Privacy Policy

1Information We Collect

1.1Personal Identifiers

We collect information that identifies you, including your name, date of birth, email address, mailing address, and account credentials.

1.2Protected Health Information (PHI)

As a health technology platform, Longova collects and processes the following categories of health information, which may constitute Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA):

• Medical history, diagnoses, medications, and allergies
• Laboratory results and clinical notes (entered by you or your enrolled clinician)
• Prescriptions and pharmacy data (retrieved via patient-authorized connection)
• Clinical care plan entries made by your enrolled clinician

1.3Biometric and Device Data

When you enroll a Longova device, the Platform receives the following data transmitted directly from your enrolled hardware:

• Body composition data from the Scan device (including body weight, body fat percentage, muscle mass, visceral fat, and related metrics measured via bioelectrical impedance analysis)
• Heart rate variability (HRV), blood oxygen saturation (SpO₂), skin temperature, and sleep data from the Move wearable device
• Glucose data, where applicable

Device data is transmitted to the Longova Platform via Longova's proprietary API. Longova does not use the device manufacturer's default consumer application (Starfit) to collect your data.

1.4Nutritional and Behavioral Data

• Food logs, nutritional entries, and macro- and micronutrient estimates (entered by you through the Longova app)
• Journal entries, behavioral adherence patterns, and activity data; behavioral pattern data used to power the Mind module (Longova's CBT-based wellness coaching feature), including food relationship indicators, stress patterns, and biometric-triggered behavioral signals

1.5Lab and Claims Data (Patient-Authorized)

With your explicit authorization, Longova may retrieve data from your laboratory provider, pharmacy, or electronic health record (EHR) system via a FHIR/OAuth patient-mediated connection. Longova does not extract data from these systems without your direct authorization for each connection.

1.6Usage Data

We collect information about your interactions with the Platform, including log data, session information, device identifiers, browser type, and feature usage patterns. This information is used to operate, maintain, and improve the Platform.

2How We Collect Your Information

• Directly from you through the Longova app when you create an account, enter health information, or log food or journal entries
• From enrolled Longova devices via the Longova proprietary device API
• From your enrolled clinician when they enter notes or care plan information through the Longova clinician portal
• From third-party systems (labs, pharmacy, EHR) when you authorize a connection via FHIR/OAuth
• Automatically through usage data and session logging when you interact with the Platform

3How We Use Your Information

3.1To Provide the Platform

We use your information to operate the Longova clinical intelligence platform, including:

• Generating AI-synthesized health summaries, alerts, and guidance for you and your enrolled clinician
• Displaying your biometric and health data in your personal dashboard
• Enabling your enrolled clinician to view your clinical data through the Longova clinician portal
• Processing device data from your enrolled Scan and Move devices

3.2AI Processing

Longova uses artificial intelligence, including a large language model layer, to synthesize your health data into actionable summaries and alerts. This processing occurs in a nightly batch run on Longova's secure cloud infrastructure. AI-generated outputs are informational and are intended for review by a licensed clinician. They are not a substitute for professional medical advice, diagnosis, or treatment.

Longova does not use your identifiable PHI to train AI or machine learning models without your prior written consent specifying the approved use.

De-identification in AI queries. When your health data is submitted to the AI synthesis layer, Longova replaces all personally identifying information with an anonymized patient ID code before the query is constructed. Your first name, last name, and date of birth are never passed to the AI layer. The AI layer receives your age (not your date of birth), your gender category, and anonymized clinical and biometric data linked only to your patient ID code. This patient ID code cannot be decrypted or re-linked to your identity by the AI subprocessor. PHI remains in Longova's HIPAA-compliant HealthLake infrastructure at all times and is never transmitted to any external AI service in identifiable form.

3.3Research Analytics

Longova retains de-identified longitudinal data for research and platform improvement purposes. When a patient deletes their account, Longova removes the PHI deletion key, which permanently de-identifies all associated data records. The de-identified records that remain cannot reasonably be re-linked to you and are retained by Longova indefinitely for research purposes. You may opt out of this research data retention at account setup or at any time through your account settings.

3.4Platform Improvement and Communications

We may use your contact information to send you service-related communications, including account notices, security alerts, and updates to this Privacy Policy. We do not use your PHI for marketing without your separate consent.

4How We Share Your Information

4.1With Your Enrolled Clinician

If you are enrolled in the Platform through a clinical partner, your enrolled clinician and authorized clinical staff can view your health data, device data, and AI-generated summaries through the Longova clinician portal.

4.2With Enterprise Partners (De-Identified Only)

Longova may share Longova's proprietary de-identified longitudinal dataset — derived from Platform operation across all enrolled clinical partners — with enterprise partners via the Longova Partner API. This dataset is owned by Longova and does not include any information that could reasonably identify you. Enterprise data licensing is subject to the research data consent you provided at enrollment. You may opt out of research data retention at any time through your account settings.

4.3With Subprocessors

Longova works with the following categories of service providers to operate the Platform. These subprocessors receive access to data only as necessary to provide their services and are contractually required to protect it:

• Amazon HealthLake (US — Ohio instance; Canada — Saskatchewan instance): HIPAA-compliant PHI storage layer. Amazon audits HealthLake for HIPAA compliance. US patient data is stored in the Ohio HealthLake instance; Canadian patient data is stored in the Saskatchewan instance.
• Google (Gemini): AI synthesis layer for data synthesis processing. Gemini processes de-identified data only. PHI does not pass through Gemini. No Gemini-specific BAA is required.

A current list of subprocessors is available upon request at privacy@longova.com.

4.4As Required by Law

We may disclose your information when required by applicable law, regulation, court order, or government request, or when necessary to protect the rights, property, or safety of Longova, our users, or the public.

4.5We Do Not Sell Your Data

Longova does not sell, rent, or trade your personal information or PHI to third parties for their commercial purposes.

5How We Protect Your Information

Longova maintains administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction, including:

• PHI is stored in a separate encrypted table, isolated from general platform data
• Each enterprise client (clinic) operates in a dedicated tenant environment on Longova's AWS infrastructure
• Account deletion triggers permanent removal of the PHI deletion key, permanently de-identifying all associated records
• Access controls and audit logging are maintained for all systems handling PHI
• Longova's contractors and employees who access PHI are required to execute confidentiality agreements containing trade secret and HIPAA obligations

No security system is impenetrable, and Longova cannot guarantee the security of all information. In the event of a data breach affecting your PHI, Longova will notify you as required by applicable law.

6Data Retention

Identifiable PHI: Retained for the period required by applicable HIPAA regulations and any longer state-law retention requirements, or until you delete your account, whichever is earlier. Account deletion triggers PHI de-identification as described in Section 3.3.

De-identified data: Retained indefinitely by Longova for research and platform improvement purposes, unless you opt out.

Usage data and account records: Retained for as long as necessary to operate the Platform and comply with legal obligations.

7Your Rights

7.1Access and Correction

You have the right to request access to the personal information and PHI Longova holds about you, and to request correction of inaccurate data. Submit requests to privacy@longova.com.

7.2Account Deletion

You may delete your Longova account at any time through the Platform's account settings. Account deletion triggers removal of the PHI deletion key, permanently de-identifying all associated health records. De-identified records may be retained for research purposes unless you opt out.

7.3Data Portability

You may request a copy of your health data in a portable format. Submit requests to privacy@longova.com.

7.4Research Opt-Out

You may opt out of Longova's retention of de-identified research data at account setup or at any time by contacting privacy@longova.com. Opting out means that upon account deletion, all data records associated with your account will be deleted rather than de-identified and retained.

7.5California Residents — CCPA Rights

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information Longova has collected about you and how it is used
• Right to delete your personal information (subject to certain exceptions)
• Right to opt out of the sale of your personal information. Longova does not sell your personal information.
• Right to non-discrimination for exercising your CCPA rights

To exercise your CCPA rights, contact privacy@longova.com. Longova will respond within 45 days.

7.6Canadian Residents — PIPEDA Rights

If you are a Canadian resident accessing the Platform through a Canadian clinical partner, your health information may also be subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to access and correct your personal information held by Longova. Contact privacy@longova.com to exercise these rights.

8Children

The Longova Platform is intended for users 18 years of age and older. Longova does not knowingly collect personal information from individuals under 18. If you believe a minor has provided personal information to Longova, contact privacy@longova.com and we will take steps to delete that information.

9Changes to This Privacy Policy

Longova may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on the Platform. The updated Policy will indicate the new effective date. Your continued use of the Platform after the effective date of the updated Policy constitutes acceptance of the changes.

10Contact Us

For questions about this Privacy Policy, to exercise your rights, or to report a privacy concern, contact: