Privacy Policy

Holohabits (the “Nutrition OS” platform) is operated by Biohacker Center Platform OÜ(registry code 16795881), registered in Estonia at Tööstuse 43-100, 10411 Tallinn, Estonia (“Holohabits”, “we”, “us”). Your practitioner uses Holohabits to run your consultation and deliver your results: your practitioner is the controller of your consultation, and we process your data on their instructions. For platform improvement, anonymised statistics, and security we act as an independent controller. For privacy questions or to exercise your rights, use our contact page. We have not appointed a statutory Data Protection Officer; please use the contact page for any request.

• Account data (name, email, phone) — to operate your account and consultations.
• Health-related data (biomarker results, allergies, lifestyle and diet) — special-category data. Synced from Biostarks with your consent and used for your wellness insights, your practitioner consultation, and AI-assisted analysis.
• Usage / marketing data on public landing pages — only with your cookie consent.

We rely on your explicit consent (GDPR Art. 9(2)(a)) for health-related data — including syncing your results, your practitioner accessing them, AI-assisted analysis, and delivery by email. You can withdraw consent at any time. We rely on legitimate interest for aggregated, anonymised statistics and platform security, and on consent for non-essential cookies and marketing.

We use vetted processors under data-processing agreements. Health-data processing is performed in the EU: Microsoft Azure OpenAI (Sweden) for AI analysis, Brevo (France) for transactional email, and Qdrant (EU) for search (query embeddings only). Optional services — calendar, video, analytics, and error monitoring — are used only where relevant, some under the EU-US Data Privacy Framework or Standard Contractual Clauses. Our databases and file storage are self-hosted on our own premises.

Health-data processing is EU-based. Any transfer outside the EEA relies on an adequacy decision or Standard Contractual Clauses.

We use AI models to help interpret your biomarker values. Your name, email, and identifiers are removed before any model call — models receive biomarker values only. This analysis supports, and does not replace, professional judgement; it is not a medical diagnosis.

We keep your data while your account is active and delete it on request or under our retention schedule. Records of your consent are kept as proof of consent.

You have the right to access, rectification, erasure, portability (export), restriction, objection, and withdrawal of consent. To exercise them, contact your practitioner or use our contact page; we provide export and erasure of your record. You may also lodge a complaint with the Estonian or your local data protection authority.