Privacy Policy

Avenant builds technology that accompanies people through the later chapters of life. Because the people we serve include elderly individuals who may be vulnerable, and because the data we handle includes health information, biometric identifiers, and intimate memories, we treat privacy not as a compliance obligation but as a core design principle.

This policy explains what personal data Avenant collects, where it is stored, how it is protected, how long we retain it, and what rights you hold. It applies to the Avenant Companion application, the Avenant Connect application for families and care networks, and this website.

Avenant is the data controller for all personal data collected through our products and this website.

If you have questions about how we handle your personal data, or wish to exercise any of your rights, please contact our Data Protection Officer at privacy@avenant.care.

We use personal data strictly for the purposes stated in the table above. We do not sell personal data, share it with advertisers, or use it to train general-purpose AI models.

Health data, biometric identifiers, and conversation memories are processed exclusively within Avenant's systems and are never disclosed to third parties without your explicit consent, except where required by law or in a genuine emergency escalation. In the latter case, only the minimum necessary information is shared with your designated emergency contact.

All platform data is held on servers located in the European Union. Each user's data is tenant-isolated — logically and cryptographically separated from all other tenants — and stored behind region-specific Virtual Private Clouds (VPCs) in accordance with GDPR, Law 25 (Québec), and HIPAA requirements.

Biometric and health data is end-to-end encrypted: encryption keys are derived on the resident's device and are never transmitted to our servers in plaintext. Access to platform infrastructure is governed by a strict least-privilege model: all administrative access is authenticated via hardware security keys, logged in tamper-evident immutable journals, and subject to regular independent compliance audits.

We retain personal data only for as long as it is needed for its stated purpose. Because the people we serve may lose the capacity to actively manage their account, we apply automatic inactivity-based retention caps in addition to user-initiated deletion:

• Biometric data (faceprint and voiceprint) is automatically purged after 90 days without an active session, even if the account remains open.
• Health data, medication records, conversation memories, and shared media are automatically purged after 12 months without an active session.
• Core identity data (name, email address, phone number) is retained until account closure, with a 30-day grace period for accidental closure.

When an account is closed — whether by the user, a legal representative, a care facility, or by automatic inactivity detection — all personal data is irreversibly deleted within 30 days.

Depending on your jurisdiction, you hold the following rights regarding your personal data:

• Right of access: you may request a copy of all data we hold about you.
• Right to rectification: you may correct inaccurate or incomplete data.
• Right to erasure: you may request deletion of your data at any time.
• Right to data portability: you may request your data in a structured, machine-readable format.
• Right to restrict processing: you may request that we limit how we use your data while a dispute is resolved.
• Right to object: you may object to any processing not strictly necessary to deliver the service.
• Right to lodge a complaint: you may contact your national or provincial supervisory authority at any time.

These rights apply under the GDPR (EU and EEA), Law 25 (Québec, Canada), and HIPAA (United States) as applicable to your situation. To exercise any of these rights, contact us at privacy@avenant.care. We will respond within 30 days.

We may update this policy from time to time to reflect changes in our practices, legal requirements, or product features. When we make material changes, we will notify active users through the application and update the Last Updated date at the top of this page.

Your continued use of Avenant's services after any change constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.