Privacy at Phenotech

You can use all of Phenotech without an account. Searches and pages are not tied to you, and the DNA sequence and VCF check runs in your browser: your file never leaves your device.

Who is responsible

Phenotech is being set up as a company; its name and address will appear here. Until then the founding team is responsible. Write to us through the form at the end of this page.

If you create an account, we keep

• your email and a scrambled form of your password (scrypt with a random salt; we cannot read it), to run your account;
• who you are (family, patient, group leader, researcher or industry) and the diseases you follow. For families, patients and group leaders the diseases you follow are health information, so we store them only with your explicit agreement, given when you sign up and withdrawn at any time in My atlas;
• if you are a family member, patient or group leader and add one in My atlas: a profile of the person affected for a disease you follow, with the diagnosis, up to 80 symptoms, an age and a sex. It is stored under the same agreement and shows you which studies might fit. Researchers and companies never see a profile. Once verified, they see only anonymous counts of how many families follow a study’s diseases and how many saved profiles fit the study’s published age and sex limits, protected like the counts described below;
• a country if you give one, only for anonymous counts;
• your choices about notifications and contact, with a dated record of each choice and the wording you saw (version 2026-10-16), so we can show what you agreed to and when;
• your saved items, the messages in your inbox, notices waiting for a weekly summary, and which notices we already emailed you.
• if you use the rare asset radar: the drugs and diseases on your watchlist, the new studies and papers found for them, and whether you want them by email. A watchlist is treated as professional interest and never feeds the family features.
• your sign-up itself (email, scrambled password, who you are, the diseases you follow, a country and your choices) from the moment you send the form, before you confirm your email address. Until you confirm it, it cannot be used to sign in and is left out of the anonymous counts and of notification emails; signing up again with the same address replaces it. Nothing deletes an unconfirmed sign-up automatically yet.

Researcher and industry accounts also keep their study announcements and requests to contact families, with the moderator’s decision. To stop abuse, we briefly keep your IP address (one minute) when you sign in or send a form.

What others can see

• Nobody sees your email. We never sell or share your contact details, and there is no advertising or tracking.
• A person checks every researcher and industry account before it can see community numbers, announce studies or ask to contact families. An institutional email address is only a hint, never enough by itself.
• Verified researchers see anonymous counts of families per disease and country: only groups of at least 5, and every number rounded down to a multiple of 5, so no family can be singled out.
• Messages through the atlas reach only members who ticked the matching box: “Academic researchers and clinicians may contact me through the atlas (each message is reviewed first; they never see my email)” or “Companies running studies may contact me through the atlas (each message is reviewed first; they never see my email)”. A moderator approves every message first; the sender must give an ethics approval or study registration; you get at most two such messages a month; and the sender never learns who received it unless you reply.
• Study announcements are reviewed by a person before they reach anyone.

Emails

We email you only after you confirm your address, and only what you ticked: recruiting studies and reviewed study announcements, newly funded research, and messages approved for you. You choose single notices or a weekly summary. Each email says why you are getting it and has a one-click unsubscribe link. Confirmation and password-reset emails are sent only when you ask for them. If someone signs up with an address that already has an account, the page does not say so; we email the owner instead.

Who processes data for us

Our host (Vercel) runs the site, our database provider (Upstash) stores account data, and our email provider (Resend or our own mail server) sends emails. They process data only on our behalf and may store it outside Switzerland and the EU. Choosing data regions and signing data-processing agreements is part of opening accounts to the public.

How long we keep it

Account data stays until you delete the account. Deleting removes your account, what you follow, your consent record, inbox, saved items and notices straight away. Announcements already published stay public without your name. A record of contact requests a moderator reviewed stays without your email, to protect families from misuse.

Your rights

In My atlas you can change or withdraw every choice, download everything we hold about you as one file, and delete your account. You can also ask us to correct something, or complain to a data-protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country.

Contact details we show for groups and studies

On group and study cards we show only contact details that an organisation publishes so that people can reach it: its general phone number and email from its own website, a contact person it names on its own site (with the role, phone and email exactly as published, and a link to that page), and a recruiting study’s central contact from ClinicalTrials.gov. We never show researchers’ personal contact details. If a detail is wrong, or it is about you and you want it removed, tell the organisation or use this form. A person on our team reviews every request. If you leave an email for a reply, we use it only for that.

Report or remove a contact, or write to us

Technical notes

We use one cookie, to keep you signed in (httpOnly, signed, 30 days; resetting your password signs out every other session). Your browser also remembers a few settings on your device, such as the view you chose; they are not sent to us. Like any website, our host’s logs see which pages and data files are requested. Please don’t write medical details in free-text fields.

To see which parts of the site are used, we count page views and a few actions (searches, downloads, watchlist additions) per day and per site section, such as “disease pages” or “radar”. A count is just a number: no cookie, no identifier, no IP address, no page address beyond its section (never a disease) and no search text. If your browser sends Do Not Track or Global Privacy Control, nothing is counted.

The 3D protein models come from AlphaFold DB at EMBL-EBI. A model loads only after you press “Show the 3D model”, or straight away if you ticked “Load 3D models straight away” (a setting kept in your browser). Your browser then requests that protein’s model file from EMBL-EBI’s server, which sees your IP address and the protein, as any website would. Nothing else is sent.