Helix app
App Privacy Policy
Last updated: 5 August 2026 · Version 2026-08-05
In short: Helix uses the information needed to provide personalised wellness features. Health and biomarker data is processed only with explicit consent. Personal data is not sold or used for third-party advertising.
Scope of the current release: This Policy describes the Helix service as a whole. Some features described here, including subscriptions and connections to external health platforms or devices, are not available in the currently released application. The related data described in this Policy is not collected until those features are released.
1. Data controller
The data controller is Helix AI Algorithm S.L., with registered office at Plaça de Pau Vila 1, Palau de Mar, Pier 01, Office 2B, 08039 Barcelona, Spain, registered with the Barcelona Mercantile Registry in Section 8, Sheet B-640445, Entry 1.
Privacy contact: info@helixai.life. Full company information is available in the Legal Notice.
2. Scope
This Policy applies to the Helix mobile application and the account-based services made available through it. The public website and early-access waitlist are covered by the separate Website Privacy Policy.
3. Information processed by the app
- Account and contact data: name, email address, authentication identifiers, account status, and security information.
- Profile and lifestyle data: age, sex assigned at birth, height, weight, goals, and answers about nutrition, sleep, activity, recovery, and other lifestyle factors.
- Health and biomarker data: laboratory reports and values, physiological markers, wellness observations, generated scores, and recommendations.
- AI chat content: questions, messages, and contextual information submitted to the wellness assistant, which may contain health information.
- Files and metadata: documents or images selected for upload, file name, format, size, processing status, and extraction results.
- Technical data: IP address, device and app identifiers, device model, operating system, language, app version, security events, crash information, and diagnostic logs.
- Connected-service data: only when an integration is offered and you choose to connect it, the categories you authorise from a health platform or device.
- Communications: support requests, feedback, consent records, and communication preferences.
- Transaction data: subscription status, product identifier, and purchase-validation information when paid features are offered. Helix does not receive complete payment-card details from app stores.
4. Sources of information
Information comes directly from you, from your use of the app, from services you explicitly connect, and from authentication or app-store providers involved in sign-in, downloads, and purchases.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, authenticate access, and provide requested app functions. | Performance of the service agreement (Article 6(1)(b) GDPR). |
| Process health, biomarker, connected-service, and health-related chat data to provide personalised wellness analysis. | Your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR). |
| Provide support and respond to requests. | Performance of the service agreement and legitimate interests (Articles 6(1)(b) and 6(1)(f) GDPR). |
| Operate, secure, troubleshoot, prevent fraud, and improve reliability. | Legitimate interests in a safe and reliable service (Article 6(1)(f) GDPR). |
| Send optional product news or marketing. | Your consent (Article 6(1)(a) GDPR). |
| Manage purchases and comply with accounting, legal, or regulatory requirements. | Performance of the service agreement and legal obligations (Articles 6(1)(b) and 6(1)(c) GDPR). |
6. Health data and consent
Health data is a special category of personal data. Helix requests explicit consent separately before processing it. Consent may be withdrawn at any time through the available privacy controls or by contacting Helix. Withdrawal does not affect earlier lawful processing, but personalised features that depend on health data may stop working.
Do not upload another person's health information unless you are legally authorised to do so and the app expressly supports that use.
7. Artificial intelligence
Helix uses artificial-intelligence and machine-learning services, including Google Cloud Vertex AI, to extract information from submitted material and generate personalised wellness explanations, recommendations, and chat responses. Relevant profile, health, and message content may be sent to these services to produce the requested result.
Primary AI processing is configured in European Google Cloud infrastructure. Direct identifiers are minimised where feasible, access is restricted, and data submitted through Helix is not authorised for use to train third-party general-purpose models. Google Cloud acts under contractual data-processing obligations.
This processing may constitute profiling, but Helix does not use it to make solely automated decisions that produce legal or similarly significant effects. AI output can be incomplete or incorrect and is provided for wellness information, not medical diagnosis or treatment.
8. Device permissions
Depending on the features you use, the app may request permission to select files or photos, use the camera for a document capture, send notifications, or access categories from a connected health service. Permissions are requested when needed and can be changed in device settings. Withholding a permission only affects the functions that require it.
9. Recipients and service providers
Information may be accessed by authorised Helix personnel and processors that provide cloud hosting, storage, AI infrastructure, authentication, security, diagnostics, support, communications, and subscription management. Current core infrastructure includes Google Cloud. Apple and Google may process sign-in or app-store transaction information as independent controllers under their own policies.
Information may also be disclosed to professional advisers subject to confidentiality or to public authorities when required by law. Personal data is not sold or shared for third-party advertising.
10. International transfers
Primary app infrastructure is configured in the European Economic Area. If a provider makes support or ancillary processing available from another country, Helix relies on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required.
11. Retention
| Category | Typical retention |
|---|---|
| Account, profile, health, biomarker, and generated wellness data | While the account is active; active account data is deleted or irreversibly anonymised within 30 days after account deletion unless lawful retention is required. Residual copies may remain in access-restricted recovery backups for up to 90 days and are then removed through the normal backup-rotation cycle. |
| AI chat content | While available in the account or until deleted by the user. The account-deletion and recovery-backup periods above apply when the account is deleted. |
| Transaction and accounting records | Up to six years or the period required by applicable law. |
| Technical and security logs | Up to 24 months, or longer when necessary to investigate an incident or establish legal claims. |
| Consent records | For the duration of the processing and applicable limitation periods. |
12. Security
Helix applies measures appropriate to the risks of health-data processing, including encrypted transmission, access controls, least-privilege administration, logging, backups, separation of environments, and incident-response procedures. No system can be guaranteed completely secure.
13. Your choices and rights
Subject to applicable law, you may request access, correction, deletion, restriction, objection, or portability; withdraw consent; and manage optional communications and connected permissions. Instructions are available at App Privacy Choices.
Requests can be sent to info@helixai.life. Helix may request proportionate information to verify identity and normally responds within one month. You may also complain to the Spanish Data Protection Agency or the authority where you live or work.
14. Account deletion
You may start account deletion in the Helix app by opening the Profile area and using the account deletion control. If you cannot access your account, you may instead use the external process at Delete a Helix Account. Deleting an account also initiates deletion of associated personal data, subject to narrowly limited legal, fraud-prevention, security, and backup-retention exceptions described on that page.
15. Children
The app is intended for people aged 18 or over. Helix does not knowingly create accounts for children. If information from a child has been submitted, contact info@helixai.life so it can be investigated and removed.
16. Wellness, not medical care
Helix provides wellness, prevention, and educational information. It does not diagnose or treat disease, provide emergency services, or replace a qualified healthcare professional. Seek professional medical advice before making health decisions and contact local emergency services for urgent concerns.
17. Changes
This Policy may be updated when the app, providers, or legal requirements change. Material changes will be communicated through an appropriate channel, and renewed consent will be requested where required. The current version and update date will remain available at this URL.
18. Contact
Helix AI Algorithm S.L.
Plaça de Pau Vila 1, Palau de Mar, Pier 01, Office 2B
08039 Barcelona, Spain
info@helixai.life