Longevistic Privacy Policy

Effective date: October 1, 2026 Last updated: October 1, 2026

Longevistic is the trade name of Washington Specialty Physicians, Inc., doing business as Longevistic (“Longevistic,” “we,” “us”). We are a physician practice based in Washington. This policy explains how we collect, use, share, and protect information through our public website longevistic.com (the public website) and our member portal at portal.longevistic.com (the member portal). The public website is hosted separately from our health-data systems. Health data for the member portal and care systems is stored with Amazon Web Services (AWS) under a business associate agreement (BAA).

Contact: hello@longevistic.com · (206) 486-0662 · 19203 Edgecliff Dr SW, Normandy Park, WA 98166

1. Three documents, three jobs

Notice of Privacy Practices (HIPAA). Once you become our patient, the health information we create or receive to treat you is “protected health information” (PHI) under HIPAA. Our Notice of Privacy Practices at longevistic.com/notice-of-privacy-practices/ explains how we use and disclose PHI and your HIPAA rights. It controls wherever it conflicts with this policy for PHI.
Consumer Health Data Privacy Policy (Washington). Washington’s My Health My Data Act protects “consumer health data” that is not PHI. Our separate policy is at /consumer-health-data-privacy-policy/.
This Privacy Policy covers everything else: visiting the Site, creating an account, paying, and the Site’s technical operation.

2. Information we collect

You give us:

Account information: name, email address, password (stored only in hashed form), and the membership plan you choose.
Contact information: phone number and mailing address if you add it.
Intake and health information: after payment, you may complete our intake questionnaire. It asks for your health history, medications, habits, family history, recent lab results, measurements such as blood pressure, wearable estimates, and documents you upload. This information is collected to provide your care and is treated as PHI. Payment is completed before intake, but payment does not collect consent.
Consent records: at the end of intake, two required checkboxes are your electronic signature. There is no typed name. Ticking them and selecting Submit is the signature, and we record your account name and email. The first checkbox agrees to our Terms, this policy, the Washington Consumer Health Data Policy, and the HIPAA Notice of Privacy Practices, and consents to telehealth care. The full agreement under that checkbox covers evaluation and care, telehealth, messages, health records, and costs. The second checkbox, kept separate because Washington’s My Health My Data Act requires sharing consent to be separate, consents to sharing your health information with Fullscript and its lab partners to order and deliver labs and supplements. We keep a record of each choice, the version of the text, a fingerprint (hash) of that text, the date and time, your IP address, and your browser’s user-agent string.
Messages: what you send through our contact form or portal.
Newsletter information: your email address if you subscribe.

Collected automatically:

Technical data: IP address, browser type, device information, and pages requested. Public-website requests appear in standard website logs. Member-portal requests and health-data system activity are logged in AWS for security, troubleshooting, and accountability under the applicable BAA.
Cookies: see section 8.

From others:

Payment processor: Stripe confirms whether a payment succeeded and sends us limited payment details, such as amount, date, last four digits, card brand, and Stripe reference numbers. We never receive or store your full card number.
Fullscript: if you choose our supplement dispensary, Fullscript may send us the ID of your Fullscript patient record and the status of supplement plans we create for you.

3. How we use information

To create and manage your account and membership, including automatic renewals of annual plans, renewal reminders, turning off auto-renew, and cancellations. Annual plans renew automatically; you may turn off auto-renew or cancel anytime, effective at the end of the paid term. Runway is refundable until the lab kit is ordered, but not after it is ordered. (See the Terms.)
To provide medical care, including reviewing your intake, ordering and interpreting tests, and preparing your plan. Our Notice of Privacy Practices governs this use.
To process payments and keep payment records.
To communicate with you about your account, appointments, results, and care, and to answer questions.
To keep a record of the consents and agreements you give us.
To send the newsletter if you subscribed. Every issue has an unsubscribe link.
To secure and improve the Site, prevent fraud and misuse, and meet legal obligations.

We do not sell personal information or health data. We do not use health information for advertising. We do not use geofencing around health care facilities.

4. How we share information

We share only what each service needs:

Recipient	What	Why
Stripe, Inc.	Name, email, billing details you enter at checkout, amount, and plan name	Payment processing. We keep clinical details out of Stripe.
Fullscript (Healthy Web Inc. / Natural Partners, Inc. and affiliates) and its lab partners	Health information, only with your separate consent, given at the end of intake or later in the portal Account tab. You can withdraw it in the Account tab or by emailing hello@longevistic.com. If you withdraw it, labs and supplements cannot be ordered through Fullscript.	Fullscript is how Longevistic orders labs and supplements. Labs are part of this agreement, not merely a disclosure.
AWS (BAA-covered environment)	Member-portal account data, intake, consents, lab results, scores, reports, staff data, and related PHI	Operating the member portal and care systems at portal.longevistic.com
Public website hosting provider	Public-website account or contact information and technical logs only; no PHI	Hosting the public website at longevistic.com
Email and newsletter service providers	Email address and message content; newsletter address	Sending account emails and the newsletter. Clinical details are not sent unless the provider is covered by the applicable BAA.
Laboratories and imaging centers	Information needed to fulfill orders	Testing you choose. Labs and imaging are billed separately.
Legal and safety recipients	Information as required	To comply with law, respond to lawful requests, or protect rights and safety
Business-transfer recipients	Information as permitted by law	If the practice is sold or merges; PHI remains subject to HIPAA’s rules

The member portal and care systems are hosted in AWS under the applicable BAA. The public website is hosted separately and does not store PHI. We do not place PHI in Stripe payment descriptions or metadata. Service providers that handle PHI on our behalf sign HIPAA business associate agreements where HIPAA requires them.

5. How long we keep information

Medical records: as long as Washington law and professional rules require.
Payment records: as long as needed for tax, accounting, and legal obligations.
Accounts that never become patients: as long as needed for legitimate business, security, and legal purposes, unless you ask us to delete information sooner and we are permitted to do so.
Server logs: as long as needed for security, troubleshooting, and legal obligations.
Fullscript patient ID: deleted when the Fullscript connection is ended or you ask us to delete it, subject to records that must be retained by law. Fullscript keeps your Fullscript account under its own policies.
Newsletter information: until you unsubscribe.

6. Security

We use reasonable administrative, technical, and physical safeguards, including:

encrypted connections (HTTPS);
hashed passwords;
encryption of stored integration credentials;
minimum necessary data sharing with Fullscript;
role-based access; and
logs designed to exclude names, emails, and health details where practicable.

No system is perfectly secure. If a breach affecting your information occurs, we will notify you as HIPAA and Washington law require.

7. Your choices and rights

Access and correction: update your account details in the portal (Account tab), or ask us to. HIPAA gives you rights to your PHI; see our Notice of Privacy Practices.
Deletion: ask us to delete non-medical information. Medical records we are legally required to keep cannot be deleted early.
Fullscript sharing: you can withdraw this consent at any time in the portal Account tab or by emailing hello@longevistic.com. If you withdraw it, labs and supplements cannot be ordered through Fullscript. Withdrawing it stops anything further from us to Fullscript. It does not delete an account Fullscript already holds; you can ask Fullscript directly about that account.
Marketing: unsubscribe from the newsletter with the link in any issue.
Washington residents: see our Consumer Health Data Privacy Policy for your rights under the My Health My Data Act.
Residents of other states: you may have additional rights under your state’s law. Contact us and we will honor them as the law requires.

We will respond within the time required by applicable law and will not discriminate against you for using your rights. We may need to verify your identity first.

8. Cookies

The Site uses a small number of cookies:

Essential: WordPress sign-in and security cookies that keep you logged in to the portal, plus a cookie that remembers form state.
Payment: Stripe may set cookies on its checkout page for fraud prevention.
Newsletter: our newsletter sign-up form may load resources from its service provider.

We do not currently use advertising cookies, tracking pixels, or third-party analytics. Browser settings let you block cookies, but the portal will not work without essential cookies.

9. Children

The Site and our services are for adults 18 and older. We do not knowingly collect information from children online.

10. Changes

We will post updates here and change the “Last updated” date. For material changes affecting members, we will email you and, where required, ask for your consent again.

11. Contact

Washington Specialty Physicians, Inc., doing business as Longevistic · hello@longevistic.com · (206) 486-0662

For privacy questions or requests, contact our Privacy Officer at hello@longevistic.com.

Privacy Policy