Legal

Privacy Policy

Last updated: August 2026

Who We Are

VAIA Longevity ("we", "us", "our") is a UK-based educational wellness platform operating at vaialongevity.com. We are the data controller for personal data processed through the platform, and we are committed to protecting your personal data in line with the UK GDPR and the Data Protection Act 2018.

Data We Collect

  • Account information: email address, username, and password (stored encrypted).
  • Profile and health information you choose to provide, such as age, goals, symptoms, supplements and tracker entries. We treat health information as special category data.
  • Facial images you upload for the optional Face Scan feature, and the visual age estimate and scores produced from them.
  • Usage data, such as pages visited, features used, and technical information such as browser type and device.
  • Payment information, processed securely by Stripe. We do not see or store your card details.

Our Lawful Basis

We process your data on these bases under the UK GDPR:

  • Consent, for optional features you switch on. For Face Scan images and derived results, we rely on your separate Face Scan consent under Article 6(1)(a) UK GDPR.
  • Performance of a contract, to provide the service you sign up for.
  • Legitimate interests, to secure the platform and prevent misuse, balanced against your rights.
  • Legal obligation, where we must retain certain records.

You can withdraw consent at any time. Withdrawal does not affect processing carried out lawfully before withdrawal.

How We Use Your Data

  • To provide and personalise your experience on the platform.
  • To generate educational wellness content and Face Scan results.
  • To manage your subscription and process payments via Stripe.
  • To send service emails, such as account and billing messages, via Brevo.
  • To improve and secure the platform and respond to your requests.

We do not sell your personal data, and we do not use your health or Face Scan data for advertising.

Face Scan Data

Face Scan is optional. When you use it, we process the facial image you submit to produce a visual age estimate, skin, hydration and eye area scores, and related educational guidance. We never use Face Scan to measure biological age, diagnose any condition, or identify or verify you through facial recognition.

Face Scan images and derived results are personal data. VAIA does not create biometric templates or process facial images for unique identification. Under the current Face Scan design, we do not classify this information as special category biometric data. We nevertheless apply enhanced safeguards, including separate Face Scan consent, restricted access, defined retention periods and deletion on withdrawal.

We ask for your separate Face Scan consent before the image is analysed, and you can withdraw it at any time. We keep an uploaded facial image for a maximum of 12 months, or sooner if you delete the scan, withdraw consent, or delete your account. Full details are set out in our Face Scan Data Policy.

Service Providers We Rely On

We share data only with trusted providers who process it on our instructions, or, where stated, as independent controllers for their own defined purposes:

  • Stripe, for subscription and payment processing. Stripe also acts as an independent controller for certain payment, fraud and legal purposes.
  • Brevo, for transactional and service email.
  • Cloudinary, for image storage and delivery.
  • OpenAI, to analyse Face Scan images, generate Face Scan results and produce AI educational content.
  • Render, for hosting, database and backups.

Some providers process data outside the United Kingdom. Where they do, we rely on the transfer safeguards in the applicable provider agreement, such as the UK Addendum to the Standard Contractual Clauses.

How Long We Keep Your Data

We keep personal data only for as long as needed for the purpose it was collected, then delete or anonymise it, unless a legal duty requires longer retention.

DataRetention
Account, profile and health dataWhile your account is active, then deleted or anonymised on account deletion
Face Scan imageMaximum 12 months from upload, or sooner on request
Consent, withdrawal and deletion recordsSix years after consent is withdrawn or the account is deleted, then deleted
Subscription and accounting recordsRetained where UK law requires, typically six years
Security and access logsKept for a limited period unless linked to an active incident

Your Rights

Under UK GDPR you have the right to access, correct, delete, restrict and object to the processing of your data, to receive a portable copy of your data, and to withdraw consent at any time. To exercise any right, contact support@vaialongevity.com. We respond without undue delay and within one month in ordinary cases.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Data Breaches

We maintain a personal data breach response procedure. Where a breach is likely to risk your rights and freedoms, we notify the ICO without undue delay and no later than 72 hours after becoming aware. Where a breach is likely to result in a high risk to you, we inform you directly.

Security

We apply technical and organisational measures appropriate to the sensitivity of your data, including encrypted transmission, access controls, restricted administrative access and deletion processes. No internet service can guarantee absolute security, but we work to protect your data and respond quickly to any incident.

Children

VAIA is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact support@vaialongevity.com and we will delete it.

Changes to This Policy

We may update this policy when our processing, providers, retention periods or the law change. Where a change is material, we will make it visible in the app.

Contact

For any privacy question, email support@vaialongevity.com.