Privacy Policy

Ennora is provided by two companies.

In this policy, “we” means whichever of the two is responsible for the information in question. Section 2 says which. “Home” means a care home in the United Kingdom or a senior living community in the United States.

For anything to do with this policy, or with personal data either company holds, write to our data protection officer, Colman Yau, at contact@ennora.ai.

Ennora Ltd is established in the United Kingdom, so the UK GDPR’s requirement for a representative in the United Kingdom does not apply to it.

Ennora makes software for care homes and senior living communities. A member of staff records or dictates a visit, the service turns what was said into text and fills the forms the home has chosen to use, and a person at the home checks and signs the result before it becomes a record.

Data protection law separates two roles. A controller decides why and how personal data is used. A processor uses it only on the controller’s instructions. In the United States the equivalent of a processor is a service provider, and where a home is covered by HIPAA, the federal health privacy law, a business associate. The role decides who is answerable to you, so we state ours plainly.

For everything a home holds in Ennora, the home decides and we act on its instructions, under a written contract. The home decides which residents are recorded, which forms are used, who may see what, and how long records are kept. We do not use the home’s information for our own purposes and we do not sell it. We use it to train AI models only if the home has agreed in writing, and then only once it has been anonymised.

The practical consequence runs through the rest of this policy. If you are a resident, a relative or an advocate asking about a resident, your request goes to the home, and we help the home answer it. If you visited this website, sent us an enquiry or work for us, your request comes to us and we answer it. Section 12 sets out both routes.

The first five kinds of information below are held for a home. The last is held for ourselves.

Most of what we hold for a home comes from the home itself. Its staff add residents, their family members and payers, and an administrator at the home creates each member of staff’s account. Family members and payers give us information directly only through the family portal. The rest comes by the routes below, and from Google when a member of staff signs in with it (section 3.3).

A lawful basis is the reason UK data protection law permits a particular use of personal data. Which basis applies depends on who is the controller, so the table names both.

Where we act for a home, the lawful basis is the home’s, not ours, and it would be misleading to claim one of our own. Our duty is to act only on the home’s instructions and to tell it if we think an instruction breaks the law. In the United States, a community decides how its residents’ information is used, and Ethero, Inc. uses it only as its contract allows, and where HIPAA applies, as its business associate agreement allows.

Language models draft; people decide. Some steps use a language model run by one of the providers in section 7. A form becomes a record only when a person signs it. A family update is finished and sent by a person. A suggested charge, or a suggested change to a form, takes effect only when a person accepts it.

No decisions by automated means alone. No decision that has a legal or similarly significant effect on anyone is made solely by automated means, including profiling. A person signs every record, accepts every charge and approves every care level.

What we do not do. We do not sell personal data. We do not disclose one home’s information to another. We do not compare one resident with another, and we do not analyse how staff speak. We do not create voiceprints, and we do not identify anyone from their voice.

Training AI models. We do not use a home’s information to train AI models unless the home has agreed to it in writing. If it has, we use only text that has first been anonymised, so that no resident, family member or member of staff can be identified from it. We never use recordings or photographs for this. A home can withdraw its agreement at any time; information already used cannot be taken back out of a trained model.

Whether you have to give us information. Nothing on this website requires you to give us personal data. To answer an enquiry we need your name, your email address and your message; your organisation and role are optional, and without the first three we cannot reply. Whether a resident, a family member or a member of a home’s staff must provide information is for the home to say, because the home decides what it records. A member of staff needs an account to use Ennora, and can choose whether to sign in with Google. If you work for us or apply to, we need the information in section 13 to employ and pay you, and some of it, such as pay, tax and right-to-work details, is required by law.

If you send us an enquiry, we will reply to it and may follow up on that conversation. We do not run a marketing mailing list.

We never market to residents or their families, and we never use anything from a home’s records to market to anyone. Residents’ information is not available to the people at Ennora who talk to prospective customers.

To stop hearing from us, reply to any message and say so, or write to the address in section 1. We will act on it without asking you to explain, and keep only the record needed to remember that you asked.

The United Kingdom and United States services run separately, each with its own database. A company that processes personal data for us is called a sub-processor. These are ours, and where each one processes a home’s information:

ElevenLabs receives the audio of a recording, and the resident’s name and the home’s chosen terms as recognition hints, which help it transcribe them correctly. OpenAI receives transcripts, the parts of a resident’s records a task needs, and staff questions to the assistant. Datadog receives ids, counts and durations from the service’s logs, never the content of a record.

We tell each home at least 30 days before a new sub-processor handles its information, and the home can object.

The sub-processors in section 7, and nobody else in the ordinary course of business. In particular:

• We do not sell personal data, and we do not share it for anyone else’s advertising.
• We do not give one home access to another home’s records.
• We do not pass residents’ information to our own sales or marketing people.

We may have to disclose information where the law requires it, for example under a court order. We answer only a valid, specific legal demand. Where it concerns a home’s records, we tell the home first unless the law forbids it.

If our business were sold or reorganised, personal data could pass to the buyer. Where we hold it for a home, the home’s contract continues to govern it, and the home would be told.

This website sets no cookies and stores nothing on your device. It shows no advertising, has no tracking pixels and loads no third-party scripts. Our typefaces are served from our own domain, so loading a page does not tell a font provider that you visited.

We count visits with Vercel Web Analytics, which is run by our hosting provider. For each page view it records the page, the site that referred you, your approximate location (country, region and city), and your browser, operating system and type of device. It does not use cookies. It tells one visit from another with a code made from your request, which is discarded within 24 hours, and what we see are totals rather than a record of any one person.

Our hosting provider also keeps ordinary server logs, including IP addresses, to serve the site and protect it from abuse.

Because nothing is stored on your device, there is no cookie banner. If we ever add a cookie or a script that needs your consent, we will ask for it first and update this section.

The care portal and the family portal are separate applications. They use cookies to keep you signed in, and remember settings, such as whether a panel is open, in your browser.

Rather than describe our security in adjectives, here is what is in place.

• Separation. Production runs in an AWS account of its own, in private networks with no public addresses. Data stays in the regions in section 7, enforced by account policy.
• Access. Accounts are created by an administrator at the home; nobody can sign themselves up. Every request is limited to the person’s own home, and the database enforces the same limit a second time. Roles and locations decide what each person sees. Every member of a home’s staff can read its residents’ health details and the forms colleagues have filled in, because they share the residents’ care. A recording itself, its transcript and its audio, is open only to the person who made it and to the home’s managers and administrators. Only the person who recorded a record may change or sign it.
• Our own staff. They reach production through named single sign-on accounts, with no long-lived keys, and their access is logged. They do not have routine access to a home’s records.
• Encryption. Encrypted connections throughout, and the databases refuse any connection that is not encrypted. Data is encrypted at rest. Sign-in details for a home’s own care system are encrypted again with a separate key.
• Audit. Administrative and clinical actions are written to an audit record that cannot be edited, and reads of records are logged separately.
• Monitoring. Account-wide audit trails, threat detection and network flow logs, with alarms on the production service.
• Minimisation. Logs hold ids and counts, never the content of a record. No voiceprints, no identification by voice, and no comparison between residents.
• Backups. Daily backups, and recovery to any moment in the last 7 days.

We hold no security certifications. We are not certified to ISO 27001 or SOC 2, and we hold neither Cyber Essentials nor the NHS Data Security and Protection Toolkit. We would rather say so than let a list of controls imply an audit that has not happened.

No system is beyond compromise. If a breach affects a home’s information, we tell the home without undue delay, and within 24 hours of becoming aware of it, so that the home can meet its own duties to regulators and to the people affected.

A home’s information is kept for as long as the home uses Ennora, unless the home deletes it sooner. When a home stops using Ennora, we return or delete its information as its contract sets out. Within that:

• The audio of a visit is deleted when the visit is abandoned. When the visit is stored, the audio is kept for 30 days to investigate faults and then deleted, unless the home’s contract says otherwise. If the home keeps recordings, they are kept for the period the home sets instead.
• The Ennora app’s copy of a recording on the device is deleted once the recording is stored or abandoned, and any copy left behind is deleted after eight days.
• The audio of a conversation between staff is kept for 30 days after it is saved, to investigate faults and so that the people allowed to can play it back, and then deleted. A conversation nobody saves is saved automatically 7 days after its app last reached Ennora, and one that holds no audio is deleted after 7 days.
• The working copy of a visit in progress, its live transcript and forms, is cleared when the visit is stored or abandoned, or after 7 days if it is left open. What is stored becomes part of the home’s records.
• Photographs and other attachments prepared for a family update but never sent are removed by a clean-up that runs every hour.
• The audit record is kept with the home’s records and cannot be edited.
• The service’s own logs are kept for 30 days.

Our own information. Website enquiries are kept for up to a year, then deleted. The code that tells website visits apart is discarded within 24 hours. Section 13 covers staff and applicants.

UK data protection law gives you rights over information about you: to be told how it is used, which is what this policy is for; to get a copy of it; to have it corrected; to have it erased in some circumstances; to restrict or object to how it is used; to have it moved to another provider; and not to be subject to a decision made solely by automated means that has a legal or similarly significant effect on you. Section 5 explains that no such decision is made. Who you ask depends on who is responsible.

If you are a resident, a family member, or an attorney or advocate acting for a resident: ask the home. The home is responsible for the information, holds the wider record of which ours is one part, and is the only party able to answer you properly. This includes what you see and send in the family portal. If you write to us by mistake we will not ignore it: we will tell you promptly, point you to the home, and tell the home so its clock starts. We then help the home answer, as our contract with it requires.

If you visited this website, sent us an enquiry, or work for us or applied to: write to the address in section 1. We will confirm we have your request, may ask for enough information to be sure who you are, and will reply within one month. If a request is complex we may extend that by up to two further months, and we will tell you why within the first month. Wherever you live, you can ask us for a copy of this information, ask us to correct it, or ask us to delete it, and we will do so unless the law requires us to keep it.

There is no charge. We can refuse a request that is manifestly unfounded or excessive, and if we do, we will explain why and how to challenge it. Where we rely on your consent, you can withdraw it at any time, without affecting anything done before.

Neither company has employees or job applicants today. If that changes, this section applies.

Each company is the controller for information about the people who work for it and those who apply to. We hold what we need to recruit, employ and pay people, give them access to our systems and remove it when they leave, and meet our duties as an employer: identity and contact details, role and contract, pay and tax details, work accounts and the record of what they did in our systems, and security training records. For applicants, we hold their application, their work history and experience, the results of our pre-employment checks, interview notes and our decision.

We use an applicant’s information to decide whether to offer them work: to assess their experience and suitability for the role, to carry out pre-employment background checks, and to confirm they have the right to work where the role is based. The lawful bases are: taking steps, at the applicant’s request, before entering into a contract with them (UK GDPR Article 6(1)(b)); our legitimate interest in recruiting people who are suitable for work that involves care homes’ information (Article 6(1)(f)); and, for right-to-work checks, our legal obligation (Article 6(1)(c)).

Background checks cover references and employment history and, where the role gives access to residents’ information and the law allows, a basic criminal record check. We ask for a criminal record check only at the offer stage, use the result only to decide that offer, and handle it under the conditions the Data Protection Act 2018 sets for criminal offence data.

Apart from the result of a criminal record check where a role needs one, we do not hold health or criminal record information about our staff. We share staff information only with the providers that run our systems, our professional advisers, and tax and other authorities where the law requires.

An application from someone we do not hire is kept for up to a year after our decision. Records about a member of staff are kept for a year after they leave, except where the law requires a record to be kept longer, as it does for pay, tax and right-to-work records.

We update this page when what we do changes. The date at the top shows when it last changed, and the changelog at the bottom records each material change with the date it took effect.

Where we act for a home, changes that affect it, including any change to the sub-processors in section 7, are notified to the home under its contract as well as published here. Publishing a change here does not replace telling the home.

Tell us first if you can, using the address in section 1. We would rather hear about a problem than have you take it elsewhere unheard.

If your complaint is about a resident’s records, the home is responsible for them and is the right place to raise it. The home has its own complaints procedure.

In the United Kingdom, you can complain to the Information Commissioner’s Office at any time, and you do not have to come to us first.

• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• ico.org.uk
• Helpline 0303 123 1113

In the United States, a complaint about how a community covered by HIPAA handles health information can also be made to the US Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr.