Privacy Policy

A note on health data and HIPAA

LongXvity offers a direct-to-consumer technology platform and is not a healthcare provider. LongXvity is not acting as a covered entity or business associate under HIPAA in connection with the Services. However, certain information processed through the Services, such as laboratory results, telehealth records, and prescription-related information, may constitute Protected Health Information when handled by licensed healthcare providers and will be subject to applicable healthcare privacy laws in those contexts. Even where HIPAA does not apply, LongXvity voluntarily applies technical and organizational safeguards consistent with the HIPAA Security Rule and industry best practices.

Eligibility

To use the Services you must be at least eighteen (18) years old and a resident of the United States. We do not knowingly collect information from anyone under eighteen.

1. Personal Information we collect

We collect four broad types of information about you:

A. Information you give us directly

• Personal details: your name, email address, phone number, mailing address, date of birth, billing details, and account login credentials.
• Health data: your lab results, prescription details, telehealth records, and other medical and health-related data, including any genetic data produced by certain lab tests.
• Biometric information: physiological measurements such as heart rate variability, sleep patterns, activity levels, blood oxygen, and body temperature from wearable devices, and identifiers derived from lab tests such as blood biomarkers and hormone levels.
• Communications: the content of your messages with our care team and your email correspondence with us.
• Transaction information: details about purchases you make. We do not store payment card information ourselves; we rely on third-party payment processors.

B. Information we get from other sources

• Device and wearable data: when you connect a third-party device (such as an Apple Watch, Oura Ring, Fitbit, Whoop, Garmin, or Withings device), we collect health and fitness data synced from it. You can disconnect any device at any time in your settings.
• Lab testing data: blood panels, metabolic and hormone markers, nutrient levels, and other results performed by independent, CLIA-certified laboratories.
• Care team communications: the content of your interactions with our care team, which may include licensed healthcare professionals.

C. Information we collect automatically

• Inferences and scoring: proprietary health scores, longevity markers, and predicted health trajectories that we generate from your biological data.
• Usage data: device information, log information (access times, pages viewed, IP address), approximate location, and information collected through cookies and similar technologies.

D. Demographic information

We may collect aggregate demographic information (such as age, gender, and race) that does not individually identify you.

2. How we use your Personal Information

• To provide, maintain, and improve the Services, including facilitating lab tests, consultations, and fulfillment, and displaying results in your dashboard.
• To respond to your questions and provide customer support.
• To communicate with you about your account and important changes to the Services.
• To operate, personalize, and analyze the Services, and to detect and prevent fraud and security incidents.
• To develop and improve our predictive and AI models. AI tools are not used to make clinical decisions, diagnose conditions, or determine treatment.
• To send promotional communications, where permitted, which you may opt out of at any time.

Identifiable health-related information is not used for commercial purposes except as permitted by law or with your authorization. Any de-identification is performed in accordance with applicable legal standards.

3. How we share your Personal Information

We share Personal Information only as needed to provide the Services:

• Laboratory partners: independent CLIA-certified labs that perform your blood draws and testing.
• Telehealth providers: independent clinicians who deliver consultations and prescribing services, subject to their own privacy practices and healthcare privacy laws.
• Pharmacy partners: pharmacies that fulfill any prescriptions you receive.
• Wearable device providers:where data sharing is governed by the device provider’s own terms and privacy policy.
• Service providers: vendors that perform functions on our behalf such as hosting, data storage, payment processing, customer support, and analytics, contractually bound to protect your information.

We may also share information in connection with a merger, acquisition, or sale of assets, to comply with the law or a legal process, or to protect the rights, property, or safety of LongXvity, our users, and others. To the extent permitted by law, we may de-identify, aggregate, or anonymize Personal Information and share it without restriction; we do not attempt to re-identify such data.

4. Your privacy choices and rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a portable copy of your Personal Information, to restrict or opt out of certain processing (including targeted advertising, sale, and profiling), and to withdraw consent where we rely on it. You also have the right not to be subject to a decision based solely on automated processing that produces significant effects, and to request human review of such a decision.

• SMS communications: if you opt in, you can opt out at any time by replying STOP or contacting hello@longxvity.ai. We do not include medical results or prescription details in SMS.
• Cookies: you can set your browser to reject cookies and similar technologies, though some parts of the Services may not function properly as a result.
• Do Not Track: because we do not sell your Personal Information or share it for cross-context behavioral advertising, universal opt-out signals do not currently apply.

To exercise any of these rights, contact us at hello@longxvity.ai. We will verify your identity and respond within the timeframe required by applicable law. You may not receive discriminatory treatment for exercising your rights, and you may appeal a decision or file a complaint with your state attorney general or data protection authority.

5. Data security and retention

We implement reasonable technical, physical, and organizational safeguards, including encryption and access controls, designed to protect your Personal Information. No system is one hundred percent secure, and any transmission of information is at your own risk. In the event of a data breach, we will notify you and the applicable authorities as required by law.

We retain your Personal Information for as long as reasonably necessary to provide the Services, manage your relationship with us, and comply with our legal obligations, after which it is deleted or de-identified in accordance with our retention policies.

6. International transfers

Your Personal Information may be transferred to and processed in the United States or other countries, which may have different data protection laws. Where required, we implement appropriate safeguards for such transfers, including Standard Contractual Clauses or other lawful mechanisms.

7. Cookies and tracking technologies

We and certain third parties use cookies, local storage, web beacons, and similar technologies to operate the Services, remember your preferences, secure the platform, and understand usage. We do not use tracking technologies to collect or process health-related information for advertising purposes. You can control cookies through your browser settings. We use privacy-focused, cookieless analytics and observability tools that do not use cross-site tracking.

8. Children’s privacy

Our Services are directed at a general audience over eighteen (18) years old, and we do not knowingly collect Personal Information from anyone under eighteen. If you believe a child has provided us information, please contact us and we will delete it unless we are legally required to retain it.

9. State-specific privacy rights

Residents of California, Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws have additional rights regarding their Personal Information, including the rights to know, access, correct, delete, and opt out of sale, sharing, and certain profiling. We do not sell your Personal Information for monetary consideration, and we do not share it for cross-context behavioral advertising. Washington and Nevada residents have specific rights regarding consumer health data under applicable health data laws; we do not use geofencing around healthcare facilities to collect or sell such data. To exercise any of these rights, contact us at hello@longxvity.ai.

10. Disclaimers

• Supplements: statements regarding supplements offered through LongXvity have not been evaluated by the Food and Drug Administration and are not intended to diagnose, treat, cure, or prevent any disease.
• Devices: our platform integrates with third-party devices, and we are not responsible for inaccuracies in third-party device data or reporting.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. Updates will be posted on this page with a new effective date. Your continued use of the Services after changes are posted constitutes acceptance.

12. Contact

For questions about our privacy practices, or to make a request or complaint, contact us at hello@longxvity.ai.