Privacy Policy

Overview

LongevityGraph (“we”, “us”, “our”) operates the longevitygraph.ai website and service. This policy explains what data we collect, how we use it, and your rights regarding that data.

The short version: We collect the health data you give us to provide the service. We don’t sell it. We don’t show you ads. We don’t share it with data brokers. Your health data is yours.

What We Collect

Account Information

• Email address (for login and communications)
• Name (optional, for personalization)
• Password hash (if using email/password login)
• Google account ID (if using Google Sign-In)
• Apple account ID and an encrypted Apple sign-in token (if using Sign in with Apple). We keep the token only so we can revoke LongevityGraph’s access with Apple when you delete your account.

Health Data You Provide

• Biomarker lab results (entered manually, imported from CSV/PDF, or synced from Function Health)
• Supplement stack (names, dosages, timing)
• Medical conditions and medications
• Treatment and intervention history
• Genetic data (23andMe or AncestryDNA uploads)
• Health goals and targets
• Medical documents (lab reports, DEXA scans, clinical notes)
• Health profile (age, sex, weight, height, lifestyle factors)

Data From Connected Services

• Wearable data from Oura Ring, WHOOP, or Apple Health (sleep, HRV, heart rate, activity)
• Clinical Health Records lab results from Apple Health, if you turn on import for that signed-in account (see Clinical Health Records)
• Biomarker data from Function Health API sync. To connect Function Health, you give us your Function Health email and password, because Function Health does not offer a sign-in link for other apps. We store them encrypted, use them only to import your lab results, and delete them when you disconnect Function Health.
• Google Calendar data when an EMR provider connects their calendar (see Google API Services and Limited Use)

Technical Data

• IP address and browser user agent (for security and rate limiting)
• Login timestamps (for account security)
• Usage patterns (which features you use — no third-party analytics)

How We Use Your Data

• To provide the service: Your health data powers the AI analysis, trend tracking, supplement grading, disease risk scoring, and all other features.
• AI processing: Health information can be sent to Anthropic and OpenAI for document and lab import analysis, information retrieval, chat responses, personalized health insights, and supplement analysis. After lab results are stored, including a Clinical Records import, the service can generate biomarker insights and refresh related reports automatically. You can also use chat to ask a question. The information sent can include profile details and goals, messages and attachments, labs and documents, medications and supplements, and connected wearable and clinical records. AI providers process data per their API terms and do not use API inputs for training. Google user data obtained via Google APIs is subject to the Limited Use commitments below and is not used to train foundational or generalized AI/ML models.
• Crisis messages: If a chat message mentions suicide, self-harm, harm to others, abuse, or a medical emergency, chat replies with fixed crisis resources (988, 911, and the Crisis Text Line) instead of an AI answer. A message that matches our built-in crisis wording gets that reply without being sent to an AI provider; other messages are first checked by an Anthropic model. Crisis messages stay in your chat history like any other message, and they are not used to personalize later answers.
• Reporting a chat answer: If you use “Report this response”, we store the reason you choose, any note you add, and a link to that answer, so our team can review it.
• Communications: We send you emails you’ve opted into — daily supplement reminders, weekly health digests, and service updates.
• Security: We use technical data to detect abuse, enforce rate limits, and protect your account.

Permission in the iOS App

Before the iOS app uploads health information, it asks for explicit permission to share with Anthropic and OpenAI. That permission covers automatic insights and reports after an upload, and it covers chat. It is separate from Apple Health permissions, the Clinical Records import switch, and the medical information disclaimer. You can decline and return to sign-in, or delete your account without accepting AI sharing. In Settings → AI Data Sharing, you can stop new health information transfers from that app installation and sign out. This does not delete information already uploaded or cancel processing already started; use account deletion to request removal of your account and data.

Clinical Health Records

On the iOS app, Clinical Records lab-result import stays off until you turn it on for the signed-in account. Turning it on uses Apple’s system permission to read Clinical Records. While you are signed in and import is on, the app can upload those lab results automatically when the app is in the foreground, and you can sync manually.

We store the parsed lab results with your biomarker tests and results. We also keep an Apple Health sync record that has no file attached. This import does not store the raw clinical record in file storage. When new results are stored, the service can automatically send selected results to Anthropic or OpenAI to write personalized biomarker insights, and it can refresh related reports. Selection is for results that are out of range or marked high clinical significance, and a biomarker that already has an insight for that same result date is skipped. That can happen without you opening chat. Chat stays available when you choose to ask a question. The iOS app collects the Anthropic and OpenAI sharing permission before the upload, as described under Permission in the iOS App.

A signed-in provider at a practice can open these results with your other lab results when your account is an active patient of that practice. Provider pages require a provider session, and a patient chart is available when you are an active patient of that provider’s practice.

In Connections, Stop importing stops future uploads from that installation. It does not delete results already stored, and it does not revoke Apple’s Health read permission. You change that permission in Apple’s settings. Stopping import does not cancel a transfer that has already reached our service. Apple does not disclose to the app whether you granted or denied that read permission.

AI Apps You Connect (MCP)

You can connect an AI app, such as Claude (Anthropic), ChatGPT (OpenAI), or another app that supports the Model Context Protocol (MCP), to your LongevityGraph record.

• Nothing is shared until you sign in to LongevityGraph from that app and approve it. You choose its permissions when you approve it.
• Once approved, the app can request the parts of your record its permissions cover: lab results, wearable data, functional measurements, genetic results, medications, supplements, and documents and notes shared with you. If you allow it, the app can also add entries to your record.
• Data you share this way is sent at your direction. The company that runs the app handles it under its own privacy policy and terms, not this policy.
• You can see your connected apps, and disconnect any of them at any time, in the iOS app (Settings → Connections → AI apps) or in Settings on the web. Disconnecting ends the app’s access right away. Entries it already added stay in your record.

What We Don’t Do

• We do not sell your data to anyone.
• We do not serve ads or share data with advertising networks.
• We do not use third-party analytics in the app (no Google Analytics, no Mixpanel, no tracking pixels).
• Our marketing pages use cookieless, aggregate analytics. The app and patient data are never measured by third parties.
• We do not share your health data with insurers, employers, or data brokers.

Text Messaging (SMS)

If you opt in, your healthcare practice can text you through LongevityGraph. Opting in is entirely optional and is never a condition of purchasing, using, or receiving any LongevityGraph product, service, or care — you can decline or revoke consent at any time with no effect on your care, and everything we would text you is also available in the app. You opt in by checking an explicit, un-pre-selected consent box (“I agree to receive text messages from my practice”) and verifying your mobile number with a one-time code; we send texts only after you have completed both steps. These are conversational, care-related messages: appointment and visit updates, medication and prescription-refill coordination, lab and result notifications, care check-ins, and replies to questions you send. We do not send marketing or promotional texts.

We do not share or sell your mobile phone number, SMS opt-in, or text-messaging consent with any third party, and we do not share that information with third parties or affiliates for their own marketing or promotional purposes. Mobile information is used only to operate the messaging service you opted into (including our messaging provider, Twilio, which transmits the messages on our behalf).

Message frequency varies based on your care. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help. You can also manage or revoke consent anytime in Settings → Messaging.

Data Storage and Security

• Account and health data in the active service is stored in an encrypted database on private infrastructure in AWS us-east-2 (Ohio).
• Passwords are hashed using bcrypt.
• Session tokens are SHA-256 hashed before storage.
• API keys are stored as SHA-256 hashes (plaintext shown once, never stored).
• Encrypted automated database backups allow point-in-time recovery for the previous 7 days.
• All connections use TLS encryption in transit.
• File uploads are validated (content-type, magic bytes, size limits) and stored in AWS object storage in us-east-2. Those objects use AWS KMS encryption by default, and public access is blocked. Noncurrent versions of those objects expire after 30 days. Clinical Records import does not place a raw clinical file in that store; other uploads can.

Data Retention and Deletion

• Your data is retained as long as your account is active.
• You can delete your account from Settings. Deletion removes the account from the active service, including biomarker tests and results, documents, wearable and Clinical Records connections, genetic uploads, chat history, and the account information that deletion covers.
• If you signed in with Apple, deleting your account also asks Apple to revoke LongevityGraph’s access. Your account is deleted even if Apple cannot be reached.
• We keep a sign-in security log (sign-in times, account-deletion events, and related security events) after deletion, to protect the service and investigate abuse. It contains no health data.
• Encrypted database backups used for point-in-time recovery can still contain data from before deletion for 7 days. Prior versions of uploaded files expire after 30 days. Files kept on our application server (documents and photos) are also copied to an encrypted backup each night; after deletion, those backup copies expire within 90 days.
• Waitlist email addresses are retained until you unsubscribe or your account is created.

Third-Party Services

We use the following services to operate LongevityGraph:

Google API Services and Limited Use

LongevityGraph uses Google APIs for:

• Sign-In: Google account identifier and email for authentication.
• Google Calendar (EMR providers who connect a calendar): create, update, and delete only LongevityGraph-originated events on the connected calendar (calendar.events.owned), and read free/busy availability (calendar.freebusy) for scheduling and conflict detection. Event content we push to Google is minimized (for example visit-type label, patient initials, and an EMR deep link)—not full clinical notes or free-text visit reasons. OAuth tokens for connected calendars are stored encrypted at rest and used only to provide these features.

Limited Use. The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use, transfer, or sell Google user data (including raw, aggregated, or derived data) to create, train, or improve foundational or generalized machine learning or artificial intelligence models. We do not retain Google Workspace or Calendar user data obtained through Google APIs for developing, improving, or training non-personalized AI/ML models. Google user data is used only to provide or improve user-facing features that are visible and prominent in LongevityGraph (sign-in and calendar sync / availability).

AI features in LongevityGraph (for example health insights via third-party model providers such as Anthropic) process data you or your practice put into LongevityGraph under this Privacy Policy and applicable agreements; those providers process data under their API terms and do not use API inputs for model training where that is their stated API policy. Google user data obtained via Google APIs is not used to create, train, or improve foundational or generalized AI/ML models.

We do not transfer or sell Google user data to advertising platforms, data brokers, or information resellers, and we do not use Google user data for advertising, credit-worthiness, or lending purposes.

Healthcare Provider Data

If you use LongevityGraph as a healthcare provider, we also process clinical encounter data, patient records, and practice management data within our EMR system. This data is subject to the same security and privacy protections described above.

HIPAA and Healthcare Providers

LongevityGraph serves two audiences under Multos Annos Inc:

• Individuals using LongevityGraph for personal health tracking are not establishing a provider–patient relationship with us. We are not a HIPAA covered entity for that personal-tracking use. Strong security practices still apply; LongevityGraph is not a substitute for professional medical care.
• Health care practices using the LongevityGraph EMR engage Multos Annos Inc as a business associate under HIPAA. PHI handled for those customers is governed by our Business Associate Agreement, which is incorporated into the Provider Terms of Service. Where those Terms conflict with the BAA with respect to PHI, the BAA controls.

We do not market a third-party “HIPAA certification.” Our obligations for provider customers are those of a business associate under the BAA and applicable law.

Your Rights

• Access: You can view all your data within the application at any time.
• Export: You can export your biomarker data as CSV and your full dataset as JSON.
• Deletion: You can delete your account from Settings. That removes it from the active service, as described under Data Retention and Deletion. Encrypted backups are not erased at the same moment.
• Communications: You can opt out of all non-essential emails from Settings.

Contact

For privacy questions or data requests, email [email protected].

Changes

We may update this policy as the product evolves. Material changes will be communicated via email to active users. The “last updated” date at the top reflects the most recent revision.