Privacy Policy
Effective November 7, 2026
1. Who Is Responsible and What This Policy Covers
1.1 Responsibility and Contact
Insilico Medicine, Inc., 1000 Massachusetts Avenue, Cambridge, Massachusetts 02138 ("Insilico," "we," "us" or "our"), is responsible for the personal information it processes through the Longevity Grok website (the "Site"), the Longevity MotherShip research hub (the "Hub") and your communications with us (together, the "Service"). Contact us at [email protected]. This policy explains what we receive, why, with whom we share it and your choices. Section 9 is our consumer health data privacy policy for the states that require one and applies to everyone in the United States.
1.2 Your Grok Bot Account and Connected Services
Longevity Grok runs inside your own Grok Bot account with xAI. We cannot access that account. We receive the lab reports, health history, wearable data, plans or other information in it only if you choose to send it to us through the MotherShip program or by email. xAI processes that information under xAI's privacy policy, which governs xAI's retention, security and any use of your information for its own purposes, including any model training, and the choices xAI offers about it. Services you connect, such as Google Health, Apple Health through P.R.O, FatSecret and lab providers, process your information under their own policies.
We provide the Service directly to you, not on behalf of a health care provider or health plan. HIPAA does not govern our handling of information you submit through the Service. This policy and applicable consumer privacy laws govern that information.
2. What We Receive and Where It Comes From
2.1 Website and Contact Information
When you visit the Site, contact us or apply for early access or a professional program, we receive what you provide, such as your name, email address, professional role, organization, credentials and correspondence, together with technical information your browser sends, including IP address, device and browser type, pages viewed and timestamps. The Site is hosted by Cloudflare. We use only cookies necessary to operate the Site and Cloudflare's aggregate analytics, which do not use advertising cookies or follow you across other sites.
2.2 MotherShip Research Contributions
Only if you opt in, the program sends us, at most once a week, coded measurements and research contributions in the categories you select, with dates reduced to the month, together with your age band, sex and a contributor code generated in your Grok Bot environment. The consent notice you see before opting in lists the exact categories. Transmission passes through a relay operated by Cloudflare that is designed so that we do not receive your internet address.
Coded contributions are pseudonymous, not anonymous. They do not include your name or contact details, but a detailed health record can sometimes be linked back to a person. We treat coded contributions as personal information and do not attempt to identify contributors.
2.3 Research Notes and Email
If you send research notes or other messages to us by email, including from an email address provided with your Grok account, we receive your email address, the message and any attachments. Email submissions are not anonymous, even when their attachments contain coded information.
3. How We Use Information
3.1 Purposes
We use website and contact information to operate the Site, respond to you, review program applications, secure and troubleshoot the Service, prevent misuse and meet legal obligations. When you separately consent to research participation, we use your contributions to evaluate and conduct longevity research and to produce the findings described in the consent notice, including aggregate results published monthly as averages by age band and sex with no group smaller than ten people. We use research notes you email to us for the research purposes you send them for and to reply to you.
3.2 No Training and No Advertising
We do not use personal information or research contributions to train general-purpose AI models, we do not permit our providers to do so, and we do not use any personal information for advertising. Where a research project would use contributions for commercial development, including drug discovery, the consent notice says so before you opt in.
3.3 Consent
Using the Service or accepting its Terms is not consent to research sharing. Where consent is required for a use or disclosure, we ask for it before that processing starts, separately from these documents. We do not treat a general acknowledgment of this policy as consent to every activity it describes.
4. Who Receives Information
4.1 Service Providers
We disclose the information needed for each purpose to providers that host the Site and the Hub, deliver email and support our operations, under contracts that limit their use of information to our instructions. Cloudflare provides hosting, the research relay and website security. No other Insilico Medicine group company receives personal information from the Service or the research program.
4.2 Research Recipients
Individual coded contributions are accessible only to the recipients named in the consent notice you accept when you opt in, which may include Insilico research staff and verified physicians and researchers admitted to the Clinic or Lab programs, under agreements that limit use to the stated research purposes and prohibit attempts to identify contributors. This policy does not itself authorize that sharing. Everyone else, including the public, receives only aggregate findings that meet applicable deidentification requirements before release.
4.3 Legal Disclosures
We may disclose information when legally required or reasonably necessary to establish or defend legal rights or to protect safety, subject to applicable law.
4.4 Sale and Advertising
We do not sell personal information and do not share it for targeted advertising, including through tracking technology or research arrangements. We have not done so in the past 12 months.
5. Your Research Choices and Deletion
5.1 Opting In and Withdrawing
Research sharing is off until you separately opt in. Before you opt in, you receive a consent notice identifying the operator, the data categories, the purposes including any commercial use, the recipients and how to withdraw. You may withdraw research consent at any time through the sharing controls in your Longevity Grok environment or by emailing [email protected]. After authenticating your request, we stop accepting, using and sharing the contributions covered by that withdrawal. To stop transmissions from your Grok Bot account, also turn off sharing there.
5.2 Deleting Contributions
You may request deletion of the contributions associated with your contributor code through the deletion request your environment sends using the deletion secret it holds. We delete those records from active systems within 30 days, send a receipt to your environment, instruct research recipients and providers to delete their copies, and remove the records from backups within 90 days.
The deletion secret authenticates requests concerning coded contributions. If it is unavailable, contact [email protected] so we can assess whether other information is sufficient to locate the records and authenticate your request. We may decline a request we cannot authenticate after commercially reasonable efforts. Losing the secret does not affect requests concerning identifiable emails or application records. Do not send your account password or deletion secret by ordinary email.
We may be unable to remove an individual contribution from already published findings that are genuinely deidentified and no longer linkable to that person, subject to applicable law. This does not excuse deletion of underlying personal or coded records that remain subject to a valid request.
6. Retention, Security and Processing Locations
6.1 Retention
We keep website logs for 12 months, contact and program application records for 24 months after our last contact with you, and research contributions until you ask us to delete them or the program ends. We keep coded records needed to verify published findings for seven years after publication unless you ask us to delete them earlier.
6.2 Security
We protect information with encryption in transit and at rest, access limited to personnel who need it, logging of access to research records, and contractual safeguards with our providers. No system is completely secure. We will provide legally required notices of a security incident.
6.3 Processing Locations and International Users
We process information in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States, where privacy laws may differ from those where you live. For users in the European Economic Area, the United Kingdom and Switzerland, we process health information on the basis of your explicit consent, and Site and contact information to respond to your requests and for our legitimate interest in operating and securing the Service. For transfers requiring contractual safeguards, we use the applicable standard contractual clauses, including the UK Addendum and Swiss adaptations where required, and you may request a copy at [email protected]. You may withdraw consent at any time without affecting earlier processing, exercise the rights in Section 7, and complain to your local supervisory authority.
7. Your Privacy Rights
7.1 Your Rights
Depending on where you live, you may have the right to:
1. confirm whether we process your information and access or obtain a copy of it,
2. correct or delete it,
3. withdraw consent,
4. restrict or object to processing,
5. opt out of certain uses or disclosures and limit the use of sensitive information,
6. appeal a denied request, and
7. complain to a regulator.
Submit requests to [email protected]. Requests about information held by xAI or another provider in its own right should also be directed to that provider. We remain responsible for our own obligations.
7.2 Verification, Timing and Appeals
We verify requests using information reasonably necessary for that purpose, such as the email address you used with us or a confirmation sent through your Longevity Grok environment, and we do not require government identification by default. We respond without undue delay and within 45 days of receipt, or within one month where European Economic Area, United Kingdom or Swiss requirements apply. We extend a deadline only where applicable law permits and give you notice and reasons within the original response period. If we deny a request, you may appeal by replying to our response. We will decide the appeal within 45 days, explain the decision and tell you how to contact your state attorney general or other regulator if you disagree. We do not discriminate for exercising privacy rights.
7.3 California Residents
We collect the categories described in Section 2, which are identifiers, professional information, internet activity, correspondence and, if you opt in or email us, health information that is sensitive personal information. We collect them from you, your browser and your Longevity Grok environment, for the purposes in Section 3, and keep them for the periods in Section 6. We do not sell or share personal information, and we use sensitive personal information only for the purposes you request and the research you consent to. You may exercise your rights to know, delete, correct and limit by contacting [email protected].
8. Children and Updates
The Service is intended for adults aged 18 or older, and we do not knowingly collect information from anyone under 18. If you believe a child has provided information, contact us so we can investigate and delete it. We will post updates here, revise the effective date and provide additional notice or obtain consent where required. New uses will not be authorized merely by changing this policy.
9. Consumer Health Data Privacy Policy
9.1 Scope and Responsibility
This section applies to everyone in the United States and is written to meet the Washington My Health My Data Act, Nevada SB 370 and the Connecticut consumer health data provisions. Insilico Medicine, Inc. is responsible for the consumer health data described here. Contact [email protected].
9.2 Consumer Health Data We Collect and Its Sources
The only consumer health data we collect is what you choose to send us. That means laboratory and biomarker values, health history and goals, sleep and activity measurements, and other health information you include in MotherShip research contributions, in research notes or messages you email to us, or in a professional program application. Research contributions also carry your age band, sex, month-level dates and a contributor code. We process health-related inferences derived from those submissions when we analyze them. The sources are you, your Grok Bot environment for contributions you authorize, and our analysis of those submissions.
9.3 How We Use It
We store, organize and analyze research contributions for the longevity research described in your separate consent, including any commercial research expressly identified there, and we prepare aggregate findings. We use emailed research notes for the research purposes you send them for and to reply to you. We use application information to review applications and respond to you.
9.4 Who Receives It
Providers that host, store, relay, secure and deliver email for the Service receive the categories needed to perform those functions under our instructions. Individual coded contributions are accessible only to the research recipients named in your consent notice, as described in Section 4. No other Insilico Medicine group company receives consumer health data. Disclosures required by law remain subject to applicable legal restrictions.
9.5 No Sale, Advertising, Tracking or Geofencing
We do not sell consumer health data, do not use it for advertising, do not permit third parties to collect consumer health data through the Site for tracking across other websites or services, and do not use geofencing around health care facilities.
9.6 Your Rights and How to Exercise Them
Email [email protected] to confirm whether we collect or share your consumer health data, access or correct it, obtain a list of the third parties and affiliates with which we have shared it and their contact information, withdraw consent, or request deletion. You do not need to create an account. Section 5 explains authentication and deletion of coded contributions. For a valid deletion request, we delete active records within 30 days, remove them from backups within 90 days, and notify recipients of the deletion requirement.
We respond without undue delay and within 45 days of receipt. Where the law permits one extension of up to 45 days, we give you notice and reasons within the original period. Requests are free up to twice a year, and otherwise free unless applicable law permits a charge for manifestly unfounded, excessive or repetitive requests. You may appeal a denial by replying to our response. We decide appeals within 45 days, explain the decision and tell you how to complain to your state attorney general.
9.7 Changes
We post material changes to this section here and give notice through the Service or an email address you have supplied before changed practices begin. We obtain additional consent where required.