How should an AI companion for seniors protect your privacy?

An AI companion for seniors should encrypt your data, tell you clearly what happens to it, and follow privacy law so you can have your data corrected and deleted. With Elsy, your stored data is encrypted and hosted in the EU, but what you say is processed by AI services in the United States so Elsy can hear you and answer. We never sell your data.

With an AI companion, security comes first. Here are the safeguards that should protect your privacy, and what Elsy does.

Why security matters for AI companions

An AI companion handles personal and sensitive information, so security matters. It takes solid safeguards to keep out people who shouldn't have access and to protect your privacy. Data protection law plays a part too. If you live in the European Economic Area or the UK, the GDPR gives you rights over how your data is handled. One of them is the right to be informed. The UK's Information Commissioner's Office explains that you have the right to be told how your personal data is collected and used. International standards help as well. ISO/IEC 27001 gives companies guidance on setting up, running and continually improving a system for managing information security, according to ISO, the organization that publishes it.

The human side

Technical safeguards are only part of it. When you and the people who help you know a few simple rules, private information is less likely to end up in the wrong hands. Age UK, a British charity for older people, advises never giving passwords or your bank account number to public AI tools. We'd say the same about your Social Security number, your National Insurance number and any security codes. That goes for an AI companion too, and Elsy doesn't need any of them. You'll find more tips in Is it safe to use an AI assistant?

How AI companions protect your data

An AI companion like Elsy should store your data on secure servers and never sell personal information. With Elsy, your conversations are recorded and stored securely so Elsy can remember what you tell her, and your stored data is hosted in the EU, in Ireland. So that Elsy can hear you, answer and remember, what you say is processed by AI services in the United States. The app tells you which services before your first conversation. We never sell your personal data, and we don't use it to train general-purpose AI models.

Your family never sees transcripts or recordings of your conversations, apart from the life stories you send them, which contain your own words and may include short excerpts of your voice. What else they see depends on their level in Your circle, which is explained further down.

Encryption

Encryption is a basic part of security. Encrypted data can't be read without the right key. Elsy encrypts your data both when it's stored and when it's sent (HTTPS/TLS), and access controls limit who can see it. But encryption doesn't mean no one else can see your data. Elsy's technical team is bound by confidentiality and can see your conversations, recordings and the photos you've shown Elsy when they need to investigate problems and improve Elsy. Our privacy policy says so.

Privacy controls and sharing settings

Elsy's sharing settings decide how much your family can see. If you set Elsy up yourself, you choose a level for each person in Your circle, and you can change it or remove the person from your circle. If a family member set Elsy up and gave consent on your behalf, that family member looks after the circle, and everyone in it is at Full trust. See how Elsy and your family work together.

You can also withdraw your permission for the AI services in the app's settings, under Privacy & terms and AI and your data. Until you give permission again, you can't talk with Elsy. Withdrawing permission doesn't delete anything. To delete your data, you delete your account, as described further down.

Sharing levels

Elsy's sharing levels run from Stories only to Full trust:

• Stories only: the life stories you send, your name and your photo.
• Safety net: also an alert if a conversation suggests something might be wrong.
• Wellbeing: also how you're doing over time.
• Care partner: also your reminders and medicines, which they can help you with and set up.
• Full trust: also what Elsy remembers about you.

Everyone above Stories only can see the photos you choose to share from your Photo album. See more about what your family can see.

Laws and standards

AI companions have to follow data protection laws like the GDPR, and companies like Elsy have to make sure their systems meet those legal requirements. Standards can help here too. According to ISO, a company that meets ISO/IEC 27001 has put in place a system to manage the risks to the data it owns or handles. A related standard, ISO/IEC 27701, sets out requirements for a privacy information management system, which helps an organization manage the risks around personal information, according to ISO.

The GDPR and your rights

The GDPR sets the rules for data protection in the EU, and the UK has its own version, the UK GDPR. If you live in the European Economic Area or the UK, these rules apply to how Elsy handles your data. The ICO explains that you have the right to get a copy of the personal data held about you, to have inaccurate data corrected and, in certain circumstances, to have your data erased. Elsy's privacy policy adds that you can complain to your local data protection authority. In the US, the rules vary from state to state. In California, for example, the Consumer Privacy Act gives you the right to know what a business collects about you, to have it corrected and to have it deleted. Before your first conversation, Elsy tells you which AI services your information is sent to and what it's used for. You can read all of it in our privacy policy.

If you want your data deleted, you can delete your account under Account in the app's settings. The deletion happens within 30 days, and once it's done, your conversations, recordings, photos, life stories and everything Elsy remembers are gone for good. A story or photo you have already emailed to your family stays in their inbox. If a family member set Elsy up for you, that family member is the one who can delete the account. You can delete a single life story, or a picture in it, whenever you like.

Finding and fixing weak spots

Companies need to look for security risks regularly to find possible threats and improve their protection. According to ISO, ISO/IEC 27001 helps organizations become aware of risks and find and fix weaknesses ahead of time. It's also built around continually improving how they manage information security. No system is completely secure, and Elsy's privacy policy says so too. If we discover a data breach that is likely to cause you significant harm, we'll notify you and the authorities as the law requires.

Keeping safeguards up to date

Safeguards need regular review and improvement to keep up with new threats. You can help too. Keep the app updated so you have the latest fixes, and read what an app says about your data before you give it permission. Here are more tips on choosing an AI app you can trust.

How to get started

Download Elsy from the App Store or Google Play. Before your first conversation, the app tells you which AI services help Elsy and what they're told. The app won't start a conversation until you've given your permission, and then you can tap Talk to Elsy. You can try Elsy free for 3 days on your own phone. See how Elsy works step by step.

Frequently asked questions

What does Elsy do to keep my data safe?

Elsy encrypts your data when it's stored on servers in the EU and when it's sent. What you say is processed by AI services in the United States so Elsy can hear you, answer and remember. We never sell your personal data, and we don't use it to train general-purpose AI models. What your family can see depends on their level in Your circle, from the life stories you send up to what Elsy remembers about you at Full trust.

How do I change my family's sharing levels?

If you set Elsy up yourself, open the Profile tab and go to Your circle. There you can choose the level for each person, see a summary of your changes and invite more people. If a family member set Elsy up and gave consent on your behalf, that family member looks after the circle.

Are my conversations with Elsy encrypted?

Yes. Your data is encrypted when it's stored and when it's sent. Encryption makes it hard for outsiders to read, but it doesn't mean no one else can see it. Elsy's technical team is bound by confidentiality and can see your conversations when they need to fix problems and improve Elsy. And what you say is processed by AI services in the United States.

Does ISO 27001 cover AI systems?

ISO/IEC 27001 is an international standard for information security. According to ISO, it sets the requirements for an information security management system, a way of managing the risks to the data a company holds that covers people, policies and technology. The standard isn't made specifically for AI, but companies of any size and in any sector can use it, including companies that build AI systems.

This is general information, not medical advice. Every situation is different, so talk to a doctor about yours.