03Privacy notice
You may optionally save your full name, international phone number, date of birth and country in your account. Edit or clear these fields at any time. Newsletter consent is separate. We do not record analytics events on account pages.
The personal report vault is a closed owner pilot. A verified, invited account may upload only its own adult medical report with separate explicit consent. Files are encrypted in private object storage; ownership metadata is in the managed database. Only the uploading account can download or delete through the website. The operator can technically access the storage and key: this is not end-to-end encryption. No reports go to AI, model training or marketing. Access expires after 30 days; expired files are removed on the next vault visit. You can delete earlier in your account. Full pilot terms appear before upload. A public health-data service has not launched.
A CELLIVITY customer account stores your name, email address, a securely hashed password, authentication sessions and the preferences you choose to save. Session cookies are required for sign-in and expire after seven days. Security records may contain an IP address and browser information. Orders are linked by account identity. We do not link a previous order just because someone enters the same email address.
Newsletters, product updates and future offers require a separate, optional choice. We record changes with the time and consent version; you can withdraw in your account or through the unsubscribe form. Email verification, recovery and marketing delivery are not yet active. A saved preference does not mean a message has been sent. You can request account access, correction or deletion through the privacy-request process below.
The longevity assessment runs locally in your browser and does not submit or store your answers on a CELLIVITY server.
The adult-access screen stores one functional cookie, cellivity_age, after you declare that you are 18 or older. It lasts for six months so the screen does not reappear on every visit. This declaration is not identity verification, does not grant professional access and does not contain health information.
For basic, cookieless first-party site measurement we store the page path, language, event type, timestamp, referring website’s host name and any UTM source, medium and campaign labels. Events include page views, section visibility, navigation clicks, form attempts and completion or error states, login, registration and checkout steps. We use aggregate counts to improve the visitor journey; they are not unique-visitor counts. Form contents, URL query strings and password-reset tokens are excluded. We respect the browser Do Not Track setting. We do not create an analytics account, cookie or persistent visitor identifier, and the application analytics table does not store an IP address, email address or assessment answer. Contact clicks are counted without recording which channel was selected. Reports use at most 90 days of events. Older records are removed when the next measurement event is saved.
The release-update request stores email, page source, consent scope and version, request status, consent time and creation time. It records a request only: it does not currently activate a mailing subscription. The closed-beta form stores email, country or market, preferred language, main interest, consent time and creation time. A professional peptide-dossier request stores name, work email, legal organization, organization website, role, country, research setting and purpose, two eligibility confirmations, consent time and a pending manual-review status. These records are used only to evaluate the stated request. None of these forms asks for health information.
The current controller and privacy contact is CELLIVITY, Riviera Jomtien, 29/111, Pattaya 20150, Thailand. A controlled privacy-request and unsubscribe workflow is available. Unsubscribe requests mark matching update records as opted out immediately; access, correction and deletion requests enter a verification queue before data is disclosed or changed. Records are hosted in the site’s managed database. The provisional retention target is no more than 12 months for people who are not invited into an active beta, professional review or launch process. Processors, any cross-border transfer details, lawful-basis assessment and the final verified fulfilment procedure must still be confirmed before any mailing campaign, commerce activation or paid marketing. No campaign should be sent until those remaining controls are active.
This is a preview disclosure, not a final PDPA/GDPR notice. Submit only contact information you are comfortable providing for the stated request.