Health data and consent

Laboratory results, biomarker values, wearable and device metrics, sleep and activity data, body measurements, conditions, medications and supplements you record, uploaded documents such as lab PDFs, and anything derived from them — including a calculator result computed from your own values.

GDPR together with the Ley Orgánica 3/2018 (LOPDGDD) treats this as a special or sensitive category, which is why it has its own notice, its own consent, its own database and its own audit trail.

Health data is a special category under Article 9. We process it only on your explicit consent, given per purpose and per recipient, and recorded with a timestamp and the policy version you agreed to. Consent is the basis, so withdrawing it stops the processing. Account and billing data is processed to perform our contract with you; security logging rests on our legitimate interest in keeping the service safe.

There is no single “I agree to health data” checkbox. You consent separately to each of these, and each one can be withdrawn on its own:

Each consent is recorded with what you agreed to, when, from where, and which version of this notice was in force. You can see that record and every entry in it from your settings — including the reads: if a clinician opened your data, you can see who and when.

• Turn off any single scope or source in your settings, and it stops immediately.
• Revoke a clinic’s access in one action. The clinic loses access the moment you do.
• Delete individual results, a whole source, or everything.
• Delete your account, which deletes all of it.

Withdrawing stops future processing. It does not undo what was lawful while the consent was in force, and it cannot pull back data a clinic already received — that clinic is its own controller and has its own retention duties, often set by medical-records law. We tell you that before you share, not afterwards.

• Sell it. Not raw, not aggregated, not de-identified, not as a statistic sold to a third party.
• Give it to an insurer, an employer, or anyone making a decision about your money or your job.
• Use it for advertising, or to build an audience segment, on this site or anywhere else.
• Use it to train a general-purpose model. Anything we train on is de-identified, aggregated, and only with separate opt-in consent that is off by default.
• Send it to an analytics service. The analytics pipeline has no access to the health database at all — that is a code boundary with a build-time check, not a policy.
• Let a staff member browse it. Access requires a clinical relationship you created, multi-factor authentication, and a logged reason.

Health data for this market is stored in the European Union and is not replicated outside it. Where a sub-processor is outside the EEA, the transfer runs on the European Commission’s standard contractual clauses plus a transfer impact assessment, and we name the sub-processors in the privacy notice.

When you share data with a clinic through the Health Data Hub, you choose the scopes and the period. The clinic sees exactly what you granted and nothing else, and the grant appears in your settings with an expiry you can shorten at any time.

From the moment it receives the data, the clinic is responsible for it as a controller in its own right, and it is clinically responsible for what it does with it. We do not interpret your results for a clinician, we do not triage them, and receiving data through us does not create a duty on our part to notice something in it. That is stated in the provider terms too, so both sides have been told the same thing.

If health data is exposed, we will tell the affected people directly and without undue delay, and we will tell the relevant regulator within the deadline that applies here — 72 hours where the regime sets one. The notice will say what happened, what data, what we have done and what you should do. We will not wait for a full forensic picture before telling you something is wrong.

You are covered by GDPR together with the Ley Orgánica 3/2018 (LOPDGDD). Under it you can:

Where to send a request

Data subject requests: privacy@longlifelist.com. Access, correction, deletion, restriction, objection and portability. We verify identity before acting, because handing your health data to someone who says they are you would be the larger failure.

Data Protection Officer: dpo@longlifelist.com. The statutory contact under Article 37 of the GDPR. Use this route for anything you do not want going through general support, including a complaint about how we have handled a request. We publish a role address rather than an individual’s name so the route keeps working when the person in the role changes.

How long we take: One month from receiving a verified request, extendable by two further months for complex requests — we tell you inside the first month if we need the extension and why.

If we get it wrong

• Agencia Española de Protección de Datos (AEPD)
• Your national data protection authority (find yours via the European Data Protection Board) — You may complain to the authority in the country where you live or work. You do not have to contact us first.