Privacy Policy
Last updated: September 17, 2026
1. The short version
We collect very little. We use it to answer you and to keep the Site running. We do not sell your personal information. We do not run ads.
2. Who is responsible
Absolutys LLC, New York, USA, operates drdavidluu.com and is the controller of personal data collected through it. Contact: privacy@drdavidluu.com.
3. What we collect
| Data | When | Why |
|---|---|---|
| Name, email, company, role, and your message | You submit the contact or "Start a conversation" form, or email us | To reply and evaluate working together |
| Name, email, and organization | You request the speaking media kit | To deliver the kit and respond to speaking enquiries |
| Technical data: IP address, browser, device type, pages viewed, referring site | You visit the Site | Security, performance, and aggregate analytics |
| Event or workshop details you provide | You register for or inquire about a session | To organize and deliver the session |
We do not ask for health information. Please do not send it. If you do, we will delete it where practical.
4. Cookies and analytics
The Site uses essential cookies or similar technologies needed for it to function and stay secure, including a seven-day access cookie for the speaking media kit. We use Vercel Web Analytics to understand aggregate traffic. It does not use tracking cookies or build profiles of individual visitors across websites. We do not use advertising trackers.
5. The Ask feature and AI
The Ask feature is not currently available on the Site. We do not currently collect Ask questions or send them to a third-party AI provider. If we introduce an AI-powered Ask feature, we will update this policy to identify the provider and explain how questions and answers are processed and retained before the feature becomes available. Do not enter personal health details or confidential information.
6. Legal bases (EU, UK, Switzerland)
- Legitimate interests: running and securing the Site, responding to business inquiries, aggregate analytics
- Steps before a contract: handling advisory, workshop, and speaking inquiries
- Consent: non-essential cookies, where used. You can withdraw consent at any time
- Legal obligation: where the law requires us to keep or disclose records
7. Who we share data with
We share data only with service providers that help us run the Site, under contracts that limit their use of it:
- Vercel (hosting, delivery, and aggregate analytics)
- Resend (delivery of enquiry and speaking media kit emails)
- Professional advisers, and authorities where the law requires
If an inquiry concerns LongevityDocs or The Heart Fund, we may pass it to that organization so the right team can answer. The newsletter linked from the Site is published by LongevityDocs on Substack. Signing up there is governed by their privacy policies, not this one.
We do not sell or share personal information for cross-context behavioral advertising.
8. International transfers
We are based in the United States and our providers may process data in the US and other countries. Where required, we rely on Standard Contractual Clauses or an equivalent safeguard for transfers from the EU, UK, and Switzerland.
9. How long we keep it
- Inquiries and correspondence: up to 24 months after our last exchange, longer if we enter an engagement
- Ask logs: none are currently collected
- Server and security logs: up to 30 days
- Analytics: aggregate only
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your data, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know, delete, and correct, and the right not to be discriminated against for using those rights. EU and UK residents may also complain to their local data protection authority. In France that is the CNIL.
To make a request, email privacy@drdavidluu.com. We respond within 30 days and may need to verify your identity.
11. Security
We use reasonable technical and organizational measures, including encryption in transit and restricted access. No system is fully secure. If a breach affects your data, we will notify you as the law requires.
12. Children
The Site is for professionals and is not directed to anyone under 16. We do not knowingly collect children's data. If you believe a child has sent us data, contact us and we will delete it.
13. Not a healthcare provider
The Site does not provide care and does not collect patient records. It is not a covered entity under HIPAA.
14. Changes
We may update this policy. The date at the top shows the latest version. Material changes will be flagged on the Site.
15. Contact
Absolutys LLC. privacy@drdavidluu.com