Wellness & Lifestyle Intelligence and GDPR: the legal frame
The portal supports a way of living; it does not diagnose and does not prescribe. Health data is processed under GDPR — on the guest's explicit consent, on an EU server.
The class. Wellness & Lifestyle Intelligence — lifestyle support: the portal collects the figures a watch and a scale deliver, shows them to the guest and to the doctor, and keeps what the doctor prescribed. It does not diagnose and does not prescribe.
Who answers for the data. The controller is the hotel: the portal's notice names the legal entity, its registration numbers, its address and the doctor by name. longev.eu is the processor: it runs the code and the server.
Every house has its own database. One codebase, but every hotel gets its own process, its own directory and its own database. There is no shared table of all the hotels' guests.
There are two consents. A general one at sign-up, an explicit one for health data before the questionnaire. Both are recorded with the version of the notice: currently version 1.7 of 17.08.2026, twelve sections in 36 languages.
The rights are buttons. Export everything in one file, an HL7 FHIR export for a clinic's system, withdrawal of consent together with erasure, deletion of the account. No letter to the hotel, no waiting.
What leaves the EU. Three things, and all three are named out loud: signing in with Google, the Garmin cloud behind a lent watch, and the depersonalised text handed to the model.
How long. Health data — three years after the last activity, server logs — up to 90 days, a password reset link — 60 minutes.
Who this is for. The hotel choosing a platform, and the guest who wants to know what became of their figures. Updated 23.08.2026.
What Wellness & Lifestyle Intelligence means
Wellness & Lifestyle Intelligence is a class of product that supports a way of living: sleep, movement, water, food and the hotel's procedures. It works with the same figures medicine does, but it claims no medical purpose and promises no therapeutic result.
What the portal does: it takes the daily states from a watch and the weigh-ins from a scale, compares them with the guest's own average, shows the picture to the guest in their account and to the doctor on the panel, and keeps and displays what the doctor prescribed.
What it never does: name a disease, prescribe either a medicine or a diet, override or replace a doctor's prescription, or promise that a procedure will cure anything.
The difference shows where the algorithm touches the plan. What is free and ours — a walk, a sauna included in the room — the portal moves by itself. A paid procedure it only proposes to move, and the doctor decides (how that works).
Where the medical-device line runs
What makes software a medical device is not the sophistication of its algorithm but the purpose its manufacturer gave it: diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease (Regulation (EU) 2017/745 on medical devices, Article 2). The portal claims no such purpose — and that is not a declaration but three places in the product itself:
The risk level from the questionnaire picks a walking route and a heart-rate corridor, not a diagnosis. It produces no legal effect, and a doctor overrides it.
The drinking cure is prescribed by the hotel's chief physician after an examination. The portal stores it, shows it and reminds the guest of a serving — it cannot prescribe one (more).
The night loop moves a procedure; it does not treat. The thresholds it moves them by are the doctors' and they are published (the numbers and the rules).
The watch is a consumer device
The hotel's kit is an ordinary Garmin Forerunner 165 Music and an ordinary Garmin Index S2 scale, bought in a shop. The portal takes none of their medical features: Garmin ships the ECG app enabled only where it is approved as a medical device, and a watch bought in another country may not carry it at all.
Pulse, its variability, sleep phases, breathing and blood oxygen are the readings of a consumer optical sensor on a wrist. That is how the portal presents them: as the movement of this guest's own body, not as the result of a test (what the watch actually measures).
The classification is held up by promises, not by a line in a document. A hotel's marketing that says «we will diagnose you from your watch» or «we will cure you in a week» breaks the frame faster than any change in the code.
Who answers for what
The GDPR roles fall out like this, and how they fall matters more than any wording about partnership: it is the hotel that answers to the guest and to the supervisory authority.
Role
Who that is
What they do
Controller
the hotel as a legal entity
decides why the data is collected; answers to the guest and to the supervisory authority; its details stand in the portal's notice
Processor
longev.eu
runs the code and the server, under a data-processing agreement and on the hotel's instructions
The doctor
the hotel's chief physician, named
sees the figures of the stay, prescribes the cure and the procedures; bound by medical confidentiality
The hosting
the provider, datacentre in the EU
keeps the server running; a processor too, under contract
Garmin
the Garmin cloud
receives what the watch records: either the guest's own account or the hotel's account behind a lent kit
Google
sign-in and the model
sign-in with Google is the guest's choice; the model works while the hotel keeps the feature switched on
Maps
OpenStreetMap, mapy.com
the guest's browser requests map tiles directly; the walk's track is never sent to them
Why every hotel has its own database
The platform is not multi-tenant in the usual sense: the guests of different houses are not kept apart by a column in a shared table. Every hotel has its own process on the server, its own directory and its own database, while the code is one and the same.
The difference is practical. A mistake in a query cannot show one hotel another hotel's guests — they are simply not in its database. A hotel that leaves takes its file whole, not a selection out of a shared store.
Two consents and the version of the notice
Health data is a special category (Article 9 GDPR), and for it «I agree to the terms» at sign-up is not legally enough. So there are two consents: the general one at sign-up and an explicit one for the processing of health data, asked before the questionnaire.
The order is held by the server, not by the interface: a request for the second consent while the notice has not been accepted is refused.
Both consents are stored together with the version number of the notice and the time. The version goes up when the meaning changes, not for a typo — and then the portal asks everybody again, in a window that stands over any screen.
That has happened three times already: version 1.5 added the scales in the room and body composition, 1.6 named the AI model and the three exits from the EEA, 1.7 the food diary and the photograph of a plate. Every time, every guest was asked again.
The portal's notice is separate from the hotel's and covers the portal only: the account, the questionnaire, the walks and the watch. Booking a room and the hotel's newsletter live in the hotel's own policy.
The portal's notice: twelve sections, open without signing in×
The guest's rights are buttons, not an e-mail
A right that is promised but performed by writing to the hotel is, in practice, not performed. So the «Account» page carries a «My data» block, and in it four buttons.
Export — everything the portal holds about the guest, in one machine-readable file: questionnaires, walks with their track points, nights, tests, prescriptions, profile (Article 20 — the right to portability).
HL7 FHIR export — the same figures in the language of medical systems, in FHIR R4: a patient and observations. A clinic's system reads that file, not only a person.
Withdraw consent — by default together with erasure: there would be nothing left to hold health data on once the consent is gone.
Delete the account (Article 17) — with a confirmation: the guest types their own e-mail address, or the button does nothing.
«My data»: export, withdrawal of consent, deletion×
What the buttons do not do
A staff account is not deleted by them. A doctor's signature stands under other people's prescriptions and morning sheets, so an administrator removes such an account — that a signature is never silently detached.
The two depths of erasure, and what survives a deletion, are laid out in Your personal data: it also explains why the journal of kit handovers stays while the staff's notes about a guest go.
Where the data lives and what leaves
The server stands in the European Union; the country of the datacentre is named in each house's own notice. Data leaves it in exactly three cases, and all three are listed in the notice by name:
Signing in with Google — only if the guest chose that door, and only the sign-in itself: the e-mail address, the name and the account identifier. The Google password never reaches the portal.
The Garmin cloud — a lent watch syncs into a Garmin account that belongs to the hotel and carries a kit number rather than the guest's name; Garmin's servers stand in the United States. The basis is the explicit consent given for the watch (Article 49(1)(a)).
The model's provider — the depersonalised morning summary (age, sex and the figures, with no name, no date of birth and no e-mail address), a message from the doctor that has to be translated word for word, and the photograph of a plate, when the guest pressed the camera themselves.
And one thing we cannot erase
The portal has no advertising and no analytics counters. The guest's browser holds only the session token and the chosen language.
The daily history in a Garmin account, though, cannot be deleted: Garmin offers no way to do it. Those days stay with Garmin under Garmin's own terms even after our copy has been erased. The portal only ever reads from such an account the days of the stay during which the guest held that kit — but saying so is more honest than keeping quiet.
How long things are kept
Each kind of data has a term of its own, and deletion within it means rows removed from the database, not hidden from the interface.
One record outlives the guest on purpose — the billing line for an active stay: its link to the account is nulled, so the month remembers that the stay happened but no longer names anybody (how an active guest is counted).
What
How long
The account
until the guest deletes it
Questionnaires, walks, profile, drinking cure
three years after the last activity — or until consent is withdrawn
The food diary and the photographs in it
the same three years; a photograph goes off the disk with its entry, not only out of the list
Daily states from a lent watch
they stay on the guest's card between stays, the same three years
A password reset link
60 minutes
Server logs
up to 90 days
What the model does, and what it never decides
Some of the portal's texts are put into words by an artificial-intelligence model: the wording of the morning summary, the translation of a message from the doctor, the background of a walk postcard, the estimate of the calories on a photographed plate.
It does not compute the risk level, does not choose the heart-rate zone and does not change the programme — it is handed what the portal has already worked out. There is no automated decision with a legal effect (Article 22 GDPR) in the portal at all.
That a text was written by a model is said to the guest in the notice itself: Article 50 of the EU regulation on artificial intelligence requires it.
And the main safety catch: not one request carrying personal text goes out until the super-admin has confirmed that a data-processing agreement with the provider exists. The switch is off by default — silence is not consent. A free tier will not do for this: by the provider's own terms it learns from what it is sent.
Calories read off a photograph are shown with a range and can be corrected: it is an estimate from a picture, not a measurement.
What the server forbids, not the interface
Looking through the guest's eyes is read-only. A doctor may open a guest's account to see exactly what the guest sees. Any request that changes something is refused at the door of the application, before any handler: a promise kept route by route lasts until the first new route.
Every entry is logged. Which member of staff opened a guest's account, and when — one line in a journal. An administrator is allowed to edit in such a session, and the price is said out loud: the edit goes out under the guest's name, and the journal remembers whose window to look into.
A guest reaches their own rows and no others. The roles are separated on the server, not hidden in a menu.
Passwords are not stored. The database holds a PBKDF2 hash, and a password reset link only as a SHA-256 of the code. A leaked database hands out neither.
Changing a password kills the keys already issued. Every token carries a session generation: a password change, a sign-out on all devices or an edit of the role kill the tokens already handed out instead of waiting for them to expire.
What the hotel does before the launch
Fill in the controller's details. While a single field is still in angle brackets, the portal treats the notice as unpublishable and says so in the administrator's panel.
Name a channel for data requests — and, if a data protection officer is appointed (Article 37), their address. The regulation does not require the officer's name to be published; a way to reach them, it does.
Name the doctor. A guest handing over health data is entitled to know who reads it, rather than being told «the spa doctor».
Sign the data-processing agreements — with the platform, and with the model's provider if the model is switched on. Until that is confirmed the switch is off and no personal text travels.
Check the marketing against the classification. A promise of treatment on the hotel's website crosses out the «lifestyle support» frame.
Remember the age line. The portal is meant for adults; no account is created for anybody under 16.
Know your supervisory authority. It is named in the notice, with an address and a website; for the Czech Republic it is the Úřad pro ochranu osobních údajů.
Questions and answers
Is the portal a medical device? No. It claims no medical purpose: it does not diagnose, does not prescribe treatment and promises no therapeutic result. It collects figures and shows them; the doctor makes the decisions.
Who answers to the guest — the hotel or the platform? The hotel: it is the controller. The platform is the processor, working under contract and on the hotel's instructions.
Is consent needed if the guest merely wears a watch? Yes. Daily states are health data, a special category under Article 9 GDPR. The portal takes a separate explicit consent for them, and it can be withdrawn in one click.
Does data leave the EU? The server is in the EU. Three things leave it, all three named in the notice: signing in with Google, the Garmin cloud behind a lent watch, and the depersonalised text handed to the model.
Does the model learn from guests' data? No. Until the data-processing agreement with the provider is confirmed, no personal text goes out at all, and the agreement itself forbids reuse and training.
What is left if a guest deletes everything? The nights, the walks, the prescriptions, the food diary and the staff's notes about them go out of the database. What stays are the house's records about itself: the journal of kit handovers and a billing line that no longer names anybody.
