Health data and consent

Laboratory results, biomarker values, wearable and device metrics, sleep and activity data, body measurements, conditions, medications and supplements you record, uploaded documents such as lab PDFs, and anything derived from them — including a calculator result computed from your own values.

HIPAA where we act as a business associate of a covered entity, plus US state privacy law treats this as a special or sensitive category, which is why it has its own notice, its own consent, its own database and its own audit trail.

Consumer health data is collected only with your separate, specific, opt-in consent, obtained before collection and recorded per purpose. That is the Washington My Health My Data standard, and we apply it across the US rather than only to Washington residents, because running two consent models would guarantee we eventually apply the wrong one.

There is no single “I agree to health data” checkbox. You consent separately to each of these, and each one can be withdrawn on its own:

Each consent is recorded with what you agreed to, when, from where, and which version of this notice was in force. You can see that record and every entry in it from your settings — including the reads: if a clinician opened your data, you can see who and when.

• Turn off any single scope or source in your settings, and it stops immediately.
• Revoke a clinic’s access in one action. The clinic loses access the moment you do.
• Delete individual results, a whole source, or everything.
• Delete your account, which deletes all of it.

Withdrawing stops future processing. It does not undo what was lawful while the consent was in force, and it cannot pull back data a clinic already received — that clinic is its own controller and has its own retention duties, often set by medical-records law. We tell you that before you share, not afterwards.

• Sell it. Not raw, not aggregated, not de-identified, not as a statistic sold to a third party.
• Give it to an insurer, an employer, or anyone making a decision about your money or your job.
• Use it for advertising, or to build an audience segment, on this site or anywhere else.
• Use it to train a general-purpose model. Anything we train on is de-identified, aggregated, and only with separate opt-in consent that is off by default.
• Send it to an analytics service. The analytics pipeline has no access to the health database at all — that is a code boundary with a build-time check, not a policy.
• Let a staff member browse it. Access requires a clinical relationship you created, multi-factor authentication, and a logged reason.

Health data for this market is stored in the United States. Where a clinic engages us as a business associate, that processing is additionally governed by a signed Business Associate Agreement.

When you share data with a clinic through the Health Data Hub, you choose the scopes and the period. The clinic sees exactly what you granted and nothing else, and the grant appears in your settings with an expiry you can shorten at any time.

From the moment it receives the data, the clinic is responsible for it as a controller in its own right, and it is clinically responsible for what it does with it. We do not interpret your results for a clinician, we do not triage them, and receiving data through us does not create a duty on our part to notice something in it. That is stated in the provider terms too, so both sides have been told the same thing.

If health data is exposed, we will tell the affected people directly and without undue delay, and we will tell the relevant regulator within the deadline that applies here — which for US health app data is the FTC Health Breach Notification Rule, plus HIPAA where a Business Associate Agreement is in place, plus state breach laws. The notice will say what happened, what data, what we have done and what you should do. We will not wait for a full forensic picture before telling you something is wrong.

You are covered by HIPAA where we act as a business associate of a covered entity, plus US state privacy law. Under it you can:

Where to send a request

Privacy requests: privacy@longlifelist.com. Access, correction, deletion, and the Washington My Health My Data consumer health data right to withdraw consent and delete. We verify identity before acting.

How long we take: Within 45 days of a verified request, extendable once by a further 45 days with notice — the common denominator of the state laws, applied to everyone in the US rather than only where it is mandatory.

If we get it wrong

• Federal Trade Commission — For unfair or deceptive practices, including under the Health Breach Notification Rule.
• Your state Attorney General — State privacy laws are enforced by state Attorneys General.
• HHS Office for Civil Rights — For HIPAA complaints, where a covered entity or its business associate is involved.