Privacy policy
Version VB-PP-2026-01 · Effective from September 14, 2026 · Replaces the version dated 1 March 2026 ·
This Policy explains what personal data we process, for what purposes, on what legal basis, for how long, and what rights you have. It forms part of the contract together with the Legal Terms, the Informed Consent and the Cookie Policy.
The Informed Consent sets out in detail the processing of the sample, the microbiome profile and the voluntary options, and prevails over this Policy in those matters.
1. Who is the controller
Data controller: GENELINK, S.L., owner of the Vivabioma™ brand. Tax ID (NIF) B98649494. Registered office: Calle Arquitecto Mora 5, 2nd floor, door 4, 46010 Valencia, Spain. Healthcare authorisation no. 11540 issued by the Regional Ministry of Health of the Generalitat Valenciana.
• General contact: info@vivabioma.com · Telephone: +34 960 090 596
• Privacy and exercise of rights: lopd@tellmegen.com
• Data Protection Officer: dpo@tellmegen.com
• Supervisory authority: Spanish Data Protection Agency (www.aepd.es) or the supervisory authority in your country of residence.
Vivabioma and tellmeGen are brands of GENELINK, S.L. and share certain corporate systems and privacy channels. This does not mean that data from the two services are combined: such combination requires the specific voluntary authorisation provided for in the Informed Consent.
The service is organised from Spain and we apply Regulation (EU) 2016/679, Organic Law 3/2018 and any other applicable Spanish legislation, without prejudice to the local laws of your country of residence.
2. Who this Policy applies to
2.1 It applies to people who visit the Website, create an account, purchase our services, take part in research or communicate with our support team.
2.2 A microbiome report does not reveal hereditary information about your relatives, but it may reflect shared habits, diet or living arrangements. You are responsible for deciding with whom you share your reports.
3. What data we process and where it comes from
3.1 Categories of data:
• Account and contact details: first and last name, email address, encrypted password, date of birth, sex if provided, address, telephone number, language and country.
• Biological sample: stool collected using our kit.
• Analysis data: technical sequencing and quality-control data, microbiome profile, estimated functions, indices and the resulting reports.
• Responses to questionnaires about diet, habits, symptoms and well-being. Optional questions are identified as such; omitting them may limit content that depends on those answers.
• Purchases and payments: orders, invoicing, upgrades and transaction metadata. We do not store full payment-card numbers.
• Platform use: logins, reports viewed, downloads, features used, metrics and data collected through cookies.
• Communications with customer support and incident records.
• Documentation proving legal representation or support measures when the service is purchased for a minor or for a person who requires support.
3.2 Source. The data are provided by you or generated during provision of the service. We do not purchase personal data from external sources in order to profile you.
4. Nature of the data and incidental human DNA
4.1 This service analyses the genetic material of microorganisms present in your sample, not your genome. The microbiome profile is not, in itself, your genetic data within the meaning of the Regulation.
4.2 However, the profile, together with your answers and the purpose of the service, may reveal information about your health and identify you indirectly. We therefore protect it at the level applicable to special categories of data for as long as it constitutes personal data.
4.3 A stool sample contains human cells and fragments of human DNA may be captured incidentally during sequencing. Their processing is limited to filtering, quality control, security and deletion in accordance with the technical cycle. They are not interpreted to determine traits, kinship, predisposition or genetic identity, and they are not included in reports or standard exports.
5. Why we process your data and the legal basis
• To register the sample, sequence, filter, generate, host and update your reports: performance of the contract (Art. 6(1)(b)) and explicit consent for health-related data and other special categories, including incidental human fragments (Art. 9(2)(a)).
• To create and manage your account, logistics, access to reports and upgrades: performance of the contract (Art. 6(1)(b)).
• To handle your rights and requests for access and portability: legal obligation (Art. 6(1)(c)).
• To verify identity, legal representation and support measures, and to prevent unauthorised analyses: compliance with applicable legal obligations (Art. 6(1)(c)) and, where no specific obligation applies, our legitimate interest in preventing unlawful or fraudulent use (Art. 6(1)(f)). Retention of evidence of consent and representation is also based on Art. 9(2)(f).
• To improve the service and ensure its security, prevent fraud and defend claims, using aggregated or anonymised analyses whenever possible: legitimate interest (Art. 6(1)(f)), with the right to object.
• To comply with tax, commercial, healthcare, quality and product-vigilance legal obligations and to respond to requests from authorities: legal obligation (Art. 6(1)(c)).
• Research and development, including the training of artificial-intelligence models, in the areas described in section 20 of the Informed Consent: your specific and separable consent (Arts. 6(1)(a) and 9(2)(a)). Combining data with another GENELINK service requires separate and additional consent.
• Professional Access: your specific consent given when you activate it.
• Transactional and support communications: performance of the contract (Art. 6(1)(b)).
• Electronic marketing communications: your consent or, for products and services similar to those you have already purchased, the legitimate interest provided for under information-society services legislation, with an unsubscribe option in every communication.
Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. Where processing is based on our legitimate interest, you may object and we will assess your particular circumstances; the balancing test is available on request at dpo@tellmegen.com.
6. Research, development and artificial intelligence
6.1 Participation is voluntary, separate and revocable, and does not affect the service or its price. It is authorised through a single checkbox covering internal research and improvement, external scientific projects, and research and development with commercial partners, under the terms of section 20 of the Informed Consent.
6.2 This authorisation does not permit us to combine your Vivabioma data with data from another GENELINK service, such as tellmeGen. Such combination requires separate, specific and additional consent, which is not currently requested during registration.
6.3 Where you authorise it, we may use pseudonymised or anonymised data from the authorised categories to develop, train, validate, audit and improve analytical models and artificial-intelligence systems intended for microbiome interpretation, report improvement and the development of new products and services.
6.4 Projects use only the minimum data necessary, exclude direct identifiers unless justified, and are subject to confidentiality, access controls, a prohibition on re-identification, an agreement with the collaborator and ethical assessment where appropriate.
6.5 These authorisations relate to data, not to the physical sample. Any research use of the sample itself requires separate consent and the applicable project, collection or biobank framework.
6.6 You may withdraw any of the authorisations as easily as you gave them. Withdrawal prevents new inclusions and ends future processing based on that authorisation, but does not affect processing already carried out lawfully, publications already made, irreversibly anonymised data or models already trained, from which your data cannot be individually removed.
7. Minors and persons requiring support measures
7.1 Our services are intended for adults: purchasing requires you to be 18 or older and a minor may not register or purchase the service independently. The service is not available to children under three years of age.
7.2 Where the service is purchased for a minor or for a person requiring support measures, the person holding parental responsibility, guardianship or providing support must provide documentary evidence in accordance with the Informed Consent. We do not begin the analysis until this has been verified, and reports for minors do not include the resistome or personalised recommendations.
7.3 Supporting documentation is retained solely as evidence of legal authority and to prevent unauthorised analyses, with restricted access, and is not used for any other purpose.
7.4 Data relating to minors are included in research only where there is specific authorisation from the representative and with any additional safeguards required by the project.
7.5 Upon reaching the age of 18, the data subject may request ownership of their account and exercise all their rights directly.
8. Automated decision-making
8.1 Generation of your reports is an automated process: our software identifies the microorganisms present, estimates functions and calculates indices by linking them to content in our knowledge base, which is developed by our scientific team from the literature.
8.2 This processing does not produce legal effects concerning you or similarly significantly affect you, because the report is informational and does not itself determine any healthcare decision.
8.3 In all cases, you may request an explanation and human review of your report by writing to lopd@tellmegen.com, express your point of view and contest the result.
9. The biological sample
9.1 Your sample is used exclusively to provide the service purchased and for the associated quality controls.
9.2 It is normally destroyed between 60 and 120 days after your results are issued and, in all cases, within six months, unless there is an ongoing quality incident or a different legal obligation, which we will inform you about.
9.3 It is not stored in a biobank or transferred to third parties for other purposes.
10. Retention, upgrades and restricted archive
• Account and contract: for the duration of the relationship and, afterwards, for the applicable limitation periods.
• Invoicing and accounting: for the periods required by commercial and tax legislation.
• Biological sample: in accordance with section 9.
• Microbiome profile, technical data and reports: while your account remains active, so that you can view and compare them and request upgrades.
• Technical and security logs: between 12 and 24 months, proportionate to their purpose.
• Documentation proving representation and records of consent acceptance: for as long as liability may arise.
• Research: for the duration of the project or until authorisation is withdrawn, subject to the exceptions in section 6.6.
10.1 If you request deletion of your technical data, upgrades and reinterpretations will no longer be possible without a new sample. We will warn you before carrying out the deletion.
10.2 When you request deletion or close your account, information that we must retain due to legal, healthcare, quality or tax obligations, or for the defence of claims, is placed in a restricted archive with limited access, is not used for any other purpose, and is deleted when the applicable period expires.
10.3 Backups are deleted or overwritten in accordance with their normal cycles, with a target maximum of 90 days from operational deletion.
11. Recipients, processors and sub-processors
11.1 We do not sell or rent individually identifiable data. We may disclose data to the following categories of recipients:
• Metagenomic sequencing laboratories, which receive the coded sample.
• Infrastructure, hosting, storage and security providers.
• Payment gateways and payment providers.
• Logistics operators.
• Support, communication and analytics tools.
• Research collaborators, where you have authorised this and using pseudonymised or anonymised data.
• Authorities and public bodies, where there is a legal obligation.
11.2 All processors are bound by contract in accordance with Article 28 of the Regulation and must implement appropriate technical and organisational measures. A change of provider does not broaden the purposes or reduce your rights.
11.3 You may request the current list of processors and sub-processors, including their location and function, by writing to lopd@tellmegen.com.
12. International transfers
12.1 The analysis and storage of your data take place within the European Economic Area, with providers in the categories identified in section 11.1.
12.2 If any ancillary function involves processing outside the European Economic Area, we will apply appropriate safeguards: an adequacy decision by the European Commission, standard contractual clauses with a transfer impact assessment and supplementary measures, or binding corporate rules. The transfer will be identified in the same list.
12.3 You may request information about the safeguards applied and, where applicable, a copy of them by writing to dpo@tellmegen.com.
13. Professional Access
13.1 You may authorise an identified professional to view specific categories of your reports for the period shown to you. Activation requires a separate action and may be revoked at any time.
13.2 Revocation prevents new access but does not delete copies that the professional has already lawfully downloaded or incorporated into their records.
13.3 The professional is responsible for their professional authorisation, confidentiality obligations and subsequent use of the information, unless the profile identifies them as a professional directly engaged by GENELINK.
14. Marketing communications
We may send you information about Vivabioma products or services where you have consented or where they are similar to products or services you have already purchased. You may object at any time, easily and free of charge, using the link included in each communication or by writing to lopd@tellmegen.com.
15. Cookies and advertising
15.1 We use technical and analytics cookies and, only with your consent, advertising cookies. At the first level of the panel you can accept, reject or configure your preferences, and change them whenever you wish. Details are set out in the Cookie Policy.
15.2 For analytics and advertising functions, we share information with our partners, including Google, in accordance with Google's EU User Consent Policy. You can consult Google's privacy and terms page to see how it uses information from sites that use its services.
15.3 These tools never access your sample, your analysis data or the content of your reports.
16. Security and data breaches
16.1 We apply technical and organisational measures appropriate to the risk: encryption in transit and at rest, pseudonymisation, role-based access control, logging and monitoring, perimeter and application protection, incident management, and data protection by design and by default. We have carried out a data protection impact assessment.
16.2 No information system is completely immune from risk. If a security breach occurs that is likely to result in a high risk to your rights, we will notify you without undue delay, indicating the nature of the incident, its possible consequences and the measures taken.
17. Your rights
17.1 You may exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, withdraw any consent you have given, and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
17.2 To exercise these rights, write to lopd@tellmegen.com or by post to GENELINK, S.L. (reference: Data Protection), Calle Arquitecto Mora 5, 2nd floor, door 4, 46010 Valencia, Spain. We may ask you to verify your identity.
17.3 We will respond within one month. This period may be extended by a further two months if the request is complex or we receive a high number of requests; we will inform you of the extension within the first month.
17.4 Exercising your rights is free of charge, except for requests that are manifestly unfounded or excessive, particularly because they are repetitive, in which case a reasonable fee may be charged or action may be refused, with reasons provided.
17.5 You may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority in your country of residence.
18. Change of control and business succession
18.1 GENELINK may be involved in corporate transactions such as a merger, demerger, financing, contribution of a business unit or the total or partial transfer of the business, including a separate transfer of the Vivabioma brand.
18.2 During preliminary negotiation and due-diligence stages, only strictly necessary aggregated, statistical or pseudonymised data may be shared, subject to confidentiality, data minimisation and access controls. Individually identifiable files or microbiome profiles attributable to a specific person will never be provided.
18.3 If the transaction is completed, the acquiring entity will succeed as data controller and will be bound by the Informed Consent and this Policy, without expanding the purposes. We will notify you without undue delay and, where possible, before it begins processing your data.
18.4 For materially different purposes, the new controller must inform you and establish a valid legal basis or, where required, obtain new consent.
18.5 In the event of insolvency or liquidation, your data may be transferred only as part of continuity of the service and with equivalent safeguards; otherwise, they will be deleted or anonymised, except for records subject to mandatory retention. These rules do not in themselves authorise the standalone sale of personal data or samples.
19. Changes to this Policy and evidence of consent
19.1 We may update this Policy due to legal, technical or service changes. Each version has a code and date, and you may request the version history at lopd@tellmegen.com.
19.2 If a change expands the purposes, categories of data or recipients, or affects any of your consents, we will inform you before it takes effect and, where appropriate, ask you to take a new affirmative action. We will not apply new purposes to data already collected without an appropriate legal basis.
19.3 We retain evidence of each consent given, including the version of the text shown to you, its hash, and the date and time. You can view and download it from your account.
20. Contact
For any questions about this Policy, you can write to lopd@tellmegen.com or, for matters requiring the involvement of the Data Protection Officer, to dpo@tellmegen.com.