Legal

PRIVACY POLICY

LONGAEVITAS HEALTH (PTY) LTD Last Updated: 28 July 2026 Entity: Longaevitas Health (Pty) Ltd CIPC Number: 2025/413084/07 Registered Address: 18 Kent Road, Dunkeld West, Randburg, 2196

1. INTRODUCTION

This Privacy Policy explains how Longaevitas Health ("Longaevitas", "we", "us") collects, processes and protects personal information in connection with the Longaevitas Health platform, a wellness and screening platform for doctor-led longevity planning and preventative care, including the Health Assessment, the Personalised Preventative Care service, the Doctor-led VitaPrint Analysis service and the Ambassador Programme (collectively, the "Services"). It should be read together with the Longaevitas Member Consent.

2. INFORMATION WE COLLECT

• Identification and contact details (name, ID number, email, phone, address).
• Demographic information (age, gender, date of birth).
• Account and preference information.
• Health information you choose to share: assessment answers, biomarker results, uploaded lab reports, lifestyle inputs.
• VitaPrint Cycle subscription information.
• Payment metadata processed by our payment provider (we do not store full card numbers).
• Technical and usage data (IP address, device, browser, access logs).

We do not collect genetic or epigenetic data unless explicitly required for a specific authorised test and with your express written consent.

3. HOW WE COLLECT INFORMATION

We collect information directly from you when you create an account, complete the Health Assessment, purchase a Doctor-led VitaPrint Analysis, join the Ambassador Programme or contact support. We also receive information from trusted partners that you have authorised to share with us, including laboratories, sample-collection partners and payment processors.

4. PURPOSES OF PROCESSING

We process personal information to:

• Provide, operate and improve the Services, including the Personalised Preventative Care service.
• Carry out wellness screening and risk stratification: comparing your assessment answers, body metrics and biomarker results against longevity reference ranges to show where your risk sits and to flag results that warrant attention by your own GP or specialist. This is screening, not diagnosis.
• Generate your personalised VitaPrint and recommendations.
• Enable an HPCSA-registered doctor to lead your personalised plan from your assessment answers and biomarker results.
• Manage VitaPrint Cycle subscriptions.
• Process Ambassador referrals and payouts.
• Communicate service messages, results notifications and (with consent) marketing.
• Maintain billing, administration and account records.
• Conduct analytics and quality assurance in anonymised or aggregated form.
• Analyse de-identified member trends to keep Vita's educational content and doctor-led protocols relevant (see section 4A below).
• Comply with legal, regulatory and professional obligations.

4A. HOW VITA LEARNS FROM MEMBER TRENDS

Vita is our platform assistant. To keep educational guidance current, we analyse de-identified trends across the member community, including changes in assessment answers, body metrics, biomarker values, and outcomes following supplement or plan recommendations. This analysis produces cohort-level insights that inform Vita's educational content and the protocols doctor-led practitioners may consider. It does not diagnose, prescribe or replace clinical judgement.

Before your information is used for cohort learning, direct identifiers (such as your name, contact details and account identifiers) are removed and only aggregated results are used. Cohort insights are only surfaced where the underlying group is large enough that an individual member is not reasonably identifiable. We do not sell your information and we do not use it to train third-party artificial intelligence models.

Cohort learning is on by default when you join. You may opt out at any time from Account > Privacy. Your future data will no longer be included in cohort learning once you opt out. Insights already generated from historic de-identified data cannot be reversed once aggregated. Opting out has no effect on the doctor-led clinical care you receive.

4B. AUTOMATED PROCESSING AND ARTIFICIAL INTELLIGENCE

We use automated processing, including rule-based scoring and artificial intelligence, to organise your information, calculate system scores, disease-risk estimates and your Longaevitas Age, to draft educational content, and to prepare a structured briefing for the reviewing doctor. These outputs are preparatory and educational.

No decision that affects you clinically is taken solely by automated means. For the purposes of section 71 of POPIA, every clinical recommendation released to you is reviewed, amended where necessary, and approved by an HPCSA-registered doctor exercising independent clinical judgement. You may ask how an automated output was arrived at, make representations about it, and request human reconsideration by escalating a question to a doctor in Ask Vita in your member portal. Each VitaPrint cycle includes a free doctor escalation, so this costs you nothing.

5. LEGAL BASIS UNDER POPIA

We process personal information on the lawful grounds of consent, performance of contract (the Member Consent), legal obligation, and legitimate interest in operating the Services securely. Health information is Special Personal Information under POPIA and is processed on the basis of your express written consent and, where applicable, section 32 of POPIA (processing by or under the responsibility of a health care professional, subject to a duty of confidentiality).

6. MARKETING COMMUNICATIONS

Marketing messages are sent only with your opt-in consent. You may unsubscribe at any time via the link in any email or by contacting support@longaevitashealth.com. We do not sell or rent personal information for marketing purposes.

7. DATA SHARING

We share personal information only with:

• The assigned HPCSA-registered doctor and clinical team reviewing your Doctor-led VitaPrint Analysis.
• Laboratories and sample-collection partners involved in your tests.
• Healthcare professionals to whom you are referred, on your instruction.
• Operators acting on our behalf under written operator agreements as required by sections 20 and 21 of POPIA (cloud hosting and database services, payment processing, email and messaging delivery, analytics, and artificial intelligence processing services).
• Regulators, professional bodies or law-enforcement agencies where required by law.

We do not sell personal information, and we do not share your identifiable health information with wellness partners, retailers or advertisers.

7A. CROSS-BORDER TRANSFERS

Some of our operators process personal information outside the Republic of South Africa. We transfer personal information across borders only where section 72 of POPIA is satisfied, which means the recipient is subject to a binding agreement, a law, or binding corporate rules providing an adequate level of protection substantially similar to POPIA and imposing onward-transfer restrictions on the same terms.

The categories of operator involved, and the regions in which they process data, are:

• Cloud application hosting and edge delivery: European Union and United States.
• Managed database, authentication, file storage and backup services: European Union, with support access from the United States.
• Artificial intelligence processing used for document extraction and drafting support: United States and European Union.
• Transactional and authentication email delivery: United States and European Union.
• Payment processing: South Africa, with card-scheme processing that may involve the United States.
• Product analytics and error monitoring: European Union and United States.

Where a recipient is in a jurisdiction without an equivalent data protection law, we rely on written contractual safeguards incorporating POPIA-equivalent obligations, including confidentiality, security, breach notification, audit and deletion terms. A current list of operators and their locations is available on request from the Information Officer.

Laboratory testing, biomarker analysis and all clinical review by Longaevitas doctors take place in South Africa.

8. SECURITY

We implement technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access control and audit logging, role-based permissions, staff confidentiality undertakings and regular vulnerability testing. While we take all reasonable precautions, no system is completely secure.

8A. SECURITY COMPROMISE NOTIFICATION

If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering the compromise and establishing its scope, in accordance with section 22 of POPIA. The notification will describe the possible consequences, the measures taken or intended, and steps you can take to reduce any adverse effects.

9. RETENTION

We retain personal information only as long as necessary for the purpose collected or as required by law. Health-related data and clinical records are retained for the longer of (i) six years after your last interaction with the Services and (ii) any longer period required by the National Health Act, HPCSA record-keeping guidance or other applicable law. Longer periods apply to the records of minors, of persons under legal disability, and to records relevant to a claim, complaint or investigation of which we are aware. Once the retention period lapses, identifiers are removed unless ongoing retention is required by law. Account and billing records are retained for the periods required by the Companies Act and tax legislation.

10. YOUR RIGHTS UNDER POPIA

You have the right to access, correct, delete, restrict or object to processing of your personal information, and to data portability where applicable. Requests should be made in writing to support@longaevitashealth.com. We respond within one month, subject to verification. Deletion of clinical records is subject to the statutory retention periods described in section 9.

11. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies, local storage and similar technologies on the website and in the member platform. We use them in the following categories only:

• Strictly necessary. Sign-in and session tokens, security and fraud prevention, load balancing, and remembering that you have accepted required terms. These are essential, and the platform cannot function without them.
• Preference. Your display, theme and language choices, and dismissal of one-time notices.
• Performance and diagnostics. First-party measurement of page performance and error reports, used to keep the platform working. This data is not used to build advertising profiles.
• Referral attribution. Where you arrive through an ambassador or partner link, a first-party identifier records the referral so the correct code and discount are applied.

We do not use advertising cookies, cross-site tracking pixels, or third-party behavioural advertising networks, and we never place your health information in a cookie.

Strictly necessary technologies are used on the basis of the legitimate interest of operating a service you have asked for. Non-essential categories are used only where you have not objected, and you may object at any time by emailing the Information Officer. You can also block or delete cookies in your browser settings, but strictly necessary cookies cannot be blocked without preventing you from signing in.

12. CHILDREN AND PERSONS UNDER 18

The Services are intended for adults aged 18 and over. You must be 18 or older to create an account, purchase a VitaPrint Cycle, or submit health information to us.

Personal information about a child is special personal information under section 34 of POPIA and may not be processed except on the grounds set out in section 35. We do not knowingly collect personal information from anyone under 18 and we do not offer paediatric assessment, testing or clinical review.

If we discover that an account has been created by, or that health information has been submitted about, a person under 18 without a lawful basis, we will suspend the account, stop processing, and delete the information unless we are required by law to retain it. If you believe a person under 18 has given us personal information, email support@longaevitashealth.com and we will act on it promptly.

Gift codes may not be purchased for, or redeemed by, a person under 18.

13. BUSINESS TRANSFERS

If Longaevitas undergoes a merger, acquisition or reorganisation, personal information may be transferred as part of that transaction, subject to continued protection under this Policy.

14. CONTACT & COMPLAINTS

Responsible Party: Longaevitas Health (Pty) Ltd Email: support@longaevitashealth.com Registered Address: 18 Kent Road, Dunkeld West, Randburg, 2196

Privacy complaints. Raise any privacy concern with the Information Officer first, at support@longaevitashealth.com. We acknowledge within 5 business days and respond substantively within 30 days.

Escalation to the regulator. If you believe your privacy rights have been infringed, you may lodge a complaint with the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, complaints.IR@justice.gov.za, https://www.justice.gov.za/inforeg/.

Clinical complaints. Complaints about the conduct or clinical judgement of a Longaevitas doctor are handled under the complaints procedure in our Medicolegal Terms, and may be escalated to the Health Professions Council of South Africa.

15. GOVERNING LAW

This Privacy Policy is governed by the laws of the Republic of South Africa.

© 2026 Longaevitas Health (Pty) Ltd. All rights reserved.

PAIA MANUAL

LONGAEVITAS HEALTH (PTY) LTD, PROMOTION OF ACCESS TO INFORMATION ACT MANUAL

Last Updated: 28 July 2026 Entity: Longaevitas Health (Pty) Ltd CIPC Number: 2025/413084/07 Registered Address: 18 Kent Road, Dunkeld West, Randburg, 2196

1. INTRODUCTION

This Manual is published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), read with the Protection of Personal Information Act 4 of 2013 ("POPIA"). It sets out the records held by Longaevitas Health (Pty) Ltd, the procedure for requesting access to those records, and the prescribed information about the personal information we process.

Longaevitas Health (Pty) Ltd operates a wellness and screening platform for doctor-led longevity planning and preventative care. We process health information for wellness screening and risk stratification, and to enable independent registered doctors to interpret those results. We are not a medical scheme, scheme administrator or healthcare broker, and diagnosis and treatment remain with the member and their own GP or specialist. This shapes the records we hold and the purposes described below.

2. INFORMATION OFFICER

Information Officer: The Chief Executive Officer, Longaevitas Health (Pty) Ltd Deputy Information Officer: The Chief Medical Officer Email: support@longaevitashealth.com Postal and physical address: 18 Kent Road, Dunkeld West, Randburg, 2196

The Information Officer is registered with the Information Regulator (South Africa) in accordance with section 55(2)(a) of POPIA and the Regulator's registration requirements. Requests, complaints and data subject requests may be sent to the address above.

3. GUIDE BY THE INFORMATION REGULATOR

A guide on how to use PAIA has been compiled by the Information Regulator in terms of section 10 of PAIA and is available at https://www.justice.gov.za/inforeg/.

4. RECORDS HELD

Longaevitas Health holds records relating to: company governance and statutory filings; employee, contractor and independent practitioner records; member account, assessment, body measurement and biomarker data; clinical records relating to Doctor-led VitaPrint Analysis, doctor notes, referral letters and sign-off; membership and VitaPrint Cycle subscription records; Ambassador registrations, referrals, commissions and payouts; wellness partner and retailer agreements; financial, tax and payment records; supplier and service-provider agreements; and IT system, access and security logs.

Certain records are available in terms of other legislation, including the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Tax Administration Act 28 of 2011, the Value Added Tax Act 89 of 1991, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the National Health Act 61 of 2003 and the Health Professions Act 56 of 1974.

5. CATEGORIES OF PERSONAL INFORMATION PROCESSED

We process the following categories of personal information:

• Members: identification and contact details, demographic information, account credentials and preferences, health assessment answers, body measurements, biomarker and laboratory results, uploaded reports, clinical correspondence, subscription and payment metadata, and technical and usage data.
• Practitioners and staff: identity, HPCSA registration, qualifications, banking and payroll details, performance and payout records.
• Ambassadors: identity and contact details, referral activity, banking details and commission records.
• Suppliers and service providers: contact details, contracting and billing information.

Health information constitutes Special Personal Information under POPIA and is processed on the basis of express consent and section 32 of POPIA.

6. CATEGORIES OF RECIPIENTS

Personal information may be provided to: the HPCSA-registered doctors and clinical teams involved in a member's analysis; pathology laboratories and sample-collection partners; healthcare professionals to whom a member is referred, on the member's instruction; operators appointed under written operator agreements (cloud hosting and database services, payment processors, email and messaging providers, analytics and artificial intelligence processing services); professional advisers; and regulators, professional bodies or law-enforcement agencies where required by law.

7. PLANNED CROSS-BORDER TRANSFERS

Certain operators process personal information outside the Republic of South Africa: cloud application hosting and edge delivery (European Union, United States); managed database, authentication, storage and backup services (European Union, with support access from the United States); artificial intelligence processing for document extraction and drafting support (United States, European Union); transactional and authentication email delivery (United States, European Union); payment processing (South Africa, with card-scheme processing that may involve the United States); and product analytics and error monitoring (European Union, United States).

Such transfers are made only where the safeguards required by section 72 of POPIA are in place, including binding contractual terms providing an adequate level of protection substantially similar to POPIA and equivalent restrictions on onward transfer. Laboratory testing and all clinical review take place in South Africa. A current list of operators and their processing locations is available from the Information Officer on request.

8. INFORMATION SECURITY MEASURES

Longaevitas applies technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, least-privilege database policies, audit logging of access to health information, multi-factor authentication for privileged accounts, written confidentiality undertakings, operator agreements, periodic vulnerability review and a documented security compromise response procedure aligned to section 22 of POPIA.

9. REQUESTING ACCESS

Requests for access to records must be made on the prescribed Form 2 and submitted to the Information Officer at the contact details above. Requests must identify the record, the form of access required, and the right the requester seeks to exercise or protect. Prescribed fees apply as published in the PAIA regulations. Decisions are issued within 30 days, extendable in the circumstances permitted by PAIA, and reasons are given for any refusal together with details of internal and judicial remedies.

A data subject seeking access to, correction or deletion of their own personal information may instead use the request procedure in the Privacy Policy, or the prescribed POPIA forms, at no charge for a first request.

10. GROUNDS FOR REFUSAL

Access to records may be refused on the grounds set out in Chapter 4 of PAIA, including mandatory protection of the privacy of third parties, medical confidentiality, commercial information of third parties, records protected by legal privilege, and records containing confidential clinical information about another person.

11. INFORMATION REGULATOR

Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg Email: complaints.IR@justice.gov.za and PAIAComplaints@inforegulator.org.za Website: https://www.justice.gov.za/inforeg/

12. AVAILABILITY AND REVIEW

This Manual is available free of charge on the Longaevitas website and on request from the Information Officer. It is reviewed at least annually.

© 2026 Longaevitas Health (Pty) Ltd. All rights reserved.