Privacy Policy

This English text is provided for convenience only. The legally binding version is the Bulgarian one — see the Bulgarian page. In case of any discrepancy, the Bulgarian text prevails.

In short

• The controller of your personal data is Microbiome Center Varna OOD — the company behind BugSpeaks Bulgaria.
• We process your health data — the questionnaire, the sample, the results and the report — only with your explicit consent and only to prepare and deliver your analysis.
• The laboratory in India receives the sample and the data needed for the analysis only under the test code (BS code). Your name, email, phone number and address stay with us, in the EU.
• Our database and the website's servers are in the European Union — in Frankfurt, Germany.
• We do not sell personal data. We do not give it to employers, insurers or advertisers, and we do not use it for advertising.
• We have no advertising cookies. Our statistics are cookie-free and only run if you allow them.
• You can view, download, correct and delete your data at any time — much of it directly from your account, the rest with a single email.

The details are below. If anything is unclear, write to us at info@bugspeaks.bg — we will answer in plain language, without legal jargon.

1. Who we are and how to contact us

The controller of personal data is Microbiome Center Varna OOD (UIC 206860918), registered seat and address of management: 19 Sveta Ekaterina St., Vinitsa, Primorski district, 9000 Varna, Bulgaria (“we”). We operate under the trade name BugSpeaks Bulgaria as the official representative of BugSpeaks for Bulgaria and the Balkans.

For anything concerning your personal data — a question, a request, withdrawal of consent or a report of a problem — write to info@bugspeaks.bg with the subject “Data protection”, call +359 876 140 111 or send a letter to the company's address.

We have not appointed a data protection officer — we are not required to by law (Art. 37 GDPR; the assessment is documented and reviewed every 6 months). Our contact person handles all personal-data questions: write to info@bugspeaks.bg with the subject “Data protection”.

2. What this policy covers

It explains how we process personal data when you:

• browse bugspeaks.bg — in Bulgarian or in English;
• order a test, a probiotic or a bundle and pay;
• have an account — including the account we create automatically when you order, so that you can track the order and receive your report;
• register your test with the BS code, complete the questionnaire, send the sample and receive the report;
• write to us, leave your email in the quiz or when reserving a test, subscribe to the newsletter or ask questions to the AI adviser Bugsy;
• apply to become a partner as a practitioner.

The policy does not cover websites and services of others that our site links to — for example the AI services opened by the “Ask an AI” buttons, social networks or the couriers' parcel-tracking pages. They have their own rules.

Our social media profiles. We have profiles on Facebook, Instagram and LinkedIn. The links to them on the site are plain links — the site loads no code from these networks and sends them no data about your visit. If you visit our profiles or write to us there, the network processes your data under its own rules; we only see what you have made visible to us (comments, messages) and aggregate statistics. Insofar as we are joint controllers with Meta Platforms Ireland Ltd for the statistics of our Facebook page (Article 26 GDPR), Meta has assumed the main obligations for them (facebook.com/legal/terms/page_controller_addendum) — you can also exercise your rights with Meta.

3. What data we process and where it comes from

Data you give us:

• Contact and delivery data: first and last name, email, phone, city, postcode and address or courier office.
• Location — only if you tap “Nearest to me” when choosing an Econt office at checkout. Your browser asks for your permission, and we use the location only in your browser, to sort the offices by distance. We do not send it to us or anyone else and do not keep it.
• If you ask for a courier to collect your sample, or for a number to leave it at an Econt office (the buttons in the sample instructions in your account): name, phone, city and address for the collection or the chosen office, and your note to the courier if you write one. The same details and the test code go to Econt so it can create the return shipment.
• Account data: email, name, phone and a password if you set one. The password is stored only in irreversibly encrypted form — nobody at our company can read it. If you sign in with Google, Google gives us your name, email, your Google account number and the address of your picture there (we do not show or use the picture); we never see your Google password. If you turn on two-factor sign-in (optional; mandatory for partner clinics), the sign-in system keeps the secret key with which the app on your phone makes the codes; the key is not shown to anyone and is deleted when you turn two-factor sign-in off or delete your account.
• Order data: products, quantities, prices and the chosen payment method.
• The health questionnaire: who the test is for, name and contact details, sex, age, height, weight, diet, alcohol, smoking, physical activity, conditions and medication. For the vaginal test, instead of height, weight, lifestyle, the general list of conditions and medication we ask: whether the uterus has been removed; whether menopause has occurred and, if so, how many years ago and whether hormone replacement therapy is taken, and if not, whether there is a pregnancy (and the week, if you write it), breastfeeding or a planned pregnancy, which contraception is used and the first day of the last period; current symptoms; diagnoses that have been given (including bacterial vaginosis, vaginal candidiasis, urinary tract infection and sexually transmitted infection, and another diagnosis, if you write one); whether antibiotics have been taken in the last month; and a note about a gynaecological condition that makes the cycle irregular or hard to track, if you write one. This is health data — a special category under GDPR, Art. 9.
• The sample: stool for the gut test, a skin sample for the skin test and a vaginal swab for the vaginal test.
• Your messages: enquiries, complaints, requests under this policy. When applying to become a partner — name, specialty, practice, city, email and phone.
• Your email, if you leave it in the quiz (together with the recommended product), reserve a test (together with the chosen test) or subscribe to the newsletter. The quiz answers stay only in your browser — we do not receive them.
• The questions you ask Bugsy.
• The email of a person you bought a test for — if you send them an invitation from “My tests” (section 7).

Data generated by the service:

• the test's BS code and its stages with their dates — shipped, sample received, on its way to the laboratory, at the laboratory, analysed, report ready — and the number of the shipment that takes the sample to the laboratory;
• if you received the kit from one of our partners (a clinic, a doctor or a retailer that sells the test) and registered its BS code in your account: which partner gave you the kit and when you registered it. By the BS code the partner sees whether it is registered and the stage of the sample; it sees your name and report only with your explicit consent, and your questionnaire answers only if it is a clinic or doctor (section 16);
• the results of the analysis and your report — health data;
• the nutrition recommendations from your report: the foods and how often to eat them in each phase. We read them automatically from the report to show them in your account as an interactive plan, and keep and delete them together with the report — health data;
• if you start the plan in your account — the start date, so that we can show you which week and phase you are in, and whether you want an email when a new phase begins. We use them to email you when a new phase begins and when the 12 weeks are over (with an offer of a follow-up test); you turn the reminders off with a switch under “Nutrition plan”. We keep and delete them together with the report;
• the order number and the payment status;
• the code of your voucher from the quiz or the reservation, when it was issued and whether and for which order it was used, as well as the discount in the order itself;
• proof of your consents: the exact text you saw, the version of the documents, date and time, and — when you order — browser type and IP address.

Data we receive from others:

• from the laboratory — the results and the report, linked only to the BS code;
• from Stripe — whether the card payment succeeded. We never see or store your card number: you enter it directly into Stripe's secure form;
• from the couriers — the delivery status;
• from a person who bought a test for you — your email, so that we can send you the invitation, and their name, so that you know who it is from (section 7).

Technical data:

• IP address and browser and device data, which the servers unavoidably process in order to show you the site;
• to protect against abuse (for example mass submissions of the forms) we count requests per address — the IP address is kept only as a keyed hash (pseudonymised) and is deleted within 1 day;
• cookies and browser storage — section 13 and the Cookie Policy;
• aggregated statistics on visits and page speed — only if you have allowed them in the banner (section 13);
• we send emails via Brevo, which records whether an email was opened and whether a link was clicked — so the links in our emails pass through a Brevo address before taking you to us.

About DNA: the test examines the DNA of the microorganisms in the sample (the microbiome), not your own genome. We do not examine your genes, hereditary conditions or ancestry. The results are nevertheless health data about you — so we apply to them, and to the raw sequencing data, the highest protection under GDPR, Art. 9.

4. Why, on what basis and for how long

Where the basis is legitimate interest, we have assessed that it does not override your interests, rights and freedoms. You can ask for more information about that assessment and object at any time (section 17).

5. Health data — what we promise

• Explicit consent. You give it in the questionnaire, before you take the sample, through a separate field that is not pre-ticked; if the test is for another adult, that person gives it themselves (section 7). We keep the exact text you saw and when you gave it. Without this consent the analysis cannot be carried out — it is a condition of the service itself, but whether to order it is entirely your choice.
• Who has access: you; the laboratory — only under the test code; our staff who handle orders and reports — only as far as they need to and under a duty of confidentiality.
• Never: we do not sell your health data; we do not use it for advertising or profiling; we do not give it to employers, insurers, banks or other traders; we do not train AI models with it.
• Research: we do not use your health data for scientific research or product development without your separate consent — except in fully anonymised, aggregated form from which you cannot be recognised.
• Withdrawal: at any time — with the “Withdraw consent for health data” button at the test in your account (or, while the questionnaire is a draft, by unticking the box) or by email to us. If the sample is not yet at the laboratory, we stop the analysis. If the analysis has already been done, we delete the questionnaire and the report and instruct the laboratory to delete the raw data. Withdrawal does not affect the lawfulness of processing before it. What happens to the payment is governed by the Terms and Conditions.

6. The sample and the laboratory

The analysis is carried out by Leucine Rich Bio Pvt Ltd — the developer of BugSpeaks, with a laboratory in Bengaluru, India. The laboratory processes the data as our processor (GDPR, Art. 28): only on our written instructions, under a duty of confidentiality and without the right to use it for its own purposes. The laboratory has no sub-processors: all processing takes place in its own laboratory in Bengaluru.

How the sample and the data travel:

1. You receive a kit with a unique code — the BS code.
2. You complete the questionnaire in your account.
3. You return the sample with Econt, free of charge for you. It reaches the laboratory only with the code — without your name and address.
4. The laboratory receives the BS code and the questionnaire data needed for the analysis: sex, age, height, weight, diet, lifestyle, conditions and medication, and for the vaginal test, instead of these, whether the uterus has been removed, menopause and hormone replacement therapy, pregnancy and breastfeeding, the cycle, contraception, symptoms, diagnoses and antibiotics. It does not receive your name, email, phone, address or payment data. Only we can link the code to you.
5. The report comes back to us under the code and appears in your account.

Retention at the laboratory:

• the sample is destroyed after the analysis;
• human DNA is removed from the raw sequencing data before it is stored; it is not analysed and not disclosed;
• the raw sequencing data and the laboratory's copy of the report are kept for up to 2 years from the report — so that the result can be compared with a follow-up test (for example the “now and after 3 months” bundle) — and are then deleted; earlier at your request;
• the report and the results — in your account, for as long as you have it (section 4).

7. A test for another person or for a child

Orders may be placed by persons aged 18 or over. If the test is for another adult, only that person can give the explicit consent for their health data. So the buyer sends them an invitation from “My tests”: we use their email only to send the invitation, and in the email they see the buyer's name. The buyer who gives us the email confirms that the person knows about the test. The invitee accepts it with their own account, gives their consent themselves, fills in the questionnaire and receives the report — the buyer sees only the delivery, not the answers or the results. If the buyer wants to fill in the questionnaire and receive the report themselves, we send the tested person an email in which they give their explicit consent with a button (we keep the text, the time, the IP address and the browser); without that consent the questionnaire for them is not unlocked. The tested person can withdraw their consent at any time by emailing us. We delete an invitation that is not accepted within 30 days after it expires or is cancelled. A test for a child under 18 is ordered by a parent or guardian, who also gives the consent for the child's health data. We do not knowingly process children's data without the involvement of a parent or guardian.

8. Who we share data with

We share data only with the recipients listed below and only as much as they need. Every processor is bound by a contract under GDPR, Art. 28.

In the event of a transformation of the company, a change of ownership or a transfer of the business, the data may pass to the successor, which assumes the same obligations under this policy. We will notify you in advance.

9. Transfers of data outside the EU

India. There is no European Commission adequacy decision for India. The transfer to the laboratory is based on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, module “controller to processor”), on a transfer impact assessment and on supplementary measures: the laboratory receives the data only under the test code — without name, contact details and address — and cannot identify you; it is obliged to delete the data within the periods in section 6.

USA and Singapore. Some providers in section 8 are companies outside the EU or have access from there — for support, security or the service itself. The transfer is based on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Decision (EU) 2023/1795), where the provider is certified under it, and on the EU Standard Contractual Clauses — which also apply should the Framework cease to apply.

You can obtain a copy of the safeguards (without the trade secrets in them) at info@bugspeaks.bg.

10. How long we keep data

We keep data only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires — the periods are in sections 4 and 6. After that we delete it or irreversibly anonymise it. Deleted data also disappears from the backups once those backups expire — after 90 days at the latest. Backups are used only for disaster recovery.

When you delete your account, we immediately delete the account, the questionnaires, the reports and the vouchers linked to your email and your orders. Only the data the law requires us to keep remains — the order's number, date, products and amounts, the code of the voucher used, the payment identifier and the test code, without name, phone, email and address — and the proof of your consents (with the IP address and browser from which they were given when ordering or, for a purchase made in person, at your first sign-in to the account), for as long as a dispute is possible (section 4).

11. How we protect data

• Encrypted connection (HTTPS) everywhere on the site.
• The database and the website's servers are in the EU (Frankfurt), and the data is stored encrypted.
• Record-level access rules: everyone sees only their own data, and staff access is limited to authorised persons.
• Access log: every time a team member opens a questionnaire, copies it for the laboratory, uploads a report, reads the nutrition plan from it or checks the code in the report, it is recorded — who, when and for which test. The team opens a questionnaire only through this record. The log is kept for 1 year.
• Reports are kept in protected storage and open only via a personal link valid for 1 hour.
• To the laboratory — only the test code (pseudonymisation).
• Backups are encrypted, with a key held only by us, before they are stored.
• IP addresses used for abuse protection are kept only as a keyed hash (pseudonymised) and deleted within 1 day.
• The site does not load fonts or scripts from Google or other advertising networks. Your browser goes to Google only if you choose “Continue with Google”. Stripe's script loads only at the card payment step.
• Our providers are chosen for their safeguards and are bound by contracts under GDPR, Art. 28.

If, despite these measures, a personal data breach occurs, we notify the Commission for Personal Data Protection (КЗЛД) within 72 hours where the law requires it, and you — without undue delay if the breach creates a high risk to your rights, telling you what happened and what you can do.

12. Automated decisions and profiling

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (GDPR, Art. 22). The report is prepared using bioinformatic analysis and the laboratory's algorithms: the indicators and the diet and probiotic recommendations are information for you — they are not a medical diagnosis and not a decision about you. You can ask for an explanation. We do not profile you for advertising.

13. Cookies and browser storage

Without consent we use only strictly necessary cookies and browser storage: for signing in to your account, the cart, protection against duplicate orders, your voucher code (so that it fills in at checkout automatically), remembering your choice in the banner and that you closed Bugsy's invitation, when we last showed you the quiz invitation (so that it is not more often than once every 2 days) and your choice in it until the quiz opens. When you pay by card, Stripe sets its own fraud-prevention cookies — only at the card step. Statistics (Umami) are cookie-free and are switched on only if you allow them in the banner; you can change your choice at any time via “Cookie settings” in the footer. We have no advertising cookies. The full list is in the Cookie Policy.

14. The AI adviser Bugsy

• Bugsy is an AI assistant that answers general questions about the microbiome and our products. It runs on a model by Anthropic.
• Only the text of the conversation is sent to Anthropic — we do not send your name, email, account or IP address.
• We do not record conversations — they exist only in the open tab of your browser. Anthropic deletes them within 30 days (unless its safety systems flag abuse) and does not use them to train its models.
• Please do not write names, contact details or personal health data — Bugsy does not need them, and the chat carries a warning about this. Before your first free-text question the chat asks for your explicit consent: if you still share information about your health, it is sent to Anthropic only to get you an answer (Art. 9(2)(a) GDPR) and is not recorded by us. The ready-made questions on the buttons are not sent to Anthropic.
• Bugsy's answers are general information, not medical advice.

15. Newsletter, quiz and reservation

• You subscribe with your email in the footer, at the end of the quiz, when you reserve a test, when you activate a test with the code from the kit, or — if you bought the test in person — at your first sign-in to the account; in the quiz, in the reservation, in the activation and in the account this is a separate, unticked box. From the footer you receive a welcome with “Microbiome 101”. From the quiz you always receive only what you asked for: the result (the recommended test, what the report contains, the price and a sample report) and a €20 discount voucher, whether or not you ticked the newsletter box. When you reserve a test, you receive the €20 voucher in the same way. You receive the newsletter only if you ticked it. After that — articles, research news and offers from BugSpeaks Bulgaria.
• If you received the voucher before we open orders, we will write to you once when we open them, only so that you know until when the voucher is valid (Terms and Conditions, section 6a).
• The newsletter is sent with your consent, and the result and the voucher at your request (section 4). For the newsletter we do not use order data or health data.
• We send it via Brevo, which records opens and clicks so that we know what is useful.
• You can unsubscribe at any time — via the link at the end of every newsletter or by email to us. After you unsubscribe we keep your email only on a “do not send” list, to respect your refusal.

16. Partner clinics, practitioners and other partners

If you apply to become a partner — a doctor, dietitian, nutritionist, etc. — we process the data in the application (name, specialty, practice, city, email, phone) in order to contact you and to conclude and perform the partnership. Partners do not receive customers' health data without the customer's explicit consent.

• A kit from a partner. Even without your consent, the clinic or other partner that gave you the kit sees whether the code has been registered, the stage of the sample (received, at the laboratory, analysis, report ready) and whether the questionnaire has been sent, without your name, answers or results. This lets the partner follow the kit it sold and answer your questions about it (legitimate interest, Art. 6(1)(f) GDPR). You can object by email to us, and then it will see only whether the code has been registered.
• An order with a clinic's code (Terms, section 6b). We record the code in the order; the clinic sees the number of tests, the dates and the amounts of the orders with its code, without names. Basis: our legitimate interest in calculating its reward under its contract with us (Art. 6(1)(f) GDPR).
• Sharing with the partner — only with separate explicit consent (Art. 9(2)(a) GDPR). You give it with the “I agree — share” button under “My tests” — for a test from the partner's kit or ordered with a clinic's code; nothing is preselected. With your consent the clinic sees on the website, for that test: your name and BS code, the stage of the test, your questionnaire answers (without phone and email), the report and the nutrition plan. A partner that is not a healthcare provider sees the same without your questionnaire answers. The partner does not see your delivery address, your payments, your other tests or the tests of people you invited. For a person under 18, a parent or guardian gives the consent.
• A partner that is not a healthcare provider (for example a retailer that sells the test). The only basis is your explicit consent. The partner uses the report and the plan only to explain them to you and to answer your questions about the test. Only the partner's people who serve you and have undertaken a written duty of confidentiality see them. If you withdraw your consent, the partner stops seeing the data on the website and deletes anything it has downloaded.
• Who sees it at a clinic. The clinic's doctors and staff, including the front desk, who look after you and are bound by confidentiality. Whatever the clinic enters in your medical records is kept under its own rules. The clinic and the other partners are independent controllers of the data they receive from us — we are not joint controllers.
• Withdrawal — at any time, with the “Stop sharing” button under “My tests” or by email to us. Access stops immediately. If our partnership with the clinic or other partner ends, the consents lapse automatically and you see this in your account.
• Log. We record every opening of the report and of the questionnaire through the partner's account — from which login, when and for which test — and keep the record for 1 year. On request we tell you when they were opened.
• The partner's staff. We process their data — name, position, work email, logins and the log — on the basis of our legitimate interest in performing the contract with the partner and keeping the system secure (Art. 6(1)(f) GDPR).
• Aggregated statistics on partners. To follow our work with the clinics and other partners, we count the tests from their kits by sex and age group. We take sex and age from the general data in the questionnaire; we do not use your health answers (symptoms, conditions, medicines, etc.) for this. We use only aggregated numbers, without names, and we do not show groups of fewer than 3 people. Only our team sees the statistics; partners do not. Basis: our legitimate interest in managing the partnerships (Art. 6(1)(f) GDPR).

17. Your rights

• Access (Art. 15) — to find out whether we process data about you, to obtain a copy of it and information about its purposes, recipients, retention periods and source.
• Rectification (Art. 16) — of inaccurate or incomplete data. You can change most of it yourself in your account.
• Erasure (Art. 17) — the account can also be deleted directly from the account. The exceptions are data the law requires us to keep and data needed for defence in a dispute — we keep those only for that purpose and only for the necessary period.
• Restriction (Art. 18) — for example while we check the accuracy of the data or the basis for processing it.
• Portability (Art. 20) — a copy of the data you gave us in a machine-readable format. From the account: “Export my data” — profile, orders, tests, questionnaires, consents and reports.
• Objection (Art. 21) — to processing based on legitimate interest; to direct marketing — always and without giving a reason.
• Withdrawal of consent (Art. 7(3)) — at any time, as easily as it was given. It does not affect the lawfulness of processing before the withdrawal.
• Explanation and human review (Art. 22) — of the way your report was prepared.

How: write to info@bugspeaks.bg (subject “Data protection”) or use your account. We reply within 1 month; for complex requests the period may be extended by a further 2 months, in which case we will tell you within the first month. It is free of charge — except for manifestly unfounded or excessive requests (Art. 12(5)). Before disclosing data we may ask you to confirm your identity — never with more information than necessary.

18. Are you obliged to give us data

By law — no. The order and delivery data, however, are needed to conclude and perform the contract — without them we cannot deliver the product to you. The consent for health data and the questionnaire are needed for the analysis — without them we cannot prepare the report. The newsletter, the quiz, the reservation, Bugsy and the statistics are entirely optional.

19. Complaints

If you believe we are infringing your rights, please write to us first at info@bugspeaks.bg — we will deal with it as a priority. You have the right to lodge a complaint with the Commission for Personal Data Protection (КЗЛД): 2 Prof. Tsvetan Lazarov Blvd. (бул. „Проф. Цветан Лазаров“ № 2), Sofia 1592, kzld@cpdp.bg, tel. +359 2 91 53 519, www.cpdp.bg — or with the supervisory authority of the EU country where you live or work. You can also seek a remedy before the courts (GDPR, Art. 79).

20. Changes to this policy

We update the policy when our services or the law change. The date of the latest version is at the top of the page. We will notify you in advance of significant changes — by email if you have an account, and on the site. You can request earlier versions at info@bugspeaks.bg.

The policy is drawn up in Bulgarian. The English translation is for convenience — in case of any discrepancy, the Bulgarian text prevails.