Who we are
Doctor’s Brain is operated by Genetic Path, a company registered in Finland under business ID 3441356-7. Genetic Path is responsible for the personal data described in this policy unless a separate agreement says that we process data for a practitioner or healthcare organization.
What information we collect
When you use the public website, we collect limited technical and usage data such as your IP address, browser, device, pages viewed, and interactions.
When you join the Doctor’s Brain waitlist, we collect your email address, the audience type you select, an optional description when you select ‘Other,’ and limited signup attribution such as the page, campaign parameters, and referring domain. Please do not submit patient information or medical details.
When you create an account, we may collect your name, email address, profile image, organization, and professional role. If you sign in with Google, we receive the basic account data you approve on the Google consent screen, such as your name, email address, profile picture, and Google account identifier.
How we use your information
We use waitlist information to manage beta access and send requested service updates. If you separately choose the newsletter checkbox and confirm the subscription email, we also use your email to send marketing updates. You can unsubscribe from marketing at any time without leaving the beta waitlist.
We use account data to authenticate you, maintain your account, communicate about the service, provide support, and protect Doctor’s Brain. We use limited technical and usage data to secure the website, diagnose errors, and understand which parts of the service are useful.
Google account data
Doctor’s Brain uses Google account data only to sign you in, identify your account, and provide account features you request. We do not use Google user data for advertising, credit decisions, research, or training general-purpose AI models. We do not sell Google user data.
We share Google user data only with service providers that help us operate or secure Doctor’s Brain, when you ask us to, or when the law requires it. Our use of data received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Analytics and session recording
We use PostHog on the public website to measure visits and interactions and to record sessions for product improvement. Form inputs are masked, and query parameters are removed from recorded network URLs. The public website does not collect patient records.
Patient data and the developing application
Doctor’s Brain is still in development. The public website does not accept patient files, medical records, or lab results. Staging and test systems are not intended for real patient data. Before a production feature accepts patient data, we will update this policy and provide product-specific notices that explain the data, purpose, providers, retention, and user controls.
Where data is processed
The website is delivered through Cloudflare, PostHog analytics use its European Union service, and waitlist contacts are managed in HubSpot. Google and HubSpot may process data internationally. When personal data is transferred outside the European Economic Area, we use an applicable adequacy decision or other safeguards required by EU data protection law.
Who we share data with
We use Cloudflare for website security, delivery, and transactional email; PostHog for website analytics and session recording; HubSpot for waitlist and marketing contact management; and Google for optional account sign-in. We may also disclose information when required by law or needed to protect users, the service, or our legal rights.
We do not sell or rent personal information.
How long we keep data
We keep inactive waitlist records for up to 24 months after the most recent interaction, unless you ask us to delete them sooner or we need to retain limited records to honor an unsubscribe request. We keep account information while your account is active and for a limited period afterward when needed for security, legal obligations, or dispute resolution. Technical and analytics records follow the retention periods set for the relevant service. You may ask us to delete your account data, subject to records we must keep by law.
Your rights and choices
You may ask to access, correct, export, restrict, or delete your personal information. You may also object to certain processing. Depending on where you live, you may have additional rights under local law.
You may complain to the Finnish Data Protection Ombudsman or another competent data protection authority.
Security
We use access controls, encryption in transit, and operational safeguards designed to protect personal data. No online service can guarantee absolute security. Contact us promptly if you believe your account or data has been exposed.
Changes to this policy
We may update this policy when the service or our legal obligations change. We will post the current version here and update the date above. If a change materially affects account users, we will also provide notice through the service or by email.
Contact us
Contact Genetic Path with privacy questions or to exercise your data protection rights. Our registered address is Kuninkaantie 43, Office 0129, 02940 Espoo, Finland.