Privacy and legal

1. Privacy notice

Who is responsible

The data controller is Juvenai SpA ("Juvenai"), Chilean tax ID (RUT) 78.402.628-0, with registered address at Cruz del Sur 133, Las Condes, Santiago, Chile, represented by René Vidal.

For any question about this notice or how we handle your data, write to privacidad@juvenai.com.

What data we process

Account data. Name, email and, if you sign in with Google, your account photo. An encrypted password if you use email and password.
Profile and clinical record. Date of birth, sex, weight, height, goals and whatever you record in your file: history, medications, allergies, habits and, if you enter them, your ID number and phone.
Health data. Lab results (entered or uploaded as PDF), your calculated biological age, data from the wearables you connect (sleep, heart rate, HRV, steps, VO2max) and your nutrition, exercise, mind and recovery logs.
AI assistant. Your conversations with the assistant, stored already pseudonymized.
Teleconsultations. The video call is not recorded; we keep the transcript, clinical notes and documents the professional approves.
Purchases and bookings. The plan you bought, your test bookings and delivery or sample-collection details.
Technical records. IP address, date and time, browser and resource requested, generated by our hosting provider to keep the service available and secure.

Juvenai is not intended for people under 18 and we do not knowingly collect their data.

Why we use it, and on what legal basis

To deliver the service: calculate your biological age, show your results and build your plan (performance of the contract).
To process your health data, which is sensitive data: only with your explicit consent, given when you create your account, upload tests or connect a wearable, and withdrawable at any time.
To use the AI assistant: with a separate consent, requested the first time you open it.
To coordinate tests and teleconsultations with labs and health professionals (performance of the contract).
To keep the service secure and prevent abuse (legitimate interest).
To comply with legal duties, such as tax and health regulations.

We make no automated decisions with legal effects on you. Recommendations from the app and the assistant are for guidance and do not replace a health professional’s assessment.

How long we keep it

For as long as your account is active. If you delete it, we erase your data within 30 days, except what the law requires us to keep longer (for example tax documents, or clinical records where health regulations apply), which we delete when the legal period ends. Technical records are kept by our hosting provider for a short operational period.

Who else is involved

Each provider acts as a processor on our instructions:

Vercel Inc.: hosting for the site and web app.
Supabase: database, authentication and file storage.
Resend: email delivery (welcome, bookings, reminders).
Cerebras: the assistant’s AI model. It only receives pseudonymized data.
Anthropic: reading lab PDFs, estimating macronutrients and teleconsultation notes.
Daily.co: teleconsultation video calls, with transcription by Deepgram.
Google: Sign in with Google, if you choose to use it.
Labs and health professionals who process your samples or see you, bound by confidentiality.
Wearable providers you decide to connect.

There are no other recipients. We do not pass your data to advertisers or data brokers.

International transfers

Several of these providers process data outside Chile, mainly in the United States. To reduce the risk, the AI assistant only receives pseudonymized data and we process your health data with your explicit consent. Where the law requires it, we rely on standard contractual clauses or equivalent safeguards offered by the provider. You can ask for more detail at privacidad@juvenai.com.

2. Data protection and your rights

The laws that apply to us

Chile. Law No. 19.628 on the Protection of Private Life, as amended by Law No. 21.719, which modernises the regime, strengthens the protection of health data and creates the Data Protection Agency.
European Union and United Kingdom. The GDPR and the UK GDPR, when we serve people based there.

Your rights

Access: know what data we hold about you and get a copy.
Rectification: correct inaccurate or incomplete data.
Erasure: delete your data where there is no lawful reason to keep it.
Objection and restriction of processing where the law allows.
Portability: receive your data in a structured, machine-readable format.
Withdraw consent at any time, without affecting earlier lawful processing.

How to exercise them

You can exercise many of them yourself in the app: view and edit your file, export your conversations and delete your account. For the rest, write to privacidad@juvenai.com stating which right you wish to exercise. We reply within 30 calendar days, or sooner where the law requires, free of charge. We may ask for information to confirm your identity, so nobody else can make a request in your name.

If you disagree with our response

You may complain to the supervisory authority: in Chile, the Data Protection Agency created by Law No. 21.719, or the authority of your country of residence. We would rather hear from you first and put it right.

3. Cookies

We use no analytics or advertising cookies. There are no pixels, social buttons or cross-site trackers. Because we only use necessary cookies, you will not see a consent banner: there is nothing to consent to.

These are all the cookies we set:

sb-…-auth-token: keeps you signed in to the app. Without it you could not log in.
juvenai_lang: remembers whether you read in Spanish, English or Portuguese.
juvenai_theme: remembers whether you chose light or dark mode.

Fonts are served from our own domain, with no requests to Google Fonts. If you sign in with Google, the login page loads Google’s script to show its button. You can delete cookies at any time in your browser; you will just need to sign in again.

4. Information security

These are the measures we actually apply, described plainly rather than as a certification we do not hold.

Encryption in transit. All traffic travels over HTTPS with TLS.
Per-user isolation. The database enforces row-level security: each person can only read and write their own data.
Pseudonymization. Before any data reaches the AI assistant, your direct identifiers are removed, with several layers of checks and a final block if anything suspicious remains.
Access control. Access to systems and provider consoles is minimal, limited to those who need it and protected with multi-factor authentication.
Credential handling. Keys and secrets live as encrypted environment variables; they are never committed to the repository or shared over email or chat.
Least data. We ask only for what is needed to deliver the service.

If something goes wrong

We maintain a procedure to detect, contain, investigate and remediate incidents. If a breach affects your personal data, we notify the competent authority within the deadlines the law sets and, where it could seriously affect you, we tell you directly what happened and what to do.

5. Health data and AI

Consent. Your health data is sensitive data. We only process it with your explicit consent, which you can withdraw in the app or by writing to us.
AI assistant. We ask for a separate consent before you use it. The assistant reads your data to answer you, but the model never receives your name, ID number, email, phone or address.
Model training. We do not use your data to train our own models. AI providers process it via API to answer your request.
Teleconsultations. AI drafts a clinical note from the transcript; nothing is written to your file without the professional’s approval.
Medical disclaimer. Juvenai, its biological age and its assistant provide guidance and education. They do not replace diagnosis or treatment by a health professional. In an emergency, call 131 (SAMU, Chile) or your local emergency number.
Research. We only use your data for research if you agree to take part in a study approved by an ethics committee, with specific consent.

6. Terms of use and purchase

Who can use Juvenai. People aged 18 or over. You are responsible for keeping your account secure.
Permitted use. You may not use Juvenai for unlawful purposes, try to access other people’s data, scrape content at scale or degrade the service.
Test plans. Juvenai Labs plans are one-off payments that include the doctor’s order, sample collection at a partner lab or at home, analysis, medical review and twelve months of app access. Prices are in Chilean pesos, VAT included.
Time to use your plan. You have 12 months from purchase to book your sample collection.
Right of withdrawal. You may withdraw and request a refund within 10 days of purchase if you have not yet had your sample taken, under Chilean Law No. 19.496 on Consumer Protection.
Content and marks. Juvenai’s software, designs, texts and algorithms belong to Juvenai SpA or its licensors.
Availability and liability. We aim to keep the service available and accurate, but we are not liable for indirect damage arising from its use, to the extent the law allows. Nothing here limits your rights as a consumer.
Governing law. These terms are governed by Chilean law, with the courts of Santiago having jurisdiction, without prejudice to your consumer rights.

7. Reporting a vulnerability

If you believe you have found a security vulnerability in Juvenai, tell us before anyone else. Write to privacidad@juvenai.com with "Security" in the subject line, describing the issue, how to reproduce it and the impact you believe it has.

What we commit to: we acknowledge your report within five business days, keep you informed while we investigate and credit you once it is resolved, if you wish.

What we ask: that you do not access, modify or delete other people’s data, do not degrade the service and give us reasonable time before disclosing it. We will not pursue legal action over good-faith research that follows these guidelines.

Summary of our policies. This text does not replace legal advice. In case of discrepancy, the Spanish version prevails.