Last updated 13 October 2026
Privacy policy
How we collect, use, share and protect your personal data, and the rights you have under the GDPR.
1. Who we are
WOW Longevity Centre is a preventive-health and longevity centre in the Altaona Sports & Wellness Resort, Murcia (Spain), opening soon. The data controller responsible for the processing of your personal data is WOW Longevity Centre (legal entity name and registered address to be confirmed).
You can reach us through our contact form. Our Data Protection Officer (DPO) can be contacted through our contact form (DPO appointment and dedicated contact details to be confirmed).
2. What data we collect
We collect and process the following categories of personal data:
- Identification & contact data — name, email address, phone number, postal address, date of birth.
- Special-category health data (Art. 9 GDPR) — biomarkers, lab results, blood-test PDFs, wearable data (HRV, sleep, recovery), mood entries, nutrition logs, and other health information you provide.
- Account & security data — hashed password, multi-factor authentication settings, session and device information.
- Usage data — audit logs (including a record of which staff member opened your health data and when), AI Habit Assistant chat transcripts, and interactions with the platform.
3. Why we collect it and on what legal basis
Under Art. 13 GDPR we are required to tell you the purpose and lawful basis for each type of processing:
| Purpose | Lawful basis |
|---|---|
| Account creation and service delivery | Art. 6(1)(b) — performance of a contract |
| Health data used to provide your care and the member app (lab results, wearable data, documents, clinical records) | Art. 9(2)(h) — provision of health care, by staff bound by professional secrecy (Art. 9(3) GDPR; Art. 9.2 LOPDGDD), acknowledged when you register |
| Sending your health data to our AI provider (AI Habit Assistant personalisation and reading your lab reports) | Art. 9(2)(a) — your explicit consent; optional and off unless you switch it on, withdrawable at any time |
| Marketing communications and newsletters | Art. 6(1)(a) — your consent (separate and optional) |
| Accounting, tax and other legal record-keeping | Art. 6(1)(c) — legal obligation |
| Security, fraud prevention and audit logging | Art. 6(1)(f) — legitimate interests |
You can withdraw any consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Manage your consents at /dashboard/profile/consents.
4. Who we share it with (sub-processors and recipients)
We do not sell your personal data. We rely on a small set of vetted sub-processors to operate the service. Each is bound by a Data Processing Agreement and only processes data on our instructions.
| Recipient | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase | Database and file storage | EU (Ireland) | EU — no transfer required |
| Vercel | Application hosting (servers in Dublin) and global delivery of public website files | EU (Ireland); US company | Standard Contractual Clauses (SCCs) |
| Anthropic | AI Habit Assistant and reading lab reports — health data only with your explicit consent | US | Standard Contractual Clauses (SCCs) |
| WHOOP | Wearable data sync (only if you connect the integration) | US | User OAuth consent + SCCs |
| Oura | Wearable data sync (only if you connect the integration) | US | User OAuth consent + SCCs |
| Resend | Transactional email delivery | US | Standard Contractual Clauses (SCCs) |
Voice input. If you dictate a message to the AI Habit Assistant, your browser turns your speech into text with its own speech service (in Google Chrome, the audio is sent to Google). That service is provided by your browser maker, not by us; typing your message avoids it.
We may also disclose personal data when required by law, court order, or to protect the vital interests or safety of users.
5. How long we keep your data
- Account data — for as long as your account is active, plus 24 months after closure to satisfy legal record-keeping obligations.
- Health data — for as long as your account is active. Deleted on verified erasure request (Art. 17 GDPR).
- Marketing leads (concierge enquiries, contact form submissions) — up to 24 months.
- Audit logs — 24 months.
- Consent receipts — retained for 6 years for evidentiary purposes (Art. 7 GDPR) .
6. Your rights
Under the GDPR (Art. 15–22) you have the right to:
- Access a copy of the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data (the "right to be forgotten").
- Port your data — receive a structured, machine-readable JSON export.
- Restrict processing in certain circumstances.
- Object to processing based on legitimate interests or for direct marketing.
- Withdraw consent at any time, where processing is based on consent.
You can exercise most of these rights directly in your account at /dashboard/profile and /dashboard/profile/consents. For anything else, use our contact form.
7. Right to lodge a complaint
You have the right to lodge a complaint with your local data protection supervisory authority — typically the authority of the EU member state where you live, work, or where the alleged infringement took place. We'd appreciate the chance to address your concerns first, so please consider contacting our DPO before filing a complaint.
8. Cookies
We use only essential cookies required for authentication and security. We do not use advertising or third-party tracking cookies. See our Cookie Policy for the full list.
9. Children
Our services are intended exclusively for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a minor has provided us with data, please contact us and we will delete it.
10. International transfers
Where personal data is transferred outside the European Economic Area or handled by a US-based provider (Anthropic, Resend, WHOOP, Oura and Vercel), we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where appropriate, supplementary technical and organisational measures to ensure an essentially equivalent level of protection.
11. Automated decision-making
The AI Habit Assistant gives general lifestyle guidance (sleep, food, stress, movement) and, with your consent, reads values from lab reports you upload. Its answers are generated automatically and are not reviewed by a clinician before you see them; they are not medical advice. It does not make decisions about you that produce legal or similarly significant effects, so you are not subject to a decision based solely on automated processing within the meaning of Art. 22 GDPR. Clinical decisions about your care are only ever made by our practitioners.
12. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email and/or by an in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.