Privacy Policy

Data protection law asks us to name the reason we are allowed to hold each thing. Ours are:

• •Your account, your contacts, your Call for Help settings and your daily check-in — we hold these to give you the service you bought. That is Article 6(1)(b) of the UK GDPR: we need this information to do what we agreed to do.
• •Your payment records — we keep these because tax and accounting law tells us to. That is Article 6(1)(c).
• •Your Medical ID — health information gets its own, stricter rule. It has a section of its own below.
• •Details of people who are not our customers — the contacts you add, the person you nominate for your check-in, and anyone who helps with your phone. We hold those because there is no way to run a phone for you without them, and because the people involved would expect it. That is Article 6(1)(f), our legitimate interests, and we have weighed those interests against the privacy of the people concerned.

If you use the daily check-in, we watch for one thing: whether the phone has been opened by the time you chose. If it has, nothing happens and nobody is told anything.

If it has not, we send an email. On the Family plan it goes to everybody who currently helps with the phone and to the check-in address you nominated, all at the same moment. The email names the person the phone is for and says plainly that there has been no sign of them on it today — and it says that everybody else got the same email, because the thing that goes wrong on a morning like that is four relatives each assuming one of the others has already rung.

Each person gets their own private link saying “I’m on it”. Pressing it does two things: it stops us emailing everybody else, and it tells the others who has picked it up. Back in the Family portal, the household can see who was emailed, what time each email went, who answered and when. We keep that record. It is how a family can tell the difference between somebody dealing with it and everybody assuming somebody else is.

If nobody answers, we ask twice more — after half an hour, and after two hours — and then we stop. Three emails is the most we will ever send about one morning.

On the Standard plan the check-in sends a single email to the address you nominated. There is no button, no reminders, and no record kept beyond the date.

We use a small number of companies to run the service. They may only handle your information on our instructions:

• •Stripe — takes payments made on the website. Stripe handles your card details directly; we never receive them.
• •Apple and Google — take payments made inside the app, if you buy that way. They tell us that a purchase happened and what it was for. They do not pass us your card details, and we cannot see them.
• •Resend — sends our emails: confirmations, password resets, check-in alerts and the emails about buying Ezefone for somebody else. They see the address the email goes to and what it says.
• •Zoho — runs our own info@ezefone.co.uk mailbox. If you write to us, Zoho holds that message the way any email provider does.
• •Laravel, through its Forge service — provides and runs the servers your information is stored on, in New York in the United States.

If you are on the Family plan, the helpers can see and change your contacts and your Medical ID, including the health information in it. You can remove anybody at any time from your phone, or ask us to by emailing info@ezefone.co.uk.

Letting one helper choose who helps. The first time you use the Family plan, you are asked once, on your own phone, whether one helper — usually the person who set Ezefone up for you — may choose who else helps. If you say yes, that person can add, change and remove helpers without you being asked each time, and nobody else who helps can add anybody. You see a short note on your phone whenever somebody is added, changed or removed, and everybody who helps is emailed too. It is a decision only you can make, from your own phone, and you can take it back at any time. If you say no, you are asked on your phone before anybody new is added.

When somebody stops being a helper, we send them one short email to say so. It does not say who removed them.

Our servers are in the United States, and some of the companies we use (Laravel, Resend and Stripe) are based there. That means your information, including your Medical ID if you have one, is held outside the UK.

UK law allows this where proper safeguards are in place, such as the UK’s data agreements with the United States or the standard contract terms these companies offer, and we only use companies that provide them.

Once in a while we might send a short email about what has changed in Ezefone — and only if you asked for it.

The box is never ticked for you. If you leave it alone, you hear nothing but the emails the service itself has to send you: your password reset, your check-in alerts, that sort of thing.

We would send no more than one a month. Our lawful basis is your consent, under Article 6(1)(a).

You can stop it whenever you like, and you do not have to explain: there is a switch in Settings on the phone, a link at the bottom of every newsletter we send, and you can email us at info@ezefone.co.uk. Any of the three is enough.

All we keep about it is the date you agreed and the date you stopped. We keep those as our evidence that we had your permission while we were using it — nothing else about the newsletter is recorded, and we do not track whether you opened one.

We have not sent one yet. Nobody has had a newsletter from us, and if you ticked the box some time ago and have heard nothing, that is why.

When you create an account or buy Ezefone for someone, we ask how you heard about us. It’s optional — you can skip it entirely, and nothing changes.

We ask because we’re a very small company with a very small budget, and knowing whether people find us through the radio, a community group or a friend is how we decide where to spend it. You choose from a fixed list of answers; there is no box to type in, so the only thing we hold is which answer you picked.

We only ever look at these answers added together as counts. They are never used to make any decision about you, never used for advertising, and never shared with anyone — including the companies named in the list.

Our lawful basis is our legitimate interest in understanding how people find us. We keep your answer alongside your account, and it is deleted when your account is deleted.

Some of the people in our records never came to us. Somebody gave us their details so that a phone would work for the person using it. This part is for them.

If you are in somebody’s contacts. We hold your name, your phone number, and — where they were filled in — your email address, a label such as “Daughter” or “Doctor”, and a photo. We got all of it from the Ezefone customer whose phone you are on. It is there so that your name and face come up when they ring you.

If you are the person we email about a daily check-in. We hold your email address, and we record that an email was sent to you and whether you answered it. The customer gave us your address themselves, by naming you as the person to tell if their phone goes unopened.

If you help with somebody’s phone. We hold your name, your email address and a scrambled version of your password, which household you help with, when you were invited and when you accepted, and a record of the changes you make — so the account holder can always see who did what.

If somebody bought Ezefone for you. We hold your name and email address because the person who bought it gave them to us, so that we could set up your account. What they can see after that depends on which plan they bought. On Standard, they cannot see inside your account at all. On Family, the person who paid is made your first family helper automatically — which means they can see and change your contacts and your Medical ID, including the health information in it. If you would rather they could not, email info@ezefone.co.uk and we will remove them as a helper. You keep the plan either way.

In every one of these cases you can ask us to take your details out. Email info@ezefone.co.uk and we will remove them. You do not need an Ezefone account to ask, and you do not have to give a reason.

• •Everything sent between your phone and our servers is encrypted in transit
• •Passwords are stored scrambled, never in readable form
• •When we no longer need it, we delete it or make it anonymous

How long we keep it

• •Your account details, your contacts, your Medical ID and your check-in records: for as long as your account is open. They are deleted when the account is deleted.
• •A record of which plan you have been on and when it changed: kept with your account, and deleted with it.
• •A record of any plan change we made by hand, and who made it: kept for one year.
• •Technical error logs: kept for 14 days, and written so they contain as little about you as we can manage.
• •Payment records held by Stripe, Apple and Google: kept by them for as long as the law requires them to.

Deleting your account

Email us at info@ezefone.co.uk and we will remove your account and everything linked to it. Where somebody else bought Ezefone for you, we keep the record of that purchase itself — what it was, when it was paid for and whether it was refunded — with your name and details taken out of it, because it is also their record and ours for accounting.