Genetic, Biomarker and Bio-Matching Consent

This Genetic, Biomarker and Bio-Matching Consent (“Consent”) explains how Idicine (“Idicine,” “we,” “us,” or “our”) may collect, use, process, store, and delete genetic, biomarker, blood type, and other biological information that you choose to provide through the Idicine app, website, or related services.

This Consent is in addition to our Terms of Use and Privacy Policy.

Please read this carefully. By selecting “I agree,” uploading information, entering biological information, or enabling biological matching features, you give Idicine permission to use your information as described below.

1. What Idicine Is

Idicine is a peer-support platform for self-reported health and wellness experiences. Idicine lets users create and join Bio Chats. A Bio Chat is a conversation that may only be visible or joinable for people who have a high biological match with the person who created the Bio Chat.

Idicine is not a healthcare provider, doctor, genetic counselor, laboratory, pharmacy, hospital, health plan, or emergency service. Idicine does not provide medical advice, diagnosis, treatment, prescriptions, clinical recommendations, dosage instructions, genetic counseling, or emergency support.

2. What You May Choose to Provide

You may choose to provide one or more of the following: blood type; genetic data; DNA files; genetic markers; genetic trait information; biomarker data; bloodwork reports; lab-related files; uploaded PDFs, images, or documents; supplement experiences; medication experiences; side effect experiences; symptoms or wellness experiences; training, sleep, energy, or recovery experiences; self-reported reactions; and other biological or health-related information.

You are not required to upload DNA, bloodwork, biomarkers, or lab files to use basic Idicine features unless a specific feature requires them.

3. Consent to Collect This Information

By agreeing to this Consent, you authorize Idicine to collect the biological, genetic, biomarker, blood type, and health-related information that you choose to provide. You should not provide information about another person unless you have legal authority and all required consent to do so.

4. Consent to Store and Maintain This Information

By agreeing to this Consent, you authorize Idicine to store and maintain the information you provide for the purposes described in this Consent, the Privacy Policy, and the Terms of Use. This may include storing uploaded files, extracted data, match signals, trait keys, profile information, and related metadata.

5. Consent to Process Uploads

If you upload DNA files, bloodwork, lab reports, or other documents, you authorize Idicine and its service providers to process those files to extract relevant information. Processing may be automated, AI-assisted, or performed through software systems. Automated processing may be inaccurate, incomplete, or unable to interpret some files.

When you upload a file for analysis, the content of that file is processed by AI software running on Idicine-controlled servers. No uploaded file content is transmitted to third-party AI providers. The raw file is deleted from our servers after processing is complete.

6. Consent to Create Privacy-Safe Match Signals

By agreeing to this Consent, you authorize Idicine to convert your biological, genetic, biomarker, blood type, and self-reported information into privacy-safe match signals. These signals are used to decide which Bio Chats may be visible or joinable for you and which users may be able to see Bio Chats you create.

7. Consent to Use Information for Bio Matching

By agreeing to this Consent, you authorize Idicine to use your biological, genetic, biomarker, blood type, and self-reported information to calculate bio match scores and Bio Chat access.

A bio match score is not a medical, clinical, diagnostic, genetic, treatment, safety, or scientific conclusion. Bio matching is only used to organize peer-support conversations.

8. What Other Users Will Not See

Other users should not see your raw DNA files, raw genetic files, raw bloodwork files, uploaded documents, or raw biomarker values unless you intentionally post or share that information yourself. Idicine may show other users limited match-related information, such as whether they meet the match threshold for a Bio Chat or a match percentage.

9. Important Inference Risk

Even though Idicine is designed to keep raw biological data private, matching features can create inference risk. For example: if you join a very specific Bio Chat, other users may infer that you have an interest, experience, or possible similarity related to that topic; or if you post details about your blood type, genes, biomarkers, medication, symptoms, or supplements, other users may learn that information from your post.

You should not post anything you are not comfortable sharing with other users who can access that Bio Chat.

10. Consent to Use Information to Provide and Improve the Service

By agreeing to this Consent, you authorize Idicine to use your information to: provide the Service; create and manage your bio profile; calculate bio match scores; determine Bio Chat visibility; improve matching quality; improve onboarding; improve privacy and safety systems; detect abuse, spam, fraud, or unsafe behavior; debug and troubleshoot issues; develop new features; measure feature performance; and provide user support.

11. Consent to Use De-Identified or Aggregated Information

By agreeing to this Consent, you authorize Idicine to create and use aggregated, anonymized, or de-identified information derived from biological, genetic, biomarker, blood type, and self-reported experience data for analytics, product improvement, feature development, community trend analysis, safety, and business purposes. Use of de-identified information for pattern-discovery research or for sharing with research partners requires your separate optional consent as described in Section 27 (Research Use Consent). The optional in-app checkboxes are listed in Section 26.

12. Optional Research or Third-Party Studies

Idicine may later offer optional research, study, survey, clinical trial awareness, or third-party project opportunities. Participation in those opportunities is optional. Agreeing to this Consent does not automatically enroll you in a clinical trial, medical study, or research project.

13. No Sale of Raw Genetic or Biomarker Files

Idicine does not sell your raw DNA files, raw genetic files, raw bloodwork files, uploaded lab reports, or raw biomarker values. We will not transfer your identifiable genetic data to a third party for that third party's own use without your separate consent where required by law.

14. Business Transfers

If Idicine is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, your information may be transferred as part of that transaction, subject to applicable law, this Consent, our Privacy Policy, and any required notices or consents.

If a proposed transaction would result in the transfer of your identifiable genetic data to a new owner or third party, we will provide advance notice and obtain any additional consent required by applicable law, including the California Genetic Information Privacy Act and Washington My Health My Data Act, before such transfer occurs.

15. Consent to Use Service Providers

By agreeing to this Consent, you authorize Idicine to use trusted service providers to help provide the Service, including cloud hosting providers, database providers, authentication providers, storage providers, AI or file-processing providers, analytics providers, security providers, customer support providers, and notification providers.

16. AI and Automated Processing

Idicine may use automated or AI-assisted systems to extract information from uploads, create match signals, summarize self-reported experiences, organize Bio Chats, detect safety issues, or support user-facing features. AI and automated systems can be wrong. AI-generated or automated outputs are not medical advice, diagnosis, treatment, clinical decision support, genetic counseling, or safety clearance. Do not use AI-generated or automated outputs to make medical decisions.

To the maximum extent permitted by law, Idicine is not liable for any harm, health outcome, medical decision, or other consequence arising from your reliance on AI-generated or automated outputs from the Service.

17. Affiliate Links and Product Mentions

Idicine may display product mentions, supplement discussions, third-party links, affiliate links, or product-related content. Product mentions and affiliate links are not medical recommendations. Always talk to a qualified clinician before changing medication, dosage, supplements, or treatment.

18. Withdrawal of Consent

You may withdraw certain consents by changing your settings, deleting uploaded data, deleting your account, or contacting us at privacy@idicine.com.

Withdrawing consent may limit or disable certain features. Withdrawal of consent may not affect: processing already completed; information already shared at your direction; content you posted in Bio Chats; information retained for legal compliance; or aggregated or de-identified information.

19. Deletion Rights

You may request deletion of your genetic, biomarker, blood type, upload, or account information by contacting privacy@idicine.com or using available in-app tools.

20. Data Retention

We retain genetic, biomarker, blood type, upload, and match-signal information for as long as reasonably necessary to provide the Service, maintain your account, support matching, comply with law, protect safety and security, prevent fraud or abuse, resolve disputes, enforce agreements, and support legitimate business purposes.

More specifically: we aim to delete raw uploaded files from our servers within 24 hours of processing. Match signals and biological profile data derived from your uploads are retained for as long as your account remains active. When you delete your account, we initiate deletion of your personal data within 30 days, subject to legal hold obligations. We may retain aggregated or de-identified information indefinitely where permitted by law.

21. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect sensitive information. No system is perfectly secure. We cannot guarantee that your information will never be accessed, disclosed, altered, or destroyed.

22. Breach Notification

If we discover a security incident involving your information, we will evaluate the incident and notify affected users, regulators, or other parties as required by law.

23. State Consumer Health Privacy Laws

Some states have consumer health privacy laws that may apply to health and wellness apps outside HIPAA. We will provide required rights and notices where applicable.

24. Your Responsibilities

You are responsible for deciding what information to provide. You should not upload or post information you are not comfortable using within the Service. You should not post another person's genetic, biomarker, health, or identifying information without legal authority and consent. You should not rely on Idicine for medical decisions. You should not use Idicine in an emergency.

25. Separate Consent Choices

In the app, we may ask you to accept separate consent choices, including: consent to collect and store blood type information; consent to collect and store genetic data; consent to collect and store biomarker or bloodwork data; consent to process uploaded files; consent to use biological information for Bio Chat matching; consent to create privacy-safe match signals; consent to use de-identified or aggregated information for research or product improvement; consent to receive research or study opportunities; and consent to share specific information with a third party.

26. In-App Consent Language

Before using biological matching, the app displays the following separate checkboxes. None are pre-checked.

27. Research Use Consent (Opt-In)

This Section describes the additional, optional consent you may grant during signup or later from Settings to allow Idicine to include your data in its internal research program. These research toggles are never pre-checked: they default to off, and including your data requires an affirmative opt-in by you. This consent is independent of every other consent in this document. Granting it is not required to use the Service, and withdrawing it does not affect access to any Service feature.

What the program is. Idicine operates an internal research program — the Bio-Outcome Intelligence Engine — that identifies statistical associations between bio-signatures (combinations of blood type, biomarker, and genetic features) and self-reported outcomes mentioned in Bio Chats. The program is designed to generate hypotheses about how biology relates to user-reported experiences. It does not produce clinical conclusions, diagnoses, prescriptions, or treatment recommendations.

Two granular toggles. Both signup and Settings expose two separate research toggles:

• Research participation. When enabled, the categories of data covered by your earlier consents (blood type, biomarker data, genetic data, self-reported experiences, and the content of Bio Chat messages you author) may be included, in pseudonymized form, in internal pattern-discovery pipelines. Pseudonymization separates your account identifiers from the bio and behavioral features used for analysis. Statistical outputs are produced only over groups of five or more distinct users (k-anonymity ≥ 5).
• Research partner sharing. Only available when research participation is enabled. When this secondary toggle is also enabled, Idicine may share fully de-identified aggregate outputs — never raw or identifiable data — with contractually bound research partners under a written Data Processing Agreement. De-identification follows the HIPAA Safe Harbor methodology, informed by the principles of the Expert Determination standard under 45 C.F.R. § 164.514(b). The DPA is published at idicine.com/data-processing-agreement.

What the program does not do. The program does not return predictions, scores, recommendations, interpretations, or any individualized output to you through the Service. The only product-facing effect of the program is improved internal ranking quality for Bio Chat surfacing. This design is deliberate: it keeps the program out of the regulatory definition of a clinical decision support tool or a software-as-a-medical-device, and it keeps medical decisions in the hands of users and their clinicians.

Infrastructure. All pattern-discovery compute runs on Idicine-controlled infrastructure. No data covered by research consent is processed by any third-party AI provider. Aggregate outputs that are shared with research partners pass through an internal pseudonymization and de-identification pipeline before any external transfer.

Lawful basis. The lawful basis for this processing is your explicit opt-in consent (Washington My Health My Data Act, RCW 19.373; California Consumer Privacy Act, Cal. Civ. Code § 1798 et seq.; California Genetic Information Privacy Act; Nevada SB 370; Connecticut SB 3; Colorado Privacy Act; and, where applicable, GDPR Article 9(2)(a)).

De-identification commitment. Idicine publicly commits not to attempt to re-identify de-identified data and contractually requires every research partner to make the same commitment, including prohibitions on combining data, fingerprinting, or any other technique that could result in re-identification.

No sale. Aggregate research insights are not sold to data brokers, advertisers, insurers, employers, or any other third party for cross-context behavioral advertising. Where a research partnership involves commercial consideration, that consideration is for the production of insights for a specific research purpose under a DPA, and is not a sale of personal information for purposes of CCPA Cal. Civ. Code § 1798.140(ad).

Withdrawal. You may withdraw research consent at any time from Settings, by deleting your account, or by emailing privacy@idicine.com. Withdrawal stops all future inclusion of your data in research processing within a reasonable operational window. Aggregate model artifacts and statistics that have already been computed and that no longer permit re-identification of you are retained under the de-identification standard above, consistent with MHMDA, NV SB 370, and the FTC Health Breach Notification Rule (16 C.F.R. Part 318).

Where to read more. See Privacy Policy §32 (Research and Pattern Discovery), Consumer Health Data Privacy Policy §8, and the Data Processing Agreement.

28. Contact

If you have questions about this Consent or want to withdraw consent, delete data, or exercise privacy rights, contact:

Idicine
5214F Diamond Hts Blvd
San Francisco, CA 94131
Email: privacy@idicine.com

For support: support@idicine.com

For legal notices: legal@idicine.com