Privacy Policy

1. Data Controller

Longevia is a brand owned by What Flows You Consultoria e Mentoria LTDA, registered under CNPJ No. 53.562.199/0001-08, with its registered office in the city of São Paulo, State of São Paulo, hereinafter the Controller.

Data Protection Officer: Stephanie Uemura.

• E-mail: platform@longevia.io
• Postal address: Rua Paracatu 846 — São Paulo SP / 04302-022

2. Data We Collect

• Account: e-mail address.
• Family health history: data entered voluntarily into the family health tree (pre-existing conditions per family member).
• App activity: episodes listened to, quiz results, activity days (streaks).
• Device data: technical information collected by Supabase (IP address, browser type) for authentication and security.

3. Legal Basis (LGPD Art. 7 and 11)

• Consent (Art. 7, I and Art. 11, I): for the collection and processing of family health data.
• Legitimate interest (Art. 7, IX): for analysing app usage and improving the service.
• Performance of a contract (Art. 7, V): for providing the contracted services.

Specific consent for sensitive data is recorded in the Consent Term, which details purposes, sharing and rights.

4. How We Use Data

• To personalise your learning path based on your family health data.
• To record progress, streaks and achievements.
• To send service-related notifications (never third-party advertising).

We do not sell your data. We do not use your data for advertising.

5. Automated Decisions (Art. 20)

The data you provide may be submitted to automated analysis and classification in order to issue personalised health and lifestyle recommendations. You may at any time request clarification, review or human intervention regarding decisions taken solely on the basis of automated processing.

6. Data Sharing

Your data is processed by the following sub-processors:

• Supabase Inc. — database and authentication (SOC 2 Type II, servers on AWS us-east-1).
• Vercel Inc. — application hosting.

We do not share data with other third parties except where required by law. Under no circumstances is data sold.

7. Data Retention

Your data is kept while your account is active. Following a deletion request, we will remove your data within 30 days, unless a legal retention obligation applies.

8. Security and Incidents (Art. 48)

We use secure authentication, encryption in transit and at rest, row-level access control on every table, and monitoring of processing activity. In the event of an incident that may create relevant risk or harm, we will notify the Brazilian National Data Protection Authority (ANPD) and you in a timely manner.

9. Your Rights (LGPD Art. 18)

You have the right to:

• Confirm that your data is being processed.
• Access your data.
• Correct incomplete, inaccurate or outdated data.
• Request anonymisation, blocking or deletion of data.
• Port your data to another service provider.
• Withdraw consent at any time.

To exercise these rights, e-mail platform@longevia.io.

10. Minors

Longevia is intended for people aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has provided data to the service, contact us for immediate deletion.

11. Note on HIPAA

Longevia is not a “Covered Entity” under the United States HIPAA statute. We nonetheless apply equivalent protection standards to health-adjacent data, including encryption in transit and at rest, access controls and security audits.

12. Cookies

We use only session cookies for authentication (managed by Supabase). We do not use tracking or advertising cookies.

13. Health Myth Challenge contest (longevia.com.br/health-quiz)

This section covers the public Health Myth Challenge quiz and its prize contest (7 to 15 November 2026, Portugal). The quiz is separate from the Longevia app and needs no account. We ask for your first name; we do not ask for your last name or email address. To run the contest we also ask for a mobile or WhatsApp number.

• What we collect: your first name, age range, education level, gender (including a “prefer not to say” option), your city, your mobile/WhatsApp number, your answers to the ten quiz questions, the time each answer took, your score, and the date and time you accepted the rules.
• Why: to run the contest, work out the winner (correct answers, then speed) and contact them about the result; and, in aggregate only, to understand who uses Longevia. During the contest, we show your first name, in real time, to the organizers and the content team, on a private ranking no one else sees. We report survey results only in aggregate, never for a group of fewer than 10 people.
• Contact about Longevia products: only if you tick the separate, optional box. You can withdraw it at any time by writing to platform@longevia.io or replying “STOP”. Not ticking it does not affect your entry.
• Legal basis: your consent, given by accepting the Contest Rules, and your separate consent for product contact if you give it.
• Retention: if you are not the winner and did not agree to product contact, we delete your number 90 days after the result is announced. If you agreed to product contact, we keep it until you withdraw consent. The winner’s number is kept until the prize is delivered and afterwards according to their consent.
• Your rights: access, correction, erasure, restriction, objection, portability and withdrawal of consent, at platform@longevia.io. You can complain to the Portuguese data protection authority (CNPD).
• Where data is processed: our hosting providers (Supabase and Vercel, in the United States) and the contest promoter (What Flows You, in Brazil) process it, which is outside the European Economic Area. We use your IP address briefly to limit spam and do not store it with your answers.
• Not medical advice: the quiz is educational and does not replace advice from a health professional. You must be 18 or older to take it.