How Expressive Uses AI Without Exposing User Data

Expressive is built on a strict architectural separation between user genomic data and AI-generated content. At no point does any AI model receive, process, or have access to a user's genetic information.

Ingestion and variant mapping

When a user uploads a raw DNA file from 23andMe, AncestryDNA, MyHeritage, or a direct sequencing provider, Expressive's ingestion pipeline parses the file, extracts the variant calls (rsid and alleles), and maps them to variants already indexed in our database. The raw file is discarded immediately after this mapping step. What remains in our system is not the user's raw genetic file. It is a set of references to variants that already exist in our independently maintained variant index, associated with the user's account.

Deterministic scoring

The variant index is built entirely from public research databases: GWAS Catalog, ClinVar, PharmGKB, and PubMed/PMC. Every variant in our index carries deterministic metadata including study associations, effect sizes, p-values, replication counts, and evidence-weighted magnitude scores computed from these sources before any user ever uploads a file. When a user's report is generated, we join their variant references against this pre-scored index. The scoring pipeline is a database join, not an inference step. No model is invoked during report generation.

How AI is actually used

AI models in Expressive operate exclusively on the content database, a body of scientific literature and study data that contains no user information whatsoever. The process works as follows:

For each SNP or gene in our index, we run a retrieval-augmented generation pipeline that reads the available studies for that variant one at a time and produces plain-English summaries of what each study found. These summaries describe the science, including population-level associations, effect sizes, and biological mechanisms, not any individual's genetic profile.

Once individual study summaries exist for a given SNP or gene, a second generation pass synthesizes them into a consolidated plain-English description of what the current body of evidence says about that variant. This gives users a clear, readable explanation of the research without requiring them to parse scientific papers.

This entire process runs in isolation. It has no connection to the user database. It does not know which users carry any given variant. It produces content that describes the science, and that content is stored in the content database indexed by rsid and gene, not by user.

Report delivery

When a user views their report, the application joins their variant references against the pre-scored variant index and the pre-generated content database. The user sees their genotype, the deterministic magnitude score derived from the research, and the plain-English study summaries. All three of those things existed before the user's report was generated and none of them were produced with knowledge of the user's identity or genetic profile.

What this means in practice

No AI model ever receives a prompt containing a user's genetic variants, health data, or any personally identifiable information. The AI layer is a content generation system that runs on public scientific literature. The user data layer is a secure, HIPAA-compliant database that AI never touches. The report is the product of joining these two completely separate systems at read time. One has never seen a user, and one has never seen an AI model.

Want updates when we ship new variant pages or a research deep-dive? Read the latest issue or get notified about early access.