YoLongevity AI Transparency Notice

Version: 1.11 Effective date: 2026-09-01 Last updated: 2026-09-01 Companion documents: Privacy Policy · Consumer Health Data Privacy Policy · Terms of Service · Cookie Policy. Contact: dpo@yolongevity.com · privacy@yolongevity.com · support@yolongevity.com.

We publish this Notice because the EU AI Act Article 50 requires it, and because we believe people who let an AI shape their daily wellness routine deserve to know exactly what the AI is, what it can do, what it cannot do, who built it, and what their rights are. This is written for users, for regulators, for journalists, and for the lawyers who will read it. We have tried to make it understandable for all four audiences.

---

0. 60-second summary

Read this first. Every other section explains one of these five points in detail.

1. You are interacting with an artificial intelligence system. When you talk to YO Coach, view your protocol, read a daily check-in, or see a recommendation in the app, the words you read were generated by an AI — not by a human clinician.
2. YoLongevity is a wellness service, not a medical service. Our AI does not diagnose disease, prescribe medication, or make clinical decisions. It is not a medical device.
3. Human involvement varies by tier. Tier 1 — Life Coach is fully self-directed: AI only, no dietitian, no physician, no ongoing human review. You give your explicit consent under GDPR Article 22(2)(c) and may request a YoLongevity non-medical-staff framework-compliance review (an "AI Review Request") free of charge once every six months. Tier 2 — Transform and Tier 3 — Elite include dietitian and physician interactions — framed as wellness-coaching and educational sessions only — engaged through our Hungarian affiliate YoLongevity Hungary Zrt. and bound by mandatory verbatim wellness disclaimers. You may request human review of any AI output at any time across all tiers.
4. We do not let our AI providers train on your data. The third-party large language models that power YO Coach — and the AI gateway that routes our requests to them — are contractually barred from using your inputs to train their models, and we do not train any of our own models on your personal data either.
5. Under the EU AI Act, we are classified as Limited Risk. That means Article 50 transparency obligations apply — and Section 9 below explains, in detail, why we are not High Risk and what would change that.

18+ only: "You must be at least 18 years old to use YoLongevity. Do not use these Services if you are under the age of 18." YoLongevity's AI features are not directed at, designed for, or made available to anyone under 18. Account-level age confirmation governs all AI interactions in the Services.

---

1. Scope of this Notice

This Notice covers the AI inside YoLongevity. It does not cover AI inside the wearables, labs, or partner clinics you may also interact with — those are governed by their own notices.

1.1 What this Notice covers

This Notice describes the artificial intelligence systems that YoLongevity operates as part of the Services. It covers:

• YO Coach — the conversational AI you interact with for personalized longevity guidance.
• Protocol generation — the AI that produces your initial and ongoing longevity protocol.
• Dynamic protocol adjustment — the AI that updates your protocol when new wearable, lab, or self-reported data arrives.
• Wellness baseline deviation alerts — the AI/rules engine that flags meaningful changes in your wearable telemetry against your established baseline.
• AI-augmented educational content — explanations, summaries, and contextual guidance the app generates on the basis of your data.
• Customer support triage — AI-first triage of inbound support requests, with human escalation always available.

1.2 What this Notice does not cover

• AI used by upstream providers inside their own products (for example, on-device machine learning that calculates your heart rate variability on an Apple Watch is governed by Apple, not by YoLongevity).
• AI used by partner clinics in their own clinical workflows (governed by the clinic's own notices).
• AI used by Moleqlar in its laboratory analysis (governed by Moleqlar).
• Any AI not operated by YoLongevity.

1.3 Hierarchy clause — most user-protective AI disclosure governs

If anything in this Notice ever conflicts with another YoLongevity document on the topic of AI, the version that gives you more protection wins.

If a provision of this AI Transparency Notice and a provision of any other YoLongevity document — the Privacy Policy, the Consumer Health Data Privacy Policy, the Terms of Service, the Cookie Policy, or any in-product disclosure — appear to conflict on the subject of AI processing, the provision that is more protective of you (giving you broader rights, more information, or stronger commitments from us) shall govern.

This hierarchy clause guarantees that no narrower legal text in another document defeats the disclosures made here.

1.4 Provider, deployer, and identification

For the purposes of the EU AI Act:

• YoLongevity — namely YoLongevity, Inc. (Delaware, United States; Delaware File No. 10568801; EIN 38-4392504; registered office Newark DE; principal executive office Kertvárosi krt 22, C building, 6/2, 1237 Budapest, Hungary), together with YoLongevity Hungary Zrt. (Cégjegyzékszám 01-10-140516; registered office 1025 Budapest, Nagybányai út 44., Hungary) as joint controller for the wellness coaching provided by its medical staff and its Wellness Coaching Personnel — the degreed dietitians who serve as the primary human point of contact, together with any other suitably qualified personnel engaged for that purpose under the oversight of the supervising physician team — is the deployer of the AI systems described in this Notice.
• YoLongevity, Inc. is established in the European Union by virtue of its Budapest principal executive office under GDPR Article 3(1) and Recital 22; NAIH (Hungarian National Authority for Data Protection and Freedom of Information; 1055 Budapest, Falk Miksa utca 9-11.; naih.hu) is our lead supervisory authority under the GDPR one-stop-shop mechanism. No Article 27 EU representative is required.
• The providers of the underlying general-purpose AI model (the foundation large language model) are listed in Section 5 of this Notice and in the sub-processor disclosures of the Privacy Policy and the Consumer Health Data Privacy Policy.

---

2. You are interacting with an AI system

EU AI Act Article 50(1) requires us to tell you, clearly and at the first interaction, that you are talking to an AI. This is that disclosure.

2.1 The disclosure

When you interact with YO Coach, with the in-app insights, with the protocol explanation panels, with the supplement-discussion prompts, or with any feature labelled with our AI badge, you are interacting with an artificial intelligence system. You are not interacting with a human, and you are not interacting with a licensed clinician. The longevity guidance, daily check-ins, protocol suggestions, and lab-result explanations you receive are generated by an artificial intelligence system, not by a human clinician.

This disclosure is provided:

• At first interaction — a prominent first-run notice on the very first AI exchange and during onboarding.
• Persistently in the user interface — every AI-generated message and every AI-generated section of your protocol carries a visible AI badge.
• In the document stack — repeated in the Privacy Policy, Terms of Service, and this Notice.

2.2 What "AI" means here

By "artificial intelligence system" we mean a software system that uses machine learning — specifically, a generative, large language model that produces natural-language text, structured recommendations, and explanations on the basis of inputs you provide and reference content we have curated. The system also uses non-generative components (rules-based logic, deterministic algorithms, classical statistics) for parts of the pipeline, such as wearable-data baselining and threshold detection. Where we say "AI" in this Notice we generally mean the combined system unless context indicates otherwise.

The AI is supervised by humans. YoLongevity-affiliated physicians, dietitians, and the Chief Medical Officer set the protocol library, validate outputs at the tier-specific points described in Section 8, and respond to escalations and human-review requests.

The AI is non-clinical. It is positioned, designed, and operated as a wellness optimisation tool, not as a medical device, clinical decision-support system, or diagnostic instrument.

2.3 Where AI shows up in the Services — at-a-glance map

2.4 UI affordances — what you will see

• Onboarding disclosure: a first-run notice introducing the AI, the human-oversight layer for your tier, and your rights.
• Persistent badge: every AI-generated message and every AI-generated section of your protocol is marked with a subtle but unmissable AI badge.
• Footer disclaimer on AI-generated outputs: "AI-generated. Educational only. Not medical advice."
• Tier-specific clarity: Tier 1 (Life Coach) onboarding states explicitly that there is no human review by YoLongevity-engaged personnel — no dietitian, no physician, no ongoing human contact; Tier 2 (Transform) and Tier 3 (Elite) onboarding state the wellness-coaching scope of dietitian and physician interactions and confirm that no doctor-patient relationship is created.

---

3. What the AI does and does not do

This section is the most important practical disclosure in the Notice. Read it carefully. The line between what the AI does and what it does not do is the same line that separates wellness guidance from medical practice.

3.1 What the AI does

• Generates a personalised longevity protocol based on the inputs listed in Section 4.1.
• Adjusts your protocol dynamically as new data arrives (wearable streams, follow-up labs, your check-in responses).
• Surfaces deviations from your wellness baseline (for example, sustained changes in resting heart rate, HRV, sleep architecture).
• Prompts you to consult your own physician where signals suggest a question outside the wellness domain.
• Provides educational explanations of longevity science as it relates to your data.
• Suggests supplements only from the curated, partner-vetted Moleqlar formulary, within wellness boundaries.
• Logs interactions and flags items for human review per the human-oversight architecture in Section 8.

3.2 What the AI does NOT do

• It does not diagnose disease or any medical condition, disorder, syndrome, or differential.
• It does not prescribe medication or recommend specific medical treatments or therapies.
• It does not make clinical decisions.
• It does not replace consultation with a licensed healthcare provider.
• It is not a Medical Device Software (MDSW) under the EU Medical Device Regulation (Regulation (EU) 2017/745).
• It is not Software as a Medical Device (SaMD) under United States Food and Drug Administration regulation.
• It is not a clinical decision support system.
• It does not perform biometric identification of individuals (no face recognition, no voice recognition for identity, no fingerprint matching).
• It does not perform biometric categorisation that infers race, political opinions, trade-union membership, religious or philosophical beliefs, sex life, or sexual orientation.
• It does not perform emotion recognition.
• It does not produce social scores or rank you against other users.
• It does not use your data for advertising, ad-targeting profiling, or sale to third parties.
• It does not train upstream LLM providers on your inputs (see Sections 5.1 and 7.5).
• It does not target minors or vulnerable groups; the 18+ gate is enforced at account level.

3.3 AI hallucinations — explicit warning

Generative AI can produce confident-sounding text that is wrong. We have engineered safeguards, but we cannot eliminate the risk. You should treat AI outputs as a starting point for your own thinking and your own physician's evaluation, never as a substitute.

Generative AI is known to hallucinate — to produce inaccurate, misleading, outdated, or fabricated information that nonetheless reads as authoritative. We have configured the system with retrieval-augmented generation (RAG) over the YoLongevity framework knowledge base — a curated, evidence-graded library of longevity protocols — to reduce hallucinations. We layer human review at the tier-specific points described in Section 8. We log inferences for trust-and-safety review (Section 11.1). We refresh the knowledge base on a regular cadence and version-stamp it.

Despite these measures, AI outputs may occasionally contain errors. You must:

• Not rely on AI outputs for any clinical decision, diagnosis, or treatment plan;
• Validate any health-relevant action with your own qualified healthcare provider before acting; and
• Report any output that appears unsafe, harmful, or inaccurate to support@yolongevity.com so we can investigate.

YoLongevity is not a clinical decision support system. The fact that AI outputs may occasionally be wrong is one of several reasons we maintain that classification.

---

4. The logic, significance, and consequences of the AI's decisions

GDPR Article 13(2)(f) and Article 22(3) require us to give you "meaningful information about the logic involved" and to explain the significance and envisaged consequences of automated processing. This section does that.

4.1 The logic — how the AI generates your protocol

The pipeline, end to end:

1. Inputs. The AI ingests:

   • Your self-reported health history and lifestyle questionnaire responses (collected at onboarding and updated as you choose to update them).
   • Your conventional laboratory results (uploaded directly or, with your explicit consent, transmitted from the partner clinic).
   • Your Moleqlar BioAge results — methylation and proteomic markers, treated as genetic data in the GDPR Article 9 sense and handled with the elevated protections that classification requires.
   • Your wearable telemetry streams from Oura, WHOOP, Garmin, Polar, Apple Health, Android Health Connect, and Withings (where you have connected those devices or platforms) — heart rate, heart rate variability, sleep architecture, activity, recovery scores, and similar signals.
   • Your anthropometric self-assessments (weight, body composition, blood pressure if self-measured, waist circumference, etc.).
   • Your prior protocol history, your prior coach interactions, and your stated preferences (dietary restrictions, exercise constraints, schedule).

2. Reference framework. The AI retrieves relevant content from the YoLongevity framework knowledge base — a curated library of evidence-graded longevity protocols spanning nutrition, sleep, exercise, stress, supplementation, and recovery, built from publicly available scholarly publications, podcasts, video interviews, lectures, and other public-domain materials by 15 named longevity researchers and clinicians (see Section 4.4 for the full source list and the copyright stance) — that has been reviewed and approved by the YoLongevity Chief Medical Officer.

3. Personalisation layer. The AI matches your inputs against the framework, weighting protocols by your tier, by your individual lab markers, by your wearable signals, and by your stated preferences. It uses retrieval-augmented generation (RAG) so the model's outputs are grounded in the curated framework rather than in the LLM's general training data alone.

4. Confidence and uncertainty. Where the AI is operating with limited or noisy data, it surfaces uncertainty in plain language ("Based on limited data…"; "We need more wearable signal before we can refine this further"). Where confidence is high, the recommendation is presented directly.

5. Human review (varies by tier).

   • Tier 1 — Life Coach: NO human review at any point in the routine flow. The protocol is generated by AI from your inputs and from the framework knowledge base, and is delivered to you autonomously. You give your explicit consent under GDPR Article 22(2)(c). You may submit an "AI Review Request" at any time, free of charge once every six months — a YoLongevity non-medical staff member confirms whether the protocol falls within framework parameters; this is a non-clinical framework-compliance check only. See T&C Schedule A §A.7.
   • Tier 2 — Transform and Tier 3 — Elite: a YoLongevity-engaged supervising physician (employed or engaged by YoLongevity Hungary Zrt., the Hungarian affiliate / joint controller) reviews the AI-generated protocol from a wellness-validation perspective and activates it for the user. This review is solely a framework-compliance and wellness-safety check; it does NOT constitute medical advice, diagnosis, or treatment, and no doctor-patient relationship is created. Ongoing dietitian check-ins (Tier 2: monthly; Tier 3: dietitian support) and physician interactions (Tier 2: one physician Q&A at the 3-month mark; Tier 3: monthly physician check-ins) follow the same wellness-coaching framing. See T&C Schedule B §B.2 / Schedule C §C.2.

6. Output. You receive a structured protocol with daily and weekly recommendations across the framework domains, supplement guidance within the wellness scope, and wellness baseline deviation alerts as new data arrives.

7. Inference logging. Every AI input and output pair is logged for trust-and-safety review and to support your right to contest, express your point of view, or request a human review (see Section 11.1).

4.2 Significance and envisaged consequences

What an AI-generated YoLongevity output does affect:

• Your daily wellness routine — diet, sleep practices, exercise programming, stress practices, supplement intake, recovery practices.
• Your interpretation of your own wearable and lab data.
• Your interactions with the YoLongevity dietitian or physician (Tier 2 and Tier 3).
• Whether YoLongevity recommends that you seek consultation with a partner clinic or your own physician for an issue that falls outside the wellness scope.

What an AI-generated YoLongevity output does not affect:

• Any medical diagnosis or treatment plan (no medical decision is made).
• Your eligibility for any healthcare service (no gating).
• Your insurance coverage, premium, or pricing (no data is shared with insurers, see Section 3.2 and Section 5).
• Any employment decision (no employer access to YoLongevity data).
• Access to public services, public benefits, or any essential service in the EU AI Act sense.
• Your access to YoLongevity's own services (we do not gate Services on AI scores).
• Any legal status, credit decision, or similarly significant effect.

4.3 Article 22 — tier-specific posture

YoLongevity's wellness service does not produce decisions with legal effect or similarly significant effect on you within the meaning of Article 22(1) GDPR (it does not gate access to any benefit, service, employment, credit, or healthcare; it does not produce social scores; it does not impose binding outcomes). Nonetheless, we operate the following tier-specific posture to ensure full Article 22 compliance regardless of how a regulator or court might characterize the activity:

• Tier 1 — Life Coach: fully automated — no human review by YoLongevity-engaged personnel. You give your explicit consent under Article 22(2)(c) of the GDPR at the pre-program acknowledgment screen. You retain all rights under Article 22(3): express your point of view, contest, and request human review (the AI Review Request — free once every six months — is a non-clinical framework-compliance check by a YoLongevity non-medical staff member). See T&C Schedule A §A.7.
• Tier 2 — Transform and Tier 3 — Elite: physician review-and-activate, plus ongoing dietitian and physician interactions (wellness coaching, not clinical care). Because a wellness-validating physician reviews and activates each protocol, and ongoing wellness-coaching interactions are part of the program, the Tier 2 / Tier 3 protocol-activation decision is not "solely automated" within the meaning of Article 22(1). Precautionary Article 22(2)(c) consent is also captured at the pre-program acknowledgment screen for any narrow sub-decision that could be characterized as solely automated (such as a routine inter-checkpoint AI adjustment).

4.4 Framework knowledge base — sources and copyright stance

This section explains where the YoLongevity framework knowledge base comes from and the copyright rule we operate under.

4.4.1 Named researchers — publicly available content only

The framework knowledge base is built from publicly available scholarly publications, podcasts, video interviews, lectures, conference recordings, and other public-domain or openly distributed materials by 15 internationally recognized longevity researchers and clinicians:

David Sinclair · Peter Attia · Andrew Huberman · Rhonda Patrick · Valter Longo Matt Kaeberlein · Nir Barzilai · Mark Hyman · Sara Gottfried · Jason Fung Michael Greger · Ben Greenfield · Eric Verdin · Peter Diamandis · Aubrey de Grey

YoLongevity reserves the right to update this knowledge base on a continuous basis as new public-domain or openly distributed material from these or additional researchers becomes available, and to expand the list of named researchers from time to time. Material additions to the knowledge base are tracked in the AI System Inventory (Section 9.3) and surfaced in the Notice changelog (Section 14).

4.4.2 Copyright shield — positive declaration

YoLongevity does NOT use, ingest, train on, embed, or otherwise process any copyrighted, proprietary, paywalled, or non-publicly-available material from any of the named researchers or any third party. The framework knowledge base relies exclusively on materials that are lawfully available in the public domain or under publicly accessible distribution channels (for example, open-access scholarly journals, freely available podcasts and video lectures, public interviews, public conference recordings, and openly published books to the extent permitted by fair use). Any content that requires payment, paid subscription, login, license, or that is otherwise marked as restricted is excluded from the knowledge base. If any researcher or rights-holder believes that material attributable to them has been ingested in violation of this rule, YoLongevity will investigate within ten (10) business days of receiving a notice at legal@yolongevity.com and will remove the material if the claim is substantiated.

4.4.3 Notice and takedown channel

To send a copyright concern relating to the framework knowledge base, write to legal@yolongevity.com with the subject line "Framework Knowledge Base — Takedown Request" and identify the work or material allegedly used, the rights-holder, and the public-domain or restricted status of the material. We will acknowledge receipt within five (5) business days, complete our investigation within ten (10) business days, and either confirm removal or explain in writing why the material is treated as public-domain or fair-use compatible. The cross-reference to the same channel and procedure appears in Terms of Service §10.6.

---

5. Our AI providers and sub-processors

We rely on third-party AI providers to power YO Coach. Here is who they are, what they do, and what we have negotiated to protect your data.

5.1 AI providers — agent platform and foundation model

YoLongevity's AI architecture uses the following named upstream providers. Every provider integration is direct — there is no intermediary agent-platform layer in any pipeline:

(a) Anthropic — foundation large-language model (protocol-generation pipeline).

The personalized longevity-protocol generation pipeline is integrated directly with Anthropic (Claude), under the same Data Processing Agreement and no-training commitment as our chat-coach integrations. Protocol generations are submitted through Anthropic's asynchronous batch-processing API: your inputs are evaluated by the Anthropic Claude foundation model and the result is returned to YoLongevity; no other AI provider sits in this request path.

(b) Anthropic — foundation large-language model (direct chat-coach integrations).

The YO Coach and Readiness Coach chat interfaces — including the same coach conversation delivered over an optional connected messaging channel — are integrated directly with Anthropic (Claude), under a Data Processing Agreement with a no-training commitment. So is our daily-guidance generation.

(c) OpenRouter — AI gateway for Google Gemini model workloads.

OpenRouter (OpenRouter, Inc., United States) is an AI gateway through which we access Google's Gemini models for defined workloads:

• the Trainer Coach chat interface;
• the text embeddings for the framework knowledge base (Google's gemini-embedding-001 model — see Section 5.2);
• knowledge-base retrieval support: to search the knowledge base during a chat, your message is translated to English and embedded using Gemini models — so that message text transits OpenRouter even when the chat itself runs directly on Anthropic;
• the short plain-language readiness narrative shown in the app; and
• internal content-processing tasks (for example, exercise-catalog categorization), which handle curated content rather than your personal data.

OpenRouter is contractually barred from using request content to train models, and we route requests with logging disabled so content is not retained beyond transient processing; Google's Gemini API terms for these routed workloads likewise exclude training on the content. A documented fallback configuration also allows the other chat coaches to be switched to run through OpenRouter — if ever used, the same no-training and minimal-retention terms apply.

Configuration we have negotiated (applies to the providers above and to the OpenRouter gateway):

• No training on YoLongevity user inputs. Each provider's contract with us prohibits the provider from using any YoLongevity user prompt or AI output to train its own foundation models or fine-tuned variants. This is a hard contractual prohibition, verified in the Data Processing Agreement (DPA), in the provider's privacy commitment, and in technical configuration.
• Retention windows. Provider-side retention is set to the shortest window compatible with the deployed workload. For Anthropic API workloads (the protocol-generation pipeline, the chat coaches, and daily-guidance generation) we run on Anthropic's standard limited-retention configuration: inputs and outputs are retained by Anthropic for up to 30 days for service delivery and trust-and-safety review, then deleted. OpenRouter-routed requests run with logging disabled, so content is not retained beyond transient processing. The applicable window is disclosed in the public sub-processor list.
• Data residency and transfers. AI requests are processed on the providers' infrastructure in the United States. Transfers of EU users' data are protected by the EU-US Data Privacy Framework (DPF) where the provider self-certifies, and otherwise by Standard Contractual Clauses (Module 2 or 3 as applicable) with supplementary measures (encryption in transit and at rest, access controls, transfer-impact assessment). See the international-transfers section of the Privacy Policy.
• AI Act warranty. Each provider warrants compliance with the EU AI Act Articles 53–55 (general-purpose AI provider obligations). The upstream GPAI obligations (model documentation, technical documentation, training-data summary publication, copyright compliance) sit with Anthropic for the Claude workloads and with Google for the Gemini workloads routed through OpenRouter. We rely on each provider's Article 53(1)(b) technical documentation and Article 53(1)(d) training-data summary for its foundation-model layer.

5.2 Vector store and retrieval-augmented-generation infrastructure

• Provider: self-hosted — a vector-search extension inside our own Supabase-managed Postgres database. No separate third-party vector-database vendor is involved.
• What it stores: embeddings of the framework knowledge base — our curated reference content, not your personal data. The embeddings are generated with Google's gemini-embedding-001 model accessed through the OpenRouter gateway (Section 5.1(c)). Searching the knowledge base during a chat transiently embeds your message text the same way, but those query embeddings are used only for the search and are not stored in the vector store.

5.3 Observability and evaluation

We do not use a third-party LLM-observability or evaluation service. Quality and safety review runs on our own infrastructure over the inference logs described in Section 11.1; no user-identifying data leaves our systems for observability purposes.

5.4 Sub-processor list — public

The full, up-to-date list of AI sub-processors (and all other sub-processors) is maintained in Section 5.1 of the Consumer Health Data Privacy Policy and the vendor disclosures of the main Privacy Policy, with retention windows and no-training commitments stated. The list is updated within 30 days of any change. Active users receive email notification before a new sub-processor begins processing their data — including where an existing sub-processor is replaced by a provider not previously on the list. Removing a sub-processor, or moving a workload to a provider already on the list, does not give your data any new destination; such changes are reflected in the published list without individual notice.

5.5 Provider DPAs and contractual protections

For each AI provider, our contracts include:

• An EU AI Act compliance warranty (Articles 53–55, where the provider is a GPAI provider).
• A no-training-on-customer-data commitment.
• Zero-day data retention or, where unavailable, the shortest commercially-available retention window with documented justification.
• Audit rights, proportionate to provider scale and to YoLongevity scale.
• Notification of material model changes that affect deployer compliance posture.
• Indemnification for AI Act non-compliance attributable to the provider.
• Standard Contractual Clauses or DPF reliance for international data transfers, plus transfer-impact assessment documentation.

You may request a copy of the safeguards in place for any specific transfer by writing to dpo@yolongevity.com, subject to redaction of commercially confidential terms.

5.6 Provider architecture — direct integrations (no agent-platform layer)

This sub-section documents the provider-architecture compliance story for the protocol-generation pipeline.

The personalized longevity-protocol generation pipeline is a single-layer, direct integration: YoLongevity submits the generation request to Anthropic (Claude) through Anthropic's asynchronous batch-processing API and receives the result back — no agent platform, gateway, or other intermediary provider sits in this request path. As the upstream general-purpose AI provider under EU AI Act Articles 53–55, Anthropic carries the substantive GPAI obligations for this pipeline: model documentation, technical documentation made available to downstream providers, training-data summary publication, and copyright compliance. An earlier version of this architecture routed the protocol-generation pipeline through an autonomous agent platform (Manus.ai) layered above Anthropic; that layer has been removed, and Manus.ai no longer processes YoLongevity user data.

YoLongevity, as the deployer, retains responsibility for the Article 50 transparency obligations (this Notice, the in-app disclosures, the badge marking, the human-oversight architecture in Section 8) and for the no-training and limited-retention configuration. When an Article 53 documentation request reaches YoLongevity, we route to Anthropic for the foundation-model documentation covering the protocol-generation pipeline and the chat coaches, and to Google (via the OpenRouter-routed workloads) for the Gemini foundation-model documentation.

The three chat-coach integrations follow the same direct pattern — YO Coach and Readiness Coach call Anthropic Claude directly (Section 5.1(b)), and Trainer Coach calls Google Gemini through the OpenRouter gateway (Section 5.1(c)).

---

6. AI output marking — how AI-generated content is identified

EU AI Act Article 50(2) requires AI-generated content to be marked in a way that is both perceivable to you and machine-readable. This section explains how we do that.

6.1 Visible UI marking

Every AI-generated output in the YoLongevity app carries a persistent, unmissable visual mark — an AI badge, icon, or footer text identifying the output as AI-generated. This marking appears:

• On every YO Coach message;
• On every AI-generated section of your protocol;
• On every dynamic protocol adjustment notification;
• On every AI-generated educational summary;
• On any AI-generated supplement-discussion prompt.

6.2 Machine-readable marking

For text outputs, machine-readable AI marking is satisfied where supported through the upstream LLM provider's content-provenance metadata (for example, signed model-output flags) and, for our own structured exports (PDF protocol summaries, CSV data dumps), through metadata flags in the file itself identifying the content as AI-generated.

6.3 Synthetic media — forward-looking gate

YoLongevity does not currently generate synthetic images, audio, or video. If we ever introduce AI-synthesised voice (for example, a voice coach), AI-generated illustrative imagery, or any other synthetic media, we will:

• Implement content provenance per the C2PA standard or an equivalent recognised standard;
• Mark the synthetic content perceivably to you in the UI;
• Update this Notice at least 30 days before launch with the new content type, the marking method, and any consent implications;
• Update the AI Act Risk Classification Memo to reflect the new feature; and
• If the new feature impersonates a real person (for example, a specific physician's voice), obtain that person's documented consent and disclose the impersonation prominently per Article 50(3).

We have no plans to introduce deepfake-style content. If we ever did, it would be disclosed under this section before launch.

---

7. Your rights regarding AI processing

You have specific, named rights when an AI affects you. This section lists them, says how to use them, and tells you our service-level commitments.

7.1 Right to know

You have the right to know that you are interacting with an AI system (already disclosed in Section 2, in the in-product UI, and in the onboarding flow), and to receive meaningful information about the logic of the AI's decision-making (already provided in Section 4.1).

7.2 Right to request human review (AI Review Request)

You may request a human review of any AI-generated protocol, recommendation, or output by clicking "Request Human Review" in the YO Coach interface or by emailing privacy@yolongevity.com. Service-level commitments by tier:

• Tier 1 (Life Coach): a YoLongevity non-medical staff member reviews the AI-generated protocol within 5 business days and confirms whether it falls within the framework knowledge base parameters. The review is non-medical, non-clinical, and does not constitute medical advice, diagnosis, or treatment. The outcome is one of: "Within framework parameters — no concern identified"; or "We recommend a deeper review — upgrade to Transform or Elite for physician-reviewed wellness support, or consult your own physician." The AI Review Request is free of charge once every six months; additional requests within a six-month window may be charged per the pricing page at https://yolongevity.com/pricing.
• Tier 2 (Transform) and Tier 3 (Elite): a YoLongevity-engaged supervising physician (employed or engaged by YoLongevity Hungary Zrt.) reviews the AI-generated protocol within 5 business days for wellness-validation purposes (no medical advice, diagnosis, or treatment; no doctor-patient relationship). Included in the subscription.

The human reviewer will look at the AI input/output pair logged under Section 11.1, your relevant context (lab results, wearable signals, prior protocols), and any point of view you have submitted, and will either confirm the AI output, modify it (Tier 2 / Tier 3 only), or recommend that you upgrade or consult your own physician (Tier 1).

7.3 Right to express your point of view

You may submit your perspective on any AI output through the in-app feedback mechanism on every AI-generated message, or by writing to support@yolongevity.com. Your submission is reviewed by YoLongevity staff and, with your consent, may inform future protocol adjustments.

7.4 Right to contest

You may contest any AI output that you believe is inaccurate or inappropriate for your situation. Contests are reviewed within 5 business days (per T&C §A.7.2): for Tier 1 (Life Coach), by YoLongevity non-medical staff as a framework-compliance check, with a recommendation to upgrade or to consult your own physician where a deeper review is warranted; for Tier 2 (Transform) and Tier 3 (Elite), by a YoLongevity-engaged supervising physician from a wellness-validation perspective. If the contest is upheld, the affected protocol element is revised and the change is logged.

7.5 Right to opt out of AI training

We do not currently train any of our own foundation models on your personal data, and our LLM providers and the OpenRouter gateway are contractually barred from training their models on your data (Section 5.1).

• EU users: opt-out by default — we do not train YoLongevity's own AI models on EU user data without explicit opt-in (and we do not currently train on any user data at all).
• United States users: opt-out by default. You may opt in via account settings if you wish to permit your de-identified data to be used in YoLongevity-internal model improvement; your opt-in is revocable at any time without affecting the lawfulness of past processing.

7.6 Right to opt out of AI-driven personalisation

You may withdraw consent to AI-driven personalisation at any time (GDPR Article 7(3)). If you do, the Services may be substantially degraded — much of the YoLongevity value comes from personalised AI guidance — and we will explain the consequences in plain language before you complete withdrawal.

7.7 Right to lodge a complaint

You may lodge a complaint about AI processing with:

• Our lead supervisory authority under the GDPR one-stop-shop mechanism: the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) at 1055 Budapest, Falk Miksa utca 9-11., Hungary, naih.hu, telephone +36 1 391 1400. EU/EEA users also retain the right to complain to the supervisory authority of their country of habitual residence, place of work, or place of the alleged infringement;
• The EU AI Office under EU AI Act Article 64 once its enforcement structure is fully operational;
• Your applicable national consumer-protection authority;
• Your state Attorney General's office (United States users); and
• The relevant state AI commissioner or AI ombuds where one has been designated (for example, under the Colorado AI Act).

7.8 Operational mechanism summary — channels and SLAs

---

8. Human oversight by tier

The human-oversight architecture differs by tier. This table is the canonical statement of who reviews what, where the service is geographically available, and what that means for GDPR Article 22.

Hungarian affiliate / joint controller. All Tier 2 / Tier 3 medical staff and Wellness Coaching Personnel (the Chief Medical Officer, the supervising physician team, and the degreed dietitians — together with any other suitably qualified personnel engaged for wellness coaching under the supervising physician team's oversight) are employed or engaged by YoLongevity Hungary Zrt. (the Hungarian affiliate, joint controller under Article 26 GDPR) — not by YoLongevity, Inc. directly. They provide wellness coaching globally (including to users outside Hungary) within the YoLongevity wellness-positioning architecture. Mandatory verbatim wellness disclaimers appear at every interaction and are logged.

Cross-references:

• T&C Schedule A.7, B.2, and C.2 contain the contractual articulation of these oversight layers.
• T&C §11A, Schedule B, and Schedule C contain the geographic-availability mechanics — wellness positioning, not medical practice, so state telemedicine licensure does not apply.
• Section 7.2 of this Notice details the user's ability to request human review at any time, in any tier, regardless of the default cadence in this table.

---

9. AI Act risk classification — Limited Risk

Under the EU AI Act, every AI system has a classification. We are Limited Risk. This section explains why, what would change that, and how we keep the classification audit-ready.

9.1 Final classification

YoLongevity's AI is classified as LIMITED RISK under the EU AI Act, triggering the Article 50 transparency obligations and not the high-risk obligations of Articles 8 through 49.

9.2 Rationale — layer-by-layer

9.3 Internal governance — audit-ready

We maintain the following governance artefacts, refreshed on the cadences listed:

• AI Act Risk Classification Memo — signed off pre-launch by the Chief Medical Officer and the Data Protection Officer; re-reviewed annually and on every material AI feature change.
• AI System Inventory — quarterly listing of every AI feature, its classification under the EU AI Act layers, and its provider stack.
• Provider GPAI Compliance Register — evidence that each general-purpose AI provider has provided the Article 53(1)(b) compliance attestations and technical documentation we rely on.
• User Disclosure Inventory — every place users see AI disclosure (onboarding, chat UI, footer, T&C, Privacy Policy, this Notice), versioned with the document version that produced the surface.
• AI Incident Log — AI-related incidents (harmful output, hallucination causing user impact, output requiring corrective action) with response steps, timeline, and any user notification.
• Boundary Watchlist — features that would force re-classification, reviewed pre-launch for any new feature; see Section 9.4.
• Annual AI Act Compliance Audit — signed off internally and made available to regulators on request.

9.4 Watchlist — features that trigger mandatory re-classification

The following features, if introduced, will trigger a mandatory AI Act re-classification review before launch, and may move YoLongevity from Limited Risk to High Risk:

• Diagnostic suggestion of any kind (for example, "your data suggests prediabetes");
• Triage to emergency services with AI gating;
• Mental-health screening producing a risk score;
• A pediatric module (under-18 users) — currently excluded by the 18+ gate;
• Voice or face emotion recognition affecting the protocol or user experience;
• Generated synthetic media at scale (AI voice coach, video avatar);
• Clinical workflow integration (for example, electronic-health-record write-back into clinical systems);
• Predictive longevity scoring shared with insurers, employers, or any third party that gates a benefit;
• Hospital partnership with patient-data flow under a HIPAA Business Associate Agreement.

We will notify users in this Notice at least 30 days before any such feature launches, and we will update the AI Act Risk Classification Memo accordingly.

9.5 Article 5 — explicit prohibited-practice confirmations

For the avoidance of doubt and to satisfy the EU AI Act Article 5 transparency expectation:

• No subliminal manipulation. YoLongevity does not deploy techniques beyond a person's consciousness, or purposefully manipulative or deceptive techniques, with the objective of materially distorting a person's behaviour in a way that is reasonably likely to cause that person significant harm.
• No exploitation of vulnerabilities. YoLongevity does not target the vulnerabilities of any natural person or specific group of persons due to age, disability, or social or economic situation, with the objective or effect of materially distorting their behaviour.
• No social scoring. YoLongevity does not evaluate or classify natural persons over a period of time based on their social behaviour or known, inferred, or predicted personal or personality characteristics, with effect across unrelated contexts or in a manner that produces detrimental treatment.
• No biometric identification in public spaces. YoLongevity does not deploy real-time or post-remote biometric identification systems in publicly accessible spaces.
• No biometric categorisation by sensitive attribute. YoLongevity does not infer race, political opinions, trade-union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data.
• No emotion recognition in workplace or education contexts.
• No predictive policing of any kind.
• No untargeted facial-image scraping for facial-recognition database building.

---

10. General-purpose AI (GPAI) provider compliance flow-down

The third-party LLM that powers YO Coach is regulated as "general-purpose AI" under the EU AI Act. The provider has obligations; we have obligations as the deployer. This section describes how the compliance chain works.

YoLongevity uses third-party large language models that qualify as general-purpose AI (GPAI) under the EU AI Act. The substantive obligations under Articles 53–55 — model documentation, technical documentation made available to downstream providers, training-data summary publication, copyright compliance — sit primarily with the upstream provider. We do, however, maintain the following verification and pass-through posture:

• Provider compliance verification. Confirmed in writing in the DPA/MSA that the provider meets its GPAI obligations under Articles 53–55.
• Provider documentation receipt. We receive and archive the Article 53(1)(b) technical documentation and the Article 53(1)(d) training-data summary the provider publishes, and rely on those for our downstream deployer compliance.
• Pass-through Article 50. YoLongevity retains responsibility for the Article 50 transparency obligations downstream of the provider — this Notice, the in-app disclosures, and the badge marking are how we discharge them.
• Material model change notifications. The provider notifies YoLongevity of material model changes that could affect deployer compliance posture; we re-evaluate our risk classification when notified.
• Indemnification. The provider indemnifies YoLongevity for AI Act non-compliance attributable to the provider, subject to the commercial caps in the relevant DPA/MSA.

---

11. Data security for AI processing

This section describes the security controls that apply specifically to AI processing. The general controls in the Privacy Policy §11 apply additionally.

• Encryption. AES-256 at rest, TLS 1.3 in transit (including all calls to provider APIs).
• Access control. Role-based access control with multi-factor authentication mandatory for all staff with AI infrastructure access; least-privilege defaults.
• Audit logging. All AI inputs and outputs that include GDPR Article 9 special-category data are logged with a tamper-evident chain (24-month retention).
• Provider security review. Annual security review of the LLM provider and other AI sub-processors; SOC 2 Type II or ISO/IEC 27001 evidence required and on file.
• Incident response. AI-specific incidents (harmful output, hallucination causing user impact, output requiring corrective action) are triaged within 4 hours of detection, with user notification where the incident affects you specifically.
• Penetration testing. AI-prompt-injection and adversarial-input testing as part of the annual security testing schedule.

11.1 AI inference logging — explicit retention disclosure

YoLongevity retains a record of AI inputs and outputs (the inference log) for two distinct, narrowly-defined purposes:

1. Trust-and-safety review — to detect harmful, hallucinated, or out-of-policy outputs and to take corrective action.
2. GDPR Article 22(3) explainability and contestability — so that, if you exercise your right to express a point of view, contest, or request human review (Section 7), our staff can reconstruct the AI input/output pair that produced the decision and review it on its merits.

Scope of inference logs:

• Inputs: the prompt passed to the model — your message, the retrieved framework context, and the system instructions that shaped the response.
• Outputs: the model's response (text, structured data, or both).
• Metadata: timestamp, model version, retrieval-augmented-generation context version, tier, your account identifier, and any human-review or Article 22 interaction markers.

Retention windows:

• Default for all tiers: 24 months from the date of the inference, after which the inference log is deleted or fully de-identified.
• Where Article 9 special-category data appears in the input or output: the same 24-month maximum, with the tamper-evident chain referenced above.
• Where required for an active trust-and-safety investigation, an Article 22 contest, or a regulatory inquiry: retention is extended to the close of the matter plus the applicable statute-of-limitations period, after which deletion or de-identification proceeds.

No training reuse. Inference logs are not reused to train YoLongevity's own models, not reused to train any third-party LLM provider's models, and not shared with any AI provider for training purposes. This is consistent with Section 5.1 and Section 7.5.

Your access. You may request the inference log relating to any AI output you contest, by writing to dpo@yolongevity.com or privacy@yolongevity.com, subject to the redaction rules in the Privacy Policy (for example, redaction of staff identifiers and of any third-party data unrelated to your account).

---

12. AI ethics — our commitments

These are the principles we hold ourselves to, in addition to the legal obligations in the rest of this Notice.

• Bias mitigation. We evaluate AI outputs against known bias dimensions in the longevity-science literature (sex, age band, ancestry-linked biomarker variation, socioeconomic factors). Where evidence shows a bias gap, we adjust the framework knowledge base and the personalisation layer rather than adjusting through opaque LLM tweaks.
• Fairness. We do not use AI to differentiate access, pricing, or service quality on the basis of any protected characteristic.
• Transparency. We publish this Notice. We mark AI outputs in the UI. We provide meaningful logic disclosure per Section 4.1. We do not hide behind "the AI did it."
• Accountability. Every AI output ultimately carries YoLongevity's name. The Chief Medical Officer is accountable for the framework knowledge base. The Data Protection Officer is accountable for the lawfulness of AI processing. The named accountabilities are in Sections 14 and 15.
• Human oversight. The tier-specific oversight in Section 8 is engineered into the product, not an afterthought. Human review on request is available at all tiers under Section 7.
• No advertising or profiling. We do not use your data for advertising or for ad-targeting profiling. We do not sell your data.
• No dark patterns. AI outputs do not nudge you towards spend, towards stickier engagement, or away from cancelling. The cancellation flow is one-click (T&C §B and §9 of the Subscription terms).

---

13. Liability for AI outputs

This section sets the liability framework for AI outputs. The same language appears in Terms of Service §13. EU and other non-waivable consumer rights and the Product Liability Directive are not affected.

• AI outputs are educational and lifestyle-oriented only — not medical advice, not clinical guidance, not professional services in the regulated sense.
• You must not rely on AI outputs for clinical decisions, and you must consult a qualified healthcare professional for any health decision.
• For death or personal injury caused by YoLongevity's negligence, fraud, gross negligence, or wilful misconduct, liability is uncapped and is not excluded by this Notice or by any other YoLongevity document.
• For non-excludable consumer-protection rights under your home jurisdiction's law, those rights prevail over any limitation in this Notice or the Terms of Service.
• The new EU Product Liability Directive (Directive (EU) 2024/2853) explicitly covers software including AI; users in the EU retain their rights under that Directive notwithstanding anything in this Notice or the Terms of Service.
• Otherwise, the 3-leg liability cap in T&C §13 applies (the greater of (i) the fees paid in the 12 months preceding the event giving rise to liability, (ii) USD 500 / EUR 500, or (iii) statutory damages).

---

14. Changes to this Notice

• Material changes are notified at least 30 days in advance by email to your account address and by an in-app banner.
• A material change includes, without limitation: a change to the LLM provider; a change to inference-log retention windows; a material model change at the provider that affects deployer compliance posture; a new AI-driven feature; any change to the human-oversight architecture in Section 8; any change to the AI Act risk classification.
• Version history: the version number and effective date always appear at the top of this Notice; a plain-English summary of the changes in any published version is available on request at privacy@yolongevity.com.
• If a change increases the protections owed to you, it takes effect immediately upon publication; if a change reduces protections, it takes effect after the 30-day notice period.

---

15. Effective date, version, and approvals

• Effective date: 2026-07-23
• Last updated: 2026-07-23
• Version: 1.10
• Approved by: Chief Medical Officer and Data Protection Officer of YoLongevity.
• AI system version log is maintained internally and is available to regulators on request; it records, at a minimum, the model identifier, the framework knowledge-base version, and the date of each material change in production.

---

16. Contact

• AI transparency inquiries: dpo@yolongevity.com
• Data Protection Officer: dpo@yolongevity.com
• Privacy / general: privacy@yolongevity.com
• Support and human-review requests: privacy@yolongevity.com (preferred, per §7.2/7.8) or support@yolongevity.com
• Legal (incl. Framework Knowledge Base takedown): legal@yolongevity.com
• Postal — Delaware (registered office): YoLongevity, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA
• Postal — Hungary (principal executive office): YoLongevity, Inc., Kertvárosi krt 22, C building, 6/2, 1237 Budapest, Hungary
• Hungarian affiliate / joint controller: YoLongevity Hungary Zrt., 1025 Budapest, Nagybányai út 44., Hungary
• Lead supervisory authority: NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság), 1055 Budapest, Falk Miksa utca 9-11., Hungary, naih.hu
• EU AI Office: European Commission AI Office, digital-strategy.ec.europa.eu/en/policies/ai-office.

---

End of YoLongevity AI Transparency Notice v1.9.