1. Operator, scope and contact
Adrian Ali operates Yirelo as an individual in California, United States. This notice covers the website, accounts, profiles, History, planning features and related communications. The service is mainly intended for U.S. users. A selectable country baseline is not approval to operate in that market.
Use Privacy Choices and Requests below for questions, access, correction, deletion, recipient information or appeals. No new account is required. Existing sign-in or other proportionate verification may be required before disclosing or changing private data. Representatives may submit requests with appropriate authorization.
2. Information and sources
Account information comes from you and authentication services: email, optional name, account identifiers and authentication records. We record document versions, exact choice wording, server times and sources for Terms/adult confirmations and health-data permissions. Email preferences and delivery, unsubscribe, bounce or complaint records support communications.
Health inputs you choose to provide include age, sex-at-birth selection, optional life stage, population context, dates, body measurements, cardiovascular/metabolic/kidney markers, coronary calcium, smoking, fitness, exercise, sleep/apnea, social connection, family-history categories and the nine Phenotypic Age laboratory biomarkers. Derived results include scenario estimates and related summaries. The separate health notice provides more detail.
Service information includes saved-profile timestamps, checkpoint counts, access level and support records. Billing information includes Stripe customer/subscription references, payment status and billing interval. Stripe handles payment details; card numbers are not entered in health-profile forms. Plus Checkout and the billing portal send you to Stripe.
Hosting/authentication providers receive technical requests including IP address, browser/device information, URLs, timestamps and security/error data. Media requests reveal the requested asset. The service does not request GPS, contacts, camera, microphone, raw DNA or direct Apple Health/Garmin access. Wearable and lab results are entered manually; the service does not access those accounts.
3. Local calculation and optional cloud saving
Most calculations run in the browser. Typing values does not automatically save a cloud profile. Selecting an international baseline sends the selected country/sex category to the life-table endpoint for public population data, not your lab panel to a research organization. Ordinary hosting requests still occur; local calculation does not mean zero network processing.
Entry requires sign-in and current Terms/adult confirmation. Cloud saving additionally requires separate health-data permission. Declining that permission leaves calculation and education available within the signed-in application. Existing members are not deemed to have given new permissions because they already have an account.
Weekly checkmarks and interface choices may be held in your browser, not all synchronized to the cloud. The privacy release clears Yirelo local profile/plan state on successful sign-out or erasure. Copies on other devices, browser backups and downloaded exports require separate attention. Shared-device users should sign out and clear local entries.
4. Purposes and limits
We use account/technical information to authenticate, deliver and secure requested features, troubleshoot, administer subscriptions, send necessary service notices and handle requests. Saved health data supports your private profile, History and requested modeling/planning functions and a support request you make about that information.
Optional research-summary and product-update emails have separate controls. A research-email preference is not enrollment in a study. We do not sell health information, disclose it for targeted advertising or use saved health records to train AI models. The service has no employer/insurer record-sharing feature. New purposes require notice and any required specific permission before use.
5. Providers and disclosures
Supabase supplies authentication, database and media storage; Vercel supplies application hosting and delivery. They process the account, health and technical information required for those functions. Resend handles contact details, email preferences, membership segments and delivery events, not laboratory values or personal model results in automated emails. A health-service account or email subscription can itself reveal a health interest.
Stripe handles paid subscriptions and billing relationships. International population requests use WHO data; research links open third-party sites. GitHub and Runway support development and public content production; the application does not transmit saved health records to them to calculate results or generate exercise media. Approved public exercise assets are separate from private account records.
Authorized operator/support access is for service purposes. Disclosures required by law or needed to address genuine security issues or protect rights are subject to applicable law. A future business/operator transition is not blanket permission to repurpose health data; appropriate notice and legally required consent are needed. We currently identify no separate affiliate receiving consumer health information. Outside websites and independent services have their own practices.
6. Cookies, analytics and browser signals
Authentication cookies and necessary browser storage support sign-in, choices and requested functions. This privacy release disables Vercel Web Analytics, Speed Insights and custom browser analytics events. Advertising pixels and session replay are not used in this release. Necessary provider access/security logs remain; disabling optional analytics does not disable hosting.
We do not sell/share information for cross-context behavioral advertising. Global Privacy Control and Do Not Track do not turn on tracking: the same no-advertising/no-optional-analytics setting applies to all visitors. Any proposed optional analytics requires an appropriate notice and choice mechanism before activation. Providers receiving technical requests may collect the technical information described above; external links are governed by those sites' practices.
7. Retention, deletion and withdrawal
Saved health profiles and History are retained while you request cloud storage, until erasure, withdrawal or account deletion. Withdrawal in Privacy Choices blocks future health-data writes and erases saved health records from the active Yirelo database; the login and billing relationship remain separate. Export first if you need a copy.
Active-database erasure does not mean every provider log, archived backup, earlier email or billing record disappears immediately. A privacy follow-up record tracks provider/backup handling. Required deletions and processor notifications follow applicable deadlines. For authenticated Washington health-data deletions, any permitted archive/backup delay cannot exceed six months. Actual provider retention and the scope of each request may need confirmation; we do not promise immediate deletion from every system.
Account, payment, security, suppression and minimal consent/request records may require separate retention to complete requests, avoid unwanted email, resolve disputes or meet legal requirements. They are not used for unrelated marketing. We review retention against its purpose and applicable requirements; ask for a specific explanation. Downloads you keep are outside the source account's deletion controls.
8. Rights and requests
Privacy Choices shows current agreement/health-permission status, published versions, a saved-health-data/consent export, and withdrawal/active erasure. Account settings retain erasure, account deletion and billing management. Email controls and unsubscribe links remain separate. These rights tools do not require payment or renewed health consent.
Request confirmation/access, correction, a copy, deletion, recipient details, withdrawal assistance or an appeal. Statutory rights depend on applicable law; the request tools are offered regardless of particular business thresholds. We may authenticate using existing sign-in or another proportionate method. Do not put confidential medical details or identity documents in the request form.
We track requests and respond under applicable deadlines, generally within 45 days for a verified data-rights request, explaining any legally permitted extension. Appeals receive separate review within applicable deadlines, no later than 45 days where Washington's law applies. A receipt means received, not verified or completed. You may contact the California Attorney General/Privacy Protection Agency, Washington Attorney General, FTC or another competent regulator. We do not penalize rights requests, though storage-dependent features need the corresponding permission.
9. Security, location, children and updates
Authentication, access restrictions and secure transport support protection, but absolute security is not promised. The service is not represented as HIPAA-certified or a clinical record system. Report suspected misuse without submitting passwords or confidential records.
Operations are primarily U.S.-associated, but providers and authorized operations can involve other locations. Exclusive U.S. data residency is not promised. New supported markets or processing arrangements require assessment of relevant local and transfer requirements.
Accounts are for adults. We do not knowingly invite children's health records; report a suspected underage account for investigation and appropriate handling. Effective dates and versions are shown. Material changes are highlighted in the service and, where appropriate, account notices; new purposes requiring consent do not rely on silence or past participation.