API Terms of Service

About these terms

These API Terms of Service (the "API Terms") govern your access to and use of the Genome Computer API, SDKs, hosted connection flow, and related developer services (the "Service"), operated by Genetic Superintelligence Company ("we," "us"). A separate signed enterprise or commercial agreement controls to the extent of any conflict with these API Terms.

These API Terms are a business-to-business agreement between Genetic Superintelligence Company and the organization that signs up for API access ("you," the "Customer"). They incorporate our Privacy Policy and the Documentation by reference. Our consumer Terms of Service govern an End User's Genome Computer account, direct purchases, and consumer services, including purchases made through our hosted connection flow. These API Terms govern your integration and use of data the End User authorizes us to share with Your Application.

The Service uses customer-authorized connections. It does not provide partner-submitted sample processing, genomic file uploads, or sequencing orders placed by you on an End User's behalf.

Acceptance

You accept these API Terms by signing up for API access, generating or using an API key, or otherwise using the Service. If you accept on behalf of an organization, you represent that you are authorized to bind that organization. The version of these API Terms in effect when an API request is made governs that request. You must be a business entity, or an individual acting in a business capacity, and at least 18 years of age.

Definitions

End User - an individual who uses our hosted flow to connect their genome or sequencing order to Your Application.

Genomic Data - genetic data and data derived from it relating to an End User, including genomic files, .genome bundles, interpretation artifacts, insight panels, answers, and context.

Output - the insight panels, processed .genome bundles, and other results made available through the Service within an End User's Access Permissions.

Your Application or Connected Application - the product, app, or system you operate and integrate with the Service.

Genome Connection - the connection between Your Application and an End User's selected genome or sequencing order, established through our hosted flow.

Access Permissions - the specific access authorized by the End User for Your Application, subject to the capabilities enabled for your integration and the current status of that authorization.

Documentation - the API reference, guides, and policies published at docs.genome.computer.

The Service

The Service lets Your Application create a Genome Connection and direct an End User to a Genome Computer hosted flow. The End User signs in with Genome Computer, selects an existing genome or eligible order, or purchases sequencing directly from us, and decides whether to authorize Your Application. Subject to Access Permissions and enabled capabilities, Your Application can follow progress, access genomic insights, and download a processed .genome bundle, as described in the Documentation.

A connection may await the End User's decision or the availability of their genome. Creating a connection, completing payment, or returning to Your Application does not by itself establish permission or mean that genomic results are ready. Your Application must use the current access and permission status returned by the Service.

We may add, change, or remove features in line with our published versioning and deprecation policy. You must follow the required request formats, limits, and behavior described in the Documentation.

API keys and account security

API keys and webhook signing secrets are confidential credentials. You are responsible for keeping them secret, for all activity that occurs under your keys, and for restricting access to authorized personnel on a least-privilege basis. Scope keys to the minimum endpoints you need, rotate them periodically, and revoke and reissue any key you believe may be compromised. You must notify us promptly at api@genome.computer if you discover any unauthorized use of your keys or account.

Onboarding information

On signup and on reasonable request, you will provide accurate information about your legal entity, jurisdictions of operation, intended use of the Service, the categories of End Users you serve, and any regulatory authorizations, professional registrations, or licenses relied on for your offering. You will notify us promptly of material changes to that information. We may require additional verification, refuse onboarding, or restrict access where your stated use case raises material regulatory or compliance concerns.

Your security responsibilities

You are responsible for the security of Genomic Data and Output once it is in your systems. At a minimum, you must:

• keep production API keys server-side only, and never embed them in browser, mobile, or other client-side code where they could be extracted;
• verify the signature on every webhook we send before acting on it, using the signing secret we provide;
• encrypt Genomic Data and Output that you store, enforce least-privilege access to it, and not expose it publicly or to unauthorized parties;
• maintain access and activity logs sufficient to investigate a security incident; and
• notify us promptly at api@genome.computer of any actual or suspected incident involving your API keys, Genomic Data, or Output.

Staging and production environments

The staging/sandbox environment (keys prefixed gc_test_) is for integration testing only. You must not upload, submit, or process any real Genomic Data, personal data, or production customer data in staging. Synthetic test fixtures are provided for this purpose.

The production environment (keys prefixed gc_live_) is for live Genome Connections and authorized access to real Genomic Data. You may process real Genomic Data in production only after completing production onboarding and only in accordance with these API Terms, including the Access Permissions and consent obligations below. We may require additional verification before enabling production access.

Hosted authorization and consent

We provide the hosted sign-in and permission flow and collect and record the End User's decision about access by the named Connected Application. We are responsible for the notices and consents required for the Genome Computer services we provide directly to the End User. You remain responsible for Your Application, the purposes for which it uses data, and the notices and consents required for those purposes.

Before requesting a connection, you must:

• accurately identify Your Application and its operating legal entity, and provide a current privacy notice and contact details;
• clearly explain the data and permissions you request, why you need them, how you use and retain the data, and any onward disclosures;
• request only the access necessary for the purposes disclosed to the End User, and obtain any additional consent required for Your Application's processing, including separate express consent for distinct purposes or disclosures where required by law;
• provide an accessible way to contact you, withdraw consent to your processing, and exercise data-protection rights; and
• maintain dated records of the notices and consents for which you are responsible, and provide evidence of compliance on reasonable request.

Acceptance of these API Terms, an End User's purchase, or their use of Your Application does not replace their authorization through our hosted flow. You must not impersonate an End User, accept on their behalf, misrepresent the permission request, or bypass that flow. You must not use the Service to obtain access to data relating to a minor or an individual who has not given the required authorization.

Access Permissions and permitted use

An API key authenticates your integration; it does not grant access to an End User's genome. Creating a Genome Connection or possessing a connection identifier likewise does not grant access. Your access depends on the End User's active Access Permissions and the capabilities enabled for your organization.

Permission to connect a genome and follow progress does not by itself authorize insight access or bundle downloads. Those capabilities require the corresponding Access Permissions. Permission for one genome, End User, or Connected Application does not extend to another. Additional permissions require a new authorization through the hosted flow.

You may access, use, and retain Genomic Data and Output only for the purposes disclosed to and authorized by the End User, in accordance with these API Terms and applicable law. A technical ability to retrieve data is not permission to use it for a different purpose. A change to your privacy notice alone does not expand an existing authorization.

You must protect connection links, tokens, and signed download links as confidential access information. Use opaque user references in connection requests, rather than names, email addresses, or other direct identifiers, and return URLs approved for your integration. You are responsible for associating each connection with the correct user of Your Application and for preventing access by other users.

Disconnection, retention, and deletion

End Users may disconnect Your Application through their Genome Computer account settings. Withdrawal of an Access Permission ends future access under that permission. You must honor revoked or declined permissions and must not attempt to restore access without a new authorization from the End User.

When authorization is withdrawn, you must promptly stop the affected access and any use that depends on that authorization. You must delete copies, cached Output, and derived records retained solely for the withdrawn purpose, and require your service providers to do the same, unless retention is required by law. Any legally required retained data must remain protected and may be used only for that legal purpose and deleted when the requirement ends. You must explain these retention practices to the End User and comply with applicable response deadlines.

Disconnection does not retrieve copies already downloaded to Your Application. You remain responsible for those copies and for honoring applicable withdrawal and deletion requests. Do not represent that disconnecting automatically erases data from your systems.

Declining or withdrawing app access does not itself cancel or refund a sequencing order or subscription, close the End User's Genome Computer account, or delete their genome held by us. Those actions are handled separately under our consumer Terms of Service and Privacy Policy. This also applies when an End User declines app access after completing a purchase in the hosted flow. You must make this distinction clear in Your Application.

Texas residents

Pending completion of our compliance measures under the Texas Genomic Act of 2025, you must not request or use a Genome Connection or access Genomic Data through the Service relating to an End User who is a resident of, or located in, the State of Texas. You are responsible for determining and confirming that the End Users for whom you request connections do not fall within this restriction. We may update or remove this restriction once our compliance measures are in place.

Data protection and responsibilities

We handle the End User's Genome Computer account, sequencing services, hosted genome, and authorized disclosures under our consumer Terms of Service, Privacy Policy, and the End User's instructions and consents. You are responsible for the personal data, Genomic Data, and Output received or otherwise processed by Your Application, including your storage, analysis, disclosures, and service providers. Each party must comply with the privacy and data-protection obligations applicable to its activities.

Purpose limitation. We do not sell End User Genomic Data or use identifiable End User Genomic Data to train AI models or license it to third parties. Disclosures to Your Application are limited by the End User's Access Permissions. You must not sell Genomic Data or Output or treat an access grant as consent to unrelated research, marketing, model training, or onward disclosure. Your service providers must be bound to protect the data and use it only to provide the services you are authorized to provide to that End User.

Confidentiality and security. Our personnel authorized to process the data are bound by confidentiality obligations. We maintain technical and organizational measures appropriate to the sensitivity of Genomic Data, including encryption in transit and at rest, least-privilege access controls, and audit logging, as described in our Privacy Policy. Your obligations are set out in "Your security responsibilities" above.

Service providers and transfers. Our Privacy Policy describes the providers involved in delivering Genome Computer services and our international data-transfer practices. You are responsible for appropriate protections for any service providers and international transfers used by Your Application.

End User requests. We handle requests concerning data held in the End User's Genome Computer account. You handle requests concerning data held by Your Application and its service providers. We will reasonably cooperate with each other on requests involving both services, including access, correction, portability, withdrawal, and deletion. You must not represent that an API agreement gives you authority to delete an End User's separate Genome Computer account or genome.

Breach notification. We will notify you without undue delay, and within 72 hours of confirmation, of a confirmed personal data breach in the Service affecting End User data shared with Your Application. You must promptly notify us of an actual or suspected incident involving the Service, your credentials, or data received through a Genome Connection, and reasonably cooperate in investigation and remediation. Each party remains responsible for notifications required of it by applicable law.

HIPAA and protected health information

The pay-as-you-go Service is not offered as a HIPAA covered entity or business associate, and no Business Associate Agreement (BAA) is provided for pay-as-you-go access. If you are a HIPAA covered entity or business associate, or otherwise need to transmit protected health information (PHI) subject to HIPAA, you must enter into a separate enterprise agreement and BAA with us before submitting such data. You represent and warrant that, unless and until such an agreement and BAA are in place, you will not submit PHI to the Service and will not use the Service as, or on behalf of, a HIPAA covered entity or business associate, including for any treatment, payment, or health-care-operations purpose. Clinical laboratory services within the Service are performed by accredited laboratory partners that hold the applicable clinical accreditations.

Acceptable use

You must use the Service lawfully and in accordance with the Documentation. You must not:

• attempt to re-identify, or enable the re-identification of, any individual beyond the processing you are authorized to perform;
• use Genomic Data or Output to make decisions that unlawfully discriminate against any individual, including in employment or insurance, contrary to the Genetic Information Nondiscrimination Act (GINA) or similar laws;
• use Genomic Data or Output for law-enforcement, forensic, familial-search, surveillance, or identification purposes, except under a separate written agreement with us;
• exceed the rate limits published in the Documentation or otherwise place an undue burden on the Service;
• circumvent, disable, or misrepresent the safety boundaries, evidence levels, or limitations returned by the Service;
• reverse-engineer the Service, the .genome format, or our interpretation logic, or use Output to build a competing interpretation database; or
• resell or sublicense raw API access, or probe, scan, or test the security of the Service without our prior written permission.

Clinical and medical boundary

The Service returns genomic data and bounded interpretation. It is not a medical device and does not provide diagnosis, dosing, prescriptions, or treatment recommendations. Output is framed for clinician review and carries explicit safety metadata. You are responsible for all user-facing claims, the design of any clinical workflow, obtaining clinician review where appropriate, and the regulatory compliance of Your Application. You must not present Output to End Users as a diagnosis, treatment, or dosing recommendation.

In addition, you must display the safety metadata and limitations returned with each Output unmodified, require clinician review in any clinical workflow, and not market or present Output for diagnosis, disease-risk prediction, carrier screening, pharmacogenomic dosing, or treatment decisions unless you hold the regulatory clearance or authorization required for that use in the applicable jurisdiction.

Pricing and payment

You pay the developer fees for API access and usage stated in your accepted pricing schedule or commercial agreement. Unless otherwise agreed, metered developer usage is billed monthly in arrears through Stripe to the card you keep on file, or by invoice where we have approved invoice billing. We do not see or store your raw card details. Applicable invoice payment terms are stated in your accepted pricing schedule or agreement. Prices exclude taxes, which you are responsible for. For card billing, you authorize us to charge your card for your developer fees and applicable taxes.

End User purchases made in our hosted flow are separate transactions between the End User and Genome Computer, at the prices and payment terms shown at checkout. Our consumer Terms of Service govern those purchases, including cancellation and refunds. Creating a Genome Connection does not make you liable for an End User's purchase unless you separately agree to pay for it. End User payments do not discharge developer fees you have separately agreed to pay.

We may change developer pricing on prior notice; changes apply to usage after the effective date. If payment fails or is overdue, we may suspend your production API access until payment is resolved. Consumed metered usage is non-refundable. You must raise any good-faith developer billing dispute within 30 days of the invoice date. Disconnecting an app does not itself cancel a separately billed subscription or reverse charges already incurred.

Availability and changes to the API

Pay-as-you-go access is provided on an "as available" basis without a service-level or uptime commitment; uptime commitments are available under an enterprise agreement. We may modify, version, or deprecate parts of the API. For production endpoints we will give notice and a migration window before removing an endpoint or field, in line with our versioning policy. New fields may be added to existing responses at any time, and your clients should ignore unknown fields. Staging and test endpoints may change without notice.

Intellectual property

As between you and us, we claim no ownership of End User Genomic Data or Output; your rights in that data are determined by your relationship with your End Users and their Access Permissions. A Genome Connection transfers no ownership of their data to you. We grant you a non-exclusive, non-transferable, revocable license to access the Service and to use the SDKs and Output within Your Application in accordance with these API Terms and the End User's authorization. General Ventures Pty Ltd owns the Genome Computer brand, the .genome format and specification (subject to any open-source or public licenses applicable to the .genome specification), the archetype system, the Human Operating Manual pipeline, the readmygenome.md skill, the Service software, models, Documentation, and all associated intellectual property. Genetic Superintelligence Company operates the Service under license from General Ventures Pty Ltd. We may create and use de-identified data derived from operating the Service, where "de-identified" means data that cannot reasonably be used to identify, and is not linked or reasonably linkable to, any End User; we will not attempt to re-identify it and will require any recipient to be bound by the same restriction. Consistent with our Privacy Policy and our public benefit charter, we do not sell or license identifiable End User Genomic Data, we do not sell, license, or commercially distribute de-identified End User genomic datasets, and we do not use identifiable End User Genomic Data to train AI models; we use de-identified data only for security, quality assurance, and improving the Service. If you send us feedback, suggestions, or bug reports, you grant us a perpetual, royalty-free, worldwide license to use it to improve the Service, with no obligation to you. You may not use our trademarks without prior written permission.

Confidentiality

Each party may receive non-public information from the other, including API keys, signing secrets, non-public pricing, and technical information marked or reasonably understood to be confidential. The receiving party will use it only to exercise its rights and perform its obligations under these API Terms and will protect it with at least reasonable care. This does not apply to information that is public through no fault of the receiving party or that is independently developed or lawfully received from a third party.

Suspension and termination

You may stop using the Service at any time. We may suspend or terminate your access, in whole or in part, for breach of these API Terms, non-payment, a credible security risk, suspected unlawful or unauthorized access or use, or where required by law. Where practical, we will give notice and an opportunity to cure.

On termination, your credentials and Your Application's access are revoked, and accrued developer fees become due. You must stop accessing the Service and handle data already received in accordance with "Disconnection, retention, and deletion" above. Ending your API agreement does not itself terminate an End User's separate agreement with Genome Computer, cancel their purchases, or delete their account or hosted genome.

Provisions that by their nature should survive termination will survive, including those on data use, retention and deletion, payment, confidentiality, intellectual property, disclaimers, liability, and indemnification.

Warranty disclaimer

The Service and all Output are provided "as is" and "as available." To the maximum extent permitted by law, Genetic Superintelligence Company disclaims all warranties, express or implied, including the implied warranties of merchantability, fitness for a particular purpose, and non-infringement, and does not warrant that the Service will be uninterrupted or error-free or that Output is fit for any medical, diagnostic, or clinical purpose.

Limitation of liability

To the maximum extent permitted by law, neither party is liable for any indirect, incidental, special, consequential, or exemplary damages, or for lost profits, revenue, or data, arising out of or related to these API Terms or the Service. Each party's total aggregate liability arising out of or related to these API Terms is limited to the total fees you paid to us for the Service in the 12 months before the event giving rise to the claim. These limits do not apply to your obligation to pay fees, your indemnification obligations, or to liability that cannot be limited under applicable law.

Indemnification

You will defend, indemnify, and hold harmless Genetic Superintelligence Company and its officers, employees, and agents from any third-party claim, loss, or expense (including reasonable legal fees) arising out of or related to Your Application and your user-facing claims; your failure to provide notices or obtain consents for which you are responsible under these API Terms; your access, use, retention, or disclosure of data beyond the End User's authorization; your failure to honor withdrawal or deletion obligations; your violation of applicable law; or your breach of these API Terms. This obligation does not extend to the extent a claim results from our breach of our own notice, consent, or data-protection obligations.

Compliance with laws

Each party will comply with the laws applicable to its performance under these API Terms. You will comply with applicable export-control and economic-sanctions laws and will not use the Service in an embargoed jurisdiction or as, or on behalf of, a sanctioned or denied party, and with applicable anti-corruption, genetic privacy, consumer health data, biometric, genetic-nondiscrimination, and data-protection laws.

Force majeure

We are not liable for any delay or failure to perform caused by events beyond our reasonable control, including laboratory outages, infrastructure or network outages, shipping disruption, natural disasters, pandemic-related disruption, or acts of government.

Changes to these API Terms

We may update these API Terms from time to time. Material changes will be notified by email before they take effect; non-material changes will be reflected in the "Last updated" date above. The version in effect when you make an API request governs that request, and your continued use of the Service after a change takes effect constitutes acceptance.

We will not materially expand our use or disclosure of End User Genomic Data already collected unless doing so is permitted by law and by the consents obtained for that data.

Assignment

You may not assign or transfer these API Terms without our written consent. We may assign these API Terms in connection with a merger, acquisition, reorganisation, or sale of assets without your consent.

Dispute resolution

These API Terms are governed by the laws of the State of Delaware, United States, without regard to its conflict of laws principles. Any dispute arising out of or related to these API Terms or the Service shall be brought exclusively in the state or federal courts located in Delaware, and you consent to the personal jurisdiction of those courts.

General

The parties are independent contractors, and these API Terms create no agency, partnership, or joint venture. There are no third-party beneficiaries, except as required by applicable law, the Standard Contractual Clauses where applicable. If any provision is found unenforceable, the remaining provisions remain in full force, and our failure to enforce a provision is not a waiver of it. These API Terms, together with our Privacy Policy, the Documentation, and any applicable order or enterprise agreement, are the entire agreement between you and Genetic Superintelligence Company regarding the Service.

About us

The Genome Computer API is operated by Genetic Superintelligence Company, a Delaware Public Benefit Corporation.

Contact

API questions: api@genome.computer. Privacy and deletion requests: contact@genome.computer.