OmevraOmevra · Security
Security & data handling
What happens to data you send Omevra — today, on the public demo, and from launch, on paid plans. The two are labelled separately, because they are different systems.
Today — the public demo
- De-identified variant lists only. The demo carries the notice: “Public demo — please do not upload patient data. Use example or de-identified variants only.”
- No accounts. The public demo has no sign-up and no login.
- Hosting: this website is hosted on GitHub Pages, and the application runs on Hugging Face.
- Your list is processed to produce your report — and it is not used to train models.
From launch — paid plans
- Encryption: TLS in transit and encryption at rest.
- Storage: customer data is stored and processed in the United States.
- Retention: customer data is kept while the account is active. Deleted data is removed from active systems within 30 days and from backups within 90 days.
- Control: export or delete your data at any time.
- Access: restricted to authorised personnel, and logged.
- Health data: a signed Business Associate Agreement is required before any identifiable health data is accepted. Until one is in place, de-identified data only.
- Subprocessors: a current list is maintained on this page. At launch it covers cloud hosting, payments, authentication, email, and error monitoring — each named here when live.