Privacy Policy

This Privacy Policy describes how Phi Longevity, LLC (“Phi Longevity,” “we,” “our,” or “us”) collects, uses, stores, and protects your information when you use our website at philongevity.com and our health intelligence platform (collectively, the “Service”). It also describes your rights regarding your data and how to exercise them.

By using the Service, you agree to the practices described in this policy. If you don’t agree, please don’t use the Service.

Information You Provide Directly

Account information: When you create an account, we collect your name, email address, and password (stored as a secure hash — we never store your plain-text password).

Health documents: You may upload health-related files including lab results (PDFs, images, structured data), wearable exports, imaging reports, genetic test summaries, and similar documents. This is the core of what the Service analyzes.

Profile information: Optional health context you choose to provide, such as age, sex assigned at birth, height, weight, and health goals. The more context you provide, the more relevant your analysis.

Payment information: If you subscribe to a paid plan, payment is processed by Stripe. We do not store your credit card number. We receive a payment confirmation token and your billing address for tax purposes.

Communications: If you contact us by email or through our support system, we retain that correspondence.

Information Collected Automatically

Usage data: We collect information about how you interact with the Service — pages visited, features used, time spent, and actions taken. This helps us improve the product.

Device and technical data: Browser type, operating system, IP address, and device identifiers. We use this for security, fraud prevention, and debugging.

Cookies and similar technologies: We use session cookies to keep you logged in and, on our public pages only, analytics cookies (Google Analytics) to understand usage patterns. Signed-in pages load no analytics. You can disable cookies in your browser settings, though some features may not work correctly.

We use your information to:

• ✓Provide the Service — analyze your health data and generate personalized reports and recommendations
• ✓Improve the Service — understand how people use the platform so we can make it better
• ✓Communicate with you — send account notifications, support responses, and (if you opt in) product updates and health insights
• ✓Ensure security — detect fraud, prevent unauthorized access, and protect the integrity of the Service
• ✓Comply with legal obligations — respond to lawful requests from authorities where required

We do not use your health data to train AI or machine learning models without your explicit consent. Data we receive from Google Health is never used to train AI models.

Your data is stored on Google Cloud Platform infrastructure (Firebase/Firestore and Cloud Storage) in the United States. Google Cloud maintains SOC 2 Type II certification and ISO 27001 compliance.

Phi Longevity is not a healthcare provider or a "covered entity" under HIPAA for your personal account. We store your records in HIPAA-eligible systems under a signed business associate agreement with Google Cloud, and we protect them to that standard. You can ask us to delete your data at any time.

We do not sell your health information, and we share it only with the service providers that run Phi Longevity and with the people you choose. Phi Longevity is a health data intelligence tool: your relationship with us is that of a software user, not a patient-provider relationship, and we strongly recommend keeping your formal healthcare relationships with licensed providers.

For the kinds of health information we collect, why, where it comes from, who it is shared with, and how to see it, share it, stop sharing it, or delete it, read our Consumer health data privacy policy.

If you choose to connect Google Health, we read three kinds of data from your Google account, read-only: activity (daily steps), sleep (duration and stages), and health metrics (resting heart rate, heart rate variability, blood oxygen and breathing rate). We never write to your Google account.

How we use it: to show your daily metrics and trends, and to include them, alongside your lab results, in your analysis and your Care Team Brief. Our AI analyzes the data in our own secure cloud environment to personalize your recommendations. It is never used to train AI models.

When it is shared: only when you choose to. If you share your Care Team Brief with a clinician or family member, they can see what you shared. If you connect your own AI assistant to Phi Longevity, that assistant can see these numbers as part of your summary. We do not sell this data, use it for advertising or credit decisions, or transfer it to data brokers.

Service providers: the data is stored and processed on Google Cloud, our hosting provider, under contract. Our AI analysis runs on Google Cloud’s Vertex AI inside our own cloud project. Service providers may use the data only to run Phi Longevity for you, never for their own purposes or to train their AI models. We may also disclose it when the law requires.

How it is protected: encrypted in transit (TLS 1.2 or higher) and at rest (AES-256) on Google Cloud in the United States, reachable only through your signed-in account, with role-based staff access and audit logs. See “How Your Data Is Stored and Protected” above.

People at Phi Longevity: no one reads your Google Health data except with your permission, to investigate security issues, to comply with the law, or in aggregated, de-identified form to run the service.

Keeping and deleting it: we keep it while Google Health is connected. Disconnecting Google Health in your account deletes the Google Health readings we stored. Reports already created with them stay in your account until you delete them, and deleting your account deletes all of your data. You can also remove Phi Longevity’s access from your Google account settings at any time.

Phi Longevity's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you choose to connect Garmin, you sign in on Garmin’s own page and choose what to share. Garmin then sends us new data each time your device syncs, starting from the day you connect: daily steps and resting heart rate, sleep (duration, stages and sleep score), overnight heart rate variability, and blood oxygen. We keep only those values, not the detailed second-by-second data Garmin sends with them. We never write to your Garmin account.

How we use it: the same way as the other wearables above: to show your daily metrics and trends, and to include them, alongside your lab results, in your analysis and your Care Team Brief. It is never used to train AI models, never sold, and never used for advertising.

Shared, stored and protected exactly as described for Google Health data above: only when you choose to share, on Google Cloud in the United States, encrypted in transit and at rest.

Disconnecting: disconnecting Garmin in your Phi Longevity account tells Garmin to stop sending data and deletes the Garmin data we stored. If you remove Phi Longevity in Garmin Connect instead, Garmin tells us and we delete it the same way. If you turn off data sharing in Garmin Connect, we stop using new Garmin data. Deleting your account deletes all of your data.

We offer a public interface at philongevity.com/mcp, philongevity.com/mcp-app and philongevity.com/mcp-chatgpt that AI assistants can call. It is meant only for synthetic or de-identified example values; please do not send identifiable health information through it. We process the values in a request only to produce that response, and we do not store them. If an assistant creates a claim link, the values are held for up to 30 minutes so you can add them to your account, then deleted. For reliability and abuse prevention we log operational events: which tool was used, counts, timings and errors. These are tied to a short one-way code derived from your network address and browser that changes daily, and we never log raw IP addresses. If you follow a link from an AI assistant to create an account, the link may carry a campaign tag so we know which channel you came from. Your account data is then covered by the rest of this policy. The ChatGPT-directory interface (philongevity.com/mcp-chatgpt) creates no claim links and adds no campaign tags.

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we’ve collected information from a child under 18, we will delete it immediately. If you believe we’ve done so, please contact us at support@philongevity.com.

We may update this policy from time to time. When we do, we’ll update the “Last Updated” date at the top. For material changes, we’ll notify you by email at least 30 days before they take effect. Your continued use of the Service after the effective date means you accept the updated policy.

If you have questions, concerns, or requests related to your privacy:

We aim to respond to all privacy inquiries within 5 business days.