Privacy policy.

HELIOS BRAIN SOCIETE ANONYME ("Helios Brain", "we", "us") is a Greek Société Anonyme registered in ΓΕΜΗ under number 190904001000, with registered office at Kifisias Avenue 265, 14561 Kifisia, Greece. We are the data controller for personal data processed through this website and in the course of our customer engagements, unless explicitly stated otherwise.

On this website we collect: (a) data you voluntarily provide through forms, including decision briefs (name, email, organisation, objective, constraints and stakeholders); (b) minimal technical data necessary to deliver the site; (c) AI demo prompts, chat messages, generated responses and random session references when you choose to generate a plan or talk to Helios; and (d) optional analytics signals only where consent is given. Do not enter confidential, personal, patient, financial-account or classified information into the public AI demos or chat. We do not run third-party advertising trackers.

Lawful bases under GDPR Article 6: contact-form submissions are processed under Article 6(1)(b) (steps prior to entering into a contract) and Article 6(1)(f) (our legitimate interest in responding to inquiries); visitor-initiated AI demo and chat interactions under Article 6(1)(f) (our legitimate interest in providing the requested interactive demonstration); minimal technical data under Article 6(1)(f); analytics where applicable under Article 6(1)(a) (consent). Customer-engagement data is processed under contract.

Where Helios Brain operates a substrate inside a customer institution, that customer is the data controller for the personal data processed by that substrate. Helios Brain acts as a data processor under a Data Processing Agreement. Customer data does not leave the European data perimeter of the deploying institution. We do not aggregate customer data across institutions. We do not use customer data to train shared models.

Contact-form and decision-brief submissions: up to 24 months from last interaction, then deleted or anonymised. Temporary AI demo records are scheduled for automatic deletion after 24 hours; chat records expire 24 hours after the last completed exchange. New conversation in the chat clears its saved conversation from our database. Only completed exchanges are retained. This local retention period does not determine the model provider's processing or retention terms. Technical logs: up to 90 days. Analytics: as defined per provider, never beyond 14 months. Customer-engagement data: as agreed with the relevant customer. You may request earlier deletion at any time.

Website services include hosting, email infrastructure and enquiry handling. When you request an AI demo or talk to Helios, your prompt and limited prior conversation context are sent to OpenAI through our AI integration service to generate the response. The public chat and demos are separate from a customer's private Helios deployment: they do not inherit that deployment's data-residency or confidentiality guarantees. Applicable provider processing terms govern that external processing. We do not sell personal data or share it for third-party marketing.

Under GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 11523 Athens, Greece. To exercise your rights, write to hello@heliosbrain.com. We respond within 30 days.

We use a minimal set of strictly necessary cookies for site delivery. The AI chat stores a random conversation reference in your browser tab's session storage, not the message transcript, so the conversation can continue across pages and reloads in that tab. Starting a new conversation removes that reference. Analytics or preference cookies, where applicable, are loaded only after your consent through the cookie banner. You can change your choice at any time by clearing cookies in your browser or contacting hello@heliosbrain.com.

We apply technical and organisational measures appropriate to the risk: TLS in transit, encryption at rest for sensitive data, least-privilege access controls, periodic adversarial review, and a documented incident response procedure. Vulnerability reports are welcome at hello@heliosbrain.com.

We may update this policy. The effective date is shown at the foot of the page. Material changes affecting your rights will be communicated by email where we have your address, otherwise by a clear notice on this site.