Privacy policy

1. Who we are

HELICAL BIO LTD, a company incorporated in England and Wales with company number 17274734 whose registered office is at Room 4.02, 52 Tabernacle Street, London EC2A 4NJ, United Kingdom ("Helical", "we", "us"), is the controller of the personal data described in this policy. Helical Bio Ltd is a subsidiary of Helical S.à r.l., a company incorporated in Luxembourg ("Helical Luxembourg"), which operates the corporate website at helical.bio under its own privacy notice and acts as our representative in the European Union under Article 27 of the EU General Data Protection Regulation. Because we offer our services to users in the United Kingdom and in the European Union, both the UK GDPR and the EU GDPR apply to the processing described in this policy. Questions and requests concerning personal data should be addressed to privacy@helical.bio, or to Helical Luxembourg at 9, rue du Laboratoire, L-1911 Luxembourg, which will forward them to us.

2. Scope of this policy

This policy applies to personal data which we process as controller in connection with the Helical MCP platform: personal data relating to individuals who register for or use accounts, including through the console and the MCP Server, to our business contacts, and to recipients of our product communications. It does not cover the corporate website at helical.bio, which is operated by Helical Luxembourg under its own privacy notice.

Where personal data is contained in datasets submitted to our services by a customer, we process that data as a processor on the customer's behalf and the customer's own privacy notice applies to it. We process such data only on the customer's instructions and only as necessary to perform the analyses requested.

You may reach our services through a third-party AI assistant, such as ChatGPT or Claude. The conversation you have with that assistant is held by its provider under its own terms; we receive only the requests the assistant makes on your behalf and return the results to it. We do not receive your wider conversation history, and those providers do not act as our service providers.

3. Personal data we collect

• Identity and contact data: name, work email address (which must be verified before you can use the services). Additional data, such as your telephone number and role or organisation, may be collected depending on the service you subscribe to. We use your telephone number for account support and, where enabled, for multi-factor authentication.
• Identity information from your organisation: where your organisation uses single sign-on, we may receive your name and email from its directory each time you sign in.
• Account and authentication data: a unique account identifier, hashed credentials (held by our authentication provider and never visible to us), email-verification status, account preferences, and the dates your account was created, last updated and last active.
• Transaction data: payments are processed by Stripe on a Stripe-hosted payment page. Stripe collects your card details, cardholder name, the billing or tax address needed to calculate applicable tax and your receipt email address; we never receive or store your card number, expiry date or security code. We keep a record of each purchase and each charge (the amount, the currency, what it was spent on and a reference to the corresponding Stripe payment) so that every charge on your account remains explainable.
• Technical and usage data: IP address, the user-agent string sent by your browser or client, the type of AI client used to connect, logs of requests and tool invocations made against your account, and diagnostic records such as error details and performance traces.
• Correspondence: support requests and other communications with us.
• Feedback data: feedback, ratings, corrections or annotations you provide, including through our in-product feedback form, together with your name, email address, the page you were viewing and any screenshots you attach.
• Marketing preferences.

4. Purposes and lawful bases

We do not use personal data to make automated decisions which produce legal or similarly significant effects concerning an individual.

5. Sharing

We share personal data with:

• service providers acting as processors on our behalf, including Amazon Web Services (hosting, storage, authentication, email delivery and AI model inference), Stripe (payments), Slack (delivery of product feedback) and providers of communications and customer-relationship tools;
• Helical Luxembourg, which provides management and engineering services to us and processes personal data only on our instructions;
• our professional advisers;
• competent authorities where disclosure is required by law; and
• an actual or prospective purchaser or investor, under obligations of confidentiality, in connection with a corporate transaction.

Some features query public scientific databases, including CELLxGENE, Open Targets, Europe PMC and CrossRef, to return results to you. These queries are made from our systems; technical data associated with your request, such as query content and timing, may be transmitted to these providers in order to retrieve results, but we do not share your name, contact details or account credentials with them. We do not sell personal data.

6. International transfers

Personal data collected through our services may be transferred to, stored in and processed in countries outside the United Kingdom and the European Economic Area. In particular we use Amazon Web Services (AWS) to process your account information, billing records and logs. AWS stores and processes this data in the United States.

Wherever we transfer personal data internationally, we ensure that appropriate safeguards are in place:

• Adequacy decisions: transfers between the United Kingdom and the European Economic Area (including transfers to and from Helical Luxembourg) are covered by mutual adequacy – the UK adequacy regulations recognise the EEA, and the European Commission's adequacy decision recognises the United Kingdom. For transfers to recipients in the United States who are certified under the EU-US Data Privacy Framework, we rely on the European Commission’s adequacy decision for that framework and its UK Extension.
• Contractual safeguards: where no adequacy decision applies, we put in place one of the following, as appropriate to the transfer: the UK International Data Transfer Agreement; the UK Addendum to the EU Standard Contractual Clauses; or the EU Standard Contractual Clauses (for transfers from the EEA).
• In any other case: we ensure that an appropriate safeguard permitted by applicable data protection law is in place before the transfer takes place.

If you have questions about international transfers, please contact us at privacy@helical.bio.

7. Retention

Retention depends on the type of record, its sensitivity, the purpose for which it is held, any legal, regulatory, accounting or contractual obligation that applies, and any agreement between us and your organization.

We have a zero data retention policy on customer prompts or any other customer content provided through the third-party service from the customer to us. Retention only applies to the following operational, security or personal data required for the operation of our service:

• Operational and diagnostic logs: retained for 30 to 90 days.
• Security, access and audit logs: retained for 12 months, as metadata without the content of datasets, prompts or results.
• Account information: retained for as long as your account is active; accounts inactive for 12 months may be disabled; account information is deleted or anonymised within 60 days after closure.
• Billing records: retained for six years after the relevant tax year, as required by tax law.
• Marketing preferences: retained until you opt out and for a maximum of six years after our last interaction.
• Feedback data: retained for as long as it is useful for improving the services and for a maximum of six years, without the content of your datasets or results.

We may retain records for longer where required by law or where necessary to establish, exercise or defend legal claims. Your personal data will not be held for this purpose for longer than six years

8. Security

We maintain appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, encrypted backups, access limited to personnel with an operational need, multi-factor authentication for our staff, and access logging and monitoring. Suspected compromise of an account or of personal data should be reported to privacy@helical.bio without delay.

9. Your rights

Under applicable data protection law, you have the following rights in relation to your personal data:

• Right of access: you may request confirmation of whether we process your personal data and, if so, a copy of that data together with information about how and why it is processed.
• Right to rectification: you may ask us to correct inaccurate personal data or to complete incomplete personal data.
• Right to erasure: you may ask us to delete your personal data where, for example, it is no longer necessary for the purpose for which it was collected, you withdraw consent on which the processing is based, or the data has been unlawfully processed.
• Right to restriction: you may ask us to restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have challenged.
• Right to object: you may object to processing carried out on the basis of our legitimate interests, and we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests. You have an absolute right to object to direct marketing at any time.
• Right to data portability: where processing is based on your consent or on a contract with you and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used and machine-readable format, or that we transmit it directly to another controller where technically feasible.
• Right to withdraw consent: where we rely on your consent as the lawful basis for processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it takes effect.
• Right to complain: you have the right to lodge a complaint with a supervisory authority. If you are in the United Kingdom, you may complain to the Information Commissioner’s Office (ico.org.uk). If you are in the European Union, you may complain to the supervisory authority of the member state in which you reside or work, including the Commission nationale pour la protection des données in Luxembourg (cnpd.lu). You also have the right to complain to us directly and we would welcome the opportunity to address your concerns before you approach a supervisory authority, so please contact us at privacy@helical.bio in the first instance.

To exercise any of these rights, please contact us at privacy@helical.bio. We will respond to your request within one month, or notify you if we require an extension of up to two further months.

10. Cookies

We use cookies and similar technologies in the following categories:

• Strictly necessary: required to sign you in, keep you signed in and route your requests to our services; set by us and by our infrastructure provider (Amazon Web Services). These cannot be turned off.
• Functional: remember preferences such as your most recently selected project.

The console uses no analytics or advertising cookies. Cookies used on the corporate website at helical.bio are described in Helical Luxembourg's website privacy notice.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or through the console. The version and date of this policy appear at its head.

12. Contact

HELICAL BIO LTD, Room 4.02, 52 Tabernacle Street, London EC2A 4NJ, United Kingdom (registered office). Email: privacy@helical.bio.