Privacy Policy

1. Who we are

LongevityMate is a biomarker tracking and education platform that helps you understand your blood test results and monitor trends over time. The Service may include AI-generated insights and reports.

Contact: hello@longevitymate.com

2. The information we collect

We collect information in a few categories:

3. How we use your information

• Provide, operate, and improve the Service
• Generate dashboards, reports, recommendations, and personalised insights
• Import and summarize data you authorize through Apple Health or Health Connect
• Store biomarker history, account settings, consent records, and uploaded report data in your account
• Run AI-powered features only when you enable them, such as AI reports, Mate, and lab extraction
• Carry out account requests you authorize through a connected assistant, retain change history, and send permitted change notifications when you choose an ongoing monitor
• Validate an uploaded DNA file and produce supported educational findings when you explicitly enable Genetic Blueprint
• Keep informational DNA findings separate from Mate, My Plan, personalized reports and recommendations
• Maintain security, prevent fraud, and stop bot/spam abuse
• Process subscriptions and manage billing status
• Communicate with you about account updates and support
• Analyse usage to improve reliability and user experience
• Comply with legal obligations and enforce Terms

4. Legal bases (EEA/UK)

• Contract – to provide the Service you requested
• Legitimate interests – to secure and improve the Service
• Consent – where required (including explicit consent for genetic and other special-category data, and consent for certain cookies or marketing emails)
• Legal obligation – when law requires it

5. How we share information

We do not sell your personal information. We share data only as needed to provide the Service and only with service providers or parties described below:

• Supabase for application infrastructure, database storage (Postgres), authentication, and related storage
• Stripe or other payment processors for subscription and billing workflows
• Approved AI providers, such as OpenAI, Gemini, or Grok, only when you enable AI analysis and use AI-powered features such as AI reports, Mate, or lab extraction
• Customer support, email, analytics, and security providers as needed
• Legal or safety requests when required by law
• Business transactions (merger, acquisition, or reorganization) with safeguards

We require third-party service providers to protect data using the same or equivalent safeguards that we require for our own systems and to use the data only for the contracted service.

We do not send your raw DNA upload to advertising or analytics providers, or include the raw file in prompts to AI providers. We do not use genetic data for advertising, sell it, or use it for research or model training. A future research program, if ever offered, would require a separate, specific opt-in.

Assistants you choose to connect

Connecting an assistant authorizes us to share the selected account information with that service for your requested tasks. Its own storage, privacy and account settings apply to information it receives. This is separate from AI processing performed inside LongevityMate. Existing source consent, feature availability and account entitlements continue to apply; connecting an assistant does not override them.

Ongoing change notifications require their own permission and a monitoring task you request. They contain record identifiers, a change version and timing information, not measurements or document contents. The assistant must request the current record using its permitted access. These notifications are not an emergency-monitoring service.

Connection access lasts up to 90 days and can be disconnected earlier from Agent connections. Disconnecting stops new account requests and future change notifications. It cannot recall data already received by an external service or a request already sent. An issued original-file download link may still work for up to 60 seconds, and an issued upload link may still accept file bytes for up to two hours. New finalization and processing require current permission. Agent-generated report downloads check current permission again when opened. Changes already saved to your account remain after disconnecting.

6. Cookies and tracking

We use cookies for essential functions, remembering preferences, and analytics. Control them via your browser.

We may use first-party aggregate heatmap analytics on public website pages to understand clicks and scroll depth. This does not record session videos, form values, private dashboard pages, uploaded health data, or report contents.

7. Data security

We use encryption, access controls, and monitoring to protect your information. No method is 100% secure.

Structured account, biomarker, report, wearable, and consent data is stored in Supabase-backed Postgres. Genetic metadata, supported findings, and consent records are stored there as well. Uploaded files and generated assets may also be stored in private cloud storage tied to that infrastructure.

8. Data retention

We retain information only as long as needed to provide the Service, comply with law, or resolve disputes.

You can request deletion of your account, AI chat history, or connected health data controls from within the product or by contacting support.

Personal-agent request logs record tool names, timing and outcomes, rather than the contents of health results, and are scheduled for deletion after 30 days. Change-notification delivery metadata is kept for a seven-day replay window, with expired delivery state removed by scheduled cleanup. Saved account changes, operation receipts, and record history are retained with the account so you can understand and correct changes; disconnecting an assistant does not erase them. These records remain subject to the account deletion and legal retention rules in this policy. An external assistant's retained copy is governed by that provider's own policy and controls.

An unfinished support screenshot upload through an assistant expires 24 hours after it is prepared; retrying does not extend that period. Temporary files that were never attached to a support ticket become eligible for scheduled removal after 27 hours, allowing issued upload links and transfers to expire. Screenshots already attached to a ticket remain with the support record under this policy.

For Genetic Blueprint, the raw source file is temporary: we delete it after successful processing. Failed, interrupted, or abandoned raw uploads are placed on an automatic 24-hour expiry after the upload session begins. We keep only the supported marker matches needed to substantiate your findings, the derived explanations, quality and coverage receipts, and consent records. Those records remain in your account until you delete Genetic Blueprint data, withdraw genetic-data processing consent, delete your account, or retention is otherwise required by law.

A deletion removes genetic content from the active product systems. Residual encrypted backup copies, where they exist, are isolated from normal use and age out under our infrastructure provider's backup-retention schedule unless the law requires longer retention.

9. Your rights and choices

You may request access, correction, deletion, portability, restriction, objection, or consent withdrawal.

Genetic Blueprint has separate controls. You can delete all Genetic Blueprint data. Informational findings are not used by Mate, My Plan or reports. Withdrawing genetic-data processing consent deletes the blueprint and stops its future use without deleting your other health data. Withdrawing consent does not make earlier lawful processing unlawful.

Email requests to hello@longevitymate.com. We may need to verify your identity.

You can unsubscribe from marketing emails at any time. Service emails may still be sent.

10. International transfers

Your information may be processed in other countries. We use safeguards required by law for transfers.

11. Children

The Service isn’t intended for children under 13 (or the minimum legal age). Contact us if you believe a child provided data.

12. Changes

We may update this Privacy Policy. We’ll update the “Last updated” date and provide notice for material changes.

13. Contact

Questions or requests: hello@longevitymate.com