Trust & Data Stewardship

Phi Longevity is not a healthcare provider or a "covered entity" under HIPAA for your personal account. We store your records in HIPAA-eligible systems under a signed business associate agreement with Google Cloud, and we protect them to that standard. You can ask us to delete your data at any time.

Your records are stored in HIPAA-eligible Google Cloud services (Firestore, Google Cloud Healthcare API FHIR store, and Cloud Storage) under a signed Google Cloud HIPAA Business Associate Agreement. AI analysis of your records runs on US-pinned Vertex AI endpoints covered by the same agreement.

Your health data is analyzed to produce your report. We do not sell your health information, and we share it only with the service providers that run Phi Longevity and with the people you choose. We do not use your identifiable health records to train AI models; analysis happens at inference time, per request, inside the BAA-covered boundary. The only further use is internal: de-identified, aggregated data to improve the service, as set out in section 8.9 of our EULA.

Delete your account and your records at any time. Deletion removes your records from our live systems right away; copies in our backups expire on their normal schedule.

Deleting your account runs a single authoritative purge: your Firestore records and subcollections, your FHIR clinical store entries (Patient and Observations), your uploaded files in Cloud Storage, your exports, and your authentication record. Active subscriptions are cancelled as part of the same flow. This is a real mechanism, live in production — not a support-ticket promise.

Request a full export any time from your account; we send it to you. It covers your profile, analyses, the canonical FHIR record, and a manifest of your uploads with time-limited download links. Credentials and tokens are redacted from exports by construction.

Phi Longevity operates public tool surfaces for AI agents (MCP and A2A). These surfaces are for synthetic or de-identified inputs only and return previews, scores, and methodology. Public assistant tools never receive personal health information. Your own assistant sees your record only after you approve it on a permission page, and you can end that at any time.

Our agent identity is verifiable: the A2A agent card is cryptographically signed (ES256), with the public key served at /.well-known/jwks.json. Agent-readable site orientation lives at /llms.txt.

No lab values, diagnoses or file contents in our logs or analytics; upload telemetry records only whether an upload step succeeded or failed. Website analytics (Google Analytics) run on our public pages only, never on signed-in pages.

Recommendations carry citations to clinical guidelines and published research. Prescription and controlled therapies are never issued as directives — at most, the report suggests a question to ask your clinician. A practicing physician graded a 30-item sample of our recommendations against the evidence they cite (completed August 2026). The 30 items were made-up cases, graded once by one physician consultant; no clinician reviews individual reports. Our reports state confidence and data coverage honestly, including when data is too old or too thin to score.

Human subscriptions run on Stripe, on our own domain. We are merchant of record; card details never touch our servers.

Security or privacy questions: support@philongevity.com. See also our Privacy Policy, Consumer health data privacy policy, and Terms.