1. Operator and scope
Adrian Ali is the individual operator of Yirelo in California, United States. This notice supplements the Privacy Notice and does not replace separate affirmative health-data permission. Health data remains sensitive even when access is free.
2. Categories, sources and purposes
You supply demographic/population context, dates, body measurements, cardiovascular/metabolic/kidney markers, coronary calcium, laboratory values, fitness/exercise, smoking, sleep/apnea, social connection and family-history categories. Optional life-stage information can be reproductive-health context. You may transcribe your own lab, clinician or wearable results; the service does not directly access those providers' accounts.
Derived information includes Phenotypic Age and its age-adjusted comparison, lifespan/scenario estimates, survival probabilities, experimental healthspan estimates, contributions and planning priorities. These are inferences, not established diagnoses. Account participation, save dates and related communications can reveal a health interest.
Processing supports the functions you request: local scenarios, private cloud profiles, dated History, comparisons and general planning examples. Necessary technical processing includes IP addresses and requested asset paths; international population requests include the selected sex/country category. We do not collect GPS or use healthcare-facility geofences.
3. Recipients and information disclosed
Supabase provides authentication and storage for account/health records. Vercel handles application hosting, requests and delivery. Resend processes contact information, email preferences, membership segments and delivery events, not laboratory panels or personal model results in automated emails. Stripe processes Plus billing/subscription information, not calculator panels. These are necessary service-provider purposes, not optional advertising disclosures.
We do not sell consumer health data or share it with advertising networks, employers or insurers through the service. No separate affiliate is identified as a recipient. Necessary processor activity for your requested service is disclosed here. Unrelated optional sharing, if ever proposed, requires its own specific permission where required, separate from collection permission.
Legally required disclosures or a lawful operator transition may require separate handling under the general notice. You may request confirmation of processing, actual third-party/affiliate recipients and a way to contact them. Generic categories do not replace an individualized recipient response where law requires it.
4. Separate permission
Cloud health permission is not required for calculation within the signed-in application, but is needed for new or updated cloud health records. It is separate from Terms and marketing. New controls start unchecked. Exact wording, document versions and server times are recorded; no historical consent is invented for existing members.
Permission covers collection, storage and use for the requested private profile, History and planning functions with the named necessary providers. It does not permit advertising, sale, unrelated studies or AI training. Opting into research-summary emails means receiving editorial material, not permitting research on your records.
5. Access, withdrawal, deletion and appeals
Use Privacy Choices to export saved health records/consent receipts or withdraw permission. Withdrawal asks for confirmation because it erases active saved health records and prevents new cloud health writes; your login and earlier subscription are separate. Calculation remains available within a signed-in account. Public privacy requests need no account; export and deletion of account data remain available without renewed Terms or health consent.
The request form needs no new account and supports confirmation/access, correction, copies, recipient details, deletion, withdrawal help and appeals. We may verify identity with an existing account or other proportionate means before disclosing or altering private records. Representatives may request with authorization. Do not include lab results or identification documents.
Verified deletion requests are followed through relevant processors, archives and backups. Active-database erasure does not certify that every copy is already gone. Applicable deadlines control, including Washington's maximum six-month permitted archive/backup delay. Requests generally follow a 45-day response period subject to applicable extensions/notices; appeals receive separate review under applicable deadlines. You may contact the Washington Attorney General or other competent regulator.
No rights request is penalized. A cloud-dependent feature may stop because it cannot operate without the permission you withdrew. Any legally required minimal retention for billing, security, suppression or request/consent evidence must be explained and does not permit unrelated health-data use.
6. Changes and contact
New categories or purposes require advance notice and any required specific permission before processing. Dated public versions are preserved. Contact the operator using Privacy Choices and Requests below. It is not a medical or emergency support channel.