Service Maintenance Notice: OmniBioAI platform services are temporarily unavailable while scheduled infrastructure maintenance is in progress. The website and documentation remain available. Platform services will be restored once maintenance is complete. Thank you for your patience.
-
+
+ // Legal
+ Privacy Policy
+ Effective 3 October 2026 · Last updated 3 October 2026
+
+
+
+ Who we are
+ This policy explains what personal information OmniBioAI collects, why, who it is shared with, how long it is kept and the choices you have. It covers this website (omnibioai.org), the hosted platform (including webstudio.omnibioai.org and the OmniBioAI API), the OmniBioAI Studio desktop application, and our documentation site.
+ "OmniBioAI", "we" and "us" mean the operator of these services, based in Kansas City, USA. You can reach us at manish@omnibioai.org for any privacy question or request.
+
+
+ The short version
+
+ - Studio is local-first. When you run OmniBioAI Studio on your own machine, your sequencing data, clinical metadata and results stay on your infrastructure. We do not receive them.
+ - We collect what we need to run the service: your account details, what you send to our hosted services, usage records for billing, and security logs.
+ - We never see your full card number. Payments are handled by Stripe.
+ - We do not sell your personal information and we do not use your content to train AI models.
+ - Do not send protected health information (PHI) to our hosted services unless we have signed a business associate agreement with you.
+
+
+
+ Information we collect
+ Information you give us
+
+ - Beta access requests: first and last name, institutional email, organization or lab, role, primary research area, operating system and a description of your intended analysis.
+ - Account information: email address, name, password (stored only as a salted hash), organization and team memberships and roles. If you sign in with Google, GitHub or Microsoft, we receive your basic profile (name, email and the provider's account identifier) from that provider.
+ - Billing information: billing contact, billing address and tax ID if you provide them. Card details are entered on Stripe's pages and stored by Stripe; we receive only a customer reference and limited card details such as brand, last four digits and expiry date.
+ - Content you submit to hosted services: questions sent to Literature AI and the API, files and data you upload, workflow parameters, chat messages and comments in shared workspaces.
+ - Support and feedback: emails, bug reports and community messages you send us.
+
+ Information collected automatically
+
+ - Usage records: which service you used, the resource and quantity (for example one answer or a number of tokens), time, organization and the API key used. We need these to bill you and to enforce plan limits.
+ - Security and audit logs: sign-ins, permission decisions, role and key changes, IP address, user agent and request identifiers. These protect your account and the platform.
+ - API keys: we store only a cryptographic hash and a short prefix of each key, never the key itself after it is shown to you once.
+ - Error reports: technical diagnostics when a service fails, which may include request metadata.
+ - Licence checks: the desktop application validates its licence key with our servers; this sends the licence key and basic technical information, not your research data.
+ - Website requests: our web host and font provider receive standard request data (such as IP address and browser type) when you load pages. This website does not use advertising or analytics trackers.
+
+
+
+ How we use information
+
+ | Purpose | Information used | Legal basis (where GDPR/UK GDPR applies) |
|---|
+
+ | Provide and operate the services, including answering your requests | Account, content, usage | Performance of our contract with you |
+ | Review beta access requests and onboard approved researchers | Beta request details | Steps taken at your request before a contract; legitimate interests |
+ | Bill usage, collect payments and keep financial records | Usage, billing | Contract; legal obligation |
+ | Secure accounts, detect abuse, enforce rate limits and keep audit trails | Security logs, usage, API key hashes | Legitimate interests; legal obligation |
+ | Fix errors and improve reliability and performance | Error reports, usage | Legitimate interests |
+ | Answer support requests and send service notices | Contact details, support messages | Contract; legitimate interests |
+ | Comply with law and respond to lawful requests | As required | Legal obligation |
+
+
+ We do not use your content to train machine-learning models, and we do not sell or rent personal information or share it for cross-context behavioral advertising.
+
+
+ Who we share it with
+ We share personal information only with service providers that process it on our behalf under contract, or where you direct us to:
+
+ | Recipient | Why |
|---|
+
+ | Stripe | Payment processing, invoicing and fraud prevention |
+ | Cloud and hosting providers (including Cloudflare and GitHub Pages) | Hosting the website, receiving beta requests, running the hosted platform, network security |
+ | Google, GitHub, Microsoft | Only if you choose to sign in with them |
+ | Error-tracking provider | Diagnosing service failures |
+ | Email provider | Sending service and support emails |
+ | AI model providers you enable (for example Anthropic or OpenAI) | Only when you or your organization choose a premium model or connect your own provider key; your request is then sent to that provider and handled under its terms |
+ | Your organization | Organization owners and administrators can see members, roles, API keys and usage for their organization |
+
+
+ We may also disclose information to comply with law or a valid legal process, to protect the rights, safety and security of our users and services, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply.
+
+
+ Health and research data
+ OmniBioAI is built with HIPAA-aligned security controls, but this is not a certification, and our hosted services are not intended to receive protected health information (PHI) unless we have signed a business associate agreement (BAA) with you.
When you run OmniBioAI Studio on your own hardware, PHI and research data are stored and processed in your environment, and you are responsible for your own compliance program. Features that send data to an external service (such as a cloud AI model) are off unless enabled, and the platform screens outgoing requests for obvious sensitive data, but you remain responsible for what you choose to send.
+
+
+ How long we keep it
+
+ - Account information: while your account is active, and deleted or anonymized within 90 days after you close it, except where we must keep it longer by law.
+ - Content on hosted services: until you delete it or close your account.
+ - Usage and billing records: as long as needed for billing and as required by tax and accounting law (typically seven years).
+ - Security audit logs: up to six years, consistent with our security and compliance retention policy, or longer if subject to a legal hold.
+ - Beta access requests: up to two years after your request, unless you become a customer.
+
+
+
+ How we protect it
+ Protections include encryption in transit, hashed passwords and API keys, short-lived access tokens, role-based access control scoped to your organization, multi-factor authentication options, least-privilege service credentials, and an append-only audit log of security-relevant events. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you as required by law.
+
+
+ Your rights and choices
+ Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know, delete and correct personal information and to not be discriminated against for exercising these rights; we do not sell or share personal information as those terms are defined in California law.
+ To make a request, email manish@omnibioai.org. We will verify your identity and respond within the time the law requires (generally 30 to 45 days). You can also revoke API keys and manage sign-in methods in your account at any time. If you are in the EEA or UK, you may complain to your local data protection authority.
+ If your organization provides your account, it controls some of your information; we may direct your request to it.
+
+
+ International transfers
+ We are based in the United States and our providers may process information in other countries. Where data protection law requires it, we rely on appropriate safeguards such as the European Commission's standard contractual clauses for transfers out of the EEA, UK or Switzerland.
+
+
+ Children
+ Our services are for researchers and professionals and are not directed to children under 16. We do not knowingly collect their personal information; if you believe we have, contact us and we will delete it.
+
+
+ Cookies and local storage
+ We use only cookies and browser storage needed to run the services: keeping you signed in, remembering preferences and protecting against abuse. We do not use advertising cookies. Blocking these may stop the hosted platform from working.
+
+
+ Changes to this policy
+ We may update this policy. We will post the new version here with a new "last updated" date and, for material changes, notify account holders by email or in the product before they take effect.
+ Questions: manish@omnibioai.org.
+
+
+
+
+ // Legal
+ Terms of Service
+ Effective 3 October 2026 · Last updated 3 October 2026
+
+
+
+ Agreement
+ These terms govern your use of OmniBioAI's website, hosted platform (including webstudio.omnibioai.org and the OmniBioAI API), the OmniBioAI Studio desktop application and related documentation (the "Services"). By creating an account, using an API key, downloading Studio or otherwise using the Services, you agree to these terms and to our Privacy Policy.
+ If you use the Services for an organization, you confirm you have authority to accept these terms for it, and "you" includes that organization. You must be at least 18 years old. A separate written agreement signed with us (for example an enterprise agreement or a business associate agreement) takes precedence over these terms where they conflict.
+
+
+ Beta services and trials
+ OmniBioAI is in beta. Features may change, be limited or be withdrawn, and may contain errors. Studio downloads include a 30-day trial licence. Beta and trial access may be granted, limited or ended at our discretion.
+
+
+ Accounts and API keys
+
+ - Keep your credentials and API keys secret. You are responsible for activity under your account and for all usage made with your API keys, including charges, until you revoke a key.
+ - Tell us promptly at the contact address below if you believe an account or key has been compromised.
+ - Organization administrators can manage members, roles, keys and billing for their organization.
+
+
+
+ Acceptable use
+ You will not, and will not let others:
+
+ - use the Services unlawfully, or to infringe others' rights, including licence terms of third-party databases;
+ - upload protected health information to our hosted services unless we have signed a business associate agreement with you;
+ - attempt to breach, probe or disrupt the Services' security, or access accounts, data or organizations that are not yours;
+ - circumvent rate limits, quotas, licence checks or billing, or share an API key outside the organization it was issued to;
+ - resell, sublicense or provide the Services to third parties as a competing service, or scrape or bulk-export them, without our written permission;
+ - use the Services to develop weapons or to cause harm, or to send malware or spam.
+
+ We may suspend access that violates these rules or puts the Services or other users at risk.
+
+
+ Research use only — not medical advice
+ The Services are research tools. They are not medical devices and are not intended to diagnose, treat or prevent disease or to guide patient care.
AI-generated answers, analyses and citations can be incomplete or wrong. Verify results, including cited sources, before relying on them, and apply your own professional judgment.
+
+
+ Fees and payment
+
+ - Pricing. Paid features are charged as shown on our pricing page, in the product or in your order: for example per answer or query, per token for premium AI models, per seat, or as prepaid credits. Free tiers include a limited allowance; requests beyond it may be refused until you add a payment method or upgrade.
+ - Billing. Usage is measured by our systems and billed monthly in arrears unless your plan says otherwise. Payments are processed by Stripe under its terms. You authorize us to charge your payment method for fees incurred.
+ - Taxes. Fees exclude taxes, which you pay where applicable.
+ - Own provider keys. If you connect your own AI provider key, that provider bills you for its usage directly; our platform fees still apply.
+ - Non-payment. If a payment fails we may limit your account to free-tier access until it is resolved.
+ - Refunds. Fees and prepaid credits are non-refundable except where required by law or stated in your plan.
+ - Price changes. We will give at least 30 days' notice of price increases for paid plans.
+
+
+
+ Your content
+ You keep all rights in the data, files and questions you submit and in the results generated for you ("Your Content"). You give us a limited licence to host, process and transmit Your Content only to provide, secure and support the Services. We do not use Your Content to train machine-learning models.
+ You are responsible for having the rights and consents needed for Your Content.
+
+
+ Third-party services and data
+ The Services connect to third-party services and data, such as PubMed/NCBI, reference databases, AI model providers, cloud platforms and lab systems. Your use of them is subject to their terms. Some reference databases (for example OMIM, COSMIC, DrugBank and OncoKB) require your own licence and credentials. We are not responsible for third-party services or their content.
+
+
+ Our intellectual property
+ The Services, including software, models we provide, documentation and branding, are owned by OmniBioAI or its licensors and are licensed to you, not sold, for use under these terms. Open-source components are licensed under their own licences, which govern your use of those components. If you send us feedback, we may use it without obligation to you.
+
+
+ Suspension and termination
+ You may stop using the Services and close your account at any time. We may suspend or end your access if you breach these terms, fail to pay, or create a security or legal risk, and we may discontinue a beta feature. On termination, unpaid fees become due; you can request an export of Your Content within 30 days, after which we may delete it as described in our Privacy Policy.
+
+
+ Disclaimers
+ THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY AND NON-INFRINGEMENT, AND WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.
+
+
+ Limitation of liability
+ TO THE FULLEST EXTENT PERMITTED BY LAW, OMNIBIOAI WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL. OUR TOTAL LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICES IS LIMITED TO THE GREATER OF THE AMOUNTS YOU PAID US FOR THE SERVICES IN THE 12 MONTHS BEFORE THE CLAIM AND US$100.
+ These limits do not apply where the law does not allow them.
+
+
+ Indemnity
+ You will defend and indemnify OmniBioAI against third-party claims arising from Your Content or from your use of the Services in breach of these terms or the law.
+
+
+ Governing law and disputes
+ These terms are governed by the laws of the State of Kansas, USA, without regard to its conflict-of-law rules. Disputes will be resolved in the state or federal courts located in Kansas, and both parties consent to their jurisdiction. Nothing here limits mandatory consumer protections in your country of residence.
+
+
+ General
+ We may update these terms; we will post the new version here and, for material changes, notify account holders before they take effect. Continued use after that means you accept the updated terms. If a provision is unenforceable, the rest remain in effect. You may not assign these terms without our consent. These terms and our Privacy Policy are the entire agreement between us about the Services, except for any separate signed agreement.
+ Contact: manish@omnibioai.org.
+
+
+
+