Privacy Policy

Effective date: June 4, 2026

Steven Davis ("we", "us") operates Steve's Longevity Coach (the "Service"), a private, invite-only application that helps a small number of authorized users understand their own health and longevity data. This policy explains what personal data the Service processes, why, and the rights you have. We are based in the United States (Commonwealth of Pennsylvania). This policy applies to everyone who uses the Service and includes additional rights for users located in the European Economic Area (EEA) and the United Kingdom (see Section 8). The Service is a personal wellness and informational tool: we are not a healthcare provider, and the Service is not a "covered entity" under the U.S. Health Insurance Portability and Accountability Act (HIPAA), so HIPAA's protections do not apply to the data it processes.

Contact: support@steveslongevitycoach.com

1. Who this applies to

The Service is not open to the public. Access is granted by invitation. You must be at least 18 years old to use it.

2. Data we process

• Account data: your email address and name.
• Health and wellness data that you provide or connect, which may include: blood test and biomarker results, body composition and fitness metrics, genetic markers, and data from third-party services you choose to connect — including Oura (sleep, readiness, activity, heart rate and heart-rate variability, and related metrics), Strava (activity and workout data), and Apple Health exports.
• Technical data: basic logs needed to operate and secure the Service.

Most of this is health data, which is a "special category" of personal data under the GDPR and is treated with additional care.

3. Why we process it

We process your health data only with your explicit consent, which you give by creating an account and connecting your data sources. We use it to:

• calculate longevity and biological-age estimates,
• generate personalized assessments, insights, and coaching suggestions,
• display your trends and history back to you.

You can withdraw consent at any time (see Section 8).

4. Service providers and data sources

To run the Service we rely on the following providers, which process or host data on our behalf:

• Supabase — database and authentication hosting.
• Vercel — application hosting.
• GitHub — source-code hosting and deployment.
• GoDaddy — domain registration and DNS.
• Anthropic (Claude) — AI processing used to generate assessments and coaching text.
• Resend — transactional email delivery.
• ImprovMX — email forwarding.

We also receive data from the sources you connect (Oura, Strava, Apple Health). Your use of those services is governed by their own terms and privacy policies. We access only the data scopes you authorize, and you can revoke our access at any time through the relevant provider or by contacting us. We do not sell your personal data, and we do not use it for advertising.

5. Where your data is processed

The Service is operated from the United States, and your data is processed and stored on servers located in the United States and other countries where our providers operate. If you access the Service from outside the United States, you understand that your data will be transferred to and processed in the United States. Where data of EEA or UK users is involved, we rely on appropriate transfer safeguards such as the European Commission's Standard Contractual Clauses.

6. Data retention

We keep your data for as long as your account is active. If you ask us to delete your account, we delete your personal data within a reasonable period, except where we must retain limited information to comply with legal obligations.

7. Security

We use industry-standard measures to protect your data, including encrypted transport, access controls, and reputable hosting providers. No system is completely secure, but we take reasonable steps to safeguard your information.

8. Your rights and choices

You may request to access, correct, or delete your personal data, or to withdraw your consent and close your account, at any time by contacting us at support@steveslongevitycoach.com. Depending on your place of residence (including certain U.S. states), you may have additional rights over your personal data; contact us and we will honor applicable rights.

EEA and UK users. If you are located in the European Economic Area or the United Kingdom, you have rights under the GDPR and UK GDPR, including the rights to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent at any time. Our lawful basis for processing your health data is your explicit consent (GDPR Article 9(2)(a)). You also have the right to lodge a complaint with your local data protection authority — in Spain, the Agencia Española de Protección de Datos (www.aepd.es).

To stop sharing your Oura data specifically, you can revoke this application's access in your Oura account settings at any time; revocation stops future syncing.

9. Children

The Service is not intended for, and may not be used by, anyone under 18.

10. Changes

We may update this policy from time to time. Material changes will be reflected by updating the effective date above and, where appropriate, notifying you.

11. Contact

Steven Davis — support@steveslongevitycoach.com