Privacy policy
Last updated 3 October 2026. This is a demo policy for Conceiva, not legal advice.
What this demo is
Conceiva is decision support for comparing a couple’s carrier form with donor records, shortlisting candidates for a genetic counselor visit, and generating cited counselor reports. It is not a diagnosis, not a laboratory, and not a prediction of a child.
Information the demo stores
- Account email, a password hash, role (couple, sperm bank, or genetic counselor), the time consent was given, and whether a couple account has completed unlock checkout.
- Counselor display name and open availability slots.
- Blood type, Rh, prior pregnancies, prior donors, miscarriages, and known family conditions.
- Carrier results: the condition name, the gene code from the report, and how many altered copies.
- Survey answers: ancestry text, CMV preference, clinical notes, ID-release preference, and family limit.
- Donor records a bank saves, including catalog text the bank confirms. Portrait keys point at synthetic drawings.
- Donor physical traits a bank enters: hair color and type, eye color, height, weight, and ethnicity as the donor reports it. Couples can filter by hair, eyes, height, and BMI. Ethnicity is shown on the profile only, with no filter. None of these change the medical rank.
- Couple shortlist entries (at most 20 candidates) and booked visit rows that copy those donor ids at booking time.
- Explanation logs and counselor candidate reports that cite record fields.
- Contact-form name, email, and message. Those messages are not tied to an account and are not emailed.
Information the demo does not take
- Raw genome files or VCF uploads.
- Real photographs of donors or children. Portraits are DiceBear Personas stand-ins under the MIT license. Catalog images are ignored.
- A race filter, an attractiveness score, or a generated face of a future child.
- Card numbers or other payment credentials. Couple match unlock checkout is processed by Stripe; this demo only records whether the account is unlocked.
How explanations use records
A couple-facing explanation is built from retrieved fields. If a field is empty, the page says it is not in the record.
Clinical notes are stored and are not copied into that couple explanation.
A counselor report for a visit candidate may include clinical notes after email and phone redaction, still as cited facts only.
Free-text history is stripped of email addresses and phone numbers before a model call.
If LLM_API_KEY is set, only those retrieved fields are sent to the model endpoint.
Without a key, the text stays on the stored record.
Catalog pages
A bank may paste a public http or https URL. The demo refuses credentials in the URL, non-public addresses, and paths disallowed by robots.txt. It does not log in to another site and does not save images from the page.
Where the data sits
Local runs keep a SQLite file under data/.
On Vercel the file is in temporary instance storage. A new instance starts again from the seeded demo, so accounts and messages on Vercel can disappear.
Set SESSION_SECRET before a shared deployment. Cookies on Vercel are marked secure.
Closing an account
Account close deletes that login, its genotypes, surveys, history, portrait keys, shortlist, visits and counselor reports tied to that account, donor rows owned by that bank, counselor slots, and its explanation logs. Contact messages are not part of an account. They remain until the database file is removed or the Vercel instance is replaced.
Sharing
The demo does not sell records. A model provider receives a field list only when an API key is configured and someone asks for an explanation. Hosting on Vercel means the request is processed by that platform under its own terms.
Contact
Questions about this policy go to privacy@example.com or the contact form.
That address is a placeholder. Set CONTACT_EMAIL before a public launch.