Privacy Policy

Version 2 · last updated: 28 August 2026

Controller: BASE4 BIOSCIENCES, S.L. (hereinafter, ”BASE4”)

1. Identification of the data controller

BASE4 BIOSCIENCES, S.L., with its registered address at Carrer de Can Campins, number 7, Floor 1, Door 1, Cabrils (08348 Barcelona), tax identification number (NIF) B-24825846, registered with the Barcelona Commercial Registry, is the sole controller of your personal data under this direct-to-consumer sales model, as no partner clinic is involved in the process.

2. Data we process

Identification and contact details (name, email address, telephone number, delivery address where applicable).
Payment details (managed by the Stripe Payments Europe payment gateway; BASE4 does not store full card details).
Health data collected through the clinical questionnaire on the platform.
Genetic and gene expression data derived from the analysis of your blood sample.
Data on use of the digital platform (registration, browsing, questionnaire, appointment booking).

Health and genetic data are special categories of personal data (Article 9 GDPR) and receive an enhanced level of protection.

3. Purposes of processing

To manage the order, payment and blood collection appointment booking.
To perform the analysis purchased and generate the results report.
To explain and review the results through BASE4’s medical team.
If the User gives express and separate authorisation: to develop, train, validate and improve BASE4’s algorithms, models and products using anonymised and aggregated data (optional secondary use).
To comply with applicable legal obligations.

4. Legal basis

Your explicit consent to the processing of health and genetic data (Articles 6(1)(a) and 9(2)(a) GDPR), subject to the additional requirements of Law 14/2007 for genetic analysis.
Performance of the contract for the purchase of the service (Article 6(1)(b) GDPR), for the order, payment and blood collection logistics.
Compliance with legal obligations (Article 6(1)(c) GDPR).

Providing identification, payment and health data is necessary for us to provide the service purchased. If you do not provide this data, BASE4 will be unable to provide the service. You may withdraw your consent at any time; in that case, BASE4 will stop processing your data and will not perform the analysis. The financial consequences of that interruption are governed by the Terms of Use and Purchase.

5. Recipients of the data

The relevant partner blood collection centre, solely in respect of the identification details required to collect the sample, acting as a processor.
Sequencing and analysis laboratories engaged by BASE4, acting as processors.
The Stripe Payments Europe payment gateway used to process payment.
Technology providers supporting the digital platform, acting as processors.
No information is disclosed to third parties for commercial or advertising purposes.

6. Data retention

Biological samples: BASE4 does not store samples. The laboratory destroys them within a maximum of 90 calendar days after completion of the analysis.

Raw sequencing data: retained for 90 days after completion of the analysis.

Identification details, health data and results: retained for as long as your account remains active. Following account closure, they will remain blocked for the legally required limitation periods and will be permanently erased once those periods expire.

Signed consent: retained throughout the processing period and the subsequent limitation periods, as evidence of the lawfulness of the processing.

Payment details: retained as required by tax and commercial legislation.

Anonymised secondary-use data: as they are not identifiable, they do not constitute personal data and are retained indefinitely.

7. International transfers

Your biological sample and the genetic data derived from it are sent to a sequencing laboratory located in the Republic of Korea. The European Commission has declared that the Republic of Korea ensures an adequate level of protection of personal data, by means of an adequacy decision adopted on 17 December 2021 and reconfirmed on 23 July 2026, pursuant to Article 45 GDPR. This transfer therefore requires no additional safeguards, and your data retain a level of protection equivalent to that applicable within the European Economic Area.

The other providers involved in the processing are located in the European Economic Area. If BASE4 were to engage a provider outside the EEA in the future where no adequacy decision applies, the transfer would take place subject to the appropriate safeguards provided for in Articles 46 et seq. GDPR, and this Policy would be updated accordingly.

8. Automated decision-making and profiling

Your sample and questionnaire are analysed using BASE4’s proprietary algorithmic models, which involves automated processing of your data and the creation of a profile of your biological status.

No result is communicated to you by exclusively automated means: all reports are reviewed by BASE4’s medical team before delivery.

You have the right to obtain an explanation of the result, express your point of view and contest the decision by contacting hello@base4bio.com.

9. Your rights

You may exercise your rights of access, rectification, erasure, restriction of processing, objection and data portability, and withdraw your consent at any time without affecting the lawfulness of prior processing, by contacting hello@base4bio.com. You have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

10. Security

BASE4 applies appropriate technical and organisational measures to protect your data, particularly health and genetic data, in accordance with the GDPR and, where applicable, the ISO 27001 certification framework being implemented by BASE4.

11. Changes to this policy

BASE4 may update this Privacy Policy to reflect regulatory or operational changes. Material changes will be notified through the platform.

12. Contact

For any queries about this Privacy Policy or the processing of your data, please contact hello@base4bio.com.

what we do

our test