Privacy Policy · Episanare

Important Notices

Please read carefully. This Privacy Policy contains important information about how Episanare collects, uses, protects, and shares your personal information — including your genetic and epigenetic data.

Not medical advice. Episanare is a wellness company. Our products, services, and reports are for educational and wellness optimization purposes only.

FDA disclaimer. Episanare's products and services have not been evaluated by the U.S. Food and Drug Administration. They are not intended to diagnose, treat, cure, or prevent any disease.

Genetic data. Episanare collects and analyzes epigenetic data derived from your biological sample — among the most sensitive personal information that exists. Please read Sections 3 and 7 carefully before submitting a sample.

1. Who We Are

Episanare Inc. ("Episanare," "we," "us," or "our") is a Delaware corporation with its principal place of business in the United States. We provide epigenetic wellness and longevity services, including DNA methylation analysis, biological age estimation, and personalized health protocol generation. We are the data controller for the personal information you provide to us.

Privacy Office: privacy@episanare.com · episanare.com/privacy

2. Information We Collect

2.1 Information You Provide Directly

Account information: name, email, date of birth, billing address, password.
Health and wellness information: self-reported lifestyle data (diet, exercise, sleep, stress, supplements).
Payment information processed through our PCI-DSS-compliant processor. We do not store full card numbers.
Communications: emails, support tickets, survey responses.
Optional Data Contribution Program data (see Section 8).

2.2 Biological Sample and Epigenetic Data

When you order a kit, you provide a saliva sample analyzed by our CLIA-certified laboratory partner. This generates raw DNA methylation values across ~850,000 CpG sites, derived biological age and pace-of-aging scores, and your Episanare Report. Your underlying genome sequence is not decoded or stored unless you specifically order an Elite-tier service that includes it.

2.3 Information Collected Automatically

Device and browser information; usage data; IP address (city/state level).
Cookies and similar tracking technologies (see Section 5).
Wearable data you authorize through Apple Health, WHOOP, Oura, etc.

2.4 Information from Third Parties

Payment processors, identity verification services, and authorized wearable / health app integrations.

3. How We Use Your Information

To provide our services (process orders, analyze samples, generate your Report and protocol, run your account, deliver coaching, process payments); to improve our services using aggregated, anonymized data only; for transactional and (with consent) marketing communications; and to meet legal and safety obligations.

We never use your individual identifiable data to train our algorithms without your explicit, separate consent.

4. How We Will Never Use Your Information

We will never sell your genetic or epigenetic data.
We will never share identifiable genetic data with health or life insurers, employers, or any entity that could use it for discriminatory purposes.
We will never disclose your data to law enforcement except under a valid, specific legal order, and we will notify you where permitted.
We will never use your data for behavioral advertising or third-party ad networks.

5. Cookies and Tracking

We use strictly necessary, performance, and functional cookies, manageable through our consent tool. We honor Do Not Track signals. We do not use marketing cookies on health or genetic data.

6. How We Share Your Information

We share only with vetted service providers (CLIA labs, cloud infrastructure under BAAs where applicable, payment processors, support and email platforms) under strict contractual obligations. In a business transfer we will notify you at least 30 days in advance and treat genetic data as a restricted asset requiring your explicit consent for any change in use. Legal disclosures are reviewed for validity and limited to the minimum required.

7. Special Protections for Genetic and Epigenetic Data

AES-256 encryption at rest; TLS 1.3 in transit.
Sample barcoding: your sample is linked by barcode, not your name, throughout lab processing.
Role-based access controls and full audit logging.
Physical samples destroyed 60 days after analysis per CLIA regulations.
Digital data deleted within 30 days of account closure, except where law requires retention.
We comply with GINA and will resist any request to share data for discriminatory purposes.

8. Data Contribution Program

An entirely optional program. Your core Episanare service is not contingent on participation. Contributed data is de-identified using HIPAA Safe Harbor or Expert Determination methods before research use. You may withdraw at any time.

9. Your Privacy Rights

You have the right to know, access, correct, delete, opt out of sale (we do not sell), and non-discrimination. California (CCPA/CPRA) and other state residents (VA, CO, CT, TX, MT, OR, etc.) have additional rights. EEA users may request GDPR-compliant handling. Email privacy@episanare.com — we respond to verified requests within 45 days.

10. Security

AES-256 at rest, TLS 1.3 in transit, SOC 2 Type II infrastructure, MFA for all employee access, annual third-party penetration testing, and 72-hour breach notification.

11. Children's Privacy

Our services are intended for adults 18+. We do not knowingly collect information from minors.

12. Changes to This Policy

We will notify you by email at least 30 days before material changes take effect. Changes to genetic-data use require your explicit consent before applying to your data.

13. Contact

Privacy Office, Episanare Inc. — privacy@episanare.com · episanare.com/privacy