generated: '2026-09-19'
method: searched
probe: true
sources:
- https://philongevity.com/privacy
- https://philongevity.com/trust
- https://philongevity.com/terms
signals:
  data_subject_request:
    url: https://philongevity.com/privacy
    section: Your Rights and Choices
    channel: support@philongevity.com
    stated_sla: 'We aim to respond to all privacy inquiries within 5 business days.'
    deletion_period: 'Deletion is permanent and completed within 30 days.'
    rights_named: [access, correction, export, deletion, opt-out of marketing, CCPA (know / delete / opt out of sale), GDPR (access, rectification, erasure, portability, objection, complaint to a supervisory authority)]
    evidence:
    - source: https://philongevity.com/privacy
      http_status: 200
      fetched: '2026-09-19'
      quote: '"Access: You can view all data we hold about you from your account settings, or by emailing support@philongevity.com. ... Deletion: You can delete your account and all associated health data at any time. Go to Account Settings -> Delete Account, or email support@philongevity.com. Deletion is permanent and completed within 30 days."'
    note: A documented request process with a channel, a response period and in-product self-service (account settings). /privacy/requests 404s; no DSR API is documented.
  exit_assistance:
    url: https://philongevity.com/trust
    section: Your data, exportable in full
    evidence:
    - source: https://philongevity.com/trust
      http_status: 200
      fetched: '2026-09-19'
      quote: '"You can request a complete export of your account: profile, analyses, the canonical FHIR record, and a manifest of your uploads with time-limited download links. Credentials and tokens are redacted from exports by construction."'
    - source: https://philongevity.com/privacy
      http_status: 200
      fetched: '2026-09-19'
      quote: '"Export: You can export your uploaded documents and generated reports at any time from your account dashboard."'
    note: A documented full-account export including a standards-based (FHIR) clinical record — portability substance, not a marketing mention. No formal switching/migration assistance beyond export.
  subprocessors:
    url: https://philongevity.com/privacy
    section: Who Can Access Your Data — Service providers
    dated: '2026-03-20'
    entries:
    - {vendor: Google Cloud / Firebase, purpose: infrastructure (Firestore, Cloud Storage, Cloud Healthcare API FHIR store, Vertex AI), location: United States}
    - {vendor: Stripe, purpose: payment processing}
    - {vendor: transactional email providers, purpose: email, note: not named}
    evidence:
    - source: https://philongevity.com/privacy
      http_status: 200
      fetched: '2026-09-19'
      quote: '"We use a limited number of third-party services: Google Cloud/Firebase (infrastructure), Stripe (payment processing), and transactional email providers. These providers are bound by data processing agreements and are not permitted to use your data for their own purposes."'
    note: A named list with purposes on a dated page, but prose inside the privacy policy rather than a standalone subprocessor table, and the email vendor is unnamed. /legal/subprocessors 404s.
  ai_transparency:
    url: https://philongevity.com/trust
    section: Clinical honesty / Where your health data lives
    evidence:
    - source: https://philongevity.com/trust
      http_status: 200
      fetched: '2026-09-19'
      quote: '"AI analysis of your records runs on US-pinned Vertex AI endpoints covered by the same agreement. ... We do not use your health records to train AI models; analysis happens at inference time, per request, inside the BAA-covered boundary. ... Recommendations carry citations to clinical guidelines and published research. Prescription and controlled therapies are never issued as directives."'
    - source: https://philongevity.com/terms
      http_status: 200
      fetched: '2026-09-19'
      quote: '"Phi Longevity is an information and data analysis tool. It is not a medical device, does not provide medical advice ... The reports, recommendations, insights, and analysis generated by the Service are for informational and educational purposes only."'
    note: A published disclosure that reports are AI-generated, where the inference runs, that user data does not train models, and the limits of the output — carried on the trust page and in the Terms rather than a dedicated /ai page (/ai/transparency 404).
probed_absent:
- signal: sbom
  urls: [{url: 'https://philongevity.com/security/sbom', status: 404}]
  note: Never derived — search only. The npm package's dependency tree is not a published SBOM.
- signal: support_lifetime
  note: No stated support period for the MCP server, the npm package or the agent card. /changelog and /status 404.
- signal: accessibility_conformance
  urls: [{url: 'https://philongevity.com/accessibility', status: 404}, {url: 'https://philongevity.com/accessibility/vpat', status: 404}]
- signal: training_data_summary
  note: The provider states user health data is NOT used to train models; it publishes no summary of what its models were trained on (the engine runs on Google Vertex AI). A negative statement is not a training-data summary.
- signal: global_privacy_control
  note: No published statement that Sec-GPC is honored. Not tested by header. The policy states data is not sold and not used for targeted advertising, which is not a GPC commitment.
- signal: data_residency
  note: Location is disclosed — data on Google Cloud "in the United States", analysis on "US-pinned Vertex AI endpoints" — but there is no residency choice or region selection, so this is a location disclosure, not a residency capability. /docs/data-residency 404.
- signal: incident_notification
  urls: [{url: 'https://philongevity.com/legal/dpa', status: 404}]
  note: No DPA and no breach-notification SLA published. The 30-day notice on /privacy concerns policy changes, not incidents.
- signal: age_assurance
  note: Terms §3 require users to be at least 18 and the privacy policy says data from under-18s is deleted on discovery; this is an eligibility rule and a takedown promise, not an age-assurance mechanism.
- signal: notice_and_action
  urls: [{url: 'https://philongevity.com/legal/report-content', status: 404}]
- signal: transparency_report
  urls: [{url: 'https://philongevity.com/transparency', status: 404}]