Privacy Policy
1. Data controller
- Controller: Plentir Tech, S.L.
- Registered address: C/ de Bárbara de Braganza, 10. Centro, 28004 Madrid, Spain
- Email: info@plentir.com
2. What data do we process?
Depending on your relationship with Plentir, we may process:
- Identifying and contact data: first name, surname, email address, phone number, national ID (DNI or NIE), postcode, year or date of birth, city.
- Profile and interest data: sex, preferences or areas of health that concern you, and the answers you provide in our wellbeing questionnaires.
- Health data (special category, art. 9 GDPR): lab results, indicators and other health information you choose to share within Plentir's services.
- Browsing data: IP address, cookie identifiers and site usage data (see the Cookie Policy).
- Administrative and billing data: your insurer and whether you wish to claim reimbursement for your tests, and the record of payments and subscriptions. Your card details are processed directly by our payment provider; Plentir does not store them.
- Mobile app data: the device identifiers needed to send you notifications (one record per device you sign in on) and your preferred communication channel, email or WhatsApp.
- Technical diagnostic data: error reports from the website and the app, containing the technical stack trace, the device model and the operating-system version. They are configured to include neither your identity nor the content of your health answers.
- Data from your wearables: if you connect a device (for example, Oura or Whoop), we read from your account with the manufacturer a daily summary of your sleep, resting heart rate, heart-rate variability, activity and recovery — including the last 90 days at the moment you connect — and we update it once a day. We keep only a rolling window with the last 60 days per device. When you disconnect it, we stop reading and delete that summary.
Health data is only processed with your explicit consent and under reinforced security measures.
If you dictate an answer in the app instead of typing it, the transcription happens on your own device: the audio is not sent to Plentir or to any third party, and only the resulting text is kept.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Managing your sign-up to the early-access list and sending you updates | Consent (art. 6(1)(a)) |
| Providing and personalising the health and longevity services | Performance of a contract (art. 6(1)(b)) |
| Processing health data for support and recommendations | Explicit consent (art. 9(2)(a)) |
| Handling requests and enquiries (including applications from professionals) | Consent / legitimate interest (art. 6(1)(a) / 6(1)(f)) |
| Web analytics and improving the site | Consent (cookies) |
| Complying with legal obligations | Legal obligation (art. 6(1)(c)) |
| Notifying you about your appointments, results and changes to your plan through the channel you choose (email, push notifications or WhatsApp) | Performance of a contract / consent (art. 6(1)(b) / 6(1)(a)) |
| Detecting and fixing technical faults and keeping the service secure | Legitimate interest (art. 6(1)(f)) |
4. Retention period
We keep your data for as long as the relationship lasts and, once it ends, for the periods legally required to address any liabilities. Data processed on the basis of consent is kept until you withdraw it.
5. Recipients and processors
We do not disclose your data to third parties except where legally required. To provide the service we may rely on suppliers acting as data processors (hosting, email delivery and messaging, push notification, web analytics, error monitoring and payment processing tools, and collaborating healthcare professionals), with whom we sign the contracts required by art. 28 GDPR. Where a supplier involves international transfers, appropriate safeguards will apply (standard contractual clauses or others provided for in the GDPR).
WhatsApp. If you choose WhatsApp as your communication channel, the messages you exchange with us — which may include data concerning your health — are processed through Meta's WhatsApp Business Platform. Three things are worth knowing before you choose it. First, Meta acts as a processor of the content of those messages, but as a controller in its own right of the associated metadata (the numbers involved, dates and times, and log data), so that second processing operation is governed by its own terms and not by this policy. Second, the content is not end-to-end encrypted as against Meta, because the Cloud API decrypts it on Meta's servers and Meta can therefore access it. Third, the messages are processed on Meta's infrastructure, which involves a transfer to the United States (WhatsApp LLC, a subsidiary of Meta Platforms, Inc.) covered by the adequacy decision of the EU-U.S. Data Privacy Framework. You can avoid this processing entirely by choosing email as your channel, and you can withdraw your consent at any time by sending STOP over WhatsApp: from that moment on we will communicate with you by email again.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, as well as withdraw your consent, by writing to info@plentir.com and stating the right you wish to exercise. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you believe the processing does not comply with the applicable rules.
7. Security measures
Plentir applies technical and organisational measures appropriate to the risk, reinforced because health data is involved, to guarantee the confidentiality, integrity and availability of the information.
8. Changes to this policy
We may update this policy to reflect changes in the applicable rules or in our services. Any change will be published on this same page.
Last updated: 28 August 2026.
← Back to home