elate | Privacy Policy

1. Who we are

Elate is made and run by Cross Digital Ltd, a company registered in England and Wales (company number 10157215). Our registered office is 1 Highcroft Court, Exeter, EX4 4RW. We are registered with the Information Commissioner's Office (ICO) under number ZA241061.

This policy covers:

the Elate web app at portal.elateuk.com or app.elateuk.com;
the Elate mobile app for care and support workers;
our website at elateuk.com.

You can contact us about anything in this policy at info@elateuk.com.

2. Our role, and your care provider's

Care and support providers ("your organisation") use Elate to plan, deliver and record care. That changes who is responsible for what:

Your organisation is the controller of the information it keeps in Elate: its records about the people it supports, and its records about its staff. It decides what is recorded and why. We process that information on its behalf, as its processor, under our agreement with it.
We are the controller of your Elate account (your sign-in and account details), the security and technical logs we keep to run Elate safely, the service emails we send you, and information about visitors and contacts on our website.

If you are a care worker, or you receive care, questions about the records your organisation keeps, including requests to see, correct or delete them, should usually go to your organisation first. We will help them answer you.

3. The information we handle

Your account

Your name, email address, profile photo, role and organisation. Your password is held by our sign-in provider, Clerk; we never see it. If you sign in with Google, Google tells us your name and email address.

Information your organisation records (as its processor)

About staff: contact details, address, emergency contact, date of birth, gender, employment details, DBS number and expiry, training records, referees and notes.
About the people it supports: name, date of birth, NHS and other reference numbers, contact details, next of kin, GP and pharmacy, and health and care information such as allergies, medicines and medication records, risk information, care plans, assessments, care notes, incidents and safeguarding concerns, documents, photos and treatment escalation plans.

Health information is special category data, and your organisation handles it under the rules for health and social care.

Visits

When you check in and out of a visit, we record the time and, only if you allow it, your location at that moment: one reading at check-in and one at check-out, with its accuracy and the device used. The app never tracks your location in the background, and your visit is recorded whether or not you allow location. We also record the tasks, notes, expenses and receipt photos you add.

Voice dictation

If your organisation has switched dictation on and you choose to dictate, we record your voice to turn it into text. See section 6 for how that works and section 9 for how long recordings are kept.

Messages

Chat messages are end-to-end encrypted on your device, so we cannot read them. To deliver them we do see who is in each conversation, when messages are sent and how large they are, group names, and which devices are registered for chat.

Your devices

A notification token for each device, a random device identifier, the operating system and app version, whether the phone supports strong encryption, how quickly the app starts, when it is opened, and reports of app errors. We use these to deliver notifications, to support the app and to find and fix problems.

Records we keep to run Elate safely

An audit record of sensitive actions (who did what, and when), records of emails we send (recipient, subject and whether it was delivered), and records of AI feature use (which feature, which model, and what it suggested).

We do not use advertising identifiers, show adverts, or sell personal information.

4. Why we use it, and our lawful basis

What we do	Lawful basis
Provide Elate to your organisation and process its records	On your organisation's instructions, under its own lawful basis (for care records, UK GDPR Article 9(2)(h), health or social care)
Run your account and keep Elate secure	Contract with your organisation (Article 6(1)(b)) and our legitimate interest in a secure service (Article 6(1)(f))
Send notifications about your work (in the app, by email and to your phone)	On your organisation's instructions; you can change what reaches you in your notification settings
Send service emails, such as invitations and account deletion updates	Legitimate interests (Article 6(1)(f))
Support you, fix problems and improve Elate	Legitimate interests (Article 6(1)(f))
Meet legal obligations and deal with disputes	Legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f))
Tell organisations about Elate	Legitimate interests, with a way to opt out at any time; never people receiving care

We do not rely on consent to handle staff records or care records.

5. Your organisation and your colleagues

People in your organisation see what their role allows. Managers and office staff can see the records they are responsible for; carers see the people and visits they are assigned. Your organisation controls these permissions.

6. AI features

Where your organisation has switched them on, some Elate features use artificial intelligence: turning dictated speech into text, tidying up text you have written, drafting summaries of documents, helping to fill in assessments, and answering questions in the Eli assistant.

These features are provided by OpenAI, which processes the information in the EU and United States.
Requests are sent with storage switched off. Under our agreement, OpenAI does not keep the information and does not use it to train its models.
When you dictate in the web app, the audio goes directly from your browser to OpenAI, so OpenAI also receives your device's IP address.
A person always checks what the AI produces before it is saved. Elate does not use AI to make decisions about anyone that have legal or similarly significant effects.

7. Who we share information with

We use trusted service providers to run Elate. They act only on our instructions and must keep the information secure.

Provider	What they do	Where
Supabase	Database and file storage	London, UK
Vercel	Hosts Elate and runs its servers; cookieless page analytics	Servers in London, UK. Vercel is a US company, and its global network, page analytics and service logs may be processed in the United States
Clerk	Sign-in and account security	United States
Cloudflare	Bot protection on the sign-in page	Global
Resend	Sends email	Ireland, EU
OpenAI	AI features (section 6)	United States
Expo	Delivers phone notifications and app updates; measures how quickly the app starts, counts app launches and receives error reports (EAS Observe and EAS Insights)	United States
Google	Android notifications (Firebase Cloud Messaging); address search and travel times (Google Maps Platform)	United States and global
Apple	iPhone notifications	United States

Notifications sent to your phone never contain care details: they say only that something has changed, and you open Elate to see it.

We may also share information:

when the law requires it, or to protect someone's safety, including safeguarding;
with a buyer or successor if our business is sold or merged, in which case we will tell you;
with your agreement.

8. Information that leaves the UK

Most information is stored in the UK. Some of our providers process it in the United States or elsewhere, as listed in section 7. When that happens we rely on UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework, where the provider is certified) or the ICO's International Data Transfer Agreement or Addendum, with a transfer risk assessment. [Confirm which applies to each provider before publishing.] You can ask us for details.

9. How long we keep information

Information	How long
Care and staff records	As long as your organisation needs them and the law requires. Your organisation sets this. When our agreement with it ends, we return or delete them as agreed.
Dictation recordings	Recordings never attached to a note: deleted within 24 hours. Recordings attached to a note: deleted after 30 days by default, or the period your organisation sets (1 to 365 days).
In-app notifications	Dismissed: 90 days. Read: 180 days.
Notification delivery receipts	7 days
System job logs	90 days
Information cached on your phone	2 to 30 days depending on the kind, encrypted, and wiped when a different account signs in
Audit and security records	As long as needed for security and accountability, and in line with your organisation's retention
A closed or deleted account	See section 10

‍

10. Closing and deleting your Elate account

You can ask for your account to be deleted at any time:

in the Elate app: open your profile, then Delete account;
on the web: portal.elateuk.com/account-deletion;
by email: write to info@elateuk.com from the email address on your Elate account.

What happens:

Your organisation's owner or an administrator reviews your request. If nobody does within 21 days, we complete it.
Once it is approved you can no longer sign in. For 30 days your organisation can restore your account if it was a mistake.
After 30 days your account is deleted.

What is deleted: your sign-in, the email address and profile photo on your Elate account, your settings, notification preferences and calendar links, and the phones registered for your notifications and your chat key backup.

What is kept, and why:

The care records you made while working, such as visit check-ins, care notes, tasks, medication records and reports of concern. Care providers must keep these by law, so your name stays on them as the person who wrote them.
Your employer's own records about you, such as your contact details and training. Ask your employer if you want those changed.
Chat messages you sent, which stay with the people you sent them to.
A record that you asked for deletion and when it was done, so we can show we acted on it.

If your account was never linked to an organisation, there is nothing to keep, and it is deleted straight away.

Your organisation may also close your account, for example when you leave. Your records are kept, and your organisation can restore your access.

11. Keeping information secure

Information is encrypted when it travels between your device and Elate, and our hosting providers encrypt it where it is stored.
Each organisation's information is kept separate, and every request is checked against the person's organisation and role.
On your phone, information Elate keeps is encrypted with a key held in the phone's secure hardware (Keychain on iPhone, Keystore on Android), which is never backed up. You can also lock the app with your fingerprint, face or screen lock.
Chat messages are end-to-end encrypted.
Files are shared through links that expire within an hour.

12. Your rights

Under UK data protection law you have the right to:

see the personal information held about you;
have it corrected if it is wrong;
have it deleted, where the law allows;
restrict or object to how it is used;
receive it in a format you can take elsewhere;
withdraw consent, where we rely on consent;
not be subject to decisions made only by automated means that significantly affect you.

For records your organisation controls, such as care or staff records, contact your organisation first; we will support it. For your Elate account, or anything we control, contact us at info@elateuk.com. We will reply within one month, or tell you if the law allows us longer.

13. Complaints

If you are unhappy with how we have handled your information, please tell us first at info@elateuk.com. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Children

Elate is for adults who work in care. It is not intended for anyone under 18 to use. A care provider may record information about children it supports; the provider controls that information.

15. Cookies and similar technologies

The Elate web app uses:

sign-in cookies from Clerk, to keep you signed in securely;
a preference cookie that remembers whether the side menu is open;
local storage in your browser for your theme and sign-in state;
secure browser storage (IndexedDB) for your chat encryption keys and messages.

We do not use advertising or tracking cookies. Our website's use of cookies is explained at elateuk.com/legal/cookies.

16. Changes to this policy

We will update this policy when the way we handle information changes. If a change is significant, we will tell you by email or in Elate before it takes effect. The date at the top shows when it last changed.

17. Contact us

Cross Digital Ltd, 1 Highcroft Court, Exeter, EX4 4RW, info@elateuk.com

Privacy Policy