Privacy Policy

1. Data Controller

Longevia is a brand owned by What Flows You Consultoria e Mentoria LTDA, registered under CNPJ No. 53.562.199/0001-08, with its registered office in the city of São Paulo, State of São Paulo, hereinafter the Controller.

Data Protection Officer: Stephanie Uemura.

• E-mail: platform@longevia.io
• Postal address: Rua Paracatu 846 — São Paulo SP / 04302-022

2. Data We Collect

• Account: e-mail address.
• Family health history: data entered voluntarily into the family health tree (pre-existing conditions per family member).
• App activity: episodes listened to, quiz results, activity days (streaks).
• Device data: technical information collected by Supabase (IP address, browser type) for authentication and security.

3. Legal Basis (LGPD Art. 7 and 11)

• Consent (Art. 7, I and Art. 11, I): for the collection and processing of family health data.
• Legitimate interest (Art. 7, IX): for analysing app usage and improving the service.
• Performance of a contract (Art. 7, V): for providing the contracted services.

Specific consent for sensitive data is recorded in the Consent Term, which details purposes, sharing and rights.

4. How We Use Data

• To personalise your learning path based on your family health data.
• To record progress, streaks and achievements.
• To send service-related notifications (never third-party advertising).

We do not sell your data. We do not use your data for advertising.

5. Automated Decisions (Art. 20)

The data you provide may be submitted to automated analysis and classification in order to issue personalised health and lifestyle recommendations. You may at any time request clarification, review or human intervention regarding decisions taken solely on the basis of automated processing.

6. Data Sharing

Your data is processed by the following sub-processors:

• Supabase Inc. — database and authentication (SOC 2 Type II, servers on AWS us-east-1).
• Vercel Inc. — application hosting.

We do not share data with other third parties except where required by law. Under no circumstances is data sold.

7. Data Retention

Your data is kept while your account is active. Following a deletion request, we will remove your data within 30 days, unless a legal retention obligation applies.

8. Security and Incidents (Art. 48)

We use secure authentication, encryption in transit and at rest, row-level access control on every table, and monitoring of processing activity. In the event of an incident that may create relevant risk or harm, we will notify the Brazilian National Data Protection Authority (ANPD) and you in a timely manner.

9. Your Rights (LGPD Art. 18)

You have the right to:

• Confirm that your data is being processed.
• Access your data.
• Correct incomplete, inaccurate or outdated data.
• Request anonymisation, blocking or deletion of data.
• Port your data to another service provider.
• Withdraw consent at any time.

To exercise these rights, e-mail platform@longevia.io.

10. Minors

Longevia is intended for people aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has provided data to the service, contact us for immediate deletion.

11. Note on HIPAA

Longevia is not a “Covered Entity” under the United States HIPAA statute. We nonetheless apply equivalent protection standards to health-adjacent data, including encryption in transit and at rest, access controls and security audits.

12. Cookies

We use only session cookies for authentication (managed by Supabase). We do not use tracking or advertising cookies.