Privacy Policy

1. Introduction

This Privacy Policy describes how Longevity Concierge ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our Telegram Mini App, Telegram bot (@longevity_coach_bot), and related services (collectively, the "Service").

By using the Service, you consent to the collection and processing of your data as described in this Policy. If you do not agree, please discontinue use of the Service.

2. Data Controller

The data controller responsible for your personal data is the operator of Longevity Concierge. For privacy-related inquiries, contact us via the Telegram bot @longevity_coach_bot.

3. Data We Collect

3.1 Identity Data

• Telegram user ID, first name, last name, username
• Language preference and timezone

Purpose: Account management, personalization
Legal basis: Contract performance

3.2 Profile Data

• Age / date of birth, gender
• Height, weight, activity level
• Occupation type, diet preferences, food allergies
• Health goals and conditions

Purpose: Personalized health recommendations
Legal basis: Explicit consent

3.3 Health Data (Special Category)

• Blood test results and AI interpretations
• Nutrition logs (meals, calories, macronutrients)
• Water intake, workout records
• Weight, blood pressure, sleep, mood tracking
• Female/male health metrics

Purpose: Core health tracking service
Legal basis: Explicit consent (GDPR Art. 9)

3.4 Usage Data

• Pages visited, features used, interaction timestamps
• Device information, app version

Purpose: Service improvement, analytics
Legal basis: Legitimate interest

3.5 Payment Data

• Telegram Stars transaction IDs
• Subscription tier and expiration dates

Purpose: Billing and subscription management
Legal basis: Contract performance

4. How We Use Your Data

• Provide personalized health tracking and recommendations
• Generate AI-powered meal analysis and blood test interpretations
• Send notifications (morning briefings, reminders, streak alerts)
• Process subscriptions and payments via Telegram Stars
• Improve our Service through anonymized analytics
• Comply with legal obligations

5. AI Data Processing

We use OpenAI API (GPT-4.1) to process certain health data for generating interpretations and recommendations. When data is sent to OpenAI:

• Only relevant health metrics are transmitted (blood test values, meal descriptions, health questions)
• Your Telegram ID, name, and payment information are never sent
• Per OpenAI's API data usage policy, API data is not used for model training
• You may opt out of AI features and use manual-only mode

6. Data Storage and Security

• Database: Supabase (PostgreSQL), hosted on AWS (eu-central-1, Frankfurt)
• Application server: Hetzner (Finland)
• Encryption: All data encrypted in transit (TLS 1.2+) and at rest
• Access control: Row Level Security (RLS) ensures users can only access their own data
• Authentication: Telegram WebApp HMAC-SHA256 validation

7. Data Sharing

We do not sell your personal data. We share data only with:

8. Data Retention

• Active account: Data retained while your account is active
• After deletion request: All personal data permanently deleted within 30 days
• Anonymized analytics: Retained for up to 2 years
• Payment records: Retained for 7 years (legal/tax requirements), anonymized
• Consent records: Retained indefinitely as legal proof, anonymized

9. Your Rights

Under GDPR (EU) and applicable data protection laws, you have the right to:

• Access: Request a copy of all your personal data
• Rectification: Correct inaccurate data via your profile
• Erasure: Request complete deletion of your account and data
• Restriction: Pause data processing
• Portability: Receive your data in a machine-readable format
• Objection: Opt out of analytics and non-essential processing
• Withdraw consent: At any time, without affecting prior processing

To exercise your rights, contact us through the bot's /help command or Settings menu.

10. Children's Privacy

The Service is intended for users aged 16 and older. We do not knowingly collect data from children under 16. If we discover such data has been collected, it will be promptly deleted.

11. International Transfers

Your data may be processed in the European Union (database) and the United States (AI processing via OpenAI). All transfers are protected by appropriate safeguards including encryption and contractual obligations.

12. Cookies and Local Storage

As a Telegram Mini App, we do not use traditional cookies. We use browser localStorage for:

• Session data and cached preferences
• Analytics event queue (sent to our server, not third parties)
• Language and theme preferences

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last updated" date
• We will increment the version number
• You will be asked to re-accept the updated policy on your next app launch

14. Contact

For privacy-related questions or to exercise your data rights, please contact us via:

• Telegram bot: @longevity_coach_bot (use /help command)