How it travels. By default these labels are carried only in the link to the app and in the sign-up session cookie that BankID sign-in already needs; nothing extra is stored on your device. Only if you accept “Pheno attribution” in the cookie banner on www.pheno.health do we also set a first-party cookie (pheno_ft, 30 days) so a later visit can still be attributed.
• Legal basis and sharing. Our legitimate interest in measuring our own marketing. It is never shared with advertising platforms. It is kept with your account or waitlist entry and deleted or exported with it on request.

On our marketing website (www.pheno.health) we may use the Meta Pixel, a tool from Meta, to measure how well our adverts on Facebook and Instagram work. It is used for advertising measurement only, and it only runs if you accept it in the cookie banner. Without your consent the Meta Pixel is not loaded at all.

• Lawful basis. Your consent (GDPR Article 6(1)(a)).
• What is sent. That you viewed a page on our website and that a waitlist sign-up took place, together with the standard browser and cookie identifiers Meta collects (for example IP address, browser and device information, and Meta’s cookie identifiers). We do not send your name, your email address, anything you type into our forms, or any health data to Meta.
• Recipient. Meta Platforms Ireland Ltd. Meta may transfer data to Meta Platforms, Inc. in the United States; such transfers rely on the EU–US Data Privacy Framework. Meta processes the data it receives under its own privacy policy.
• Withdrawing consent. You can withdraw your consent at any time under Cookie settings at the bottom of the website. After that, no further events are sent to Meta.

The Meta Pixel is not used inside the application (app.pheno.health).

We do not sell or trade your personal data. However, we may share data with:

• Service Providers:
  • Hosting, database and file storage – Supabase (database, login and file storage, hosted in Stockholm, Sweden) and Vercel (application hosting; the application’s server functions run in Stockholm, Sweden).
  • AI processing – Amazon Web Services: Amazon Bedrock for the AI, restricted to EU regions, and Amazon Transcribe for voice input (Frankfurt, Germany).
  • Identification – Signicat, for BankID login.
  • Email and SMS – Postmark (email) and 46elks (SMS, Sweden).
  • Payments – Stripe.
  • Operations and security – Sentry (error monitoring, EU data region; identifying details are removed from error reports before they are sent), Upstash (rate limiting to protect the service against abuse), and Vercel Web Analytics and Speed Insights (cookieless measurement of page views and page performance).
  • Push notifications – if you turn notifications on, they are delivered through the push service of your browser or device (for example Google, Apple or Mozilla).
  • Marketing website (www.pheno.health) – Vercel (hosting), Usercentrics (cookie consent) and, only if you accept them in the cookie banner, Google Analytics, Google Tag Manager, Google Ads and the Meta Pixel (see Section 5c).
• Laboratory: SYNLAB analyses your blood sample. Lab requisitions and results are exchanged through Labportalen (Infosolutions, Sweden).
• Services you connect yourself: If you link a wearable or fitness service (for example Oura, Garmin, Withings, Fitbit, WHOOP or Strava), we collect data from it with your permission. That service handles the data it holds under its own privacy policy; we do not send your Pheno results to it.
• Apple Health and Health Connect: If you use the Pheno app on iPhone or Android, you can choose to connect Apple Health (HealthKit) or Health Connect. Pheno then reads, and never writes, the following data from your phone: steps, active and total calories, sleep (duration and sleep stages), resting heart rate, heart rate variability, blood oxygen, respiratory rate, VO2 max, weight and body fat. We only read the types you allow in your phone’s permission prompt, and only after you tap Connect in the app. We use this data solely to show it alongside your blood results and in the lifestyle part of your Pheno Score. It is stored in Stockholm, Sweden like the rest of your health data, never used for advertising, never sold and never shared with third parties. You can stop sharing at any time in your phone’s Health settings or under Profile → Connected services. Pheno’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Data from Apple HealthKit is not used for advertising or data mining and is not disclosed to third parties.
• Other players in Pheno Leagues: Only what you choose to share in the leagues you join, as described in Section 4a.
• Legal Authorities: If required to comply with legal obligations.

These third parties process data under GDPR-compliant agreements ensuring security and privacy.

Where your data is processed. Your account and health data are stored in Stockholm, Sweden, and AI processing runs in EU regions. Postmark, Stripe, Vercel and Google are based outside the EU/EEA; transfers to them are protected as described in Section 11. On request to team@pheno.health we will tell you which providers process your personal data and where.

We retain personal data for as long as necessary for its intended purpose or as required by law. Retention periods vary:

• Marketing Data: Until users withdraw consent.
• Account Data: While the user has an active account.
• League chat messages: 12 months, or until you delete them or leave the league.
• League results and final season tables: for as long as the league and your account exist. Your record of league consents is kept for the life of your account.
• Analytics Data: Retained for up to 26 months, after which it is anonymized.

If we cannot specify an exact retention period, we determine it based on criteria such as the nature of our relationship with you, the sensitivity of the data, and any legal or regulatory requirements. Once the applicable period has expired, we will either securely delete or anonymize your data.

You have the following rights regarding your personal data:

• Access – Request a copy of the personal data we hold.
• Correction – Request corrections to inaccurate data.
• Deletion – Request data deletion (subject to legal obligations).
• Objection – Object to data processing for marketing purposes.
• Portability – Request a structured copy of your data for transfer.
• Withdraw Consent – Opt out of marketing communications at any time.

To exercise any of these rights, please contact us at team@pheno.health or via https://www.pheno.health/contact. Please specify the right you wish to exercise and provide details to help us respond efficiently.

If you believe your data protection rights have been breached, you have the right to lodge a complaint with a supervisory authority, such as the Swedish Authority for Privacy Protection (IMY). You can find their contact details at https://imy.se.

We implement technical and organizational safeguards to protect your data from unauthorized access, alteration, or misuse. However, no online service is completely secure, and we encourage users to take precautions when sharing personal data.

Our services are not intended for users under 18 years old. We do not knowingly collect personal data from minors. If a minor has provided us with data, we will take steps to delete it.

If we transfer data outside the European Economic Area (EEA), we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Other GDPR-compliant mechanisms ensuring lawful cross-border data processing.

You may contact us at team@pheno.health to request more information or a copy of the relevant transfer safeguards (e.g., SCCs) if applicable.

Pheno Health Platform uses automated processing of your personal data to produce personalised health information. Specifically:

• Biomarker results. Each of your blood-test results is shown against the analysing laboratory’s own reference interval (within or outside the interval), using a deterministic rule engine.
• Pheno Score and biological-age estimates. These are derived from your biomarker results and your demographic data using documented formulas. The methodology is described in our Algorithm Transparency document, available on request via team@pheno.health.
• AI-generated lifestyle and supplementation suggestions. When you interact with the AI, your scored results plus your conversation context are used to generate non-prescriptive lifestyle and supplementation suggestions. These are framed as educational guidance, not as a clinical diagnosis or treatment decision.

Article 22 GDPR position. This processing constitutes profiling under Article 4(4) GDPR, but it does not produce legal effects on you or similarly significantly affect you within the meaning of Article 22(1). The outputs are informational and educational; they do not, by themselves, deny you a service, an employment opportunity, an insurance product, or any other legally significant outcome. We do not share individual Pheno Scores, biological-age estimates, or AI conversation content with employers, insurers, or any other third party for decision-making purposes.

Legal basis. Where automated processing is used, we rely on (a) the performance of the user agreement under which you receive the service (Article 6(1)(b)) and (b) explicit consent for the processing of health data (Article 9(2)(a)).

Safeguards and your rights. Pheno's automated outputs are informational and educational and are not individually reviewed by a clinician before you see them. Every result is checked against safe limits, and critical values are escalated for follow-up. You retain the rights described in Section 8 — including the right to obtain meaningful information about the logic involved, to express your point of view, and to contest any output you consider inaccurate. You can also discuss any result with your physician or another qualified healthcare provider. Contact team@pheno.health to exercise any of these rights.

If our use of automated decision-making changes — for example, if outputs are ever used as the basis for a decision with legal or similarly significant effects — we will update this Privacy Policy and obtain a separate, freely-given, informed consent before doing so.

We may update this Privacy Policy from time to time. The latest version will always be available at https://www.pheno.health. We will notify users of significant changes.

For any privacy-related inquiries, you can contact us at:

• Email: team@pheno.health
• Address: Pheno AB, company reg. no. 559499-9129, Döbelnsgatan 16B, 113 58 Stockholm, Sweden
• Web Form: https://www.pheno.health/contact