Version of 2026-10-17
Longevio is a personal health-analytics tool. This notice says what it holds about you, why, for how long, and what you can do about it. It covers longevio.ai, longevio.app, the Longevio app for iPhone and the transactional email the service sends.
The controller is Digital One Technology Consulting Limited, 6-9 Trinity Street, Dublin 2, D02 EY47, Ireland. Contact: info@digital1.one.
No data protection officer is designated. Longevio is a private instance with a small number of accounts, so the Article 37 threshold is not met; write to the contact address above.
Sign-in is provided by Digital One ID, operated by the controller, so there is no second controller: the same company operates the identity service and Longevio.
Identity: your email address and the identity-provider subject id; the version of the terms you accepted and the time; your confirmation that you are old enough, and the time.
Health data (special category, Article 9): readings from the services you connect — Whoop (recovery, cycles, sleep, workouts), Ōura (daily summaries and heart rate), Withings (scale and blood-pressure readings), Apple Health (an export you upload, a continuous push of eight named metrics from an automation, or the iPhone app described below; anything else in the payload is dropped at the door). Connecting a service reads back up to twelve months.
Health data you type: diary scores and tags, supplements, medications and experiments, lifestyle answers (education, smoking, alcohol, sauna, steps, diet, social contact), your birth date, height, sex and country, waist and functional measurements, goals and their daily snapshots, coach conversations and the notes the coach saves, and any product list you paste.
The iPhone app: with your permission, it reads from Apple Health the types you allow (weight, body composition, heart rate, resting heart rate, heart-rate variability, blood pressure, blood glucose, steps, VO2max, sleep and workouts) and sends them to Longevio as it does for any other source. It never writes to Apple Health. It keeps your sign-in, the address Apple gives the phone for notifications, the point each Apple Health type was last synced to, and your unsent coach messages in the iOS Keychain, on that device only. It asks longevio.app for signed updates to the app; those requests carry the app’s version and platform, and no account data. The app contains no analytics, no crash reporter and no advertising identifier.
Activity: the days you opened the app — one row per day, nothing else in it — drawn as the seven-day tick in the header and kept for 90 days. It is recorded for every account unless you switch it off under Settings → Features & tracking.
Notifications: the reminders and messages the app has sent you, naming a product or a person and a time, kept 30 days. Each is a row you can read in the app; where you have allowed them, a push notification is one way that row also reaches a device, and the queue it goes through holds the same title and body for 30 days at most.
Email delivery: a queued message and its outcome — the address, which of the three account templates it is, and whether it was sent or failed. The body is deleted the moment the message is sent, and no message Longevio sends carries a reading. A permanent delivery failure also records that the address is suppressed, so nothing further is sent to it.
Technical: the browser user agent recorded on a consent record; web-server logs to be confirmed: log retention period; and, on the invitation request form, a hash of your IP address salted with a key that rotates daily, so it cannot be linked back after 24 hours.
To open and run your account, sign you in and keep the service secure — Article 6(1)(b), performance of the contract, and Article 6(1)(f), our legitimate interest in security. The balancing test is on file.
To draw the seven-day tick in the header — the days you opened the app, one row per day and nothing else in it — Article 6(1)(b), performance of the contract: it is part of the service you signed up for, it is not health data, and the switch under Settings → Features & tracking stops the recording for your account.
To analyse your own record and show you your own analytics — your explicit consent, Article 9(2)(a) together with Article 6(1)(a). This is what the product does, so without it there is nothing to show; your account still exists, and you can withdraw at any time.
To run the AI coach and read product labels into rows — a separate explicit consent, asked the first time you use either. Declining leaves the rest of Longevio working.
To show label formulations matched to a signal you choose — part of the analytics consent. The matching runs on your device, nothing is ranked for you, and there are no affiliate links.
To send the invitation, the welcome message and account notices, including a notice that someone has asked to connect with you — Article 6(1)(b). None of these carries a reading. There is no marketing list.
To remind you of your own schedule and to tell you what another person or the app has done — the notification rows you read in the app, and the push notifications that carry them to a device you have allowed them on — Article 6(1)(b), performance of the contract: reminders are part of the service you signed up for. A reminder names a product, a person or a measurement and a time, and carries no reading. Every kind can be turned down or off in the app, and a device can be silenced on its own.
Longevio sent a daily readout of your own figures by email until 15 September 2026, under a separate explicit consent, Article 9(2)(a) with Article 6(1)(a). That email has been deleted, the consent has been withdrawn for every account that held one, and no email Longevio sends now carries a reading. The consent records themselves are kept as evidence, on the schedule below.
Longevio makes no automated decision with legal or similarly significant effect (Article 22). Every figure it shows is labelled measured, user-reported, calculated, evidence-supported or speculative, and is informational.
to be confirmed: hosting provider, legal name — Hosting of the application, its database and its nightly backups. The service runs on one server, and the backups are kept on that same server. to be confirmed: server country, inside the EEA.
Anthropic PBC — The AI coach, product enrichment and reading a pasted product list into rows. United States. Standard contractual clauses (Module 2) under the Anthropic data processing addendum. API data is not used to train models under the commercial terms. to be confirmed: DPA date, transfer impact assessment date, input retention period, and whether zero data retention was granted
Resend, Inc. — Delivery of email: the invitation, the welcome message, and a notice that someone has asked to connect with you or accepted your request. Longevio sends no other email, and none of these carries a reading from your record. United States. Standard contractual clauses under the Resend data processing addendum. No health data is transferred: what leaves is an email address, a link, and — on a connection notice — the name of the person who asked. Open and click tracking are disabled, so the provider records no reading of the message. No supplement, medication or experiment is named in any message. A daily readout of your own figures was sent by email until 15 September 2026; it was the one message that transferred health data (Article 9) to the United States, it has been deleted, and the consent it ran on has been withdrawn for every account that held one. to be confirmed: DPA date, transfer impact assessment date, sending region, and how long Resend retains message content
Apple and the browser push services. A notification you have allowed goes from Longevio to Apple Push Notification service on an iPhone, or to the push service of your browser’s vendor (Google, Apple or Mozilla) in a browser, and from there to your device. Its title and body name a product, a person or a measurement and a time, and carry no reading. Apple and the browser vendors deliver the message; they are not given your record.
Whoop, Ōura, Withings and Apple Health are sources you connect, not recipients: data flows from them to Longevio. Access to each is read-only and can be revoked in Longevio, at the vendor, and for Apple Health in the iPhone’s Settings › Health.
Nothing is sold, and nothing is shared for anyone else’s purposes.
Two processors are in the United States: Anthropic PBC, for the AI coach and product research, and Resend, Inc., for email. Both are covered by standard contractual clauses, and a transfer impact assessment is on file for each. Only one of them can receive health data, and only on your explicit consent: the coach transfer under the AI consent. Without it, the only thing that leaves the EEA is an email address, a link and the name of someone asking to connect.
Email is not encrypted end to end, and that is why no email Longevio sends carries a reading. Until 15 September 2026 a daily readout did, under its own consent; it has been deleted. A copy that reached your mailbox before then is held by whoever operates that mailbox, on their terms and not on Longevio’s, and Longevio cannot reach it. Your figures are in the app.
Web fonts are served from Longevio’s own domain, so no font provider sees your IP address.
Your record: for the life of the account.
Raw device payloads: 24 months. Imported free text: 30 days. Client diagnostic logs: 30 days.
Backups: rolling snapshots; a deleted account falls out within 14 days, and the deletion is re-applied automatically after any restore.
Invitations: 90 days after expiry. Invitation requests: 90 days. Sent or failed email: 30 days; the body of a sent message is deleted at the moment of sending. A suppression record — the address a message permanently failed to reach — is kept for the life of the account, because it is what stops Longevio writing to a dead mailbox again.
Notifications: 30 days, both the row you read in the app and the queued push it was sent through, on the same clock as email for the same reason — a message that has been delivered has no further purpose, and neither should carry a product name longer than that. One thing outlives them: a one-way fingerprint of what has already been announced, so something meant to be said once is not said again after the message itself is deleted. Nothing can be read back out of it — no product, no person, no figure. Withdrawing the health consent deletes those fingerprints with the rest of the record, and deleting your account removes everything at once.
Accountability records: 24 months. Consent records: five years after the account is deleted, with the account identifier removed, because they are the evidence that consent was given and withdrawn.
Everything is served over TLS. Sign-in is single sign-on; session cookies are httpOnly and Secure. The service runs on one single-tenant server in the EU. Data is scoped per user and a test asserts that no other user’s value can appear in a response. No third-party scripts run in the app. Vendor credentials are encrypted at rest and ingest keys are stored only as hashes. No reading leaves that server by email: what is queued for the mail provider is an address, a link and, on a connection notice, a name, passed over TLS. The subject line and the preview text of an email carry no figure either. A push notification is different: its title and body name a product, a person or a measurement and a time, and a banner is read by a locked screen — which is what the switch for each kind, and the quiet hours beside it, are there to control. On an iPhone, the sign-in and the other device keys are kept in the iOS Keychain, on that device only; they do not move to another device through iCloud Keychain or a restore. to be confirmed: confirm disk and backup encryption on the server
You can see and export everything Longevio holds about you (Settings → Privacy → Export), correct it in the app, delete your account, restrict or object to processing, take your data elsewhere as JSON, and withdraw either consent at any time — as easily as you gave it, without affecting what was done before.
Withdrawing the health consent erases your health record and keeps your account. Deleting the account removes every row that belongs to you.
If you think something is wrong, write to info@digital1.one; you can also complain to the Data Protection Commission (Ireland), dataprotection.ie.
Longevio accepts accounts from age 16. You confirm this when the account is opened, and the birth date you give is checked against it. An account found to be below the threshold has its health consent withdrawn and its health record erased.
This notice is versioned and dated. A change that affects what you consented to is re-consented in the app, with a summary of what changed.