Privacy Policy

This covers Memorise: the Ellie voice companion, the family circle, the care-home portal, and the websites and apps that reach them. It explains what we hold about you, why, who else touches it, how long we keep it and what you can ask us to do with it.

The operator of Memorise is the controller of that information. ⚠️ The registered entity, its address and a data-protection contact are not stated in this draft because they are not settled — see §20.

Almost everything here is about one of three people:

• The senior — the person who talks to Ellie. They are the subject of nearly all of it, including every sensitive category in §4.
• A family member — someone the senior has accepted into their circle. We hold their account and what they write, and they can see a filtered view of the senior’s.
• Facility staff — employees of a care home where the senior is an active resident. Their access is covered in §8, and their employer’s relationship with us by a separate agreement and a Data Processing Agreement.

⚠️ The person who pays is usually not the person this is about. Paying for Memorise does not make anyone the subject of it, and it does not grant access to a senior’s conversations.

The list below is the inventory, not a summary of it. Where something is not held, that is said too — those lines matter as much as the rest.

Three categories need naming separately, because they carry more risk than the rest put together and because the law treats them differently.

Health-adjacent conversation content. Ellie is a companion, not a clinician, but people tell a companion how they feel. Conversation text, the memories drawn from it, the mood estimates and the distress records can all reveal health. Under GDPR-style rules that is special-category data.

The voiceprint. A biometric identifier. Illinois names “voiceprint” explicitly in its biometric privacy law. §9 is entirely about this.

Position. One most-recent position, recorded only when there is a reason and never on a timer, and overwritten rather than accumulated — there is no movement history. A position older than two hours is withheld from a notification rather than attached, because a stale position sends somebody confidently to the wrong place. Every look-up is logged, and the senior may be told that you looked.

Everything comes from one of four places:

• The senior — what they say to Ellie, what they enter, what they press.
• Their family — the account they create, the messages and photos they send, and details they enter about the senior when helping set things up.
• A care facility — admission details and notices, where the senior is a resident.
• The service itself — memories, summaries, mood estimates, the voiceprint and the technical logs are all derived rather than given.

We do not buy personal data, and we do not enrich what we hold from outside sources.

Every use below is one of: providing the service, keeping somebody safe, keeping the service secure, or meeting a legal obligation.

• To have a conversation. The profile, the recent conversation and the memories retrieved for that turn are what let Ellie answer in context, in the right language, and open with something from yesterday.
• To remember. Memories are extracted once per conversation and retrieved later by meaning, which is what makes the fifth week different from the first.
• To tell the family how the day went. A summary, a mood, the topics — filtered by the permissions the senior sets.
• To remind about medicine, on the senior’s own clock, and to tell the family when a dose was not marked taken.
• To reach somebody when it sounds like it matters. §7.
• To know it is the right person speaking, so private memories are not read out to whoever is holding the phone. §9.
• To keep accounts secure — sign-in limits, refused-login alerts, abuse controls on account creation, and an audit trail of sensitive access.
• To fix faults. The request trail exists so that a failure can be investigated rather than guessed at.

⚠️ The lawful basis for the special-category processing in §4 is under review in this draft. Whether acceptance at onboarding is sufficient, or whether separate explicit consent is required — and whether a senior may decline the screening and keep the rest of the service — is not settled here.

We do not sell personal data, and we do not use conversations to train models for anybody else.

Every senior utterance is screened automatically for signs that something is wrong right now. On a possible fall, medical problem or self-harm, every accepted family member is notified at once, and — where the senior is an active resident of a participating facility — its on-duty staff alongside them. Lower-severity observations are recorded and shown in the family’s feed rather than pushed.

A notification may include a verbatim extract of the senior’s own words and their most recent position where it is recent enough to be meaningful. Anyone in the circle without a device is emailed instead.

What it is not — these are operating limits, not boilerplate.

• Not monitoring, and nobody is listening. It reads only text derived from conversations with Ellie, and only while she is being used.
• Not an emergency service. It will never summon emergency services. A notification means you should make contact.
• Not a diagnosis. It reports what was said, never what is wrong.
• Wrong in both directions. It will sometimes notify when nothing is wrong and sometimes fail to notify when something is. The absence of a notification means nothing.

⚠️ There is no per-topic setting that turns it off. A permission control must not be able to suppress a warning that somebody may be hurt. The senior is told about the screening once, up front — not during a conversation, because raising it mid-crisis alarms the one person least able to act on it.

Family members see summaries and indicators, not transcripts, and only within the per-topic permissions the senior sets — health, money and romantic topics lock independently. Two things sit outside those settings deliberately: distress notifications (§7) and the most-recent position, which is available on request, logged, and disclosed to the senior.

Facility staff, where the senior is an active resident, are in one of the two message threads and not the other:

Staff also receive distress notifications and can see the most-recent position on the same basis as the family, because a resident has somebody in the building and a son two cities away does not.

Beyond that: the processors in §10, and anyone we are legally required to disclose to. We do not share with advertisers or data brokers.

Ellie is a voice product, so speech is captured on the device and sent to us to be transcribed and answered. The audio itself is not stored.

From speech we derive a voiceprint — a 192-number representation of how a person sounds. It cannot be turned back into a recording or played. It is used for two things: signing in by voice where that is enabled, and deciding whether to include private memories in a reply when an unrecognised voice is speaking. The comparison runs on our own server, not at any third party, so no audio or voiceprint leaves our infrastructure for this purpose.

⚠️ How the voiceprint comes to exist is the part you should know, and it is currently a gap. Besides the deliberate enrolment in settings, the service can build one from ordinary conversation, once it has heard the same person across at least three separate sessions. There is no separate consent step for that. A biometric privacy law such as Illinois BIPA requires written notice and a written release before collection, and a published retention and destruction schedule. This page is the notice; the release and the schedule do not exist yet. Until they do, treat automatic enrolment as a limitation being worked on rather than a settled practice, and see §13 for how to remove a voiceprint that already exists.

Voice recognition is a judgement and it is sometimes wrong. A cold, a noisy room or a poor microphone can make a senior sound like a stranger; when that happens the reply is more cautious and the family is told once. The conversation is never cut off.

These companies process data on our behalf, for the purpose named and no other. We do not control their own policies; the point of naming them is that you can read them.

⚠️ This is the honest answer, and most of it is a gap rather than a policy.

One category has a retention period. The technical request trail is deleted a month at a time, so a record lives roughly 30 to 60 days and then is gone.

Everything else is currently kept for as long as the account exists, and some of it beyond that:

• The short-term context of a conversation is deleted when that conversation ends.
• Memories are never deleted automatically. They fade in relevance — an important one much more slowly than small talk — but they are not removed.
• Conversations, summaries, medication logs, messages and photographs persist.
• Distress records and the security log are append-only and are not deleted at all, including the senior’s quoted words. They exist so that it is possible to answer, later, why the service did or did not act — a question a product for vulnerable adults will eventually be asked.

⚠️ No retention or destruction schedule has been decided, and a biometric privacy law requires a published one. That is the single biggest reason this page is a draft rather than a policy, and it is not something a website page can settle on its own. Until it is decided, §13 is the route to having something removed.

Depending on where you live, you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct something that is wrong.
• Delete it — see §13 for what works today.
• Restrict or object to a particular use.
• Withdraw consent, where consent is what we rely on. Withdrawing consent for the voiceprint works today and is §13.
• Complain to a supervisory authority — §20.

⚠️ A senior’s rights are theirs, not their family’s. A family member cannot exercise them on a senior’s behalf simply by paying or by being in the circle. Where a senior cannot act for themselves, who may act for them — and on what evidence — is an open question in this draft.

Two limits are worth stating plainly. Erasing a senior’s data can destroy a security record about a different person, and some records we are required to keep. Where we cannot delete something, we will say which and why rather than quietly keeping it.

The voiceprint can be deleted on its own, today. There is a control in the app, and using it removes the voiceprint, the derived recordings behind it and the flags that depend on it — without deleting the account. Voice sign-in stops working and Ellie stops trying to recognise the speaker; nothing else changes.

Individual items can also be removed: a medicine, a message, a photograph.

You can delete an account from inside the app. The side menu carries a Delete account option — on the senior's app and on the family app alike — and using it, after a confirmation, erases the account and what is theirs: conversations and their transcripts, extracted memories, the voiceprint and its recordings, medicines, photographs in their family circle, and the sign-in devices. It takes effect immediately and cannot be undone. Two things survive in anonymised form, deliberately: the security log keeps a record that actions happened (with the email address removed, so it names nobody), and registration history keeps its abuse signal without the address. A family member's past messages in another person's family thread are removed along with their account.

Two automated judgements are made about a senior, and neither decides anything final:

• The distress screening (§7) decides whether to notify the circle. It does not diagnose, does not contact emergency services and does not restrict anything.
• Speaker recognition (§9) decides whether a reply may include private memories. When it is unsure, the reply is more cautious — the conversation is never refused.

Both are probabilistic and both are wrong sometimes. ⚠️ The recognition thresholds are uncalibrated — they come from English-language benchmarks and have not been measured against elderly speakers across the eight languages the product serves, so its real accuracy is not known.

Neither produces a legal effect or anything resembling profiling for advertising. No automated decision affects anybody’s access to the service.

Data is held in a database and on a file store operated for Memorise, with the processors in §10 handling their own portions. ⚠️ The hosting location is not settled and is therefore not stated here. When it is, this section names the country.

The processors in §10 are international, which means conversation text and, for the providers that handle it, the audio of a turn cross borders — most of them to the United States. Where that requires a safeguard, the safeguard has not yet been documented, and that is an open item rather than a claim.

What is in place today:

• Passwords are stored only as a bcrypt hash; we never hold the password.
• Sign-in is limited and refused attempts are bounded, so an account cannot be hammered. The first signed-in device holds the account — a second sign-in is refused rather than granted, and the device in use is told somebody tried.
• Access to a senior’s data is checked on every request against their circle.
• Photographs are decoded, stripped of metadata and re-encoded before storage, so an uploaded file cannot carry location or anything executable.
• Sensitive access is audited — every position look-up leaves a record naming who looked.
• Traffic is encrypted in transit.

⚠️ Encryption at rest for the voiceprint and its derived recordings is not yet implemented. It is an open item, listed alongside retention, and it would be wrong to let the list above imply otherwise.

No service is perfectly secure. If a breach affects you and the law requires it, we will tell you and the relevant authority.

This website sets no cookies and contains no analytics, no advertising and no third-party tracking of any kind. There is no consent banner because there is nothing to consent to.

It stores one thing in your browser: the language you chose, so the site is in that language next time. That never leaves your device. The staff portal additionally stores a sign-in token in the browser, for as long as you are signed in.

The staff portal reports its own render errors to us so a blank page can be investigated; those reports go into the request trail in §11 and expire with it.

Memorise is not for children and we do not knowingly collect anything about them. An account must be created by an adult. If a child’s information has reached us, tell us and we will remove it.

We will update this page as the open items in it close — the retention schedule, the hosting location, encryption at rest, the consent step for automatic voice enrolment, and the contact route. The date at the top changes when it does, and we will tell account holders about a change that materially affects them before it takes effect.

This page is published in English only. The service speaks eight languages and the link to this page is translated, but the document is not — a translation of a data-protection commitment that nobody has reviewed is a second policy, and we would rather have one that is right. If reading it in English is a barrier, ask us and we will explain any part of it.

⚠️ A contact route for privacy questions has not been set up yet, and rather than print an address nobody is reading, this draft says so. It is an open item, and it has to be a real, monitored address before this page is in force — particularly since §12 and §13 both depend on being able to reach us.

In the meantime: if you are a family member or a senior, ask whoever set the service up for you. If you are a care facility, use the contact in your facility agreement.

You have the right to complain to a data-protection supervisory authority in the country where you live, whatever we do.

If somebody is in danger, do not contact us — contact emergency services where you are.