Consumer Health Data Privacy Policy

We collect these kinds of health information:

• Lab results: the values, the dates, and which lab or health system they came from.
• Medical records you connect or upload: for example conditions, medications, and results from the health systems you connect, and the files you upload.
• Wearable data: sleep, heart rate, heart rate variability, and activity from the devices you connect.
• What you tell us: for example your age, sex, height, weight, and health goals.

We use it to:

• Build your Care Team Brief and your report, and show your trends over time.
• Let you share your brief or your records with people you choose.
• Keep your account secure and answer your requests.

We also use de-identified, combined data to improve the service, as set out in section 8.9 of our EULA. We will not collect more kinds of health information, or use what we have for a new purpose, without asking you first.

• You: what you upload, type in, or tell us.
• The health systems you connect, such as your patient portal.
• The wearable devices you connect.

We collect from these sources only after you upload, connect, or enter the information.

• With the service providers that run Phi Longevity: the health information you give us, so it can be stored and analyzed for you.
• With the people you choose: only what you put in a share link or a records packet. A Care Team Brief link shows your name, age and sex, and the results, trends and checks on your one-page brief. A records packet is one PDF with your brief, your lab results, any blood pressure readings you imported, a summary of your wearable data, conditions and medications from health-record files you uploaded, and the documents you tick.

• Our service providers. Google Cloud stores your records and runs the analysis. Our payment and email providers handle your account and billing details; we do not send them your records.
• The people you choose, such as your doctor or someone on your care team, through a share link or packet that you create.
• Affiliates: none. We do not share your health information with any affiliate.
• The law: if a court order or other legal duty requires it, we may have to give information to authorities. We tell you first when the law lets us.

We do not sell your health information, and we share it only with the service providers that run Phi Longevity and with the people you choose.

• We take nothing of value in exchange for your health information.
• We do not use your health information for targeted advertising.

• See and download: sign in, go to Account, and choose “Export My Data”.
• Ask us whether we collect or share your health information, and who we shared it with: email support@philongevity.com.
• Delete: sign in, go to Account, and choose “Delete My Account”, or email us. We delete your health documents and personal data within 30 days.
• Stop a share: open “My health record shared links” and stop any link, any time, in one click.
• Withdraw your consent: stopping a share withdraws your consent to that share. To withdraw your consent to our collecting or using your health information, email support@philongevity.com or delete your account.
• If we say no to a request, you can appeal. Reply to our answer, or email us, and say you want to appeal. We answer your appeal in writing.

We answer requests without undue delay, and always within 45 days. If a request is complex, we may take up to 45 more days, and we will tell you why.

Sharing is your choice, and it is separate from using Phi Longevity. You can say no and still use everything else.

• Nothing is shared until you tick the box and create a link. The box starts unticked.
• You decide who gets the link, and you send it yourself.
• A link works for 7 days unless you pick a different time.
• You can add a 6-digit access code.
• We tell you each time your link is opened.
• You can stop it with one click from “My health record shared links”.

What stopping can and cannot do: it ends the link right away. It cannot take back a copy someone already saved or printed. An office that downloads a PDF will usually keep its own copy.

We store your records in HIPAA-eligible systems under a signed business associate agreement with Google Cloud, and we protect them to that standard.

Your information is encrypted while it travels and while it is stored. Our staff can reach it only when their work requires it, and we keep a log when they do.

If your health information is ever obtained by someone you did not approve, we will tell you, and we will tell regulators, as the law requires.

If you think a link reached someone you did not mean to share it with, stop it from “My health record shared links” and email us. We will look into it and tell you when it was opened.

The analysis of your records runs on Google Cloud, under the business associate agreement described above. We do not use your identifiable health records to train AI models.

Phi Longevity is not for anyone under 18. We do not knowingly collect health information from children.

When we change this policy, we post the new version here with a new version number and date. For changes that matter, we email you at least 30 days before they take effect. This is version CHDP-2026-10-12, effective October 12, 2026.

Questions or requests about your health information: support@philongevity.com. We aim to reply within 5 business days.