Last updated:
Privacy Policy
1. Introduction
Sterlon Services OÜ (“we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you visit sterlinglongevity.com (the “Website”) or use our services.
Data controller: Sterlon Services OÜ, a company registered in the Republic of Estonia under registry code 16332514.
Contact: care@sterlinglongevity.com
2. Data We Collect
Personal Data
Information you provide directly when you enquire, book, or contact us:
- Full name, email address, telephone number, and country of residence
- Date of birth and gender (for programme eligibility)
Health Data (Special Category Data)
When you complete a health assessment or consultation form, you may provide health-related information. Under the GDPR, health data is classified as “special category” personal data and receives additional protections.
- Medical history and current conditions
- Symptoms, medications, and prior treatments
- Assessment scores and physician notes
Booking & Payment Data
- Programme preferences, travel dates, and accommodation requirements
- Payment details are processed by Stripe and are never stored on our servers. We retain only a transaction reference and amount for accounting purposes.
Technical Data
Automatically collected when you visit the Website:
- IP address, browser type and version, operating system
- Pages visited, time spent, referring URL
- Device identifiers and screen resolution
3. Legal Basis for Processing
We process your personal data on the following legal bases under GDPR Articles 6 and 9:
| Data Type | Legal Basis | GDPR Article |
|---|---|---|
| Health assessment data | Explicit consent | Art. 6(1)(a) & Art. 9(2)(a) |
| Booking & payment data | Performance of a contract | Art. 6(1)(b) |
| Communication data | Performance of a contract / Consent | Art. 6(1)(a) & (b) |
| Technical data (server logs, security) | Legitimate interest | Art. 6(1)(f) |
| Analytics cookies | Consent | Art. 6(1)(a) + ePrivacy Directive |
| Marketing communications | Consent | Art. 6(1)(a) |
4. How We Use Your Data
- To carry out administrative pre-screening for partner-clinic eligibility — i.e. to forward your information to our partner clinic so their licensed physicians can determine your medical suitability. All clinical decisions are made by the treating partner clinic; Sterlon Services OÜ is not a medical provider and does not perform medical assessments.
- To coordinate bookings, accommodation, transfers, and travel logistics
- To communicate with you about your programme, including pre-trip preparation and post-programme follow-up
- To process payments and manage financial records
- To improve our Website, services, and user experience
- To send you relevant research, stories, and programme updates (only with your consent)
- To comply with our legal and regulatory obligations
Automated Processing
Our website assessment and the Doctor-Backed AI in your guest portal use automated tools to organise the information you give us, suggest relevant educational material, and prepare it for review by our team and the partner clinic’s physicians.
No decision that produces a legal or similarly significant effect for you is made solely by automated means. Programme suitability is determined by licensed physicians at the partner clinic following a formal medical evaluation; any “candidacy” or “match” indication shown by our tools is preliminary and educational. You may ask for human review of anything these tools produce by contacting us.
5. Data Sharing
We do not sell, rent, or trade your personal data. We share your data only with the following parties, and only to the extent necessary:
- Partner clinics (Thailand) — Your health data is shared with the treating medical facility to prepare and deliver your programme. This sharing is based on your explicit consent and is necessary for the performance of your booking.
- Payment processor (Stripe) — Payment card data is processed directly by Stripe, a PCI DSS Level 1 certified provider. We do not have access to your full card details.
- Hosting provider (Amazon Web Services) — Our Website and data are hosted on AWS infrastructure within the EU, with appropriate security measures.
- Analytics — Google Ireland Limited (with consent) — We use Google Analytics 4 to understand how visitors use our Website. It runs only after you accept analytics cookies, and it is configured so that Google Signals and advertising personalisation are switched off, meaning your visit is not joined to a signed-in Google account and is not used to build advertising audiences. No data is shared with advertising networks.
6. International Data Transfers
Your personal data may be transferred outside the European Economic Area (EEA) in two circumstances:
- Thailand — for the purpose of medical coordination and programme delivery.
- United States — if you accept analytics cookies, the resulting analytics data is processed by Google. Google LLC is certified under the EU–US Data Privacy Framework, and Google Ireland Limited acts as our processor. If you decline analytics cookies, no such transfer takes place.
When we transfer data outside the EEA, we implement appropriate safeguards including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data processing agreements with all receiving parties
- Technical security measures including encryption in transit and at rest
7. Data Retention
| Data Category | Retention Period | Reason |
|---|---|---|
| Booking & payment records | 7 years | Estonian accounting and tax requirements |
| Health assessment data | Until consent is withdrawn, or 3 years after last contact | Programme coordination and follow-up |
| Communication records | 3 years after last contact | Service quality and dispute resolution |
| Server logs and security data | 12 months | Security and abuse prevention |
| Analytics data (Google Analytics) | 14 months | Understanding which content is useful |
| Marketing consent records | Duration of consent + 1 year | Compliance documentation |
8. Your Rights Under the GDPR
As a data subject, you have the following rights. To exercise any of these rights, please contact us at care@sterlinglongevity.com. We will respond within 30 days.
- Right of access — Request a copy of the personal data we hold about you
- Right to rectification — Request correction of inaccurate or incomplete data
- Right to erasure — Request deletion of your data (“right to be forgotten”), subject to legal retention obligations
- Right to restrict processing — Request that we limit how we use your data
- Right to data portability — Receive your data in a structured, machine-readable format
- Right to object — Object to processing based on legitimate interest or for direct marketing
- Right to withdraw consent — Withdraw consent at any time, without affecting the lawfulness of processing performed prior to withdrawal
Right to lodge a complaint: If you believe your data protection rights have been violated, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon):
- Website: www.aki.ee/en
- Email: info@aki.ee
9. Cookies
We use cookies and similar technologies to ensure the Website functions correctly and to improve your experience.
Essential Cookies
Required for core Website functionality such as session management and security. These cannot be disabled.
Analytics Cookies
We use Google Analytics 4, which sets the cookies _ga and _ga_<property-id> (expiry: 2 years) to distinguish one visitor from another.
- Nothing is set until you agree. No Google script is loaded, and no analytics cookie is written, before you accept. If you decline, none is ever set.
- We measure which pages are read, including our condition and research articles, so we can see which material is worth writing. Page addresses and titles are reported as they appear on the site.
- Nothing inside the guest portal is measured. Analytics is switched off entirely on the portal, booking-management, clinic and administrative areas, where health information and account data are handled.
- Search terms you type on the site are not collected, and identifying values such as an email address are stripped from web addresses before anything is sent.
- Google Signals and advertising personalisation are switched off, so your activity is not joined to a signed-in Google account and is not used to build advertising audiences.
Withdrawing consent is as easy as giving it. Select Cookie settings in the footer of any page to change your choice at any time.
Advertising Cookies
We do not use advertising or third-party tracking cookies.
10. Children’s Privacy
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by updating the “Last updated” date at the top of this page. Where required by law, we will obtain your consent to any material changes that affect how your data is processed.
12. Contact
For any questions regarding this Privacy Policy or your personal data, please contact us:
- Data controller: Sterlon Services OÜ
- Registry code: 16332514
- Data protection enquiries: care@sterlinglongevity.com
Supervisory authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, Estonia.