Privacy Policy
OncoGenix AI — cancer genomics learning, analysis and AI research assistants.
Last updated: 16 September 2026
This policy explains what personal information OncoGenix AI collects when you use our website and platform, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. Please read it before creating an account. By using the platform you agree to the practices described here.
Contents
Who we are
OncoGenix AI is operated by Hrishikesh Jadhav, an independent developer trading under the registered trademark OncoGenix AI, with a principal place of business in Maharashtra, India. For the purposes of data protection law we are the data controller: we decide what personal information is collected and what it is used for.
You can reach the person responsible for privacy at oncosupport@oncogenixai.com. We answer privacy requests personally, usually within a few working days.
The platform is a research and education tool. It is not a medical device, is not certified for clinical use, and must not be used to make a diagnosis or treatment decision for any patient.
Quick summary
- We collect the minimum needed to run an account: your email address, the display name you choose, and the work you save on the platform.
- We do not sell your personal information, and we do not share it for advertising.
- We do not use advertising, social-media or cross-site tracking cookies. Only the technically necessary storage that keeps you signed in is used.
- We never see or store your full card number. Card payments are handled by our payment provider as merchant of record.
- You can ask us at any time for a copy of your data, a correction, or deletion of your account and everything in it.
What information we collect
The categories below are the complete set. Nothing outside them is collected deliberately.
1. Account information
- Email address — required, and used as your login and the address we contact you on.
- Password — stored only as a salted cryptographic hash. No one at OncoGenix AI can read your password.
- Display name — optional, chosen by you, shown in the interface.
- Sign-in method — whether you use email and password or Google sign-in, plus the email confirmation and password-reset records needed to secure the account.
- Role and permissions — the access level granted to your account (for example basic user, moderator or admin) and the individual permissions attached to it.
2. Information from Google sign-in
If you choose “Continue with Google”, Google shares your name, email address and profile photo with us, subject to the consent screen you see at that moment. We use these to create and recognise your account. We do not ask for or receive access to your Gmail messages, Drive files or contacts.
3. Work you create and save
- Notes you write on gene and mutation pages.
- Analysis runs, saved cohorts, filters, and results you generate in the workspace.
- Pipelines, executions, validations and reports you create in the pipeline and agent tools, together with the prompts and answers exchanged with the AI assistants.
This content is readable only by you. It is never shared between accounts, published, or shown to other users unless you share it yourself.
Please do not upload patient-identifiable information. The platform is not designed to hold personal data about patients or research subjects. If you paste identifiable material, we will treat it as your content under this policy, but we ask you not to do it.
4. Billing and subscription information
- Which plan you hold, its price, its status and its billing period.
- Payment records we need to match money to a plan: order identifier, amount, currency, the payment method used, the transaction reference you give us when you pay by UPI, and the status and timestamps of each request.
- For card payments, the subscription and customer identifiers our payment provider gives us. Card numbers, expiry dates and security codes are held by the payment provider, never by us.
- Free-trial and demo-access records showing when access was granted and for how long.
5. Usage and security records
- Plan allowance counters — how many AI questions you have used this month and in which assistant, so we can apply the limits of your plan.
- Audit trail — a record of administrative and sensitive actions (who did what, and when), so misuse can be investigated.
- Operational logs — job runs, ingestion counts, errors and system health, used to keep the platform working and to fix faults.
- Standard server requests — as with any website, our hosting provider records request metadata such as IP address, browser and device type, pages requested and timestamps. We use this for security, abuse prevention and reliability, not to build a profile about you.
6. Support and email records
Messages you send us, the replies we send, and the delivery records of emails we send you (recipient address, which email, when it was sent, whether it was delivered, bounced, or marked as a complaint, and whether you unsubscribed).
7. What we do not collect
We do not collect payment card details, government identity documents, precise geolocation, health data about you, or information from other websites about your browsing. We do not run advertising networks and we do not buy personal data from third parties.
How we collect information
- Directly from you — when you sign up, save a note, run an analysis, subscribe, or write to support.
- Automatically — as you use the platform, the systems that run it record usage counters, audit entries and request metadata.
- From Google — your name, email and profile photo, when you use Google sign-in.
- From our payment provider — notifications that a payment succeeded, failed, was refunded or a subscription changed.
The scientific data displayed by the platform — cancer mutation and occurrence records, clinical variant classifications, gene annotation and publication records — is ingested from public sources (COSMIC, ClinVar, public gene references and PubMed). That is published research data, not personal information about you.
Why we use your information, and our legal basis
We only use personal information for the purposes below. “Legal basis” uses the language of the EU/UK data-protection rules; for users in India the equivalent grounds are consent, reasonable purpose and legal requirement, and we apply the stricter of the two.
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and secure your account | Email, password hash, display name, sign-in method, Google profile | Contract; consent |
| Give you the access your plan includes | Role, permissions, plan and subscription records, AI usage counters | Contract; legitimate interests |
| Take payment and issue access | Order and subscription records, payment references, provider identifiers | Contract; legal obligation (tax, invoicing) |
| Send receipts, reset links and service notices | Email address, email delivery records | Contract; legitimate interests |
| Keep the platform safe and investigate abuse | Audit trail, server request metadata, operational logs | Legitimate interests (security); legal obligation |
| Fix faults and improve the tools | Operational logs, error reports, aggregated usage counters | Legitimate interests |
| Answer support requests | Support messages, account and billing records | Contract; legitimate interests |
| Send optional product news | Email address, subscription preference | Consent, which you can withdraw at any time |
We do not make decisions about you by fully automated means that have a legal or similarly significant effect. Plan allowance limits are applied mechanically, and a human can review and override them if you ask.
International transfers
Our infrastructure and some of the services listed above operate outside India, including in the United States and Europe. If your personal information is transferred out of your country, we rely on service providers that publish their own security and data-processing commitments, and, where the law requires it, on standard contractual safeguards offered by the provider.
Where we rely on your consent for a transfer, we tell you first and you may ask us to stop it.
How long we keep your information
| Information | How long we keep it |
|---|---|
| Account details (email, display name, role) | For as long as your account exists, then deleted within 30 days of a deletion request |
| Notes, saved analyses, pipelines and AI conversations | Until you delete them or close your account |
| AI usage counters | Rolling monthly counters, kept while your account is open to reconcile limits and disputes |
| Audit trail of sensitive actions | Up to 24 months, then removed, so misuse can be investigated |
| Billing and order records | As long as required by Indian tax and accounting law (generally 8 years), even after account closure |
| Support messages | Up to 24 months from the last reply |
| Server request logs | Short-lived operational logs, typically a few weeks |
| Email delivery records | Up to 24 months, and unsubscribe records for as long as needed to keep you off lists |
When information is no longer needed for any of these purposes it is deleted or anonymised so it can no longer be linked to you.
How we protect your information
- Access to your data is controlled per area and per action; your notes and saved work are readable only by you.
- Passwords are salted and hashed; they are never stored or transmitted in plain text.
- Connections to the platform and its services are encrypted in transit (HTTPS).
- Administrative actions are recorded in an audit trail that you cannot edit or delete.
- Payment card data is held by the payment provider, not by us.
- Access to production systems is limited to the minimum necessary and reviewed.
No system is completely secure. If a personal-data breach occurs that affects you and the law requires us to tell you, we will notify you and the relevant authority without undue delay and, where required, within 72 hours of becoming aware of it.
Your rights and choices
You can ask us at any time to:
- Access — confirm whether we hold your data and receive a copy of it.
- Correct — fix inaccurate information, such as a wrong display name.
- Erase — delete your account, your saved work and your usage records, subject to the billing records we must legally retain.
- Restrict or object — pause processing, or object to processing based on legitimate interests.
- Port — receive the data you gave us in a structured, machine-readable format to move it elsewhere.
- Withdraw consent — stop optional product emails, or stop a processing activity that relies on consent.
To exercise any of these, email oncosupport@oncogenixai.com from the address on your account. We may ask you to confirm who you are before answering, so your data is not handed to the wrong person. We respond within one month (30 days) and free of charge; a complex request may take an extension, which we will tell you about.
If you are in the EEA or UK and believe we have mishandled your data, you may also complain to your national data-protection supervisory authority. In India you may raise the matter with us first and, if unresolved, with the authority established under the Digital Personal Data Protection Act.
Email we send you, and unsubscribing
- Essential emails cannot be turned off while you hold an account: email confirmation, password resets, purchase receipts, payment-failure notices and changes to your subscription or access.
- Optional emails (product news and updates) are sent only where you asked for them, and every one includes an unsubscribe link.
- Unsubscribing takes effect immediately. If a confirmation email is unexpected, do not click it — write to us and we will check whether someone entered the address by mistake.
Children
The platform is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete the account and the data attached to it.
Changes to this policy
We may update this policy as the platform changes or the law requires. The current version is always at oncogenixai.com/privacy with the revision date at the top. If a change materially affects how we use your information, we will tell you by email or with a notice in the platform before it takes effect.
Contact us
Questions about this policy, a data request, or anything about how your information is handled:
Related pages: Data, AI and trust · Plans · Who we are