Privacy Policy

Who we are and what this covers

Ellis is an iPhone app for an adult who wants help with everyday things. They talk to it, and it can, for example, telephone their pharmacy about a refill. Someone who helps them sets it up. This policy covers the Ellis app and the website at www.askellis.care.

Ellis is run by Munzer Al Azzeh, an individual developer in the United States, who publishes the Ellis app on the App Store. No company has been formed yet, and when one is, it will be named here. On this page, “Ellis”, “we” and “us” mean the person who runs Ellis.

Two people use Ellis, and this policy covers both. The Caregiver is the adult who sets Ellis up and holds the account. The person they look after is the adult Ellis is set up for, who uses it on their own iPhone and does not create an account.

What we collect from the Caregiver

• Their sign-in. The Caregiver signs in with Apple, with Google, or with an email address and a password. From Apple or Google we receive the name and email address that service shares with us; with Sign in with Apple, that can be a relay address Apple creates instead of the real one. We never see an Apple or Google password, and an email password is stored only in a form that cannot be turned back into the password.
• Their details: name, phone number and email address, and how they know the person they look after.
• The requests they make. The Caregiver can ask Ellis for a refill from their own phone, on the other person’s behalf.
• A notification token for their phone, if they allow notifications.
• Their subscription: which plan they chose and whether it is active. Apple takes the payment, and we never see card details.

What we collect about the person they look after

The Caregiver enters these details during setup, and can see and change them in the app:

• Their first and last name, date of birth and phone number, and their home address if the Caregiver adds it.
• Their medicines: for each one, the name, strength, prescription number, date of the last fill, days’ supply or directions, and refills left.
• The pharmacy for each medicine (name, phone number and address) and the prescriber (name and phone number).
• Their doctor, and their appointments: who with, the date and time, and what each one is for, including an appointment Ellis books or moves for them.
• Their insurance card details: the plan, member number and group number.
• The people they call. Only the contacts the Caregiver picks from their own phone’s address book are saved. The rest of the address book never leaves the phone.
• The shops they use, if the Caregiver adds them.
• A photo of them for their profile, if the Caregiver adds one. It is made small on the phone before it is saved, and only the Caregiver can see it.

A photograph of a prescription label or an insurance card is read on the phone itself, by Apple’s Vision framework, to fill in the details on screen. The photograph is not uploaded and is not kept.

Ellis does not connect to a health system, a pharmacy account or an insurer, and does not pull records from any of them. Everything it holds was typed in, chosen from a search, read from a photograph on the phone, or is the profile photo the Caregiver chose.

When the link the Caregiver sends is tapped on the other person’s iPhone, that phone gets its own sign-in, with no name, email or password, which ties it to the household. If they allow notifications, we also keep a notification token for that phone. Ellis does not collect the phone’s location, and it does not read its address book.

Talking to Ellis, and the AI service behind it

The person they look after talks to Ellis by voice, in the app. The conversation is handled by ElevenLabs, a voice AI company that works for us. What they say is sent to ElevenLabs, together with the names and strengths of their medicines, the pharmacy for each, and their upcoming appointments, so that Ellis can understand them and answer. The Caregiver agrees to this policy while they are setting Ellis up, before the household is created. The microphone is asked for separately, by iOS, and Ellis listens only while somebody is holding a conversation with it.

ElevenLabs uses a large language model to work out what to say, which can be one run by another AI company that ElevenLabs works with. ElevenLabs keeps a record of each conversation, including the text of what was said, in Ellis’s account with them.

Ellis keeps a record of what was asked for and what it did about it, so that the Caregiver can follow along.

When they ask Ellis to ring someone they call, the phone’s own dialer places the call, and iOS asks them to confirm first. That is an ordinary phone call. It does not pass through Ellis or ElevenLabs.

The telephone calls Ellis makes

When a refill is asked for, by the person they look after or by the Caregiver, Ellis telephones the pharmacy for that medicine. If the pharmacy says a new prescription is needed, Ellis calls the prescriber’s office as well. Ellis calls only about a medicine the Caregiver has added: adding a medicine is the Caregiver’s permission for Ellis to call about it.

Ellis also books appointments. When the Caregiver asks, Ellis telephones a doctor’s office the Caregiver has saved, to book an appointment for the person they look after or to move one that is coming up. It books or moves only the appointment the Caregiver asked for, and asking is the Caregiver’s permission for that call. The appointment it books, with its date and time, is saved in the app.

The call is made by an AI voice agent run by ElevenLabs, on a telephone line from Twilio. It can give the pharmacy or office the person’s name, date of birth, address and phone number, the medicine and prescription details on file, and, on a call about an appointment, the appointment being asked for. Beyond who it is calling for and why, it gives one fact at a time, and only when it is asked for it.

No audio of these calls is recorded or kept. ElevenLabs writes a summary of each call, and Ellis keeps that summary for 90 days so that the Caregiver can read it, then deletes it. ElevenLabs also keeps a record of each call, including the text of what was said, in Ellis’s account with them.

Apart from booking or moving an appointment the Caregiver asked for, Ellis never books, cancels, orders or pays for anything on a call, and it never agrees to a payment.

Notifications

Ellis sends the Caregiver a notification when a call finishes with a result that matters, such as the refill being ready, an appointment being booked, the pharmacy needing the doctor, or nobody being reachable, and when the person they look after asks for something that needs the Caregiver. The person they look after can get a reminder the day before an appointment.

Notifications reach the phone through Expo and Apple, which receive the phone’s notification token and the words of the notification. Either person can turn notifications off in the iPhone’s Settings, under Notifications, then Ellis.

How we learn what is hard to use

The app sends reports about how it is used to PostHog, an analytics company that works for us, so that we can see where people get stuck and fix what goes wrong. A report says which screen was opened, which steps of setting Ellis up were finished, and whether a sign-in, a purchase, a sent link or a request worked, with the error’s code if it did not. It says how long a conversation with Ellis lasted and how many times each side spoke, and what went wrong when the app hit an error or closed unexpectedly. Each report carries the app’s version, the iPhone’s model, iOS version, language and time zone, and a random identifier for the account, with whether the account is the Caregiver’s or belongs to the person they look after.

The app also records what its screens look like while it is being used. Every word and every picture is covered over on the phone before anything is sent, so a recording shows the layout of each screen and where it was tapped, and nothing that was written on it.

No report or recording contains anything typed, a name, an address, a phone number, a medicine, an appointment, or anything said to Ellis. PostHog is set not to keep the phone’s internet address, and not to work out where the phone is.

What this website collects

If you ask to be told when Ellis launches, we collect the email address or US phone number you give, which of the two you chose, and which part of the site you signed up from. Our server passes it to Formspree, which stores it for us. We use it only to tell you when Ellis is available, and we do not add it to any other list.

Vercel, which hosts this website, records the ordinary details of each request, such as the internet address, the page asked for and the kind of browser, for a short time, for security and to keep the site running. We do not use those records to identify anyone.

The website sets no cookies of its own. It counts visits with PostHog, in a way that stores nothing in your browser: which pages are viewed, the page or site you came from, the kind of browser and device, errors on a page, and whether the launch sign-up was opened and sent, but never what was typed into it. PostHog tells one visit from another with a code its servers work out from your internet address and browser, which changes every day, and it does not keep the address.

After a sign-up, the site stores one small flag in your browser so that the form does not keep asking you. The flag records which method you chose, not your address or number. Our Cookie Policy explains both.

How we use it

We use the information above to do what Ellis is asked to do: to answer, to call a pharmacy or a prescriber’s office about a refill or a doctor’s office about an appointment, to send reminders and notifications, and to show the household what happened. We use email addresses to send sign-in codes and account messages. We also use the information to keep accounts secure and to fix problems.

We do not use it to advertise to anyone. The app has no advertising, and it does not track anyone across other companies’ apps or websites. The usage reports described above are used only to make Ellis easier to use and to fix problems. We do not sell personal information, and we do not share it for marketing.

Who receives it

These service providers work for us, on our instructions, and receive only what they need for their part:

• Supabase runs our database and sign-in. It stores the account and household details described above, in the United States.
• Vercel runs Ellis’s server, which the app talks to and which passes the details of a call to ElevenLabs. Vercel also hosts this website.
• ElevenLabs handles the voice conversations in the app, places the calls to pharmacies, prescribers’ offices and doctors’ offices, and writes the call summaries. It receives what is said to Ellis, the medicine list and upcoming appointments, and, for each call, the details described under “The telephone calls Ellis makes”.
• Twilio provides the telephone line for those calls, through ElevenLabs. It carries each call as it happens, including the number called.
• RevenueCat processes subscription status for us. It receives an anonymous identifier linked to the Ellis account and the App Store purchase receipt, not names or health details.
• PostHog receives the app’s usage reports, error reports and covered-over screen recordings, and counts visits to this website, as described above. It holds them in the United States.
• Apple provides Sign in with Apple, takes App Store payments, and delivers notifications.
• Google provides Sign in with Google, for people who choose it.
• Expo passes notifications to Apple for delivery.
• Resend sends sign-in and account email, such as a code to reset a password.
• Formspree stores the launch sign-ups from this website.
• Apple Maps suggests the home address as the Caregiver types it. What is typed goes to Apple through Ellis’s server, with the general area the phone’s internet connection is in, so that nearby streets come first. Apple does not receive the phone’s internet address, and Ellis’s server keeps neither the search nor the area.
• Public lookup services receive what the Caregiver types into a search box when choosing a medicine, a pharmacy, a doctor or a shop: the U.S. National Library of Medicine’s RxNav service, the CMS NPI Registry, and OpenStreetMap search services (Nominatim, and Photon, run by komoot). The search goes straight from the phone, so the service also sees the phone’s internet address, as any website does. Nothing else is sent to them.

The pharmacy or office Ellis calls hears the details it needs to find the prescription, as described above. That is the point of the call.

Inside the household, the Caregiver sees the details they entered, each request and what happened with it, and the call summaries.

We will disclose information if a valid legal process requires it, or if it is necessary to protect someone’s safety.

Health information

Much of what Ellis holds is about health: medicines, prescriptions, prescribers, appointments and insurance numbers. We treat all of it as sensitive, whether or not a particular law requires it. Ellis is not a health plan, a healthcare provider or a healthcare clearinghouse, and it does not file insurance claims or say what a plan covers.

The Caregiver enters these details for someone else. Before setting Ellis up, the Caregiver confirms in the app that they are 18 or over and that the person they look after knows about it.

How long we keep it

• Call summaries: 90 days, then deleted.
• Usage and error reports in PostHog: up to one year. Screen recordings: 30 days.
• Everything else in an account and its household: until the account is deleted.
• Website launch sign-ups: until the launch notice has been sent, then deleted. You can ask us to remove yours sooner.
• Ordinary server records, such as an internet address and the page asked for: a short time, for security and to keep the service running.

When an account is deleted, what our database holds for it is removed straight away. Copies in our database provider’s backups are removed on that provider’s backup schedule.

Deleting an Ellis account does not remove the usage reports already sent to PostHog. They carry only the account’s random identifier, and they are removed when their time is up, or sooner if you ask us.

ElevenLabs keeps its record of conversations and calls under the retention settings of Ellis’s account with them, and deleting an Ellis account does not remove it. Our other providers keep their own logs of the work they do for us, such as a call carried or an email sent, for as long as their own policies set. When someone asks us to delete their information, we also ask our providers to delete what they hold for us about them.

How it is protected

Information is encrypted in transit, over TLS, between the app, this website, our server and our providers, and it is encrypted at rest on our servers. Details saved on the phone before an account exists are encrypted with a key kept in the iOS Keychain. Access to stored data is limited to the people and services that need it to run Ellis.

Ellis is not end-to-end encrypted: our server and ElevenLabs can read the details they handle, because they need them to answer and to make the calls. No system is perfectly secure, and if something goes wrong that affects your information, we will tell you.

Your choices

• See and change: the Caregiver can see and change the details they entered, in the app.
• Delete: the Caregiver and the person they look after can each delete from Settings in the app. Delete your account has the steps and says exactly what is removed.
• Take Ellis off the other phone: the Caregiver can remove Ellis from the phone of the person they look after at any time, in Settings. It stops working there straight away.
• Notifications: either person can turn them off in the iPhone’s Settings.
• Ask us: you can ask to see, correct or delete what we hold about you by writing to hello@askellis.care from the email address on the account. If you are the person being looked after, you can ask too, even though you did not enter the details; we will confirm who you are first.

Your rights in California and other states

If you live in California, the California Consumer Privacy Act gives you the right to know what personal information we collect and how it is used and shared, the right to have it deleted, the right to have it corrected, and the right not to be treated differently for using those rights. We use sensitive information, such as health details, only to provide Ellis. We do not sell personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front.

Other states give similar rights, and we answer the same requests from anyone in the United States. If you would like someone to make a request for you, they will need your written permission, and we may check with you directly. We will answer a request within the time the law allows, and we will not charge for it unless a request is plainly excessive.

Where Ellis is offered

Ellis is offered in the United States, and our database is in the United States. Some of the providers listed above may process information in other countries as part of their service.

Children

Ellis is for adults. The Caregiver must be 18 or over, Ellis is set up only for an adult, and you must be 18 or over to sign up on this website. We do not knowingly collect information about anyone younger, and if we learn that we have, we will delete it.

Changes to this policy

We update this page whenever what we collect or how we use it changes. The date at the top is the date of the last change. If a change affects information you have already given us, such as a new use of it, we will tell you by email or in the app before it takes effect.

How to contact us

Email hello@askellis.care. Questions, requests and complaints all go there, including requests to see, correct or delete information. Contact is by email.