Consent Term for the Processing of Personal and Sensitive Data

1. Controller and Data Protection Officer

Longevia is a brand owned by What Flows You Consultoria e Mentoria LTDA, a company registered under CNPJ No. 53.562.199/0001-08, with its registered office in the city of São Paulo, State of São Paulo, hereinafter the Controller, responsible for decisions regarding the processing of the personal and sensitive data consented to herein.

For clarification, communications or to exercise rights relating to data protection, the Data Subject may contact the Data Protection Officer (DPO):

• Officer: Stephanie Uemura
• Contact e-mail: platform@longevia.io
• Postal address: Rua Paracatu 846 — São Paulo SP / 04302-022

2. Personal and Sensitive Data Collected

Through registration, use of the platform and interaction with its services, the following data may be collected and processed:

• Identification and registration data: full name, CPF (Brazilian taxpayer number), date of birth, e-mail address, telephone number, among others;
• Health and behavioural data: information on eating habits, physical activity, physical parameters, sleep routine, clinical history and self-reported physical and emotional wellbeing;
• Electronic records: access data, interactions, preferences and use of platform features;
• Images or voice: occasionally, in specific contexts relating to the use of integrated platform features;
• Communications: messages, questions, support records and suggestions exchanged between the Data Subject and the Controller.

3. Purposes of Processing and Legal Basis

The data indicated above will be processed for the following legitimate and clearly defined purposes:

• a) To develop, adapt and recommend personalised content and guidance aimed at promoting the user’s health, wellbeing and education, based on individual profiles, histories and behavioural patterns — on the basis of the data subject’s consent (art. 7, I, and art. 11, I, LGPD);
• b) To ensure proper identification, authentication and security of access to the platform, and to prevent fraud — on the basis of performance of a contract and legitimate interest (art. 7, V and IX, LGPD);
• c) To carry out statistical analysis, internal research and development of improvements to the user experience, through automated processing methods and analysis of anonymised data — on the basis of consent and legitimate interest (art. 7, I and IX);
• d) To carry out institutional, informational and technical communications relating to the platform experience, the use of features or the maintenance of contracted services — on the basis of consent and performance of the contract (art. 7, V and I);
• e) To share data with service providers and partners, strictly within the limits necessary to fulfil the purposes above, observing security, necessity, purpose and transparency — on the basis of the data subject’s consent (art. 7, I).

4. Automated Decisions

The Data Subject acknowledges that the data provided may be submitted to automated analysis and classification processes, based on mathematical and statistical models, for the purpose of issuing personalised recommendations relating to health and lifestyle.

The Data Subject may at any time request clarification, review or human intervention regarding any decision taken solely on the basis of automated processing, as provided for in article 20 of the LGPD.

5. Data Sharing

Data may be shared with processors, technical partners, research institutions and contracted service providers, provided that such entities are contractually bound to observe the principles of information security, confidentiality and strict compliance with data protection legislation.

Under no circumstances will data be sold or passed on to third parties for advertising purposes or for anything exceeding the limits of this consent.

6. Data Security and Governance

The Controller undertakes to adopt organisational, technical and administrative best practices to protect data against unauthorised access, loss, leakage, alteration or destruction.

Measures adopted include:

• Secure authentication mechanisms and data encryption;
• Logging and monitoring of processing activities;
• Internal procedures for incident prevention and response;
• Adoption of data governance and protection policies consistent with international standards.

In the event of an incident that may create relevant risk or harm to the Data Subject, the Controller undertakes to notify the Brazilian National Data Protection Authority (ANPD) and the Data Subject in a timely manner, as required by article 48 of the LGPD.

7. Data Retention Period

Personal and sensitive data will be stored throughout the period of use of the platform’s services, or for as long as necessary to fulfil the purposes set out in this Term.

After that period, data may be deleted or anonymised, unless a legal or regulatory obligation justifies its retention.

8. Rights of the Data Subject

Under article 18 of the LGPD, the Data Subject has the right to request:

1. Confirmation that processing exists;
2. Access to the data processed;
3. Correction of incomplete, inaccurate or outdated data;
4. Anonymisation, blocking or deletion of unnecessary data or data processed in non-compliance with the law;
5. Portability of the data to another service or product provider;
6. Deletion of personal data processed on the basis of consent;
7. Information about the public and private entities with which the data has been shared;
8. Withdrawal of consent at any time, by express statement through the channels indicated;
9. Review of decisions taken solely on the basis of automated processing.

9. Withdrawal of Consent

The consent given here may be withdrawn at any time by express request sent to the platform’s privacy channel: platform@longevia.io

Withdrawal will not affect processing already carried out under the consent previously given, nor the continuity of any resulting legal obligations.

10. Final Declaration

I declare, for all due purposes, that I have read and understood this Consent Term, being fully aware of its provisions, including as to how my personal and sensitive data will be processed, and that I may at any time exercise the rights provided for in the LGPD.