Humankind Privacy Policy

1. Introduction

This Privacy Policy explains how Humankind Bio, Inc., a Delaware Public Benefit Corporation ("Humankind," "we," "us," or "our"), collects, uses, shares, and protects your information when you use our website, platform, and services (collectively, the "Service").

Humankind exists to advance human understanding through the collective analysis of genomic and phenotypic data. Our corporate charter includes a binding legal commitment: identifiable individual data remains under individual control and is not sold or licensed for commercial use.

This is not a policy we chose. It is a constraint we built into our legal structure.

Geographic scope. Humankind currently offers its Service only to residents of the United States. This Privacy Policy applies to US residents who are customers of the Service and to visitors of our website. If you visit our marketing site from outside the United States, we may collect basic browsing information for analytics purposes (as described in Section 2.2), and you may choose to provide us with your email address by joining our waitlist (as described in Section 2.3), but we do not collect or process genetic data from non-US users.

By using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, do not use the Service.

2. Information We Collect

2.1 Information You Provide

Account Information

When you create an account, we collect:

• Name
• Email address
• Password (stored in encrypted form)
• Payment information (processed by third-party payment providers; we do not store full payment card details)
• US residency confirmation and billing address

Genetic Data

When you use the Service, you may provide genetic data by:

• Uploading a DNA data file from another provider (such as AncestryDNA, 23andMe, or similar services)
• Ordering a sample kit and providing a biological sample, which is processed by our accredited laboratory partner to generate genomic data

Your genetic data includes raw genotype data (SNPs and other genetic variants) and any analysis or insights derived from that data.

Phenotypic Data

You may optionally provide information about your traits, lifestyle, and outcomes ("phenotypic data") to enhance your insights and contribute to cluster intelligence. This may include:

• Self-reported traits and characteristics
• Lifestyle and wellness information
• Responses to surveys or questionnaires
• Outcomes you choose to share

Communications

When you contact us, we collect the content of your messages and any information you choose to provide.

2.2 Information Collected Automatically

Usage Data

When you access the Service, we automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and features used
• Date and time of access
• Referring website or source

Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep you logged in
• Remember your preferences
• Understand how you use the Service
• Improve the Service

You can control cookies through your browser settings. Disabling cookies may limit your ability to use certain features of the Service.

2.3 Waitlist Information

If you join our international waitlist, we collect:

• Your email address
• Your country or region of residence
• Optionally, information about your interest in the Service

We use waitlist information only to notify you when the Service becomes available in your region and to understand which international markets may be of interest for future expansion. We do not use waitlist information for any other purpose, do not share it with third parties (except service providers who help us send waitlist communications), and will delete it at your request at any time.

3. How We Use Your Information

3.1 Genetic Data

We use your genetic data solely to:

• Generate your Human Operating Guide — Analyze patterns in your genetic architecture and provide personalized insights into behavioural, physical, sensory, and lifestyle tendencies.
• Power cluster insights — Contribute to aggregated analyses that reveal what works for people with similar genetic architecture, in a form where individuals are not reasonably identifiable.
• Improve the Service — Develop better analytical methods and enhance the accuracy of insights.

We do not use your identifiable genetic data for:

• Advertising or marketing purposes
• Sale or licensing to third parties
• Sharing with insurers, employers, or law enforcement (except as required by law)

3.2 Account and Usage Information

We use your account and usage information to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Verify your US residency and billing information
• Send administrative messages (account verification, security alerts, policy updates)
• Respond to your inquiries and provide support
• Analyze usage patterns to improve the Service
• Protect against fraud and unauthorized access

3.3 Communications

With your consent, we may send you:

• Updates about new features or services
• Research findings and insights relevant to your genetic architecture
• Community updates and cluster news

You can opt out of marketing communications at any time by clicking "unsubscribe" in any email or contacting us at privacy@humans.inc.

4. How We Share Your Information

4.1 What We Never Do

We do not sell your data. This prohibition on the sale or licensing of identifiable individual data for commercial use is embedded in our corporate charter as a Public Benefit Corporation. It is legally binding and survives any change in ownership or leadership.

Specifically, we will never:

• Sell your identifiable genetic data to any third party
• License your identifiable genetic data for commercial use
• Sell, license, or commercially distribute aggregated or de-identified genetic datasets
• Share your genetic data with insurers or employers
• Provide your genetic data to data brokers or advertisers

4.2 Aggregated and De-Identified Data

We may use aggregated, de-identified data — in a form where individuals are not reasonably identifiable — to:

• Improve the Service and develop new features
• Improve our understanding of genetic architecture across populations
• Publish aggregate findings in scientific or research contexts, only where individuals are not reasonably identifiable

We do not sell, license, or commercially distribute aggregated or de-identified genetic datasets. We use industry-standard de-identification practices. We require any party with whom we share de-identified data to agree contractually not to attempt to re-identify individuals.

4.3 Service Providers

We share information with third-party service providers who help us operate the Service, including:

• Accredited laboratory partner
• Cloud hosting providers
• Payment processors
• Email service providers
• Analytics providers

These providers are contractually obligated to use your information only to provide services to us and to protect your information consistent with this Privacy Policy. A current named list of subprocessors is available on request to privacy@humans.inc.

Laboratory partner specifically. Our accredited laboratory partner processes your biological sample to generate your genetic data. The laboratory may use de-identified data from samples they process only for internal quality assurance and method improvement, as is standard for accredited laboratories. They are contractually prohibited from selling, licensing, commercially distributing, or using your sample-derived data for unrelated research, product development, third-party data products, or any commercial purpose beyond the services they provide to Humankind.

4.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process, such as:

• A court order or subpoena
• A request from law enforcement with appropriate legal authority
• To protect the rights, property, or safety of Humankind, our users, or others

If we receive a legal demand for genetic data, we will:

• Notify you before disclosure unless legally prohibited from doing so
• Challenge overly broad or inappropriate requests where feasible
• Disclose only the minimum information required

4.5 Business Transfers

If Humankind is involved in a merger, acquisition, or sale of assets:

• Any acquiring entity must assume the data protection obligations in our corporate charter
• You will be notified before your information is transferred
• You will have the opportunity to request deletion of your data before any transfer

5. Your Rights and Choices

5.1 Access Your Data

You can access your genetic data and Human Operating Guide through your account at any time.

5.2 Correct Your Data

You can update your account information and phenotypic data through your account settings. If you believe your genetic data contains errors, contact us at support@humans.inc.

5.3 Delete Your Data

You can request permanent deletion of your genetic data at any time by contacting us at privacy@humans.inc. We will honor deletion requests within 30 days.

Upon deletion:

• Your genetic data will be permanently removed from our active systems
• Your Human Operating Guide will no longer be accessible
• Your contributions to previously generated aggregated analyses cannot be individually removed, because those analyses do not identify you and are not linked back to your account
• Backup copies will be purged according to our retention schedule (no longer than 90 days after deletion from active systems)

5.4 Sample Destruction

If you provided a biological sample through our sample kit, our accredited laboratory partner processes the sample to generate your genetic data. Samples are stored, destroyed, or returned according to the laboratory partner's policies and applicable law. Where legally available, you may request destruction of your biological sample by contacting us at privacy@humans.inc. For California residents, sample destruction is available within 30 days of consent revocation in accordance with the California Genetic Information Privacy Act.

5.5 Download Your Data

You can request a copy of your genetic data in a standard format by contacting us at privacy@humans.inc.

5.6 Restrict Processing

You can request that we stop processing your genetic data for cluster insights while retaining your Human Operating Guide. Contact us at privacy@humans.inc.

5.7 Withdraw Consent

Where we rely on your consent to process information, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Data Security

We implement technical and organizational measures to protect your information, including:

• Encryption of genetic data at rest and in transit
• Access controls limiting who can access genetic data
• Regular security assessments and monitoring
• Employee training on data protection

No system is perfectly secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. If we become aware of a security breach affecting your genetic data, we will notify you as required by law.

7. Data Retention

We retain your information as follows:

After you request deletion of your genetic data, backup copies are purged within 90 days.

8. Data Location

Humankind is based in the United States. All genetic data, account information, and customer data are stored and processed in the United States by Humankind and our US-based service providers. We do not transfer customer genetic data outside the United States.

9. Children's Privacy

The Service is not intended for anyone under 18 years of age. We do not knowingly collect genetic data or personal information from children under 18. The Service is not directed to or intended for children. We comply with the Children's Online Privacy Protection Act (COPPA) and applicable US state laws regarding minors' privacy.

If you believe we have collected information from a child under 18, contact us immediately at privacy@humans.inc and we will delete that information.

10. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services (such as DNA testing providers). This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before providing them with your information.

11. Updates to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:

• Email to the address associated with your account
• Prominent notice on the Service

The "Last Updated" date at the top of this policy indicates when it was most recently revised. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. State Privacy Rights

12.1 California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Genetic Information Privacy Act (GIPA):

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected, the sources of that information, our purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. Our corporate charter prohibits the sale or licensing of identifiable individual data for commercial use.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Genetic Data Specific Protections: Under California GIPA, we provide additional protections for genetic data including specific consent requirements, the right to revoke consent and have your biological sample destroyed within 30 days, and limitations on disclosure.

12.2 Other State Genetic Privacy and Comprehensive Privacy Rights

Residents of US states with applicable genetic privacy or comprehensive privacy laws have rights under their respective state laws. These rights generally include access to your personal information, correction of inaccurate information, deletion of your personal information, portability of your data, and opt-out from certain processing activities.

These rights are available, where applicable, to residents of California, Montana, Texas, Virginia, Utah, Tennessee, Arizona, Kentucky, Maryland, Wyoming, and other states with relevant privacy or genetic privacy laws. We honor all such rights to the extent required by applicable law.

To exercise any of these rights, contact us at privacy@humans.inc. We will respond within the timeframe required by the applicable state law.

13. International Visitors

Humankind currently offers its Service only to US residents. If you are located in the European Economic Area, United Kingdom, Switzerland, Australia, Canada, or other regions outside the United States, you may visit our marketing site and join our waitlist, but we do not provide the Service to you and do not process your genetic or sensitive personal data.

International visitors must not upload genetic data, purchase the Service, or use another person's US address or identity to access the Service.

Browsing data (such as IP address) collected when you visit our marketing site is handled as described in Section 2.2. Waitlist data is handled as described in Section 2.3.

If you have questions about your data, contact privacy@humans.inc.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Humankind Bio, Inc.
535 Mission Street, 14th floor
San Francisco, CA 94105
United States

Email: privacy@humans.inc

For general support: support@humans.inc
For legal inquiries: legal@humans.inc