Phenome Longevity
Privacy policy
Last updated: [publication date]. Draft V1 for legal review before publication.
1. Who we are
Phenome Longevity Ltd ("Phenome", "we", "us", "our") is the data controller for the personal data described in this policy. Phenome Longevity Ltd trading as Phenome Longevity, is registered in England and Wales under company number 13926236. Our registered office is The Shard, 32 London Bridge Street, London SE1 9SG. Our trading address is The Shard, 32 London Bridge Street, London SE1 9SG, United Kingdom. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC006359.
This policy explains how we collect, use, share and protect your personal data when you use our website (phenomelongevity.com), the Phenome Longevity app, our test kits, our PhenomeTech Ring and Band, our Phenome+ supplements and our consultation and genetic counselling services.
Orders placed with Phenome Omics Biyoteknoloji A.Ş. in Türkiye are covered by that company's own privacy notice. Our clinic programmes and the physical clinic are also covered by separate notices.
2. How to contact us
- Data Protection Officer (privacy questions, rights requests, data protection complaints): info@phenomelongevity.com
- Customer care (orders, account help, account deletion): hello@phenomelongevity.com. Our team answers within one working day.
- Post: Data Protection Officer, Phenome Longevity Ltd, The Shard, 32 London Bridge Street, London SE1 9SG, United Kingdom.
3. The personal data we collect and where it comes from
Some of the data we handle is special category data under the UK GDPR. This includes your genetic data, microbiome data, health and lifestyle information and the health readings from your wearable device. We give this data extra protection. We usually process it with your explicit consent. In a small number of cases, such as keeping laboratory records for quality and audit, or dealing with legal claims, we rely on another legal condition, as shown in section 4.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact data | Name, email address, delivery and billing address, phone number, date of birth | You, when you place an order, create an account or contact us |
| Account data | Login details, account settings, kit activation codes, your preferences | You, through the app or website, and phenomeportal.org/activate |
| Order and payment data | Products bought, order history, delivery details, payment status. We do not store your full card details. | You, Shopify, and our payment providers (Stripe and PayPal) |
| Delivery data | Tracking numbers, delivery status, proof of delivery | Royal Mail and DHL |
| Genetic data (special category) | Results of the Comprehensive Genomic, Carrier Screening, Newborn Screening and Sports Performance Tests, including raw sequence data | Our accredited laboratories, from the sample you send us |
| Microbiome data (special category) | Results of the Gut and Oral Microbiome Tests. These analyse bacterial DNA only; no human DNA is analysed. | Our accredited laboratories, from the sample you send us |
| Health and lifestyle data (special category) | Questionnaire answers about your health, diet, sleep, exercise and family history; notes from consultations and genetic counselling | You, and the clinicians and genetic counsellors you speak to |
| Wearable data (special category) | From the PhenomeTech Ring and Band: heart rate, heart rate variability (HRV), blood oxygen (SpO2), blood pressure estimates, sleep stages, skin temperature and movement | Your device, synced to the app by Bluetooth |
| Connected app data (special category where it relates to health) | Activity, sleep, heart rate and other data you choose to share | Apple Health or Google Fit, only if you switch on the integration |
| Insights | Personalised insights and recommendations from Longevity AI | Generated by us from the data above |
| Communications data | Emails, messages, support requests, complaints, feedback | You |
| Marketing data | Your marketing preferences, whether you open our emails | You, and our email and CRM provider (Klaviyo) |
| Technical and usage data | IP address, device type, browser, app version, pages viewed, crash reports | Your device, through cookies, SDKs and similar technologies (see our Cookie Policy) |
Our tests and devices are for wellness and information only. They are not diagnostic and do not diagnose, treat, cure or prevent disease. Wearable readings are estimates.
4. How we use your data and our lawful bases
We must have a lawful basis under Article 6 of the UK GDPR for each use of your personal data. For special category data, we also need a condition under Article 9. We do not treat your use of our website as consent to anything. Where we rely on consent, we ask for it clearly and separately, and you can withdraw it at any time.
| Purpose | Data used | Lawful basis (Article 6) | Condition for special category data (Article 9) |
|---|---|---|---|
| Processing and delivering your order, taking payment, handling returns and refunds | Identity, contact, order, payment and delivery data | Contract | Not applicable |
| Creating and running your account, activating your kit | Identity, contact and account data | Contract | Not applicable |
| Analysing your sample and producing your report in the app | Genetic, microbiome, health and lifestyle data | Contract | Explicit consent (Article 9(2)(a)) |
| Clinician review of reports, consultations and genetic counselling | Genetic, microbiome, health, lifestyle and wearable data | Contract | Explicit consent (Article 9(2)(a)) |
| Collecting, storing and showing wearable readings, trends and sleep data | Wearable data | Contract | Explicit consent (Article 9(2)(a)) |
| Importing data from Apple Health or Google Fit | Connected app data | Contract | Explicit consent (Article 9(2)(a)) |
| Producing personalised Longevity AI insights | All data you have shared in the app | Contract | Explicit consent (Article 9(2)(a)) |
| Scientific research (only if you opt in) | Pseudonymised genetic, microbiome, health and wearable data | Consent | Explicit consent (Article 9(2)(a)) |
| Customer support and handling complaints | Identity, contact, order and communications data, and special category data only where you raise it | Contract; legitimate interests (resolving issues and improving service) | Explicit consent, or an alternative condition where you share health information with us to resolve a support request |
| Keeping accounting and tax records | Order and payment data | Legal obligation | Not applicable |
| Laboratory quality control and audit | Laboratory and analytical data | Legal obligation; legitimate interests (meeting laboratory accreditation standards) | Explicit consent Article 9(2)(h) with the health or social care condition in Schedule 1 of the Data Protection Act 2018 |
| Sending marketing emails | Contact and marketing data | Consent, or for existing customers, the soft opt-in under PECR (legitimate interests) | Not applicable. We do not use special category data for marketing. |
| Website and app analytics, security and fixing faults | Technical and usage data | Legitimate interests (keeping our services secure and improving them); consent where our Cookie Policy says it is needed | Not applicable |
| Preventing fraud and keeping our systems secure | Identity, order, payment and technical data | Legitimate interests (protecting you and us) | Not applicable |
| Establishing, exercising or defending legal claims | Any relevant data | Legitimate interests | Legal claims (Article 9(2)(f)) |
Recognised legitimate interests. The Data (Use and Access) Act 2025 created a list of "recognised legitimate interests", such as national security, emergencies and safeguarding. We do not currently rely on recognised legitimate interests. If we do in future, we will update this policy.
If you do not give us data. We need some data to provide our products. For example, we cannot analyse your sample without your explicit consent and kit activation, and we cannot show wearable readings unless you allow us to process them.
5. Your consent and how to withdraw it
We ask for your explicit consent in the app before we process your genetic, microbiome, health or wearable data. Research consent is separate and optional. Marketing consent is also separate.
You can withdraw any consent at any time in the app settings or by emailing info@phenomelongevity.com. Withdrawing consent does not affect processing that took place before. If you withdraw consent for us to process your sample or results, we may not be able to provide the service you bought; our Returns, Cancellations and Refunds Policy explains what happens to your order.
6. Wearables and connected apps
The PhenomeTech Ring and Band measure your heart rate, heart rate variability, blood oxygen (SpO2), blood pressure estimates, sleep stages, skin temperature and movement. The device sends this data to the Phenome Longevity app by Bluetooth. We then store it securely so we can show your dashboard, trends and insights.
These readings are health data and therefore special category data. We only process them with your explicit consent, which you give when you pair your device. You can pause syncing, unpair your device or delete your wearable data in the app.
If you switch on Apple Health or Google Fit, we only read the data types you allow. You can change these permissions at any time in Apple Health, Google Fit or your phone settings. Data received from Apple Health or Google Fit is never used for advertising or marketing, never sold, and never shared with third parties except to provide our service to you.
Our devices are wellness devices, not medical devices. Readings are estimates and are not suitable for diagnosing or managing any medical condition.
7. Longevity AI and automated decision making
The app uses algorithms, which we call Longevity AI, to analyse the data you share and produce personalised insights, such as trends in your sleep or suggestions linked to your results. This is a form of profiling.
We do not make any decision about you that has a legal effect or a similarly significant effect based solely on automated processing. Longevity AI insights are information to help you, not decisions. They do not decide what products you can buy, what you pay, or whether you can use our services.
The Data (Use and Access) Act 2025 changed the UK rules on automated decision making. Under these rules, if we ever make a significant decision about you solely by automated means, we will tell you, and you will have the right to:
- make representations about the decision;
- ask for a person to review it (human intervention); and
- contest the decision.
Separately, you can ask us at any time for a person to review any Longevity AI insight, or to explain how it was produced. Email info@phenomelongevity.com.
8. Research
We only use your data for scientific research if you give separate, opt-in consent. Before use in research, your data is pseudonymised, which means your name and contact details are removed and replaced with a code. You can withdraw your research consent at any time in the app or by emailing info@phenomelongevity.com. Data that has already been used in completed research or published in aggregate form cannot be withdrawn from that research.
9. Your samples
Your sample is securely destroyed after analysis, unless you have given separate consent for further testing or for research. Please see our Test Kit and Sample Policy for more detail.
10. Children
Our products and services are for adults aged 18 and over. We do not knowingly collect data from children, except as described below.
Newborn Screening Test. This test is for babies. Only a parent or legal guardian can buy and activate it. The parent or guardian provides the baby's sample, gives consent on the baby's behalf, holds the account and receives the results. We treat the baby's genetic data as special category data, with the same protections as any other customer's data. If you believe we hold data about a child without proper consent, please contact info@phenomelongevity.com and we will delete it.
11. Who we share your data with
We never sell, rent or trade your personal, health or genetic data. We never share your data with employers or insurers.
We share data only with the following, and only as much as each needs:
- Accredited laboratories (ISO 15189) that analyse your sample. They receive your sample with a kit code, not your name, wherever possible.
- Clinicians and genetic counsellors who review reports or provide consultations you book.
- Payment providers: Stripe and PayPal, to process payments. They may act as independent controllers for some purposes, such as fraud prevention.
- Couriers: Royal Mail and DHL, to deliver your order and return your sample.
- Technology providers: Shopify (our online shop) and Amazon Web Services (AWS, hosting and storage).
- Email and CRM provider: Klaviyo, to send service and marketing emails.
- Analytics providers: Shopify and Google, to help us understand how our website and app are used.
- Professional advisers: lawyers, accountants, auditors and insurers, where needed.
- Group companies: Phenome Longevity AB (Sweden) and Phenome Omics Biyoteknoloji A.Ş. (Türkiye), only where needed to provide our services.
- Apple Health or Google Fit, only if you choose to connect them.
Except where stated above, our service providers act as processors. They may only use your data on our instructions and under a written contract that requires them to keep it secure.
Law enforcement and regulators. We only share data with the police, courts, regulators or other public bodies where the law requires us to, for example under a court order. We will check each request carefully and share no more than is legally required.
Change of ownership. If our business, or part of it, is sold or merged, your data may pass to the new owner. They will have to protect it in line with this policy.
12. International transfers
Some of our providers store or access data outside the UK. When we transfer personal data outside the UK, we make sure it is protected by one of these safeguards:
- the country has been approved by the UK government under UK adequacy regulations (for example, countries in the European Economic Area); or
- we use the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures needed.
You can ask for more information about these safeguards by contacting info@phenomelongevity.com.
13. How long we keep your data
| Data | How long we keep it |
|---|---|
| Order, payment and billing records | 6 years, to meet accounting and tax law |
| Customer accounts | While your account is active. Inactive accounts are anonymised or deleted after 24 months of inactivity. |
| Laboratory and analytical data | 5 years, for quality and audit |
| Wearable data | While your account is active. Inactive accounts are anonymised or deleted after 24 months of inactivity. |
| Support enquiries | 12 months after resolution |
| Data protection complaints | 6 years |
| Research data | While scientifically relevant, or until you withdraw your consent |
| Marketing preferences | Until you unsubscribe, and then a suppression record so we do not contact you again |
| Biological samples | Destroyed after analysis, unless you consented to further testing or research |
You can ask us to delete your account at any time by emailing hello@phenomelongevity.com. We will delete or anonymise your data, except where we must keep it by law (for example, billing records and laboratory data kept for audit).
14. Marketing
We only send marketing emails if you have opted in, or if you are an existing customer and we are telling you about similar products or services (the "soft opt-in"). In that case, we will have given you a chance to opt out when you bought from us.
Every marketing email has an unsubscribe link. You can also change your preferences in the app or email hello@phenomelongevity.com. We will still send service messages, such as order updates and results notifications, because they are needed to provide your service.
Your results are never sent by email. We only email you to say that results are ready to view in the app.
15. Cookies and similar technologies
We use cookies on our website and similar technologies, such as SDKs and local storage, in our app. Some need your consent and some do not. Please see our Cookie Policy for details and for how to manage your choices.
16. How we keep your data secure
We use technical and organisational measures to protect your data. These include encryption in transit and at rest, access controls so that only authorised staff can see your data, pseudonymisation of samples and research data, and regular reviews of our providers' security . Results are only available in the app or your secure online account.
Please keep your login details private and tell us straight away if you think your account has been accessed without your permission.
Data breaches. If a personal data breach happens, we will report it to the ICO within 72 hours where the law requires. If the breach is likely to put your rights and freedoms at high risk, we will tell you without undue delay.
17. Your rights
You have the following rights over your personal data:
- Access: to ask for a copy of your data (a subject access request).
- Rectification: to ask us to correct inaccurate or incomplete data.
- Erasure: to ask us to delete your data.
- Restriction: to ask us to limit how we use your data.
- Objection: to object to processing based on legitimate interests, and to object to direct marketing at any time.
- Portability: to receive data you gave us in a commonly used, machine readable format, or to have it sent to another organisation.
- Withdraw consent: at any time, for any processing based on consent.
- Automated decisions: the safeguards described in section 7, including human review.
How to use your rights. Email info@phenomelongevity.com or use the privacy settings in the app. You do not usually have to pay. We may ask you to prove your identity before we act.
How long we take. We will respond within one month of receiving your request (or, where we need to check your identity, from when we have confirmed it). If your request is complex or you make several requests, we may extend this by up to two further months; we will tell you within the first month if so. When you ask for access, we will carry out reasonable and proportionate searches for your data, as the law allows.
Some rights have limits. For example, we may need to keep certain records by law. If we cannot fully meet your request, we will explain why.
18. Complaints about how we use your data
Under section 164A of the Data Protection Act 2018, added by the Data (Use and Access) Act 2025, you have the right to complain to us about how we handle your personal data. We want to hear from you so we can put things right.
How to complain to us:
1. Use our data protection complaints form at [link to complaints form], or email info@phenomelongevity.com with the subject "Data protection complaint".
2. We will acknowledge your complaint within 30 days of receiving it.
3. We will investigate and tell you the outcome without undue delay, keeping you updated if it takes longer than expected.
Complaining to the ICO. If you are not happy with our response, you can complain to the Information Commissioner's Office. The ICO will usually expect you to have raised the issue with us first.
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
For complaints about products, orders or service, please see our Complaints Policy.
19. Links to other websites and services
Our website and app may link to other websites or services, such as Apple Health or Google Fit. Those services have their own privacy policies, and we are not responsible for how they use your data.
20. Changes to this policy
We may update this policy from time to time, for example when the law changes or we launch new products. We will show the date of the latest version at the top. If we make important changes, we will tell you by email or in the app before they take effect.
21. Related policies
Please also read our Cookie Policy, Website and App Terms of Use, Terms of Sale, Test Kit and Sample Policy and Complaints Policy.