1. Who we are
My Longevity Centre (“we”, “our”, “us”) is a UK-based health and wellness facility specialising in evidence-led longevity services, including advanced diagnostic testing, personalised prevention programmes, and age-management therapies. For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we are the data controller of the personal information we collect.
Registered address: Soho Health Ltd, 124 City Road, London EC1V 2NX
Contact email: [email protected]
If you have any questions about this notice or wish to exercise your rights, please contact our Data Protection Lead at the details above.
2. The data we collect
Because we provide clinical-grade, preventative and wellness services, we collect and process both ordinary and special category data (health-related information).
3. How we obtain your data
-
Direct interactions – consultation forms, in-person assessments, portals and mobile apps.
-
Wearable and connected devices – only where you actively pair a device or upload data.
-
Referrals from authorised third-party clinicians – with your prior consent.
-
Automated technologies – cookies and similar technologies on our digital platforms.
5. Sharing your data
We never sell your personal data. We may share it only:
-
With specialist laboratories for processing diagnostic samples.
-
With referring or partner medical professionals where you have authorised us to coordinate care.
-
With technology providers (e.g. secure EHR platform, cloud hosting) under binding data-processing agreements.
-
With regulators or insurers where legally required, or to establish, exercise or defend legal claims.
-
If we restructure or transfer the business, in which case the receiving party must honour this notice.
All third parties are assessed for GDPR compliance and required to implement appropriate security measures.
6. International transfers
Your information is stored on UK or EEA servers wherever possible. If we must transfer data outside the UK/EEA (e.g. to a specialist US lab) we will use a lawful mechanism such as UK Addendum-equivalent Standard Contractual Clauses and, where necessary, additional technical safeguards.
7. Data retention
We keep medical records for a minimum of eight years from the date of your last visit, aligning with the UK Faculty of Sport and Exercise Medicine and private healthcare retention guidance.
Non-clinical data (e-mail enquiries, marketing preferences, website analytics) is reviewed every 24 months and deleted or anonymised when no longer required.
8. Your rights
Under the UK GDPR you have the right to:
-
Access the personal data we hold about you.
-
Request correction of inaccurate or incomplete data.
-
Request erasure (“right to be forgotten”) where legal grounds permit.
-
Restrict or object to certain processing.
-
Data portability – to receive your data in a structured, machine-readable format.
-
Withdraw consent for marketing at any time.
-
Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or 0303 123 1113.
9. Security measures
We employ ISO 27001-aligned controls, including:
-
AES-256 encryption at rest and TLS 1.2+ in transit.
-
Multi-factor authentication for staff access.
-
Role-based access in our electronic health-record system.
-
Regular penetration testing and staff data-protection training.
-
Secure on-site document disposal and CCTV in clinical areas.
10. Cookies and similar technologies
Our website uses strictly necessary cookies for core functionality and (with your consent) performance and analytics cookies (e.g. Google Analytics). A full cookie notice is displayed on first visit and accessible at any time in the site footer.
11. Automated decision-making
We do not use automated decision-making that produces legal or similarly significant effects without human oversight.
12. Changes to this policy
We may update this notice from time to time. Any material changes will be communicated via e-mail or highlighted on our website at least 14 days before they take effect.
