Privacy Notice

Version 1.2, effective 2 September 2026. Analytics information updated 8 September 2026. Shop information added 8 October 2026.

Who we are

Vitality Consult Ltd (company number 14070877), trading as The Longevity Lab, is the controller of the personal information described in this notice. Our registered office is 140 Lee Lane, Horwich, Bolton, BL6 7AF. Contact our data-protection contact at info@the-longevity-lab.co.uk.

Information we collect

Depending on the service, we collect identity, contact, account, order, payment-status, appointment and correspondence information. We also collect information you provide in your health profile, including relevant medical history, medicines, supplements, symptoms, hormone or fertility context, lifestyle information and goals. We receive laboratory results and may create structured biomarker records, practitioner notes and personalised reports from that information.

Health information is special-category personal data and receives additional protection. Payment-card and bank credentials are handled by the payment provider and are not intended to enter The Longevity Lab systems.

Why we use information and our lawful bases

• To create and administer your account, take payment, arrange testing or collection, provide results and reports, and deliver services you request: performance of our contract with you.
• To use health information for those specified services: your separate, explicit consent under Article 9(2)(a) UK GDPR.
• To meet accounting, tax and other legal requirements: legal obligation.
• To secure the service, prevent misuse, keep proportionate audit records and establish or defend legal claims: our legitimate interests or the legal-claims condition where applicable.
• To send broader promotional marketing: where you have given consent or another lawful electronic-marketing route applies. You can object or opt out at any time.
• Where you actively start purchasing one of our tests or services and provide your email address, we may send a limited reminder about that incomplete purchase under the products-and-services soft opt-in in the Privacy and Electronic Communications Regulations, provided the applicable conditions are met. We give you a clear opportunity to refuse when your email is collected and an opt-out in each reminder.

Service messages needed to fulfil your order, provide security information or communicate your results are not promotional marketing. Checkout-recovery reminders are kept separate from health-result content and broader marketing preferences.

You may withdraw health-data consent for future processing by contacting us. Withdrawal does not affect processing already completed and may mean we cannot continue the service. We may still keep limited records where another lawful basis requires this.

Shop orders

When you buy products from our shop, we use your name, contact details, purchased items, payment status and delivery address to fulfil your order, send transactional updates, arrange delivery and manage returns. Stripe processes payment details. Couriers and our email provider receive the details needed for delivery and service messages. We do not send your report, results or medical history to Stripe or product suppliers when you shop. The basket stores product identifiers and quantities in your browser; it does not store report content. Guest purchases can be shown in an account with the same verified email address.

Optional website analytics

With your consent, we measure use of public website pages and basic campaign attribution. We use this to improve the website and understand which marketing leads to purchases. Google Analytics collection, when enabled, uses broad page groups and interactions. We do not send health answers, results, names, email addresses, private account pages or test-specific conditions to Google Analytics. Our own commercial records remain separate from Google. You can withdraw analytics consent through Cookie choices in the footer. Our Cookie Notice states whether Google collection is currently enabled and explains the cookies and controls.

What you must provide

Identity, contact, order and test-relevant health information may be required to provide the service. Optional optimisation questions are labelled and can be skipped, although this may limit how personalised the interpretation can be.

How information is obtained

Most information comes directly from you. We may also receive information from the person buying you a gift test, a parent or guardian where an approved junior pathway applies, laboratories, collection providers, payment providers and reviewing professionals. We will identify the relevant source where it is not obvious.

Who receives information

We disclose only what is necessary to providers involved in the service, which may include laboratories, sample-collection or courier providers, reviewing doctors or practitioners, secure hosting and database providers, payment infrastructure, email delivery and carefully approved technical providers. Providers must be assessed and contracted according to their role.

If testing is arranged through an employer, the employer does not receive identifiable health results. Gift purchasers do not receive the recipient's results.

International transfers

We prefer UK or EEA processing where practical. If an approved provider transfers personal information outside the UK, we will document the destination and use an applicable adequacy regulation or approved contractual safeguards and risk assessment. You may ask us for information about the relevant safeguard.

Automated tools and human review

Software may help recommend a test, structure information and prepare a report draft. Missing laboratory values are not inferred. Where automated extraction is introduced, it must be validated and uncertain values must be checked by a person before release. We do not make solely automated decisions that produce legal or similarly significant effects. The website guide uses fixed, pre-written service information only. It cannot access accounts or reports, does not call an AI model, and retains neither question text nor a session identifier. It refuses personal health questions. The private report assistant is not enabled. If it is introduced later, it will require a separate launch review and active client agreement before any minimum necessary report context is sent to an approved provider.

How long we keep information

Abandoned checkouts are kept for up to seven days. Unverified accounts are scheduled for deletion after 30 days. Core order, consent, health-profile, verified-result and released-report records are normally retained for up to six years after service completion, subject to any shorter or longer period required for safety, accounting or legal claims. Raw duplicate laboratory uploads and superseded drafts are removed sooner. Security logs are normally kept for up to 12 months. Backup or recovery copies follow the documented operational recovery schedule and are not kept as a separate indefinite archive. A legal hold may temporarily pause deletion for specific records.

Security

We use access controls, encryption in transit and at rest, private storage, role separation, administrator multi-factor authentication and audit records. We maintain and review proportionate backup/recovery arrangements as part of production operations. Detailed results are provided through the authenticated account rather than copied into ordinary email.

Your rights

Depending on the lawful basis and circumstances, you may have rights of access, rectification, erasure, restriction, portability and objection. You can also withdraw consent. To make an access, correction or deletion request, use My Account → Privacy & Data or email us. We may need to verify identity and may retain information where the law permits or requires it.

Your right to object: you may object to processing based on our legitimate interests and to direct marketing at any time.

Data-protection complaints

If you are unhappy with how we have handled your personal information, email info@the-longevity-lab.co.uk with the subject “Data protection complaint”, or use the complaint option in My Account → Privacy & Data. Please explain what happened and what outcome you are seeking.

We will acknowledge receipt within 30 days. We will investigate the complaint without undue delay, make appropriate enquiries, keep you informed about progress where appropriate and tell you the outcome without undue delay. We may ask for proportionate information to confirm your identity or understand the issue.

You also have the right to complain to the Information Commissioner's Office. Information about doing so is available at ico.org.uk/make-a-complaint.

Children

Online services for children remain unavailable until the separate parental-responsibility, competence, safeguarding, privacy and retention pathway has been approved.

Changes to this notice

We will publish the current version and date. Material changes affecting existing clients will be brought to their attention through an appropriate service message.