1. Information We Collect

We collect information you provide directly, including your name, email address, company affiliation, and health-related data such as biomarker results, wearable device data, and lab reports. We also collect usage data and analytics to improve our platform.

2. How We Use Your Information

Your data is used to provide personalized biological age assessments, generate your PACE score, power AI coaching recommendations, and improve our services. We do not sell your personal data to third parties.

3. Data Security

We implement industry-standard security measures including encryption at rest and in transit, row-level security policies, mandatory multi-factor authentication, and comprehensive audit logging. All health data is stored in compliance with applicable regulations.

4. Data Retention

We retain your data for as long as your account is active or as needed to provide our services. You may request deletion of your data at any time by contacting our support team.

5. Your Rights

You have the right to access, correct, or delete your personal data. You may also request a copy of your data in a portable format. For EU/EEA residents, these rights are guaranteed under GDPR.

6. Contact

For privacy-related inquiries, please contact us at hello@pacesovereign.com.

1. Acceptance of Terms

By accessing or using PaceSovereign, you agree to be bound by these Terms of Service. If you do not agree, you may not use the platform.

2. Description of Service

PaceSovereign is a biological asset management platform that provides personalized aging metrics, AI-driven coaching, and health data analytics. Our platform is a data intelligence tool and does not constitute medical advice, diagnosis, or treatment.

3. Medical Disclaimer

PaceSovereign is not a healthcare provider. All scores, insights, and recommendations are generated by AI and published research. Always consult your physician before making changes to your health protocol. We are not responsible for health decisions made based on our data.

4. User Responsibilities

You are responsible for maintaining the confidentiality of your account credentials and for all activities under your account. You agree to provide accurate data and not to misuse the platform.

5. Intellectual Property

All content, algorithms, and designs on PaceSovereign are owned by us or our licensors. You may not copy, modify, or distribute any part of the platform without written permission.

6. Limitation of Liability

PaceSovereign is provided “as is” without warranties of any kind. We shall not be liable for any indirect, incidental, or consequential damages arising from your use of the platform.

7. Changes to Terms

We reserve the right to modify these terms at any time. Continued use of the platform after changes constitutes acceptance of the new terms.

1. What Are Cookies

Cookies are small text files stored on your device when you visit a website. They help us provide essential functionality, remember your preferences, and understand how you use our platform.

2. Categories of Cookies We Use

3. Your Choices

When you first visit PaceSovereign, you can choose which cookie categories to accept. You can change your preferences at any time by clearing your browser's local storage or contacting us. Necessary cookies cannot be disabled as they are essential for the platform to function.

4. Data Storage

Your cookie preferences are stored locally on your device using localStorage. We do not use third-party cookie tracking services. Your health data is never stored in cookies or used for analytics purposes.

5. EU/EEA Rights

Under the EU ePrivacy Directive and GDPR, you have the right to accept or refuse non-essential cookies. We obtain your explicit consent before setting any analytics or marketing cookies. You may withdraw consent at any time.

6. Contact

For questions about our cookie practices, contact hello@pacesovereign.com.

1. Definitions

For the purposes of this Data Processing Agreement (“DPA”), the following definitions apply:

• “Controller” means the User who determines the purposes and means of processing Personal Data through the PaceSovereign platform.
• “Processor” means PaceSovereign, which processes Personal Data on behalf of the Controller pursuant to this DPA.
• “Personal Data” means any information relating to an identified or identifiable natural person, including health data, biometric data, and genetic data as defined under Articles 4 and 9 of Regulation (EU) 2016/679 (GDPR).
• “Processing” means any operation performed on Personal Data, including collection, storage, analysis, scoring, AI-driven inference, and deletion.
• “Sub-processor” means any third party engaged by PaceSovereign to process Personal Data on behalf of the Controller.

2. Scope & Purpose

This DPA governs the processing of Personal Data by PaceSovereign on behalf of the Controller for the following purposes: computation of the PACE (Pace of Aging Composite Estimate) score; AI-driven health coaching and nudge generation; longitudinal trend analysis of biological markers; readiness scoring; league-based peer comparison (anonymized); and generation of the Bio-Passport.

3. Data Categories

The following categories of Personal Data are processed under this DPA:

• Biomarker readings (blood panels, metabolic markers, hormonal profiles, inflammatory markers)
• Wearable device metrics (heart rate variability, sleep architecture, activity data, recovery scores)
• Laboratory reports (PDF uploads parsed via AI extraction)
• Genetic and epigenetic data (where voluntarily provided)
• AI coaching conversation logs and personalized recommendations
• Account identifiers (name, email address, authentication credentials)

4. Processing Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, unless required to do so by Union or Member State law to which the Processor is subject. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes applicable data protection law. Processing activities are limited to those necessary to provide the services described in Section 2.

5. Security Measures

PaceSovereign implements the following technical and organizational measures to ensure the security of Personal Data:

6. Sub-processors

The Controller authorizes the Processor to engage the following sub-processors for the processing of Personal Data. A complete list is maintained in the Sub-processor Register appended to this DPA.

• Supabase Inc. — Database, authentication, and storage (EU-West, Ireland)
• Vercel Inc. — Application hosting and CDN (EU, Frankfurt)
• Anthropic PBC — AI processing for coaching, PDF parsing, and nudge generation (US — data not retained by Anthropic)
• Resend Inc. — Transactional email delivery (EU)

7. International Data Transfers

All sub-processors are EU-based with the exception of Anthropic PBC (United States). For transfers to Anthropic, PaceSovereign relies on the European Commission's Standard Contractual Clauses (SCCs) adopted pursuant to Commission Implementing Decision (EU) 2021/914, supplemented by a Transfer Impact Assessment confirming that Anthropic does not retain Personal Data beyond the duration of each API request. No Personal Data is transferred to jurisdictions lacking an adequacy decision without appropriate safeguards in place.

8. Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subject requests under Articles 15–22 of the GDPR, including:

• Right of access (Article 15) — Full export of all Personal Data in JSON and CSV formats
• Right to rectification (Article 16) — Correction of inaccurate biomarker or profile data
• Right to erasure (Article 17) — Complete deletion of all Personal Data and derived scores
• Right to data portability (Article 20) — Machine-readable export in standard formats
• Right to restriction (Article 18) — Suspension of processing while disputes are resolved
• Right to object (Article 21) — Objection to specific processing activities

All Data Subject requests shall be acknowledged within 72 hours and fulfilled within 30 calendar days of receipt.

9. Data Breach Notification

In the event of a Personal Data breach, the Processor shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification shall include:

• The nature of the breach, including the categories and approximate number of Data Subjects affected
• The categories and approximate volume of Personal Data records concerned
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach, including mitigation of adverse effects
• The identity and contact details of the Processor's Data Protection Officer

10. Retention & Deletion

Personal Data is retained for the duration of the Controller's active account. Upon account termination or upon written request from the Controller:

• All Personal Data shall be permanently deleted within 30 calendar days
• Deletion is performed via cryptographic erasure of encryption keys, rendering all encrypted data irrecoverable
• Derived data (PACE scores, readiness scores, coaching summaries) is deleted alongside source data
• Audit log entries are retained for regulatory compliance (minimum 24 months) but are anonymized upon account deletion

11. Audit Rights

The Controller has the right to request an annual audit of the Processor's data processing activities. PaceSovereign shall make available its SOC 2 Type II report (once certified) in lieu of an on-site audit, unless the Controller demonstrates a reasonable need for on-site inspection. The Processor shall cooperate fully with any audit and provide all reasonably requested documentation within 14 business days of the request.

12. Term & Termination

This DPA is effective from the date the Controller creates a PaceSovereign account and remains in force for the duration of the processing activities. Upon termination:

• The Controller may request a complete data export (JSON and CSV) within 14 calendar days of termination
• All Personal Data shall be deleted within 30 calendar days of termination, subject to Section 10
• The Processor shall provide written confirmation of deletion upon request
• Obligations under Sections 5, 9, and 10 survive termination of this DPA

1. Regulatory Status

PaceSovereign is a lifestyle optimization and biological asset management platform. PaceSovereign is not a covered entity or business associate as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 C.F.R. Parts 160 and 164. We do not provide medical diagnosis, treatment, or payment processing. We do not transmit health information in connection with transactions for which the U.S. Department of Health and Human Services has adopted standards.

2. HIPAA-Aligned Practices

Notwithstanding our non-covered status, PaceSovereign voluntarily implements security practices aligned with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C):

3. Protected Health Information

While PaceSovereign processes health-related data (biomarker readings, wearable metrics, laboratory reports), this data is provided voluntarily by users for personal wellness and longevity insights. It is not collected, maintained, or transmitted in connection with any HIPAA-covered transaction. Users should not upload data subject to HIPAA protections without first consulting their compliance officer.

4. Business Associate Agreements

For Enterprise tier clients whose employees' data may be subject to HIPAA requirements, PaceSovereign is prepared to execute a Business Associate Agreement (BAA) upon request. Enterprise BAAs include additional administrative, physical, and technical safeguards as required by 45 C.F.R. § 164.314. Please contact our compliance team to initiate this process.

5. Contact

For HIPAA-related inquiries, please contact our compliance team at compliance@pacesovereign.com.

1. Permitted Use

PaceSovereign is designed exclusively for personal biological asset management. Permitted uses include: uploading and analyzing biomarker data to generate PACE scores; receiving AI-driven coaching recommendations; aggregating wearable device data for readiness and trend analysis; participating in anonymized league-based peer comparisons; and generating a Bio-Passport for personal reference.

2. Prohibited Conduct

The following activities are strictly prohibited and constitute grounds for immediate account termination:

• Sharing, transferring, or disclosing account credentials to any third party
• Automated scraping, crawling, or extraction of data from the platform via bots, scripts, or other programmatic means
• Reverse engineering, decompiling, or disassembling any component of the PaceSovereign platform, including the PACE scoring algorithm
• Using platform data, scores, or reports for insurance underwriting, actuarial assessment, or employment screening decisions
• Uploading falsified, fabricated, or deliberately manipulated laboratory reports or biomarker data
• Harassing, intimidating, or doxing other users within league features or any connected communications
• Attempting to circumvent row-level security policies, access other users' data, or exploit platform vulnerabilities
• Reselling, sublicensing, or commercially redistributing any PaceSovereign data, insights, or outputs without written authorization

3. Data Accuracy

Users bear sole responsibility for the accuracy and integrity of data uploaded to PaceSovereign, including laboratory reports, biomarker readings, and wearable device integrations. PaceSovereign is not liable for PACE scores, readiness assessments, coaching recommendations, or any other outputs derived from inaccurate, incomplete, or falsified inputs.

4. Account Integrity

Each PaceSovereign account corresponds to a single natural person. Corporate or organizational accounts for multiple individuals require the Enterprise tier. Users shall not create multiple accounts to circumvent usage limits, league rankings, or enforcement actions. Sharing Bio-Passport grades or PACE scores under false pretenses — including representing another person's scores as one's own — constitutes fraud and is grounds for immediate termination without refund.

5. AI Coaching Limitations

The PaceSovereign AI Coach provides data-driven suggestions based on published research and the user's biomarker trends. The AI Coach does not provide medical advice, diagnosis, or treatment recommendations. All coaching outputs include the disclaimer that users must consult a qualified physician before making changes to their health protocol. Users who rely on AI coaching outputs without independent medical consultation do so at their own risk.

6. Enforcement

PaceSovereign reserves the right, at its sole discretion, to investigate and take appropriate action against any user who violates this Acceptable Use Policy. Actions may include, without limitation: issuance of a written warning; temporary suspension of account access; permanent termination of the account without refund; and referral to law enforcement authorities where the violation involves unlawful conduct. PaceSovereign shall endeavor to provide reasonable notice before enforcement action, except where immediate action is necessary to protect the platform, other users, or comply with legal obligations.