HerLongevityLab is operated by Gallivan Limited ("we", "us", "our"), a company registered in England and Wales (company number 13818938), registered address: 37 Olivia Drive, Leigh on Sea, Essex, SS9 3EF.

We are the "data controller" for the personal information described in this policy. If you have any questions, contact us at [email protected].

Information you give us:

• Your contact details — your first name and email address.
• Your health and wellbeing check-in answers — for example how you've slept, your mood, energy, physical symptoms and other information you choose to enter in your weekly check-in. This is "special category" data (information about your health), which the law gives extra protection.
• Any free-text notes you choose to add to a check-in.

Information collected automatically or by our providers:

• Payment information — your subscription payments are processed by Stripe. We do not see or store your full card details; Stripe handles those securely on our behalf.
• Basic technical/usage data — such as the fact that you opened or completed a check-in, used to operate the service.

We do not ask for and do not want your full medical records, NHS number, or clinical test results.

• Your name & email — to create your account, send your reports and service emails. Lawful basis: performance of our contract with you.
• Your check-in answers (health data) — to generate your personalised report and doctor-ready summary. Lawful basis: your explicit consent, which you give when you submit a check-in.
• Your email address — to send you weekly reminders and service updates. Lawful basis: consent / our legitimate interest in operating the service.
• Payment details (via Stripe) — to take your subscription payment. Lawful basis: performance of our contract; legal obligation (accounting).

Because your check-in answers include health information, we only process them on the basis of your explicit consent (Article 9(2)(a) UK GDPR). You can withdraw that consent at any time (see section 7) — though if you do, we can no longer produce your reports.

Your reports are generated with the help of artificial intelligence (AI). Your check-in answers are processed by an AI model to draft your personalised report and doctor-ready summary. This processing:

• organises and reflects back the information you have given us;
• does not make any medical diagnosis or treatment decision;
• does not produce any legal or similarly significant decision about you.

A human-designed set of rules guides the AI to use careful, non-diagnostic language. Your reports are for information and self-tracking only — see our Terms of Service.

We do not sell your data. We share it only with trusted providers who help us run the service, under contracts that require them to protect it:

• Stripe — payment processing.
• Resend — sending your report and reminder emails.
• Tally — collecting your check-in answers via our online form.
• Anthropic — providing the AI model that helps draft your report.

Some of these providers may process data outside the UK (for example in the United States). Where they do, we rely on safeguards approved under UK data protection law (such as the UK International Data Transfer Addendum or Standard Contractual Clauses) to keep your information protected.

We may also disclose information if required by law, or to establish, exercise or defend legal claims.

• We keep your check-in answers and reports for as long as you are a member, so we can show you your trends over time.
• If you cancel, we keep your data for a limited period in case you return, and then delete or anonymise it. You can ask us to delete it sooner (see section 7).
• We keep basic payment and transaction records for as long as the law requires (generally 6 years for tax purposes).

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• correct information that is wrong or incomplete;
• erase your data ("right to be forgotten");
• restrict or object to our use of it;
• withdraw consent at any time (this won't affect processing we did before you withdrew);
• data portability — receive your data in a usable format.

To exercise any of these, email [email protected] and we'll respond within one month.

You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO) — www.ico.org.uk — though we'd be grateful for the chance to put things right first.

We use reputable providers, restrict access to your data, and use secure connections. No online service can be guaranteed 100% secure, but we take reasonable steps to protect your information.

Our website uses only the cookies necessary to make it work and, where applicable, basic analytics. We do not use your check-in data for advertising.

HerLongevityLab is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18.

We may update this policy from time to time. If we make significant changes, we'll let you know by email or on our website. The "last updated" date at the top shows the current version.

Gallivan Limited, trading as HerLongevityLab

Email: [email protected]

Registered address: 37 Olivia Drive, Leigh on Sea, Essex, SS9 3EF