Privacy Policy

This policy explains how Mitra Bio Ltd. (“Mitra Bio”, “Mitra”, “we”, “us”) collects and uses personal data when you purchase and use our at-home skin test kit and applies to our direct customers.

Who we are

Mitra is responsible for the personal data described in this policy.

What personal data we collect

Where our service uses facial-image analysis, we also collect any photograph you choose to submit, and the facial-image analysis derived from it, after kit registration.

Some of the information above — your health survey responses, information revealing your ethnicity, the genetic data derived from your sample (your DNA methylation / epigenetic data) and, where facial-image analysis is used to identify you, biometric data — is treated as sensitive data under applicable US state laws. We collect and use this data only with your consent, as described in "Your privacy rights" below.

How we use your personal data

Where you choose to submit a photograph for facial-image analysis, we rely on your consent for that processing. Using your personal, identifiable data to train and improve Mitra's predictive models is optional. We will only use your personal, identifiable data for this purpose if you give your separate, explicit consent, which is kept apart from your consent to take the test. This consent is not a condition of providing you with your results, and you can withdraw it at any time without losing access to your results or any other service. Any data you allow us to use for model training is used only by Mitra; we do not sell it or share it with any third party for their own purposes.

For your genetic data (your DNA methylation / epigenetic data), your health survey data, any biometric facial-image data, and your results receive special protection, we use such data only to provide the service you have purchased and for the specific purposes described in this policy to which you have consented.

In particular:

• We do not use your genetic data, health data, or results for advertising, or to build marketing or customer profiles about you.
• We do not use your genetic data, health data, or results to make, or help anyone else make, decisions about your eligibility for insurance, employment, credit, housing, or any other product or service unrelated to the service you purchased.
• We do not disclose your genetic data, health data, or results to any employer, or to any provider or administrator of health, life, long-term-care, or disability insurance, or to anyone acting on their behalf or advising them.

The only exceptions are where you have given your separate, explicit consent to a specific disclosure, or where we are required to disclose by law. Our service providers may use this data only to perform the service on our behalf and for no other purpose.

You understand and agree that if you give consent for us to use your data for any research or commercial product that includes or results from your Report information or Self-Reported Information, you will not receive compensation.

Who we share your data with

We share personal data with the following categories of service providers, who are contractually required to protect it:

From time to time, Mitra may share aggregated, anonymised data with external research partners, such as academic institutions, non-profit organisations, or pharmaceutical companies, to advance research using epigenetic and health data. Because this data cannot be used to identify you, it may be used in this way without requiring further consent from you. Mitra will not share or sell any personally identifiable data without receiving your prior written consent.

Our checkout is operated by an independent e-commerce platform provider. That provider's own privacy notice and terms of use also apply to your checkout experience. Our checkout platform provider does not receive your health survey responses, biological sample data or facial image data and these are collected and processed separately, as described above.

Where we process your data

Mitra is based in the United Kingdom. We and our service providers process personal data in the United States and in other countries outside the United States. Wherever your personal data is processed, we require it to be protected consistent with this policy and applicable law, and we put appropriate contractual and security safeguards in place with our service providers.

How long we keep your data

We keep your personal data for as long as necessary to provide our services and comply with our legal obligations. The retention period depends on the type of data and the purpose for which it was collected.

Once your sample has been processed and quality-checked by our laboratory partner, any leftover physical sample is disposed of. Your sequencing data is then transferred securely to Mitra for analysis and reporting of your results.

If you have consented to your data being used to help train and improve Mitra's predictive models, that underlying data collected for this purpose is retained for 10 years. Once a model has been trained, individual data cannot be extracted or removed from it, so if you withdraw your consent, we will stop using your data in any new training going forward, but this does not undo any improvements already made to a model before you withdrew.

Your rights

Subject to certain conditions and exceptions under applicable law, you have the right to:

• Ask whether we process information about you
• Request closure of your account and destruction of any biological sample that remains
• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Opt out of targeted advertising, sale or sharing where those rights apply
• Lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office)
• Exercise your rights without unlawful discrimination

To exercise any of the above rights, please contact us at dpo@mitrabio.tech.

Licence for Research and Product Development. In addition to the rights granted elsewhere in this policy, and to the extent permitted by applicable law, you grant Mitra a perpetual, irrevocable, worldwide, royalty-free, fully paid-up, sublicensable and transferable licence to use, host, store, process, analyse, aggregate, and create derivative works from your de-identified Report information, the de-identified data derived from your sample and your Self-Reported Information, for the purposes of providing, operating, improving and developing the services and for research and product development. This licence permits Mitra to combine your de-identified data with data from other sources and to share de-identified or aggregated datasets with research and commercial partners. Nothing in this paragraph limits any mandatory right you have under applicable data protection laws that cannot be waived by contract.

Ownership of Derived Data. "Derived Data" means any data, analyses, statistics, models, algorithms, methodologies, insights, biomarkers, correlations, reference datasets or other results that we create or derive from processing, analysing or aggregating de-identified or aggregated information. As between you and us, Derived Data, together with all de-identified and aggregated information, is the sole and exclusive property of Mitra, as are all intellectual property rights in it. To the extent you have or acquire any right, title or interest in de-identified information, aggregated information or Derived Data, you irrevocably assign it to Mitra and agree to do any acts reasonably necessary to give effect to that assignment. This does not affect the rights you retain in your own personal information under applicable data protection laws

Disclosure required by law

You acknowledge and agree that Mitra is free to preserve and disclose personal information to law enforcement agencies or others if required to do so by law, or in the good faith belief that such preservation or disclosure is reasonably necessary to:

• Comply with legal process (such as a judicial proceeding, court order, subpoena or government inquiry) or obligations that Mitra may owe pursuant to ethical and other professional rules, laws and regulations;
• Enforce these Terms and Conditions;
• Respond to claims that any content violates the rights of third parties; or
• Protect the rights, property or personal safety of Mitra, its employees, its users, its clients and the public.

In such an event we will notify you in advance through the contact information you have provided, unless doing so would violate the law or a court order.

Notwithstanding the foregoing, we will not disclose your sample, your Report information or your Self-Reported Information to any law enforcement agency other than in response to a valid warrant, subpoena or court order, or with your specific consent; and we will not disclose them to any insurer, employer or prospective employer without your specific consent.

You understand that the technical processing and transmission of the Services, including your personal information, may involve transmissions over various networks and changes made to conform and adapt to the technical requirements of connecting networks or devices. You acknowledge and agree that Mitra has the right to monitor any use of its systems by its personnel and to maintain records of that monitoring, and that Mitra may, in its sole discretion, restrict access to the website.

Security incidents and breach notification

We investigate suspected security incidents and take steps to contain and address them. If a breach requires notification, we will notify affected individuals and relevant authorities in the manner and within the time required by applicable law. This may include applicable U.S. state breach laws, the FTC Health Breach Notification Rule and UK data-protection requirements.

Cookies

Cookies are small text files placed on your browser or device. Similar technologies include pixels, tags, local storage and software development tools. They can support checkout and sign-in, remember choices, protect the service, measure use or support content and advertising.

The categories we use:

Managing cookies

You can select or change non-essential cookie choices through your cookie settings. You can also restrict cookies through your browser, although blocking strictly necessary cookies may prevent checkout, sign-in, or other core functions from working.

Where required, we recognize supported browser-based privacy preference signals, such as Global Privacy Controls, as a request to opt out of sale or sharing and targeted advertising for the applicable device and browser. Your choices may need to be set again if you use another device or browser or clear stored cookies.

Children

Our product and website are not directed at, and we do not knowingly collect personal data from, children under eighteen (18) years old.

Changes to this policy

We may update this policy from time to time, including when our service, providers, processing or legal obligations change. We will post any changes on this page and update the “Last updated” date above.

Contact us

If you have any questions about this policy or how we handle your personal data, please contact our Data Protection Officer at dpo@mitrabio.tech