security
Last updated: 16 August 2026
Lifelong holds medical records, test results and recordings of consultations for whole families. This page says what protects them, in the same words our Privacy Policy uses, and it says plainly what we have not done.
1. how your information is protected
| Control | What it means |
|---|---|
| Encryption in transit | TLS 1.2 or higher on every connection between your device and us |
| Encryption at rest | AES-256 for stored data, including backups |
| Authentication | Operated by a specialist provider. We never store your password in a form we can read |
| Access controls | Which of our staff can reach production data is limited on a need-to-know basis, and access is logged |
| Isolated environments | Testing and development never touch real user data |
| Audit logging | Changes to health records, and everything the assistant does, are recorded in an audit trail |
| Vendor requirements | Contractual security obligations on every processor, and a Business Associate Agreement where a vendor offers one |
Every employee and contractor is bound by written confidentiality obligations and is trained on handling health data, and the same restrictions apply contractually to the companies that process data for us. See Consumer Health Data Privacy Policy §7.
what we are not
Lifelong is not end-to-end encrypted. We can read your data on our servers, because reading it is how the product works — extracting structure from a lab report, generating an insight, answering a question. Any service that does those things can see your data. What we do instead is minimise who and what can reach it, log access, and never use it for anything outside the Privacy Policy.
The same is true of the assistant: a conversation with Alo is not encrypted end-to-end once it reaches us, because Alo has to read it to answer. Every message, tool use and proposed change is logged, so it is always possible to reconstruct what the assistant did and why, and you can see and delete your conversations. See AI and Alo Disclosure §2.
2. certifications, stated honestly
We have not completed a SOC 2 audit, and we do not hold any security certification. We have not commissioned an external penetration test. We are not a HIPAA covered entity, and we do not describe Lifelong as "HIPAA compliant" — where a vendor offers a Business Associate Agreement we sign one, which is a contractual commitment, not a certification. Our regulatory position is set out in full in Privacy Policy §3.
We would rather this page were short and true than long and impressive. When any of the above changes, it will be named here with its date and its scope, and not before.
3. what happens when content leaves us
To generate a result we send the relevant content to a model provider. What protects it there is not anonymity — it is encryption in transit, written contracts restricting each provider to processing on our instructions, a contractual prohibition on using anything we send to train or fine-tune models, and sending as little as the task requires.
Where content goes out identifiable, we say so rather than implying a de-identification that does not happen. The full account, including which features minimise names and which do not, is in the AI and Alo Disclosure §3.
4. reporting a vulnerability
If you find a vulnerability, email privacy@trylifelong.com before disclosing it publicly. Our machine-readable contact details are published at /.well-known/security.txt under RFC 9116.
safe harbour
For good-faith security research conducted under the responsible disclosure paragraph of our Acceptable Use Policy, we will respond promptly, will not pursue legal action against you, and will credit you if you would like.
Please keep your testing to accounts and data that are yours. Do not access, modify or exfiltrate another family’s health information to demonstrate a finding — tell us what you found and we will reproduce it.
5. if something goes wrong
No system is perfectly secure, and a page that claimed otherwise would not be worth reading. If a breach affects your health information, we will notify you and the appropriate regulators as required by the FTC Health Breach Notification Rule, the GDPR, and applicable state laws.
- Security questions and vulnerability reports: privacy@trylifelong.com
- A right you want to exercise: make a privacy request
- Everything else we publish: Legal