LONGEVITA INSIGHTS Privacy, Consumer Health Data, and State Rights Notice

— Document ID — LMI-LI-PRIVACY-02

— Version — 3.0

— Last updated — August 24, 2026

— Effective date — August 24, 2026

— Privacy contact — info@LongevitaMI.com | 407-205-7877 | 1724 33rd St., Suite 200, Orlando, FL 32839

— Request methods — Email, telephone, or mail using the privacy contact information above

Section 1. Scope, Service, and Roles

This Notice describes how Longevita Medical Institute, LLC, doing business for this nonclinical service as Longevita Insights (“LMI”), collects, uses, discloses, protects, retains, and deletes personal information and consumer health data associated with the Longevita Insights personal-use subscription. It applies to the nonclinical subscription and related enrollment, billing-token, support, security, consent, cancellation, and privacy-request records. This Notice supplements LMI’s general Privacy Policy, available at https://www.longevitamedicalinstitute.com/privacy-policy, and controls for the consumer health data practices it specifically addresses. It does not replace LMI’s HIPAA Notice of Privacy Practices for protected health information within an LMI HIPAA-covered clinical function.

Longevita Insights uses technology supplied by Heads Up Health LLC and approved service providers. Heads Up Health may provide separate user terms and privacy notices that govern its own processing. Connected devices, applications, laboratories, patient portals, and other sources also have independent privacy practices.

LMI operates clinical and nonclinical functions. Whether specific information is protected by HIPAA depends on the actual source, purpose, organizational designation, and data flow. LMI does not represent that every item in a nonclinical consumer Account is HIPAA-protected. LMI applies the privacy, consumer-health-data, security, breach-notification, contract, and other law that governs the data and role.

Section 2. Data We Collect

— Category — Examples

— Account and identity — Name, email, telephone number, state, age confirmation, account identifiers, authentication information, billing-token references, and communications.

— Health and wellness — Symptoms, goals, measurements, activity, sleep, nutrition, stress, mood, medications, supplements, reproductive or sexual health information you choose to enter, and health history.

— Wearables, devices, and apps — Activity, heart rate, sleep, weight, glucose or other measurements, device identifiers, source metadata, and integration permissions.

— Laboratory, diagnostic, and records — Files, images, reports, test names, values, units, reference ranges, dates, report text, and extracted or transcribed content.

— AI interactions — Prompts, selected account context, uploaded content used in a prompt, generated responses, feedback, and safety or misuse flags.

— Technical and usage data — IP address, device and browser data, login and audit records, feature use, errors, support records, security events, cookies or similar technologies permitted in the authenticated environment.

— Derived information — Trends, summaries, annotations, correlations, scores, inferences, and other outputs generated from the categories above.

Section 3. Sources of Data

— You, including information you enter, upload, scan, photograph, import, or communicate.

— Connected sources you affirmatively authorize, including wearables, home devices, applications, laboratories, EHRs, patient portals, and nutrition tools.

— Heads Up Health and approved processors when they generate, normalize, transmit, store, secure, or support data for the Service.

— LMI subscription, tokenized payment, support, consent, cancellation, privacy-request, and security records.

Section 4. Purposes of Processing

— Create, authenticate, secure, administer, bill, support, and terminate the Account and subscription.

— Receive, store, organize, display, trend, transcribe, extract, summarize, and permit export or user-directed sharing of information.

— Provide enabled AI functions for general information, organization, data navigation, transcription, and low-risk wellness support.

— Provide nonclinical technical, billing, cancellation, privacy, and security support.

— Detect fraud, harmful output, misuse, unauthorized access, and security incidents; maintain, test, and improve system functionality.

— Comply with law, legal process, contractual duties, recordkeeping requirements, and enforceable requests.

— Create deidentified or aggregate operational information. Optional comparative cohort analytics require the subscriber choice recorded in the integrated agreement.

— Not authorized. The Service is not used under this Notice to diagnose, treat, prescribe, provide individual clinical monitoring, sell consumer health data, place person-specific health information in advertising, or make employment, insurance, credit, housing, education, legal, or other consequential decisions.

Section 5. Recipients and Service Providers

— Recipient category — Purpose

— Heads Up Health — Platform hosting, account affiliation, storage, integrations, dashboards, AI-enabled functions, support, security, and related operations.

— Infrastructure and security processors — Cloud hosting, authentication, multifactor authentication, email, logging, backups, incident response, and technical support.

— Payment processor — Tokenized payment setup, recurring charges, fraud controls, receipts, and charge management. LMI does not place full payment-card or bank-account credentials in the ordinary subscription record.

— Approved AI and document processors — Processing selected prompts, files, or extracted content to provide enabled features under approved contractual and technical controls.

— Connected sources selected by the consumer — Sending or receiving data when the consumer connects an integration, imports information, or directs an export.

— Professional advisers and authorities — Legal, compliance, accounting, insurance, audit, security, or legally required disclosures, subject to applicable limits.

LMI may share the categories listed in Section 2 with the recipient categories above only as reasonably necessary for the disclosed purpose, as directed by the consumer, or as permitted or required by law. LMI does not sell consumer health data or permit cross-context behavioral advertising or person-specific marketing based on consumer health data. LMI will disclose additional categories, recipients, or purposes and obtain new consent before materially expanding processing where applicable law requires it.

Section 6. Artificial Intelligence and Document Processing

When an AI-enabled feature is used, selected prompts, files, extracted text, account context, and metadata may be transmitted to the Platform Provider or approved AI or document-processing services. The resulting output may be stored or logged as configured to provide the feature, investigate safety or misuse, and maintain quality and security.

— The Service identifies AI-enabled features in the interface or associated description so consumers know when they are interacting with software rather than a clinician.

— LMI will not represent an AI output as clinician-authored unless a clinician actually reviews and adopts it in a separate clinical workflow.

— LMI does not offer the personal-use tier for disease diagnosis, treatment directives, specific medication instructions, individualized clinical risk determinations, or time-critical clinical alarms.

— No person-specific AI interaction will be used in external marketing. LMI does not intentionally submit identifiable health or wellness information to publicly available AI tools or permit it to train or improve a vendor’s public or general-purpose model. Any other product-improvement use must be consistent with this Notice, applicable contracts, and required consent.

Section 7. Deidentified and Aggregate Information

LMI may create information reasonably designed not to identify an individual. For patient data subject to HIPAA, LMI will use a valid HIPAA deidentification method when required. For non-HIPAA consumer data, LMI will use a documented comparable standard, including access controls, minimum-cell-size or suppression rules appropriate to the output, contractual no-reidentification restrictions, and controls against rare combinations.

Properly deidentified or aggregate information may be retained and used for lawful operations, quality, research planning, and statistical analysis after cancellation or deletion. Deidentification materially reduces but does not make identification risk literally zero. LMI will not attempt to reidentify data except under controlled testing to evaluate deidentification or as required by law.

Comparing a nonclinical subscriber cohort with an LMI medically guided patient cohort is governed by the optional analytics choice in the integrated agreement and documented deidentification controls. Observational differences do not establish causation, and any external claim remains subject to substantiation and fair presentation.

Section 8. Cookies, Tracking, and Advertising Technology

In the authenticated Longevita Insights environment, LMI authorizes only technologies reasonably necessary for security, functionality, support, and privacy-protective analytics. LMI does not authorize advertising pixels, cross-site targeted-advertising trackers, or session-replay tools to capture health content on authenticated health pages. Public website tracking is described in the LMI Privacy Policy and is not combined with person-specific health information for advertising. LMI honors legally recognized opt-out preference signals where applicable.

Section 9. Security Safeguards

LMI uses and requires reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information. Safeguards may include role-based access, least privilege, multifactor authentication, encryption in transit and at rest where appropriate, audit logging, workforce confidentiality, vendor diligence, secure configuration, incident response, backups, and risk assessment. No system can guarantee perfect security. Use unique credentials and secure devices and networks, and promptly report suspected compromise to info@LongevitaMI.com or 407-205-7877.

Section 10. Retention, Account Closure, and Deletion

— Data category — Retention standard or criteria

— Active Account data — For the subscription term and as reasonably necessary to provide the Service.

— Contract, consent, billing, cancellation, and audit records — Generally six years after Account closure, or longer when required for tax, payment, litigation hold, dispute resolution, or applicable law.

— Routine support and security logs — For the period reasonably necessary for support, security, fraud prevention, audit, and legal obligations, based on sensitivity and risk.

— Verified deletion requests — Removed from active systems within the applicable legal period after authentication, subject to legal exceptions; applicable affiliates, processors, contractors, and other recipients are notified as required.

— Backups — Isolated from ordinary use and deleted or overwritten on the documented backup cycle and within the applicable legal deadline; until then, the data is not used for unrelated purposes.

— Deidentified and aggregate information — May be retained while it remains deidentified and subject to no-reidentification controls.

Billing cancellation does not automatically specify immediate Account closure, deletion, disconnection of a source, or withdrawal of optional analytics. Consumers may request one or more of those actions. LMI will not promise instantaneous or absolute deletion when legal holds, payment records, isolated backups, fraud records, or technical constraints lawfully require limited retention. Retained data will be restricted from unrelated use.

Section 11. Consumer Choices and Request Process

Depending on residence, data, and applicable law, consumers may have rights to confirm processing; access; correct; delete; receive a portable copy; withdraw consent; obtain certain recipient information; opt out of sale, targeted advertising, or qualifying profiling; appeal a denial; and use an authorized agent. LMI’s launch policy is not to sell consumer health data or use it for cross-context behavioral advertising.

Submit a non-PHI privacy or consumer health data request by emailing info@LongevitaMI.com, calling 407-205-7877, or mailing Privacy and Records Requests, Longevita Medical Institute, LLC, 1724 33rd St., Suite 200, Orlando, FL 32839. LMI will authenticate requests proportionately, respond within the applicable period, provide an appeal process where required, and not unlawfully discriminate for exercising a right. Withdrawal of consent needed to operate a requested feature may require disabling the feature or closing the Account. Withdrawal does not invalidate processing already completed or require deletion of previously validly deidentified outputs. Requests concerning PHI or medical records should follow LMI’s Notice of Privacy Practices or the secure patient portal.

Section 12. State-Specific Consumer Health Data and Privacy Rights

Section 12.1 Washington

Washington residents and individuals whose consumer health data is collected in Washington may have rights under chapter 19.373 RCW, including a prominently posted consumer health data privacy policy, consent for collection, separate and distinct consent for sharing when required, access to certain recipient information, withdrawal, deletion through applicable processors and affiliates, appeal rights, security safeguards, and restrictions on sale and geofencing. LMI does not sell consumer health data.

Section 12.2 Nevada

Nevada residents may have rights under NRS chapter 603A to confirm collection, access, obtain recipient information, cease collection or sharing, delete, withdraw consent, and appeal. Nevada law requires a consumer health data privacy policy and, when consent is used, separate and distinct sharing consent. LMI does not sell consumer health data. A verified deletion request will be handled within the applicable statutory period and backup treatment.

Section 12.3 Connecticut

Connecticut residents may have rights involving access, correction, deletion, portability, consent withdrawal, opt-out, confidentiality, processor contracts, and appeals. LMI will not use a geofence to identify visits to protected health-care locations or use this subscription for consequential decisions.

Section 12.4 California

To the extent California privacy law applies, California residents may have rights to know, access, correct, delete, obtain information about personal information, opt out of sale or sharing, limit certain sensitive-information uses, and receive nondiscriminatory treatment. LMI’s launch policy prohibits sale or cross-context behavioral advertising using consumer health data. Automatic-renewal, cancellation, and price-change disclosures appear in the integrated subscription agreement.

Section 12.5 Colorado and Other States

Colorado residents may have access, correction, deletion, portability, opt-out, and appeal rights when the Colorado Privacy Act applies. Other comprehensive privacy laws may apply in Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and additional states effective at the time of processing. LMI will apply its national baseline unless a state requires a different response period, appeal process, consent standard, universal opt-out signal, or data-minimization rule.

Section 12.6 Florida and New York Subscription Rights

Florida and New York residents retain applicable consumer-protection, automatic-renewal, cancellation, privacy, and breach-notification rights. LMI provides clear recurring-charge disclosures and a retainable acknowledgment. A Longevita Insights subscription may be canceled by emailing info@LongevitaMI.com, calling 407-205-7877, or mailing LMI at 1724 33rd St., Suite 200, Orlando, FL 32839. A valid email cancellation does not require an additional telephone call, and LMI processes cancellation effective when received.

Section 13. HIPAA Rights When Applicable

If specific information is protected health information within an LMI HIPAA-covered clinical function, the LMI HIPAA Notice of Privacy Practices and HIPAA rights apply to that information. Those rights may include access, amendment, restrictions, confidential communications, an accounting of certain disclosures, and a paper copy of the HIPAA notice. LMI will route a request to the correct legal process.

Section 14. Children, Genetic Data, and Biometric Identifiers

The personal-use tier is for adults age 18 or older, and LMI does not knowingly enroll minors in this tier. Do not upload raw genomic sequencing files, DNA profiles, or biometric templates used to identify a person unless LMI expressly enables a specific feature and provides the separate notice and consent required for that feature. Any future genetic or biometric function will be subject to applicable notice, consent, retention, deletion, vendor, security, and legal requirements before activation.

Section 15. Incident and Breach Notification

LMI maintains an incident-response process. Depending on the facts and legal role, an incident may be governed by HIPAA/HITECH, the FTC Health Breach Notification Rule, state breach-notification law, consumer-health-data law, contract, or multiple regimes. LMI will investigate and provide legally required notices. Unauthorized disclosure can be reportable even without hacking or network intrusion.

Section 16. Changes to This Notice

LMI may update this Notice prospectively. The current version and effective date will be posted, and LMI will provide advance notice of material changes. LMI will obtain new consent before materially expanding collection, use, or sharing when law requires it. Prior versions will be retained.

Section 17. Contact, Complaints, and Appeals

Contact Privacy and Records Requests, Longevita Medical Institute, LLC, at info@LongevitaMI.com, 407-205-7877, or 1724 33rd St., Suite 200, Orlando, FL 32839. Requests concerning PHI or medical records should follow LMI’s Notice of Privacy Practices or the secure patient portal. Consumers may also contact the applicable state attorney general, privacy regulator, consumer-protection agency, or the U.S. Department of Health and Human Services Office for Civil Rights when jurisdiction applies. LMI will not retaliate for a good-faith complaint. Appeal instructions will be included when LMI denies a request that carries an appeal right.