1. Local-First Privacy Architecture
At Biogistry ("Platform", "we", "us", or "our"), privacy is embedded into our core software design.
Biogistry operates as a browser-native, local-first genetics suite. By default, all patient records, pedigree charts, Punnett squares, chromosome idiograms, notes, and clinical files created in Biogistry are stored entirely within your browser's local sandbox using IndexedDB and localStorage, or saved to local file directories on your computer via browser File System Access APIs.
2. Zero-Knowledge AES-GCM 256-Bit Encryption & Master Passwords
Before backing up data to your selected local device folder via the File System Access API, Biogistry prompts you to create a Master Password.
- Zero-Knowledge Architecture: Backup encryption and decryption occur locally within your browser using AES-GCM 256-bit encryption. Your Master Password remains strictly on your device — Biogistry central servers NEVER receive, store, or know your Master Password.
- User Password Responsibility: Because our servers have zero knowledge of your password, Biogistry cannot reset or recover forgotten Master Passwords. You take 100% full responsibility for data loss, theft, or access issues resulting from forgotten passwords or sharing credentials.
- Plaintext External Snapshots: Snapshots exported to external connectors (such as Google Drive or custom FHIR webhooks) are saved unencrypted/plaintext unless encrypted with your Master Password. You are responsible for creating and maintaining your Master Password to protect cloud snapshots.
- Recommended Credential Management: We strongly advise using dedicated, encrypted password managers (such as Bitwarden, 1Password, or KeePass) to securely store your Master Password passphrase and recovery keys.
3. Aggregated, Cookieless Telemetry & Privacy-Preserving Analytics (Umami)
To maintain infrastructure reliability, assess aggregate site performance, and continuously optimize our user experience, Biogistry utilizes Umami (hosted via cloud.umami.is), an open, privacy-preserving, cookieless telemetry tracking solution.
- 100% Cookieless & Non-Invasive: Umami operates completely without persistent tracking cookies, third-party cookies, fingerprinting, or cross-site behavioral tracking. It respects visitor anonymity by default and is fully compliant with GDPR, CCPA, and PECR without requiring invasive cookie banners.
- Telemetry Only — NEVER Strictly Your Data: Tracking is strictly confined to high-level, aggregate diagnostic telemetry (e.g., aggregate page visits, referring sources, browser type, operating system, and geographic country). Umami NEVER captures, inspects, or logs your personal data, clinical files, form entries, or Protected Health Information (PHI).
- Scope of Tracking (Public Pages, Free Tools & Blogs): Telemetry actively monitors pageviews and engagement across our public marketing pages, articles and blog posts, documentation, and free educational tools (including the Free Pedigree Chart Maker, Free Punnett Square Calculator, and GEDCOM Viewer) to help us understand feature adoption and refine free clinical utilities.
- Strict Tracking Boundary — Zero In-App Tracking within
/app: While inbound clicks directed toward our workspace application (/app) are tracked in aggregate to measure platform traffic flow, all activity, workflows, navigation, and user interactions occurring inside the/appworkspace are strictly excluded and never tracked. What happens inside the clinical workbench remains entirely private, local-first, and confidential. - Service Improvement Purpose: Any telemetry data collected is used solely to evaluate infrastructure uptime, detect technical bottlenecks, and improve service quality for our users, and is never monetized, sold, or shared with advertising networks.
4. Onboarding Data & Testimonial Safeguards
When you sign in or complete clinician onboarding, we collect minimal profile details required for session management (such as your full name, email address, primary professional role, and avatar URL).
Onboarding data is stored with strict enterprise data protection safeguards. Your Personally Identifiable Information (PII) like name and email is strictly protected and will NEVER be published, shared, or displayed as a public testimonial or showcase without your explicit written permission.
5. Help & Feedback Support Portal (Strict No-PHI Policy)
When reaching out for assistance or submitting feedback via our support portal or email, you must STRICTLY AVOID inputting any PHI or patient identifiers in your messages or attachments.
Support messages and feedback submissions are stored in plaintext on our cloud servers so the Biogistry engineering team can review recommendations and troubleshoot issues. Please describe features, bugs, or UX questions using generalized, non-patient descriptions only.
6. Third-Party Payment & Cloud Infrastructure Providers
Biogistry utilizes select, enterprise-grade third-party infrastructure providers to support payment handling, database persistence, edge hosting, and transactional communication services.
- Polar.sh & Stripe (Payment Processing & Billing): Subscription management, checkout, tax collection, and billing lifecycle services are provided by Polar.sh Inc. as our Merchant of Record. Polar's payment checkout infrastructure is powered by Stripe. Payment credentials, credit card details, and billing addresses are collected and processed directly by Polar.sh and Stripe under their strict PCI-DSS Level 1 compliance safeguards. Neither Polar.sh nor Stripe stores or has access to patient health records (PHI).
- Cloudflare (Edge Compute, Application Hosting & Database): Biogistry runs on Cloudflare Workers and Cloudflare Pages serverless edge infrastructure. User account registration, session metadata, onboarding preferences, and platform audit receipts are persisted in Cloudflare D1 (SQLite). Cloudflare infrastructure ensures global low-latency availability, DDoS mitigation, and encrypted database storage. Zero Protected Health Information (PHI) is stored or hosted on Cloudflare servers.
- Resend (Transactional Email Communications): Account verification, magic sign-in links, security alerts, and subscription billing receipts are dispatched via Resend. Resend processes recipient email addresses solely for message delivery and transaction verification. Resend does not store or process patient health data (PHI).
7. External Connectors & Third-Party Integrations
Biogistry provides optional connectors for syncing workspace data with user-managed cloud accounts (such as Google Drive) or custom FHIR webhooks.
Biogistry bears zero liability for data stored in, processed by, or transmitted to third-party services. Covered Entities are strongly advised to execute a Business Associate Agreement (BAA) directly with third-party cloud providers (e.g. Google Cloud / Workspace) or host self-owned infrastructure under strict security controls before connecting health data endpoints.
8. Platform Audit Logging & Compliance Recordkeeping
To maintain security integrity, prevent misuse, and fulfill regulatory compliance mandates, Biogistry records immutable platform audit logs when critical actions occur (such as enabling an external connector, authenticating cloud sessions, or acknowledging legal/BAA terms).
Audit Log Contents: Audit records capture your full name, email address, institutional organization details, timestamp, IP address, and exact connector configuration events.
Retention Schedule: Compliance audit log entries are retained for a minimum of seven (7) years or indefinitely at Biogistry's discretion to satisfy statutory health data audit trails and legal safety standards.
9. Account Deletion & Limits on Right to be Forgotten
You have the right to request deletion of your Biogistry account at any time. When you request account deletion, your user account profile, onboarding details, and stored session tokens are permanently removed from our active database.
While account deletion purges active user profile and onboarding data, platform audit log records confirming external connector executions, security authorizations, and legal/BAA acknowledgments are strictly EXCLUDED from account deletion / right to be forgotten requests. These compliance audit records (including name, email, organization, and action timestamps) are retained for a minimum of 7 years or indefinitely for legal defense, auditability, and safety purposes.
10. HIPAA & Regulatory Alignment
Biogistry is designed to support HIPAA-aware clinical workflows. Because patient data remains in browser-local storage or local file systems under the clinician's direct control, Biogistry does not act as a central cloud repository for PHI.
Healthcare providers retain full custody, control, and responsibility for ensuring their local devices, browser sandboxes, and connected external storage systems adhere to physical, administrative, and technical safeguards required under HIPAA, HITECH, GDPR, and local health regulations.
11. Policy Revisions & Contact Information
We may update this Privacy Policy from time to time to reflect platform enhancements or legal changes. The "Effective Date" at the top of this page indicates when the latest revisions took effect.
If you have questions, privacy inquiries, or data protection concerns, please contact our Data Protection Officer at:
Biogistry Privacy & Data Protection Office
Email: hello@biogistry.com
Website: biogistry.com