Privacy & data protection

Enigma Clinical Platform handles two kinds of data. Cohort genomic data is published only as aggregate summaries, and account data is collected so that access to the platform can be approved and secured.

Cohort genomic data

Aggregate allele counts, allele numbers, homozygote counts and frequencies per variant. Individual genotypes, sample identifiers and participant details are not shown or downloadable in the browser.

Account data

Name, e-mail address, mobile number (for the SMS second factor), affiliation and intended use, plus the approval status and role an administrator assigns.

Data submissions

Details and attachments you send through the data-submission request form, kept for review by administrators.

Technical data

Sign-in events, browser and device information and aggregate usage analytics, used to secure and improve the service.

• Purpose limitation: account data is used only to authenticate users, approve access and contact them about the service.
• Data minimisation: we ask only for what account approval and the second factor need, and publish cohort data only in aggregate.
• Accuracy: you can review and correct your profile at any time, or ask us to do it.
• Storage limitation: data is kept only as long as the retention periods below require.
• Integrity and confidentiality: access is protected by the security controls described below.
• Accountability: requests and incidents are handled by a named privacy contact.

The web application runs on Firebase App Hosting in the Google Cloud us-central1 region (United States). Account data is held in Google Firebase (Authentication, Firestore and Cloud Storage) and the aggregate cohort tables are served through a managed Hasura GraphQL service. These services are currently hosted outside the Kingdom.

Moving hosting to an in-Kingdom region (Google Cloud Dammam, me-central2) is on the platform roadmap. Until then, transfers outside the Kingdom are limited to account data and aggregate, non-identifying cohort summaries.

Under the PDPL you can ask us to:

• tell you what personal data we hold about you and how it is used;
• give you a copy of your personal data in a readable format;
• correct, complete or update inaccurate data;
• delete your account and personal data when it is no longer needed, unless we must keep it by law;
• withdraw your consent to processing, which ends your access to registered features.

We aim to answer requests within 30 days.

• Account data: while the account is active; deleted on request or after the account is closed.
• Data-submission requests and attachments: for as long as the review and any resulting agreement require.
• Security and sign-in logs: for as long as needed to investigate incidents and meet audit obligations.

• Mandatory second factor (SMS) and administrator approval before an account can query cohort data.
• Approval is enforced on the server, in the data API proxy and in the Firestore and Storage security rules, not only in the user interface.
• Database credentials are held server-side in Google Secret Manager and are never sent to the browser.
• All traffic is encrypted in transit (HTTPS with HSTS); browser security headers restrict framing, MIME sniffing, referrers and device permissions.
• Cohort data is shown only as aggregate counts and frequencies.