Privacy Policy

Controller. The controller of your personal data is Axo Longevity UK Ltd, a company registered in England and Wales (Company No. 17169283), registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. ICO registration number ZC153626.

Our US group company, Axo Longevity, Inc. (373 Wythe Avenue, Suite 11B, Brooklyn, NY 11249, USA), helps us provide our services and receives personal data from us as described in sections 6 and 7.

Privacy contact. Email privacy@axolongevity.com for any question about this statement or to exercise your rights.

EU representative (Article 27 EU GDPR). Because neither Axo entity is established in the EU, we have appointed DataRep (a trading name of Data Protection Representative Limited), 77 Camden Street Lower, Dublin, D02 XE80, Ireland, as our representative in the EU. You can contact DataRep about your data, quoting "Axo Longevity".

Data Protection Officer. We have assessed that we are not required to appoint a Data Protection Officer. We review this assessment at least once a year. Our privacy contact above handles all data protection matters.

Axo provides wellness, performance and educational insights based on biomarker testing and other information you share with us. We are not a healthcare provider and do not diagnose, treat, cure or prevent disease. Our services are for adults aged 18 and over, and we do not knowingly collect personal data from anyone under 18.

• Identity and contact data: name, email address, phone number, postal address, date of birth, sex and gender.
• Account and transaction data: account details, membership tier, orders, appointment bookings, payment status and billing details. Card details are handled by our payment processor; we do not store full card numbers.
• Health data (special category data): biomarker and blood test results, health questionnaires (including your ethnic origin, which can affect how some results are interpreted), medical history you choose to share, medications and supplements, results reports, Biological Age and Health Score outputs, and data from wearable devices you connect.
• Genetic data (special category data): only if you order a genetic test.
• Communications: messages, emails and chat conversations with our support team, including anything you choose to tell us in them.
• Technical and usage data: IP address, device and browser information, approximate location, cookie identifiers, and how you use our website and app.
• Marketing preferences: whether you have agreed to receive marketing and how you interact with our emails.
• Event data: if you attend an Axo event, your registration details and, only if you agree, photos or video of you.

We do not ask for, and do not want to receive, information about your religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation.

• Directly from you, when you create an account, buy a membership, complete questionnaires, book appointments, contact us or attend an event.
• From laboratories and sample-collection partners, who send us your test results.
• From wearable devices and health apps you choose to connect (for example WHOOP, Oura or Apple Health).
• From payment processors and buy-now-pay-later providers, who confirm your payment status.
• Automatically, through cookies and similar technologies on our website and app (see our Cookie Policy).
• From partners who refer you to us, such as a clinic, coach or another member, if you sign up through them.

We only use your personal data where the law allows it. For each purpose below we rely on the lawful basis shown. For health, genetic and ethnic origin data we also rely on your explicit consent (Article 9(2)(a) UK and EU GDPR), which we ask for before you take a test.

• Providing our services (creating your account, arranging your tests, receiving and analysing your results, producing your report and action plan): performance of our contract with you; explicit consent for health and genetic data.
• Taking payment and managing your membership, including renewals: performance of our contract.
• Customer support and responding to your messages: performance of our contract and our legitimate interest in helping you.
• Telling you about a result that may need urgent medical attention, where we become aware of one: your explicit consent and, in an emergency, your vital interests.
• Improving our services and developing new features, using data that is de-identified wherever possible: our legitimate interest in improving our services; explicit consent where health data is involved.
• Marketing emails: your consent, which you can withdraw at any time using the unsubscribe link or by contacting us. Existing members may receive emails about similar Axo services based on our legitimate interest, with an easy opt-out in every email.
• Analytics and advertising cookies: your consent, given through our cookie banner.
• Preventing fraud and keeping our services secure: our legitimate interest in protecting Axo and our members.
• Meeting legal obligations, such as tax and accounting records: legal obligation.
• Handling complaints and legal claims: our legitimate interest in defending our position and, for health data, the establishment, exercise or defence of legal claims (Article 9(2)(f)).

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that balancing test. Providing your contact, payment and health data is necessary for us to provide the testing service; if you do not provide it, we cannot provide that service.

Automated decisions. We use software, including AI tools, to help produce your reports and insights, but we do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

We do not sell your personal data. We share it only as needed with:

• Laboratories and sample-collection partners, to collect and analyse your samples and return your results. Depending on the arrangement they act as our processors or as independent controllers under their own privacy notices. Our laboratory partners are accredited laboratories in the UK, the EU and Peru. You can ask us for the names of the laboratories that handled your samples.
• Service providers (processors) who help us run Axo, listed in section 12. They may only use your data on our instructions.
• Payment and buy-now-pay-later providers (Stripe, Klarna, Scalapay), to take payment. Klarna and Scalapay use your data as independent controllers under their own privacy notices.
• Our group companies, Axo Longevity UK Ltd and Axo Longevity, Inc., to provide and support our services.
• Partners who referred you, only if you ask us to share your results with them or agree to it.
• Professional advisers (lawyers, accountants, insurers and auditors).
• Public authorities, regulators or courts, where the law requires it.
• A buyer or investor, if Axo or its business is sold or restructured, under confidentiality obligations.

We store your account, health and results data in the EU (Frankfurt, Germany). Some of the organisations we share data with are outside the UK and EEA, including our US group company and service providers in the United States, and one laboratory partner in Peru. When we transfer personal data outside the UK or EEA we protect it by:

• relying on an adequacy decision or UK adequacy regulations, including the EU-US Data Privacy Framework and its UK Extension where the recipient is certified; or
• using the European Commission's Standard Contractual Clauses, with the UK Addendum or the UK International Data Transfer Agreement for UK data, together with an assessment of the risks of the transfer.

You can ask us for more information about the safeguards we use, and for a copy of them, by emailing privacy@axolongevity.com.

We keep personal data only for as long as we need it for the purposes above, then delete it or anonymise it securely.

• Account, health and results data: for as long as you have an account, then for 2 years after your membership ends or your last activity, so that you can return and see your history, unless you ask us to delete it sooner.
• Transaction and billing records: 6 years after the end of the financial year they relate to, to meet UK tax and accounting rules.
• Support conversations: 3 years after the conversation closes.
• Records of your consents: for as long as we rely on the consent, plus 6 years.
• Marketing data: until you unsubscribe or withdraw consent, after which we keep a record so that we do not contact you again.
• Cookie data: for the periods set out in our Cookie Policy.

We may keep data for longer where we need it for a legal claim or a legal or regulatory obligation. Deleted data may remain in our encrypted database backups for up to 7 days before they are overwritten.

We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, role-based access controls, multi-factor authentication on our systems and confidentiality obligations for our staff and contractors. We limit access to health data to the people who need it to provide our services. If a personal data breach is likely to put your rights at risk, we will tell you and the relevant regulator as the law requires.

Under the UK GDPR and EU GDPR you have the right to:

• be informed about how we use your data (this statement);
• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data erased, in certain circumstances;
• restrict how we use your data, in certain circumstances;
• receive your data in a portable format, or have it sent to another provider;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw your consent at any time. This does not affect processing already carried out. If you withdraw consent to the processing of your health data, we will not be able to continue providing testing services to you;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects.

To exercise any right, email privacy@axolongevity.com. We may need to confirm your identity. We will respond within one month, which we may extend by up to two further months for complex requests; if we do, we will tell you why. We do not normally charge a fee.

If you are unhappy with how we have handled your data, please contact us first at privacy@axolongevity.com so that we can try to put it right.

You also have the right to complain to a data protection regulator:

• United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk, telephone 0303 123 1113.
• European Economic Area: the data protection authority in the country where you live or work, or where you think the problem happened. You can find your authority at edpb.europa.eu.

These providers process personal data on our behalf under written terms that require them to protect it.

• Amazon Web Services: hosting, storage and networking (EU, Frankfurt).
• Supabase: database hosting (EU, Frankfurt).
• Retool: internal operations tools used by our team (US).
• Google Workspace: email, documents and internal collaboration (US and EU).
• Slack: internal team messaging (US).
• Intercom, including Fin AI: customer support and messaging (US). We do not send your result values, Biological Age or Health Score outputs or genetic data to Intercom, but its AI assistant will read anything you include in a message to us, so please do not share your results in chat.
• Customer.io: transactional and marketing emails (US and EU).
• Stripe: payment processing (global).
• Sentry: error monitoring (US).
• Contentful: website and app content management (US and EU).
• SelfDecode: analysis of genetic data, where you order a genetic test (US).
• Google Analytics and Google Tag Manager: website analytics, only with your cookie consent (global).
• Meta (Facebook and Instagram) Pixel and X (Twitter) Pixel: advertising measurement, only with your cookie consent (global).

We use cookies and similar technologies on our website and app. Non-essential cookies, including analytics and advertising cookies, are only set with your consent, which you can change at any time through the cookie settings link in our website footer. Our Cookie Policy explains this in more detail.

We may update this statement from time to time. We will post the updated version on our website with a new effective date and, where the changes are significant, we will tell you by email or in the app.