DidemBio Privacy Notice

Effective date: October 26, 2026

This Privacy Notice explains how DidemBio LLC collects, uses, discloses, and retains personal information when you visit our covered website, create an account, purchase credits, use our research analysis platform, or contact us. It also explains your choices and how to exercise applicable privacy rights. It should be read alongside our Terms of Use at https://didembio.com/terms.

DidemBio is for adult researchers. Identifiable or regulated human research data are prohibited at launch. Ordinary account, payment, and support information is still personal information and is covered by this notice. Accepting our Terms or acknowledging this notice is not blanket consent to personal information processing.

Contents

1 Who is responsible for your information

DidemBio LLC is a Texas limited liability company at 8080 Westpark Drive STE 98209, Houston, TX 77063, USA. We use "DidemBio," "we," "us," and "our" to refer to this company. Privacy contact: legal@didembio.com.

We determine how personal information is used to operate our accounts, handle purchases and support, secure the platform, and meet our legal obligations. For these activities, we act as a controller, or the equivalent business under applicable privacy law. This notice covers our website at didembio.com and our application at app.didembio.com, including DidemBio-operated subdomains used to provide them. It does not replace a separate notice expressly provided for a different service.

Your employer, university, or research institution may independently decide how to use information about you. Its own privacy notice applies to those decisions. An institutional email address does not by itself give the institution access to your account or authorize us to share your research with it. We disclose information to an institutional representative only with a valid instruction or other lawful basis and appropriate verification.

This notice does not authorize the upload of personal research datasets or create a data processing agreement. If we later offer a separately approved service in which we process personal research data on a customer's instructions, the roles, permitted data, and required agreement will be established before that service is used. Our actual legal responsibilities are determined by the processing and applicable law, not solely by contractual labels.

2 Information we collect and its sources

2.1 Information you provide. We collect your email address, account credentials, and the profile details requested by the registration form, such as your name, institution or company, and role. We store a password hash for authentication rather than a readable password. Required fields are identified in the form. Without required account information, we cannot create or secure an account. You can choose whether to provide information marked optional.

When you use the platform, we receive your uploads, filenames, project names, metadata, analysis settings, annotations, and instructions, and generate analysis results. Although the scientific datasets must meet our restrictions in Section 4, account identifiers, authorship details, and the association between a project and an account may be personal information. Do not put participant names or other prohibited personal information in filenames, labels, metadata, or free text.

If you contact support, make a feature request, submit a custom analysis brief, dispute a charge, or exercise a privacy right, we receive your contact details, message content, any materials you choose to send, and associated case references. We keep records of our response and relevant internal notes. Do not send passwords, full card details, or prohibited research data in these communications.

2.2 Payment information. Stripe handles card details entered into its checkout. We do not store your full card number or card security code in our application. We receive and retain purchase and payment records such as transaction and checkout identifiers, payment status, amount and currency, the credit pack purchased, credits used or restored, refund information, account references, and timestamps. Stripe may also make billing or payment contact information available to us for support, reconciliation, tax, or dispute handling. Stripe's own use of personal information is described in its Privacy Policy.

2.3 Information generated through use. We process account identifiers, verification and academic eligibility status, session creation and last-use times, actions taken in the app, analysis and storage usage, job status and errors, and related billing records. Administrative actions and support access may be recorded with an operator identity, time, affected account or job, reason, and relevant details.

Our systems receive an IP address when a device connects, including for request routing and abuse prevention. Cookies and browser storage hold the information described in Section 6. Amazon Web Services (AWS) handles request metadata for our website and application. Where enabled, hosting, access, and security logs may retain IP addresses, browser or device details, requested URLs, access times, response codes, and security events. Our application records operational and administrative events, including account or job identifiers, actions, errors, and service email outcomes; email logs may include recipient addresses and message subjects. The providers that deliver our emails and host our contact inbox receive the addresses, message contents, and delivery or support information needed to provide those services. We do not infer that information is absent from infrastructure logs merely because it is not in our account database.

2.4 Information from other sources. We obtain payment confirmations and related transaction information from Stripe. An authorized representative of your institution may provide business contact or purchase information when dealing with us on your behalf. We derive academic eligibility from a verified email domain and any affiliation information supplied for review. Reference databases provide scientific annotations used in analyses, as described in Section 5. We do not purchase personal profiles from data brokers to enrich your account.

3 How and why we use personal information

We use information only for the purposes described below or another purpose for which we provide legally required information and establish a valid legal basis. Where the GDPR or UK GDPR applies, the following describes the basis for each activity. A basis of contract applies only when processing is necessary for a contract with the individual concerned, or steps requested before that contract; an agreement with an institution does not automatically supply that basis for its employees' information.

3.1 Accounts and requested services. We use account details, authentication records, project instructions, and service usage to create and verify accounts, run requested analyses, deliver results, manage credits, and respond to support requests. Where you contract with us personally, the basis is performance of that contract or requested precontractual steps. Where an institution is the customer, our basis for its authorized users' business contact and account information is our legitimate interest in administering the institutional service and helping its users access it.

3.2 Purchases and billing. We use account and transaction information to process purchases, allocate credits, reconcile payments, and handle refunds or payment disputes. The basis is performance of a contract with you, or our legitimate interest in administering an institutional customer's purchases. We also retain and use records needed to satisfy applicable accounting, tax, or other legal obligations. We rely on the legal obligation basis only where the relevant law qualifies under the applicable data protection regime.

3.3 Academic eligibility. We use your verified email domain and affiliation information to determine whether academic pricing applies and to review questions or misuse. The basis is performance of the requested pricing arrangement with you, or our legitimate interest in applying eligibility rules consistently for institutional users. Automatic verification compares the email domain with recognized academic domains. A match can grant academic pricing; otherwise standard pricing applies until eligibility is approved. You may request staff review or correction by contacting us. We do not use this process to decide educational admission, employment, clinical care, or access to credit.

3.4 Service communications. We use your email and account or transaction details to send verification and password-reset messages, operational notices, deletion reminders where available, support responses, purchase information, and important legal or security notices. The basis follows the service or legal purpose of the message: contract, the legitimate interests described here, or an applicable legal obligation. These communications are separate from marketing.

3.5 Safety and reliability. We use authentication information, IP addresses, usage and error records, and appropriate audit information to prevent unauthorized access, investigate misuse, diagnose faults, and maintain a reliable service. Our legitimate interests are protecting users and the platform, preventing fraud, and resolving technical problems. We use information proportionately and consider the impact on affected individuals. This purpose does not authorize advertising profiles or unrelated reuse of scientific datasets.

3.6 Legal matters and rights requests. We use relevant contact, transaction, support, and audit information to respond to lawful requests, exercise or defend legal claims, and handle privacy or security complaints. The basis is an applicable legal obligation where one exists; otherwise, where permitted, our legitimate interest in resolving disputes, verifying requests, protecting rights, and maintaining appropriate evidence. We limit records to what the purpose requires.

3.7 Consent and optional activities. We do not treat your use of the service as consent to optional marketing, nonessential tracking, or new uses of research data. Where an activity requires consent, we will explain that activity and obtain the required choice before it begins. You can withdraw consent as described in Section 10 without affecting the lawfulness of processing before withdrawal.

3.8 Launch practice. We use personal information for essential service communications and operations. We do not send optional marketing campaigns or use optional third party analytics, advertising pixels, or cross-site advertising profiles. If this changes, we will update the relevant information and provide the legally required consent or opt-out controls before the new processing starts.

4 Research data and model use

4.1 Restricted inputs. Do not upload identifiable or regulated human research data, including HIPAA protected health information, personal health or genetic data, identifying biometric data, participant contact details, medical records, identifying images, or reidentification keys. The restriction includes support attachments and embedded metadata. Removing names or using participant codes may leave data identifiable or regulated. Public availability, a consent form, or a label saying "deidentified" does not by itself make an upload permissible.

Human genetic and sequencing data are presumed to identify an individual, and may be special-category data, unless robust, demonstrated anonymization establishes otherwise; a participant code, a public source, or a “deidentified” label does not meet that standard.

We accept nonhuman, synthetic, or sufficiently anonymous human research data only where you have the necessary rights and the data meet the Terms of Use. Truly anonymous information may fall outside some privacy laws, but our contractual confidentiality and permitted-use commitments still apply. We do not attempt to identify participants in data accepted as anonymous. Where applicable law requires it, we maintain the data in deidentified form and require relevant recipients to do the same.

4.2 Accidental uploads. If you believe personal research data were submitted by mistake, stop further uploads and contact legal@didembio.com, identifying the account and affected file without repeating the sensitive contents. We may restrict access or quarantine processing while we assess and address the issue. We will comply with applicable duties concerning personal information actually received; the upload restriction does not eliminate those duties.

4.3 Analysis and model fitting. We process scientific inputs and results to provide your requested analysis, requested support, security, and other limited purposes allowed by the Terms. Some selected statistical or machine learning methods fit a model to your dataset solely to carry out that analysis. We do not use customer datasets or results to train, fine tune, or improve reusable models for our own purposes or for other customers, and do not permit our providers to do so. We do not send Customer Data to generative AI providers for general model training. This is consistent with Section 7.3 of the Terms of Use.

We also do not use Customer Data, uploads, or Results to improve or develop our products or services, except as necessary to provide and support your requested analysis.

Any future materially different use requires a separate, explicit agreement. A change to this notice or ordinary acceptance of revised Terms does not by itself grant permission to repurpose previously submitted research data. We do not sell customer datasets, publish your research, or use your research findings in publicity without permission.

5 Who receives information

We disclose information only to recipients who need it for the described purpose or as otherwise permitted by law. A provider's role depends on what it actually does; not every recipient acts solely as our processor.

5.1 Hosting and operations. Amazon Web Services (AWS) provides the infrastructure used to store account information, uploads, results, and operational records and to run the application. Google Workspace handles correspondence sent to our didembio.com mailboxes. The provider used to send automated service emails receives recipient addresses, message contents, and delivery information. For current provider information, contact legal@didembio.com.

5.2 Payments. Stripe and the payment organizations involved in your chosen payment method receive information needed to process payments, prevent fraud, reconcile transactions, and handle refunds or disputes. We disclose the account and purchase references needed for those activities. Stripe may act as a processor for some activities and independently determine purposes for others, as explained in its privacy information.

5.3 Scientific reference services. Selected analyses make server-side requests to reference services. MyGene.info may receive gene or feature identifiers for mapping or organism inference. Ensembl may receive a gene symbol and source and target species for an ortholog lookup. KEGG may receive an organism code and pathway identifier to retrieve pathway lists and diagrams; the current rendering path applies gene-level fold-change values locally. MSigDB may receive a public gene-set collection name and version, and Hugging Face Hub may receive a public reference-model identifier when we download those resources. These requests do not intentionally include account identifiers, filenames, complete datasets, or sample-level measurements. Do not use identifiable participant information as an identifier. The services may independently record our server’s IP address and other request metadata under their own policies.

5.4 Downloads and external services. Some downloadable interactive HTML figures load the Plotly software library from an external content delivery service when you open them. That connection can disclose your IP address, browser request information, and any referrer supplied by your browser to the delivery service. A library download is distinct from uploading the underlying dataset. The external service is Plotly’s CDN at cdn.plot.ly. The browser requests a versioned Plotly.js file when the downloaded HTML figure is opened. Websites you visit through ordinary external links have their own privacy practices.

5.5 Staff, advisers, and lawful requests. Authorized staff and contractors may access the information needed for operations, requested support, billing questions, security, and troubleshooting, under appropriate access and confidentiality restrictions. Professional advisers may receive necessary information for accounting, legal, or similar services. We may disclose relevant information to competent authorities or other parties when legally required, to pursue or defend a legal claim, or where law permits disclosure necessary to protect rights or safety. We assess requests and limit disclosure as appropriate; this is not an unrestricted right to disclose all account contents.

5.6 Business changes and your directions. A proposed merger, financing, reorganization, or sale of the business may involve limited disclosure under appropriate confidentiality protections. A successor must handle the information consistently with applicable law and any binding commitments. We will provide legally required notice and obtain consent where required. We may also disclose information to someone you validly authorize after appropriate verification. We do not make your datasets or results public by default.

6 Cookies and browser storage

6.1 Authentication cookies. We use the first party dbio_session cookie to associate your browser with a server-side session and the dbio_csrf cookie to help prevent forged requests. Their browser lifetime is up to 30 days; the server session ends sooner after 14 days of inactivity and can also be revoked. Blocking these cookies can prevent sign-in or protected account actions. Cookie expiration does not determine how long all related security records are retained.

6.2 Other browser storage. The app also uses local storage and session storage. This can include an authentication-change signal and tab checkpoint, interface preferences such as whether the sidebar is collapsed, records of dismissed onboarding or low-balance notices, and upload-queue details such as filenames, file sizes, project or upload identifiers, and progress. These records support account separation, requested uploads, and interface behavior. The upload queue record does not itself contain a copy of the entire uploaded dataset.

Session storage normally lasts for the browser tab's session. Local storage does not have a built-in expiration and can remain until the app clears it, the browser removes it, or you clear site data. Logout and account changes clear some account-specific state but do not necessarily remove every preference. Do not assume closing a tab clears local storage, especially on a shared computer.

6.3 Choices. You can use browser settings to review or clear cookies and site storage. Doing so may sign you out, reset preferences, or disrupt upload recovery. Authentication and security storage needed to provide a service you request are distinct from optional convenience features. We obtain consent or provide other required controls where the law requires them. Sidebar settings and dismissed onboarding or low-balance notices are first-party preference storage. The app does not currently offer a separate switch for this storage; you can clear it through your browser. Stripe may use its own cookies and similar technologies when you visit its hosted checkout. We do not characterize every first party storage item as strictly necessary merely because it is set by DidemBio.

We do not change our website's behavior in response to the older browser "Do Not Track" setting. Legally recognized universal opt-out signals, such as Global Privacy Control, are distinct and are addressed in Section 11.

7 International processing and transfers

DidemBio is based in the United States. Our authorized personnel in the United States may access information to provide and support the service. Our primary application systems and backups are hosted in AWS’s US East (N. Virginia) region. We use Amazon SES for service email, Google Workspace for legal and support correspondence, and Stripe for payments. These providers and their authorized affiliates or subprocessors may process relevant information in other countries. Their current location information is available from AWS, Stripe, and Google Workspace. Choosing a storage region does not confine all support, payment, email, or security processing to that region.

Where an international transfer requires a legal mechanism, we rely on the EU–U.S. Data Privacy Framework, its UK Extension, or the Swiss–U.S. Data Privacy Framework for transfers to certified U.S. provider entities when their certification covers the transfer. Otherwise, we use applicable EU standard contractual clauses and UK or Swiss supplements under the relevant provider agreement. If an EEA, UK, or Swiss institution transfers personal information directly to DidemBio and transfer terms are required, we put those terms in place with the institution before the transfer. We apply additional safeguards where required. Contact legal@didembio.com for information about the applicable mechanism or a copy or summary of relevant safeguards.

8 How long we keep information

We retain information for the periods below or, where a precise period cannot be fixed in advance, according to the stated criteria. We consider the purpose, whether an account or request remains active, legal recordkeeping duties, the need to resolve a specific dispute or security issue, and whether deletion or effective anonymization is appropriate. We do not retain personal information indefinitely merely because it could be useful.

8.1 Scientific files. The standard service schedule is seven days from upload for unanalyzed files and 30 days after completion for analysis results. Inputs used in an analysis follow the applicable analysis schedule shown in the app. A completed paid pin extends the displayed deadline by 30 days. Incomplete uploads are subject to the inactivity limit disclosed in the upload process, normally 24 hours unless a different limit is disclosed. The expiration of files does not automatically delete account, job, or billing records. An automated daily retention process removes expired files from active storage. Download materials you need before their deadline.

8.2 Account and authentication records. We retain profile and account information while the account is active, then delete or anonymize it subject to necessary lawful exceptions. Session access lasts no more than the periods in Section 6, but expiration of an access credential is not the same as deletion of its database record. We delete or anonymize active profile and authentication records within seven days after account closure, subject to the limited exceptions below. We email an inactivity warning at least 30 days before an account reaches 12 months without a successful sign-in or other account activity. If it remains inactive, we close it at 12 months and delete or anonymize those records within seven days. We delete expired session records within seven days after expiry and used or expired verification and password-reset token records within 24 hours after use or expiry.

8.3 Operational records. Analysis and usage records may retain account and job identifiers, assay types, analysis settings, counts, status, timestamps, and credit costs after associated files expire. We keep these records while your account is active, then delete or anonymize them from active systems within seven days after account closure, except for limited records retained under Sections 8.4 and 8.5. We delete support messages, custom analysis requests, and internal case notes one year after the matter is resolved, unless a documented legal need requires longer retention.

8.4 Payment and legal records. We retain purchase, refund, tax, and accounting records for seven years after the end of the tax year to which they relate, unless a specific legal obligation requires longer. We retain records of accepted Terms and material privacy choices while an account is active and for four years after it closes. We retain complaints, privacy-rights requests, and our responses for three years after final resolution. A documented legal hold may extend the relevant period for specific records. When the hold ends, we delete or anonymize records no longer needed. We retain only information necessary for these purposes; keeping these records does not extend the retention of uploaded scientific datasets.

8.5 Logs and backups. Access, application, and error logs under our control are retained for 30 days from the event. Authentication, administrative audit, and security logs under our control are retained for one year from the event. We retain specific logs longer only for a documented incident, investigation, or legal obligation. Providers may separately retain records under their applicable terms and privacy notices. Deleted information may remain in restricted backups; each backup is retained for no more than 30 days from its creation. We do not use retained backups for unrelated processing. If we restore a backup, we reapply recorded deletions so information that should have been deleted is not permanently reintroduced.

8.6 Closing an account. You can use account settings or contact us to request deletion. The self-service process may require active jobs to be canceled or completed first. A privacy request is not refused merely because that control is unavailable: contact us for assistance. Account closure removes or restricts active account access, but does not necessarily erase all support correspondence, provider-held payment records, audit logs, or backup copies at the same moment. We assess statutory deletion requests across the relevant systems and explain any lawful exception that applies. We will not condition a privacy request on accepting new Terms or resolving an unrelated billing dispute.

9 Security and access by staff

We use safeguards appropriate to the nature and risk of the processing. Application measures include password hashing, server-side account access checks, revocable sessions, verification and reset controls, and limits intended to reduce abuse.

Access to account information or scientific materials is limited to authorized purposes and personnel. Administrative tools record relevant actions or access reasons, but this is not a promise that every infrastructure access event is covered by the same application log. We require appropriate confidentiality and access restrictions for personnel and providers. Contact us promptly if you suspect unauthorized access or an accidental disclosure.

No system can guarantee absolute security. If a personal information breach occurs, we will investigate, take appropriate steps, and notify affected individuals or authorities when and as applicable law requires. This notice does not waive liability or any statutory rights relating to security or privacy.

10 Your choices and privacy requests

10.1 Available requests. Depending on the law that applies and its conditions and exceptions, you may request confirmation of processing; access or a copy; correction; deletion; restriction; portability; information about recipients; objection to certain processing; withdrawal of consent; and protections relating to specified automated decisions or profiling. Additional regional rights are described below. You can ask us about your information even if you are unsure which law applies.

10.2 How to contact us. Email legal@didembio.com or write to the postal address in Section 15. State the right you wish to exercise and enough account or contact information for us to locate the relevant records. Where available, account settings let you update profile information or request closure. You do not need to create a new account to submit a privacy request, and you do not need a self-service export feature to request a copy where you have that right.

10.3 Verification and representation. We may verify identity or authority in a manner proportionate to the request, for example through an existing authenticated account or an email confirmation. We will not ask for your password or full payment card details. If additional evidence is necessary, we will explain what is needed and use it only as appropriate to handle and secure the request. An authorized agent may submit a request where permitted; we may need evidence of authority and, where lawful, confirmation from you. We protect other people's information and may redact it from a response.

10.4 Responses and appeals. We respond within the period required by applicable law and explain any lawful extension, refusal, or fee. Requests are ordinarily free; a fee or refusal for an abusive or excessive request is used only where the applicable law permits it. If we decline a request, you may seek review by emailing legal@didembio.com with "Privacy appeal" and the request reference or sufficient details to identify it. This process does not remove a right to complain directly to an authority or seek another remedy. We will not unlawfully discriminate against you for exercising a privacy right.

10.5 Consent and communications. You may withdraw consent for an activity that relies on it by contacting us or using the control provided for that activity. Withdrawal does not make prior lawful processing unlawful. We may still process information under another independently applicable basis for a separate purpose, which we will explain. Essential account, billing, security, and legal messages are not optional marketing subscriptions. If we later offer marketing, its opt-out process will be separate from service access.

11 Additional information for United States residents

11.1 State rights. Applicable state laws, including laws in Texas and California, may give you rights to access, correct, delete, or obtain a portable copy of personal information and, in specified circumstances, opt out of sale, targeted advertising, or certain profiling. Some laws provide rights to identify recipients or categories of recipients or to limit certain uses of sensitive information. Scope, exemptions, and response rules vary, including for business contact information. We apply the protections required by the law governing the request; this notice does not claim that every state statute applies to every account.

11.2 California categories. The information described in Section 2 can fall into these California categories: identifiers such as name, email, account ID, IP address, and session identifiers; personal information described in California Civil Code section 1798.80(e), such as contact and relevant billing information; commercial information such as purchase and credit-use records; internet or network activity such as interactions and security records; professional or employment-related information such as institution and role; and inferences such as academic eligibility. Account login information, when combined with credentials allowing access, may qualify as sensitive personal information. We use it for authentication, security, and other permitted operational purposes, not to infer sensitive traits. Identifiable human research data are not an intended collection category for this service.

The sources, purposes, recipients, and retention criteria for these categories appear in Sections 2, 3, 5, and 8. Our hosting and operational providers can process the categories needed to host and support accounts. Payment organizations receive relevant identifiers and commercial or billing information. Email and support providers receive contact details and the content needed for the communication. Advisers, authorized representatives, and lawful recipients receive only relevant categories as described in Section 5.

Historical collection and disclosures during the preceding 12 months, or the shorter period since operations began: During the 12 months before this notice’s effective date, our public website collected identifiers and internet or network activity, including IP addresses and website request details. When people contacted us, we collected their contact details and any professional information they provided. We disclosed relevant website information to our hosting provider and correspondence to our email provider to operate the site and respond to inquiries. We did not sell or share personal information. The analysis platform was not available to customers during this period, so we did not collect customer account, purchase, upload, or analysis-use information through it.

11.3 Sale, advertising, and signals. We do not sell personal information for money or other valuable consideration, share it for cross-context behavioral advertising, or process it for targeted advertising as those terms are defined by applicable law. We do not knowingly sell or share personal information of people under 16. Because we do not conduct those activities, there is no such processing to opt out of at launch. We recognize legally required universal opt-out signals for the activities they cover; they do not prevent necessary authentication or payment processing. Before introducing an activity requiring additional notices, consent, or opt-out controls, we will provide them and honor applicable signals and choices.

11.4 Timing and review. Where California or Texas law requires a response within 45 days, we follow that deadline and give timely notice if a legally permitted extension is necessary. Where Texas law applies, we address an appeal within 60 days after receipt and, if denied, explain how to complain to the Texas Attorney General. A shorter period or different procedure under another applicable law takes priority. California residents may also contact the California Privacy Protection Agency or California Attorney General. These routes do not limit other available remedies.

12 Additional information for European and UK users

Where the GDPR or UK GDPR applies, Section 3 identifies our purposes and lawful bases, including the legitimate interests pursued. You may object to processing based on legitimate interests on grounds relating to your situation. We must then stop unless the law permits continued processing, such as compelling overriding grounds or the establishment, exercise, or defense of legal claims. An objection to processing for direct marketing, if such processing is introduced, does not require reasons.

You may request access, correction, erasure, restriction, and, where the legal conditions are met, a portable copy of information you provided for processing based on consent or contract. If processing is based on consent, you may withdraw it. You also have applicable safeguards relating to solely automated decisions with legal or similarly significant effects. The academic eligibility logic and its consequences are described in Section 3.3, including a route to staff review.

We ordinarily respond to a rights request without undue delay and within one month where that rule applies. If the law permits additional time due to complexity or the number of requests, we inform you within the initial period and explain the reason. We provide any other required complaint acknowledgments or responses under applicable local rules.

You may complain to the data protection authority where you live or work, or where the alleged infringement occurred, as applicable. EU and EEA authority details are available through the European Data Protection Board. UK users may contact the Information Commissioner's Office. You need not obtain our permission or complete our internal process before using an available regulatory remedy.

Our ordinary privacy contact remains available regardless of whether a representative or officer is required.

EU/UK representative: Our Article 27 representative in the European Union is [NAME, ADDRESS, EMAIL], and our Article 27 representative in the United Kingdom is [NAME, ADDRESS, EMAIL]. You may contact either representative on matters relating to the processing of your personal information.

People in Switzerland and elsewhere may have similar rights under their applicable laws. Contact us to exercise them. The Terms of Use, including their governing-law or liability clauses, do not displace nonwaivable privacy rights or an authority's powers.

13 Children and age restrictions

The service is intended for people at least 18 years old who meet any higher local age requirement for entering the service agreement. We do not knowingly offer accounts to children or solicit their personal information. If you believe a child has provided personal information, contact us so that we can investigate and take appropriate action, including deletion where required. The prohibition on identifiable or regulated human research data also covers data about children; an adult account does not authorize uploading it.

14 Changes to this notice

We will update this notice when our relevant practices or legal requirements change, identify the effective date, and provide email, in-app, or other legally required notice of material changes. Where a new purpose requires consent or another step before processing begins, we will complete that step rather than treating continued use as consent. An update does not retroactively override contractual data-use restrictions or remove applicable rights.

15 Contact information

DidemBio LLC

8080 Westpark Drive STE 98209

Houston, TX 77063, USA

Privacy questions, requests, appeals, and suspected accidental data submissions: legal@didembio.com

Security or legal notices may also be sent to legal@didembio.com.

Public notice location: https://didembio.com/privacy