Your Privacy Matters
Grace Suite, including Grace Companion, Grace Notes and Grace Care Facilities, is committed to protecting the privacy and security of our users, particularly vulnerable individuals, their families and professional carers. This Privacy Policy explains how we collect, use, store and protect your personal information in accordance with UK GDPR and the Data Protection Act 2018.
Grace is designed for global use. Where local laws give you additional rights or require extra notices, we apply region-aware safeguards and provide country or region-specific guidance where needed.
Unless stated otherwise, references to "we", "us" or "our" in this Policy refer to the operators of the Grace Suite products listed above.
For example, Grace Companion focuses on conversations, reminders and family messaging; Grace Notes supports professional care records and visit notes; and Grace Care Facilities supports resident records, care plans and staff activity within registered organisations.
Care & Safeguarding Framework
Grace is built around a social work-informed approach: support independence first, escalate only when needed, and keep sensitive features visible, proportionate, and connected to a clear care or safety purpose.
This framework guides how Grace handles GPS, child safety, vulnerable adults, AI conversation, family access, reminders, wellbeing check-ins, and emergency escalation. Read the Grace Care & Safeguarding Framework.
1. Information We Collect
Personal Information:
- Name, email address, and contact details
- Relationship information (for next of kin)
- Time zone and location preferences
- Date of birth and emergency contact information
Voice Data:
- Voice recordings for personalised reminders (optional)
- Voice-to-text transcriptions of conversations
- Voice samples stored securely for cloning purposes
Usage Information:
- Conversation history with AI companion
- Grace Check-In summaries created from existing reminders, messages, wellness prompts, photos, visitor updates, safety settings and account activity
- Reminder preferences and responses
- Language preferences and optional approved translated reminder wording
- Help request history and emergency contacts made
- Device information and usage patterns
Safety Location & GPS Data:
- Approximate or precise device location when location sharing is enabled
- Latitude, longitude, accuracy, timestamp, and map links for safety sessions
- Emergency location events, safe places, and Family Safety Map activity
- Optional visitor or professional GPS check-ins where the user chooses to share them
2. How We Use Your Information
We use your information solely to:
- Provide personalised reminders and companionship
- Generate voice-based reminders in familiar voices
- Translate reminder wording and generate speech in the selected Grace language where supported
- Notify designated family members of help requests
- Share safety location updates with authorised family, guardians, or care professionals when enabled
- Provide Grace Check-In summaries that surface relevant reminders, messages, wellbeing prompts, visitor updates and safety context to the person and authorised family
- Improve conversation quality and response accuracy
- Ensure safety and wellbeing of users
- Comply with legal obligations
We never sell your data to third parties. Ever.
3. Data Security
We implement industry-standard security measures:
- End-to-end encryption for all voice data
- Secure cloud storage with regular backups
- Access controls and authentication requirements
- Regular security audits and updates
- Data minimisation principles
Note: Voice recordings are encrypted and stored separately from personal information. Only authorised personnel can access this data for service improvement.
4. Family Access & Consent
When a next of kin, parent, or guardian registers on behalf of another person, they affirm they have consent, parental responsibility, or legal authority to do so. Family members with granted access can:
- View reminder history and conversation summaries
- Receive notifications when help is requested
- Modify reminder schedules and preferences
- Access emergency contact information
- View Grace Check-In summaries that bring together existing account activity for the linked profile
- View safety location updates and Family Safety Map activity where location sharing is enabled
The person using Grace, their parent, or their legal guardian can revoke family access at any time through settings where appropriate.
5. Safety Location & GPS Data
Grace Companion uses location only for safety, emergency, family reassurance, visitor check-in, and professional audit features. Location sharing is controlled through Safety Location settings, the Family Safety Map, device permissions, and the specific feature being used.
- Location is not used for advertising or sold to third parties.
- Timed sharing sessions are designed to end automatically so GPS sharing is not left on by mistake.
- NOKs and guardians must have consent, legal authority, or a genuine best-interests safety reason before enabling or viewing location sharing for another person.
- Children and vulnerable adults require extra care, a clear explanation, and a lawful basis before any location safety plan is enabled.
For the full explanation of how GPS works in the web app and PWA, including iPhone and Android limits, see our Safety Location & GPS Policy.
6. Data Retention
We operate a three-tiered retention system to balance your privacy with legal safeguarding obligations:
Tier 1: Essential Safeguarding Data (7 years)
- Conversations flagged as concerning (risk of harm, confusion, distress)
- Legal basis: Legal obligation, Vital interests
- Cannot be deleted on request if legal obligation applies
- Access: You, authorized family members, safeguarding authorities
Tier 2: Family Monitoring Data (12-24 months, configurable)
- Normal daily wellbeing conversations
- Legal basis: Legitimate interests, Consent
- Default: 12 months active, then 12 months archived, then deleted
- You can choose: 12 or 24 month retention in settings
- Can be deleted on request with 30-day grace period
- 60-day notice before permanent deletion
Tier 3: Service Improvement Data (Indefinite, anonymised)
- Anonymised conversation patterns for AI improvement
- Legal basis: Explicit consent (optional, opt-in only)
- All personal information removed (irreversible anonymisation)
- Cannot be linked back to you (GDPR Recital 26 compliant)
- Consent expires annually and must be renewed
Other Data Retention:
- Voice recordings: Retained until account deletion or revoked consent
- Personal information: Retained while account is active, deleted within 30 days of account closure
- Reminder history: Stored for 6 months
- Safety location data: Retained only as needed for safety, audit, family reassurance, and legal or safeguarding responsibilities
- Access logs: Maintained for 3 years for security and accountability
Manage Your Data: Visit your Data Management Dashboard to view all stored conversations, adjust retention periods, and exercise your data rights.
7. Your Rights
Under UK GDPR, you have the right to:
- Access: Request a copy of all your data
- Rectification: Correct inaccurate information
- Erasure: Request deletion of your data
- Portability: Receive your data in a portable format
- Restriction: Limit how we process your data
- Objection: Object to certain data processing
- Withdrawal: Withdraw consent at any time
To exercise any of these rights:
- Visit your Data Management Dashboard for immediate access and deletion requests
- Email us at privacy@gracecompanion.co.uk
We will respond to all requests within 30 days as required by GDPR Article 12.
8. Account Deletion & Right to Erasure
You may delete your account or request data erasure at any time via your Data Management Dashboard.
Upon account deletion:
- All personal information is permanently deleted within 30 days
- Voice recordings are securely erased with cryptographic overwriting
- Non-safeguarding conversations are immediately deleted
- Family members are notified of account closure
Important: Safeguarding Data Retention
Conversations flagged for safeguarding purposes (indicating risk of harm, abuse, or urgent need) must be retained for 7 years under UK Adult Safeguarding legislation. This is a legal obligation under GDPR Article 6(1)(c) and cannot be overridden by a deletion request.
You will be notified of any data retained for legal reasons, including the specific legal basis and retention period. You may request a review of safeguarding flagging decisions.
Anonymised, aggregated data (with all personal identifiers removed) may be retained for service improvement purposes. This data cannot be linked back to you and is not considered personal data under GDPR Recital 26.
9. Third-Party Services
We use the following third-party services:
- OpenAI: Conversation processing, Grace Voice text-to-speech, and reminder translation where enabled
- ElevenLabs: Family voice cloning, multilingual reminder text-to-speech, and reminder call audio (data processing agreement in place)
- Supabase: Secure database and authentication
All third-party processors comply with UK GDPR and have appropriate data protection agreements.
10. Hosting and Data Residency
All primary user data is stored within the European Union (Ireland) using Supabase’s EU region. Our application services are hosted by Vercel within the EU. We maintain full data residency within the EU/EEA.
We do not transfer or store personal data outside the EU/EEA except as strictly necessary for AI processing via OpenAI’s API. Such transfers are covered by Standard Contractual Clauses and technical supplementary measures as documented in our Data Protection Impact Assessment.
Our sub-processor register includes Supabase (EU), Vercel (EU), and OpenAI (US with SCCs). We will notify users of any new sub-processors or changes to data locations at least 30 days in advance.
Global users can record their country, compliance region, preferred legal notice language, and preferred data region in settings. These preferences help Grace apply more suitable notices and feature safeguards, but they do not by themselves move existing data between hosting regions.
See our Global Compliance & Safety Readiness page for the wider framework covering GPS, children, vulnerable adults, AI, consent, and data transfer safeguards.
11. Children's Privacy
Grace Companion is designed for adults aged 18 and over. We do not knowingly collect information from children under 18.
If a family safety profile is used for a child, location sharing must be enabled only by a parent or legal guardian, with clear age-appropriate explanation, visible controls, and a genuine safety purpose. Location sharing for children must never be hidden, left running unnecessarily, or used for unrelated monitoring.
12. Changes to This Policy
We may update this Privacy Policy periodically. Significant changes will be communicated via email and in-app notifications. Continued use after changes constitutes acceptance.
13. Contact & Complaints
For privacy-related questions or concerns:
Data Protection Officer
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
ico.org.uk | Helpline: 0303 123 1113