Privacy policy

Who we are

variis is a longevity intelligence publication anchored in Singapore and Australia. We publish research, market analysis, and reader tools for people making evidence-based decisions about long-term health.

The publisher entity is [Company legal name], registered as [Company registration number], with a registered office at [Registered business address]. Our data protection officer is [Data protection officer name and email], and they are the first point of contact for any privacy question, request, or complaint.

This policy applies to the variis website, newsletter, reader accounts, and any related service we operate under the variis name.

The short version

We collect the minimum data needed to send you the newsletter, remember your account, and understand which stories readers value. We do not sell your data to anyone. We do not run third-party advertising on variis, and we do not build shadow profiles of our readers.

If you only read one section of this policy, read this one. The rest is the detail behind it.

What we collect

We try to hold as little personal data as possible. In practice, that means:

• Email address when you sign up for the newsletter or create a reader account.
• Market you are reading from (Singapore, Australia, or elsewhere), which you can set yourself and change at any time. This field is optional.
• Topics of interest you select in human-readable form (for example, healthspan research, clinical infrastructure, policy). This field is optional.
• Article views, meaning which pages you visit on variis, when you visited, and the device type. We use this to understand what readers value.
• Saved items and comparisons, if you have a reader account and choose to save them.
• IP address, used for security, rough geolocation, and to protect the service from abuse.
• Device and browser information, so we can render the site correctly and diagnose problems.

We do not ask for, or want, sensitive personal information such as health records, financial account details, or identity documents. Please do not send those to us.

How we use it

We use the data above for a small, defined set of purposes:

• To send you the newsletters and account emails you asked for.
• To remember your preferences, saved items, and reading history when you sign in.
• To understand which stories readers value, in aggregate, so we can commission and publish better work.
• To protect the service from fraud, spam, credential stuffing, and other abuse.
• To meet legal, regulatory, and tax obligations that apply to us.

We do not use your data to train third-party advertising models. We do not sell reader lists. We do not share your reading history with third parties for marketing.

Legal basis

Under Singapore's Personal Data Protection Act (PDPA) and Australia's Privacy Act 1988, we rely on the following grounds to process your personal data:

• Consent, when you opt in to the newsletter, create an account, or set optional preferences.
• Legitimate interest, for the day-to-day operation of the site, security, and understanding aggregate readership.
• Legal obligation, when we are compelled to retain or disclose data by valid law or court process.

If you are reading variis from outside Singapore or Australia, local law may give you additional rights. As a matter of policy, we apply the same baseline standard to every reader wherever they are, and we will honour local rights where they apply to you.

Sharing

We do not sell personal data. We do not rent it, trade it, or hand it to data brokers.

We do share limited data with a small number of vendors who help us run the service. Each of them is contractually bound to protect your data and use it only for the purpose we engaged them for:

• Resend, which delivers our newsletter and transactional emails.
• Vercel, which hosts the variis website and serves it to your browser.
• Neon, which stores the database behind reader accounts.

We may disclose personal data to law enforcement, regulators, or courts, but only when we receive a valid legal request and only to the extent required. Where the law allows, we will tell you before we disclose.

If variis is ever acquired, merged, or restructured, personal data may transfer as part of that transaction. In that case, we will notify affected readers and the same protections will continue to apply.

Retention

We hold data for as long as we need it, and no longer:

• Email addresses are retained until you unsubscribe or delete your account.
• Aggregate analytics about readership are retained for two years.
• Server logs used for security are retained for 30 days.
• Account content (saved items, comparisons) is retained for the life of your account, and deleted within 30 days of you closing it.

We may retain a minimal record of the fact you unsubscribed, so that we do not accidentally re-add you if your address appears in a future import.

Your rights

Under the PDPA in Singapore and the Privacy Act 1988 in Australia, you have the right to:

• Access the personal data we hold about you.
• Correct anything that is wrong or out of date.
• Delete your account and the personal data associated with it, subject to any records we are legally required to keep.
• Withdraw consent at any time, including by unsubscribing from the newsletter.
• Ask questions about how we handle your data and expect a substantive answer within a reasonable time.

To use any of these rights, write to us at privacy@variis.co. We may ask you to verify your identity before we act, so that we do not disclose data to the wrong person.

If we do not resolve your concern, you can complain to your regulator. In Singapore, that is the Personal Data Protection Commission (PDPC). In Australia, it is the Office of the Australian Information Commissioner (OAIC). We would rather hear from you first and fix it, but the escalation path is yours.

Cookies

variis uses only essential cookies. That means:

• A session cookie so signed-in readers stay signed in.
• A theme preference cookie if you set one.
• A security cookie used to protect against cross-site request forgery.

We do not run third-party advertising cookies, and we do not embed social tracking pixels. For product analytics we use PostHog, configured with IP truncation and cookieless tracking where the tooling supports it. We use it to understand aggregate reading behaviour, not to profile individuals.

Children

variis is written for adults making evidence-based decisions about long-term health. It is not directed at people under 16, and we do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal data, contact privacy@variis.co and we will delete it.

International transfers

variis stores reader data in Singapore as the primary region. If you are reading from Australia, or from anywhere else in the world, your data will cross a border to Singapore for processing.

We rely on the ASEAN Data Management Framework and standard contractual safeguards with our vendors to keep the level of protection consistent across those transfers. Where you have specific rights under local law that require additional safeguards, we will honour them.

Changes to this policy

We may update this policy from time to time, either because the law changes, our vendors change, or the service changes. The Last updated date at the top of this page always reflects the most recent version.

Where the changes are material (for example, a new category of data or a new vendor with access to personal data), we will email newsletter subscribers before the changes take effect, so you have time to review them and decide whether to remain subscribed.

Contact

For any privacy question, request, or complaint, write to us at privacy@variis.co.

You can also reach us by post at [Registered business address]. If your request is time-sensitive, email is the fastest route.