Who is responsible
LONGEVITY GROUP is responsible for the purposes and means of the personal-data processing described in this policy. Company information is set out in the Legal notice. 2HUNDRED is the brand presented on this website. Other group companies do not automatically have access to your information.
This policy concerns the website, its invitation application, login and home-visit booking interfaces. Clinical records, laboratory results, Oura account data and medical care are separate: the responsible professionals must explain their own processing before those services collect information.
Information used by the website
In the current website, application, login, invitation and booking values are processed within the open page. They are not submitted to a central application database, a clinical system or a payment provider, and are not saved by this site in local storage. The site does not persist these values across page sessions; your browser may separately restore fields through its own autofill or history features. A confirmation displayed by this interface does not represent the creation of a clinical record or a payment-provider transaction.
Clinical history, test results and medical documents should be shared through the channels provided by your care team, not through an invitation application's free-text answer. The website does not connect to your Oura account or laboratory record.
- Technical connection data: the requested page, IP address, browser and device information, and technical errors needed to serve and secure the site.
- Application fields: full name, email, phone, occupation, LinkedIn or social-profile links, motivation and readiness to start if accepted.
- Member interfaces: an email address or invitation code, then name, contact details, home-visit address, optional access instructions and selected visit date and time.
- Direct correspondence: the contact details and message you choose to send when contacting us separately.
Purposes and lawful bases
Technical processing allows us to provide, secure and troubleshoot the site. Where personal data is involved, this relies on our legitimate interest in operating a reliable and secure website, under GDPR Article 6(1)(f).
Information you choose to provide to request membership, access or a visit is used for the corresponding steps requested by you, under Article 6(1)(b) where preparatory contractual steps apply. General enquiries and necessary follow-up rely on our legitimate interest in answering you. If a legal obligation requires us to keep a particular record, Article 6(1)(c) applies to that record.
Readiness to start the programme is an application statement, not consent to marketing, medical treatment or general health-data processing. We do not add an applicant to marketing campaigns merely because they fill in a form. Any processing that requires consent must be explained and requested separately.
Your choices and required fields
You can browse without completing a form. The application interface requires contact details, occupation, motivation, readiness and at least one profile link; you can provide a social profile instead of LinkedIn. A visit request requires the details needed to identify and contact you and locate the visit. Floor or door instructions are optional.
Leaving a required field blank prevents the corresponding form from continuing. We do not ask you to disclose sensitive personal characteristics for selection. There is no solely automated admission, medical decision or health-risk profiling performed by this website.
Access, providers and transfers
When you follow an invitation link, any code included in the URL accompanies the page request and may appear in technical logs. Treat that link as personal. Values typed into the current in-page forms are not sent to a social platform, advertising provider, payment processor, laboratory or Oura. Supplying a profile URL does not embed that platform's tracking tools in the form. Fonts and visual assets are served from the website itself.
Technical delivery involves the website infrastructure. Staff and service providers may access personal data only where needed for the stated purpose and subject to appropriate confidentiality and contractual duties. We do not sell personal data or share it with other group companies merely because they belong to the same group.
If a service is introduced that transfers personal data outside the European Economic Area, the relevant notice must identify that transfer and its legal safeguards before it takes place. Depending on the destination, safeguards may include an applicable adequacy decision or the European Commission's standard contractual clauses with necessary additional measures. The use of a provider's name does not, by itself, establish an adequate safeguard.
How long information is kept
The present forms use the active page's memory and do not write their values to persistent application storage. Browser autofill and history may separately retain information according to your browser settings. The website does not keep a central history of applications, visit requests or transactions from these interfaces.
For technical logs and correspondence received separately, retention is limited to the time necessary to deliver and secure the service, investigate an incident, answer the enquiry and complete necessary follow-up. Records needed for a legal obligation or a legal claim may be isolated and retained for the applicable legal period; they must not continue to be used for unrelated purposes.
Before persistent application, membership, billing or medical-record systems are introduced, their information notices must specify the relevant retention periods or sufficiently precise criteria. Medical and accounting records may have different legal retention rules; this website policy does not authorise indefinite storage of those records.
Cookies and device storage
The current website sets no advertising or audience-measurement cookies and loads no advertising or analytics trackers. The router may keep a technical scroll-position record in session storage so navigation restores the page position. That record remains on the device and lasts only for the tab's session.
These technical features do not perform advertising or cross-site tracking. If optional trackers are introduced, they must stay off until you have made the required choice, with refusal as easy as acceptance and a way to change that choice.
Your rights
Depending on the applicable conditions, you may request access, correction, erasure, restriction, portability and an explanation of the processing of your personal data. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. French law also allows instructions concerning your data after death.
To exercise a right, write to LONGEVITY GROUP at 128 rue La Boétie, 75008 Paris, France, specifying the right concerned. We may request proportionate information to verify identity where reasonably necessary, not an identity document in every case. Requests are normally answered within one month; a permitted extension of up to two further months requires an explanation within the first month.
These rights are subject to legal conditions and are not an automatic right to erase records that must lawfully be kept. You may complain to the CNIL, the French data-protection authority, including through its online complaints service. Your right to seek a judicial remedy is unaffected.
Right to object
You may object to processing based on legitimate interests for reasons relating to your situation. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
You may object to direct marketing at any time, without giving a reason. We will stop using your information for that purpose. An invitation application is not a marketing subscription.
Updates
The date above identifies this version. We will update the policy when the website's processing changes and provide information at the relevant point of collection. A general website policy does not replace a specific patient-information notice, medical confidentiality or any consent required for a particular clinical or connected-device service.