Our commitment
to
your privacy

Information you provide directly

• Account information — name, preferred name, email, phone number, and login credentials.
• Caregiver information — mailing address, relationship to the Elder, and notification preferences.
• Elder profile information — name, date of birth, language, hearing status, timezone, preferred topics, and AI companion voice preferences.
• Payment information — on iPhone, subscriptions are purchased through Apple In-App Purchase and billed by Apple; on our website they are processed by Stripe. We store a customer or transaction identifier and subscription status, never card numbers.
• Feedback and communications you send when contacting support.

Information generated through the Service

• Conversation transcripts of calls and in-app chat, produced by our speech-to-text and AI providers (see Third-Party Service Providers).
• Call audio recordings — for calls of one minute or longer, we record the Elder's side of the call and use it, together with the transcript, to measure speech and conversation patterns over time for the cognitive-wellness features. Recordings are stored securely, are never shared with Caregivers, and are automatically deleted 90 days after the call. Transcripts are kept for as long as the account exists.
• Self-reported health and wellness data — mood, sleep, appetite, pain, medication adherence, and exercise.
• Cognitive-wellness measures derived from conversations and from optional exercises — scores, response times, and trends.
• Biographical and story data, recipes, call metadata, check-in records, and messages you exchange with Alma in the app.

Information collected automatically

If the Elder uses the Alma mobile app, and only with the permissions they grant on their phone, we collect:

• Apple Health / Health Connect readings (read-only; Alma never writes to Health): activity (steps, distance, flights climbed, exercise and stand time, walking speed and steadiness), heart (heart rate, resting and walking heart rate, heart-rate variability, and Apple's irregular-rhythm, high and low heart-rate and atrial-fibrillation notifications), breathing (respiratory rate, blood oxygen, sleep breathing disturbances), sleep, body measurements (weight, height, body and wrist temperature), readings and symptoms the Elder logs in Health (blood pressure, blood glucose, dizziness, fatigue, fainting, shortness of breath, chest discomfort, palpitations, headaches, mood changes), falls detected by Apple Watch, workouts, and daylight and sound-exposure levels. We do not read clinical health records.
• Phone activity signals: step count from the phone's motion sensor, battery level, operating-system version, and whether app permissions are on.
• Precise location, including in the background, to notice unusual inactivity and, when Alma cannot reach the Elder, to share the phone's last known location with the care circle. Location is converted to a street address by Microsoft Azure Maps for that purpose.
• Device and app identifiers needed to deliver calls and notifications: push-notification tokens, an app-install identifier, and the device's time zone and language.

Health readings are shown to the Elder's designated Caregivers as trends, flags and summaries, and are analysed to develop and improve Alma's wellbeing insights. Some readings are collected and stored before a corresponding insight exists so that new insights can be validated against real history before they are shown. Health readings are never used for advertising and are never sold.

We process your personal information under the legal bases permitted by the VCDPA, CCPA/CPRA, and other applicable law. Account, profile, biographical, payment, and call-metadata processing is based on contract performance. Health, wellness, and cognitive assessment data — which is sensitive — is processed on the basis of your explicit opt-in consent. Device and analytics data is processed on the basis of legitimate interest and, for cookies, consent.

We use your personal information to:

• Provide the Service — conduct AI companion calls, generate wellness summaries, deliver notifications, and compile biographies.
• Monitor self-reported health metrics over time and alert Caregivers when concerning patterns are detected.
• Administer cognitive wellness exercises and track trends (this constitutes automated profiling).
• Personalize conversations to the Elder's interests, language, and hearing needs.
• Manage accounts, process payments, and provide customer support.
• Improve the Service using aggregated, de-identified usage data. We do not use identifiable customer data to train third-party AI models.
• Send service-related communications and protect the security of our systems.

We do not sell or share (as defined under the CCPA/CPRA) your personal information for cross-context behavioral advertising. We share your information only:

• With Caregivers in the Elder's care circle — call summaries, health readings and trends, mood and wellbeing assessments, care alerts, and, when Alma cannot reach the Elder, the phone's last known location. Full conversation transcripts and call recordings are not shared with Caregivers.
• With service providers who help us operate the Service, under contractual obligations to protect your information.
• When required by law, or to protect rights and safety — including in cases of suspected elder abuse.
• In a business transfer, with at least 30 days' advance notice and an opportunity to opt out or delete your data.

We use the following third-party services to operate Alma. All are bound by data processing agreements and, where required, Business Associate Agreements:

• Microsoft Azure — cloud hosting, databases and file storage (United States).
• OpenAI — real-time voice AI for Alma's phone calls. During a call, the Elder's live audio, the conversation so far, their first name, recent check-in answers and life-story context are streamed to OpenAI to generate Alma's replies. OpenAI does not use Alma customer data to train its models under our contractual terms.
• Microsoft Azure OpenAI Service — AI analysis of transcripts, chat messages and check-in answers to produce summaries, wellbeing insights and life-story content.
• AssemblyAI — speech-to-text transcription of calls.
• LiveKit — secure audio transport for calls made through the Alma app.
• Twilio — phone calls to and from Elders and Caregivers, text messages, and the one-time verification codes used at sign-up and account deletion (sent by SMS in the United States and Canada, and by WhatsApp elsewhere).
• Microsoft Azure Maps — converting the Elder's last known location into a street address for care-circle alerts.
• Microsoft Azure Communication Services — transactional email (invitations and account notices).
• Expo — delivery of push notifications to the Alma app and distribution of app updates.
• Apple — App Store purchases and subscription billing on iPhone, push and call notifications, and Sign in with Apple.
• Google / Firebase — account sign-in (email, Google, and Sign in with Apple are handled through Firebase Authentication) and push notifications on Android.
• Stripe — payment processing for subscriptions bought on our website.
• Google Analytics — website usage analytics (website only; not in the app).

Alma implements security and privacy safeguards that align with the standards set forth in the Health Insurance Portability and Accountability Act (HIPAA), regardless of whether Alma is a covered entity or business associate. Where Alma contracts with covered entities and receives protected health information on their behalf, we operate as a Business Associate and comply fully with HIPAA.

Administrative, technical & physical safeguards

• Access to health data is restricted to authorized personnel on a need-to-know basis, with audit logs of all access.
• A designated Privacy Officer oversees compliance; workforce training is conducted regularly.
• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256 or equivalent), with role-based access controls and key rotation.
• Infrastructure is hosted on Microsoft Azure, which maintains SOC 2, HIPAA, and ISO 27001 certifications.

We maintain executed Business Associate Agreements with our cloud hosting, transcription, and telephony providers. A current list is available by contacting privacy@heyalma.ai.

We implement industry-standard measures to protect your data, including encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent), Firebase Authentication and OAuth 2.0 login, phone-based one-time password verification, per-device registration secrets, encryption key rotation, comprehensive audit logging, and regular backups.

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents in accordance with our breach notification obligations.

We retain your personal information for as long as your account is active or as needed to provide the Service.

• Active accounts — data is retained for as long as your account exists.
• Call audio recordings — automatically deleted 90 days after the call.
• Transcripts, health readings, check-in records, summaries and life-story content — retained for as long as your account exists, so Alma can compare today with your usual patterns.
• Canceled subscriptions — your account continues on the free Alma Pulse plan and your data is retained until you delete the account.
• Account deletion — you can delete your account from the app at any time (Elder: Settings → Delete Account; Caregiver: Settings → My Account → Delete Account). Access ends immediately, you have a 30-day window to change your mind, and after that all personal information is permanently erased, including transcripts, recordings, health readings, biography content, messages and call history. Records required by tax or payment law (transaction identifiers and amounts) are retained for 7 years.

We may retain de-identified, aggregated data that cannot reasonably identify any individual for analytical purposes indefinitely.

Regardless of your location, you have the right to access, correct, and delete your personal information, to obtain it in a portable format, to withdraw consent where consent is the legal basis for processing, and to opt out of non-essential communications.

Virginia residents (VCDPA)

Virginia residents may additionally opt out of profiling that produces legal or similarly significant effects — including our cognitive wellness trend analysis. To exercise these rights, contact privacy@heyalma.ai; we respond within 45 days. If we decline a request you may appeal with the subject line “VCDPA Appeal,” and we will respond within 60 days.

California residents (CCPA/CPRA)

California residents have the right to know what personal information we collect and why, to delete and correct it, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information, and to non-discrimination for exercising these rights.

Because our Service involves a Caregiver setting up an account on behalf of an Elder, we use a multi-layered consent framework. At account creation, the Caregiver must represent that the Elder has been informed about the Service and that the Caregiver has legal authority to enroll them.

During the first AI call, Alma verbally confirms with the Elder that they understand they are speaking with an AI companion service, that they consent to ongoing check-in calls, and that health summaries will be shared with their Caregiver. This verbal consent is recorded in the Elder's account. The Elder may revoke consent at any time — by telling Alma during a call, calling our support line, or emailing privacy@heyalma.ai — without the Caregiver's involvement, and the Caregiver cannot override that decision.

Before their first call or chat, the Elder is shown in the app that calls and chats are transcribed and recorded and processed by service providers, including AI services, and must agree before continuing. The Caregiver agrees to the same at sign-up for their own account.

Full conversation transcripts and call recordings are not shared with the Caregiver.

In the event of a data breach involving your unencrypted personal information, we will notify you without unreasonable delay and in no event later than 60 days after discovery, consistent with Virginia's breach notification statute and, where applicable, HIPAA. Notifications describe the incident, the information involved, the steps we are taking, and steps you can take to protect yourself. Where required by law we will also notify the Virginia Attorney General and the U.S. Department of Health and Human Services.

Alma is designed for older adults and their adult family caregivers. Our Service is not directed to children under 18, and we do not knowingly collect personal information from children. If we become aware that we have collected such information, we will take steps to delete it within 30 days.

Alma's Service is operated from and data is stored in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your country. By using the Service, you consent to this transfer.

We may update this Privacy Policy from time to time. For non-material changes, we will post the updated policy with a revised “Last Updated” date. For material changes — particularly any affecting how we collect, use, or share health data — we will notify you via email and in-app notification at least 30 days before they take effect, and material changes to health data processing will require your affirmative re-consent. If you do not agree, you may cancel and request deletion of your data at any time.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Alethiom LLC, 11107 Sunset Hills Rd, Ste 400, Reston, VA 20190
• General inquiries: info@heyalma.ai
• Support: support@heyalma.ai
• Privacy Officer, HIPAA & breach reports, and VCDPA appeals: privacy@heyalma.ai

We will respond to all privacy-related inquiries within 30 days, or within the timeframes required by applicable law, whichever is shorter.