Privacy Policy - Leaf AI Ltd

Effective Date: January 1st, 2024

1. Introduction

Leaf AI Ltd ("we", "us", "our") is committed to protecting the privacy and security of your personal data. This privacy policy provides information on how we collect, use, and protect the personal information of individuals using Lola, our chatbot designed for reminiscence therapy for those with dementia and other vulnerable individuals ("service users").

2. Contact Details

Leaf AI Ltd is a company registered in England and Wales, with company registration number 14987657 and registered address:

Office 3, Delifonseca Dockside,
Brunswick Way, Liverpool, L3 4BN

We are registered with the Information Commissioner's Office (ICO) with reference ZB608102.

For any privacy-specific concerns, please contact our Data Protection Officer, Adam Galloway, at privacy@lolabyleaf.com.

3. Data We Collect

We collect the following types of personal data:

• Personal Information: This may include names, contact details, and other identifying information.
• Interests and Events Data: Information related to the user's interests and significant life events.
• Conversational Data: Lola collects data from user interactions, which may include messages and conversations.
• Voice data: Recordings of your voice when interacting with Lola, primarily used for measuring transcription quality.
• Technical and log data: Data such as your IP address, device details, usage data.

4. How We Use Your Data

Your data is used for the following purposes:

• Providing Our Services: We use your data to deliver the Lola by Leaf service and personalise user experiences.
• Quality Improvement: Conversations with Lola may be used for training and quality improvement purposes.
• Communication: We may use your information to communicate with you regarding our services, updates, and support.
• Protecting our services: We may use your information to monitor usage of our services.
• Legal Obligations: We may process your data to comply with legal obligations.

5. Data Security and Storage

We take your data privacy and security seriously. We store your data securely within Microsoft Azure servers in the United Kingdom. We employ technical and organisational measures to protect your data from unauthorized access and breaches.

6. Legal Basis for Processing

The legal basis for processing your data is your consent, which is freely given by you or a carer acting on your behalf. You have the right to withdraw your consent at any time.

By using Lola by Leaf, you consent to the collection, use, and sharing of your information as described in this Privacy Policy. You may withdraw your consent at any time by contacting us at privacy@lolabyleaf.com.

7. Data Retention

We store personal data for a maximum of 6 years beyond the time you cease using our service.

8. Sub-Processors

We may share your data with third-party data processors for the purposes outlined above. Our current third-party data processors include:

• Microsoft (Azure)
• OpenAI
• Sentry
• Firebase
• ElevenLabs

These third parties are bound by their own privacy policies and contractual agreements to ensure the protection and security of your data.

We may have to share your data in the event of business sale or transfer. If this happens, you will be notified and given the ability to opt out.

9. Your Rights

Under the GDPR, you have several rights, including:

• The right to access your personal data.
• The right to have your personal data corrected or deleted.
• The right to restrict the processing of your data.
• The right to data portability.
• The right to object to data processing.

To exercise these rights, please contact the Data Protection Officer, Adam Galloway, at privacy@lolabyleaf.com.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of any significant changes and post the updated policy on our website.

11. Complaints

If you have a complaint about our handling of your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local data protection authority.