Charity No. 1171887
Elevate Privacy Policy
Keeping your information safe
Version 1.0 - Effective date: 6 May 2026
Public Health Collaboration ("PHC") is a registered UK charity dedicated to improving public health. Elevate is a digital lifestyle and wellness service offered by PHC to its members. This Privacy Policy explains how we use the personal data we collect when you use the Elevate mobile application or its supporting web companion.
Elevate is built and operated for PHC by Black Pear Software Ltd ("Black Pear"). PHC is the Data Controller for the personal data described in this Policy. Black Pear is the Data Processor and acts on PHC's documented instructions.
This Policy supplements PHC's wider charity-level Privacy Notice at phcuk.org/privacy-policy. Where this Elevate Privacy Policy is more specific, this Policy governs your use of Elevate.
Who Elevate is for
Elevate is a wellness and lifestyle service for adults aged 18 or over. We do not knowingly collect data from anyone under 18. To create an account, you must confirm that you are 18 years of age or older and provide a date of birth that confirms your age.
Elevate is not a medical device. Nothing in Elevate, including any output of the AI Health Coach, any AI-generated insight, any community message and any practitioner conversation, is medical advice, diagnosis or treatment. Always consult a qualified healthcare professional for clinical decisions.
What personal data we collect
We collect personal data only where you choose to give it to us, where you authorise us to read it from a connected device, or where we generate it from the data you have already given us.
| Category | Examples |
|---|---|
| 1. Identity and contact data | Email address, given name, family name, country, profile photograph where you choose to add one, display name and biographical text. |
| 2. Demographic and physiological data | Date of birth, gender, height, weight, waist circumference. |
| 3. Health metrics | The metrics you choose to record or sync, for example blood pressure, blood glucose, blood ketone, sleep duration and quality, exercise activity, VO2 max, and pathology lab results coded against SNOMED. |
| 4. Wellbeing and lifestyle data | Mood scores, stress scores, mindfulness and breathing session records, gratitude entries, dietary preferences, allergens, dietary restrictions, preferences and goals. |
| 5. User-generated content | Free-text messages you send to the AI Health Coach, free-text notes you record against meals, exercise or measurements, and photographs you submit to Elevate. |
| 6. Wearable and health-platform data | Where you authorise the integration: data synced from Strava, Apple HealthKit or Google Health Connect. We only read the metrics you have authorised, and you can disconnect integrations at any time. |
| 7. Authentication and minimal device data | Authentication tokens issued by AWS Cognito, session timestamps, device identifiers needed to deliver push notifications you have opted into, and minimal technical telemetry necessary to operate the service. |
| 8. Consent records | Records of the consents you have given, for example to enable a wearable integration, share data with a practitioner, or receive communications. |
| 9. AI-inferred and derived data | Pillar scores, an overall health score, AI-derived nutritional estimates, AI-generated coaching responses, meditation scripts, meal plans, recipe enhancements, images and lightweight personalisation memory. |
What we do not collect. We do not collect biometric identifiers, genetic data, or data revealing your racial or ethnic origin, religion, political opinions, sex life or sexual orientation. Where you unlock the app with Touch ID or Face ID, that biometric is processed on your device by your operating system; it is not transmitted to us.
Where the data comes from
Most data comes directly from you, recorded in the app. Some data is read at your authorisation from Strava, Apple HealthKit or Google Health Connect. Some data is generated by Elevate from the data you have given us, for example AI-derived pillar scores or AI-generated meal plans.
You decide which features to use, which integrations to enable, and which fields to fill in. Optional features are off by default and require your explicit, granular consent before they are turned on.
Special category data
Some of the data we process about you is special category data within the meaning of Article 9 of the UK GDPR, specifically data concerning your health and your mental and psychological wellbeing.
Why we use your data - our lawful basis
We rely on the following lawful bases under the UK GDPR.
| Processing | Article 6 lawful basis | Article 9 condition |
|---|---|---|
| Identity, contact and demographic data, to operate the service | Article 6(1)(b) - performance of the contract with you | Not applicable |
| Health metrics, wellbeing data and your free-text content where it concerns your health | Article 6(1)(b) - performance of the contract | Article 9(2)(a) - your explicit consent |
| Use of the AI Health Coach | Article 6(1)(b) - performance of the contract; the AI Coach is a core feature of paid membership | Article 9(2)(a) - your explicit consent to AI-assisted health coaching |
| Wearable, Apple Health and Strava sync | Article 6(1)(a) - your consent | Article 9(2)(a) - your explicit consent |
| Sharing with a practitioner | Article 6(1)(a) - your consent | Article 9(2)(a) - your explicit consent |
| Service security, fraud prevention and abuse detection | Article 6(1)(f) - legitimate interests of PHC and Black Pear in operating a secure service | Not applicable |
| Aggregate, anonymised analytics for service improvement | Article 6(1)(f) - legitimate interests, balanced by anonymisation before analysis | Not applicable once anonymised |
| Marketing communications only if you opt in | Article 6(1)(a) - your consent | Not applicable |
Withdrawing consent. You can withdraw your consent at any time from within the app. Withdrawing consent stops further processing of the relevant category. It does not affect the lawfulness of processing carried out before you withdrew.
AI features and how they use your data
Elevate's AI features are powered by enterprise services from Anthropic, OpenAI, and ElevenLabs. The data you submit through these features is sent to those providers solely so that they can return the AI output you requested.
- The AI Health Coach uses Anthropic Claude models.
- Meal analysis, recipe enhancement, scoring and image generation use OpenAI models.
- Voice narration of meditation scripts uses ElevenLabs text-to-speech.
Your data is not used to train any AI model. PHC and Black Pear use commercial enterprise APIs that contractually exclude the use of submitted prompts for general AI model training.
We do not send any data that directly identifies you to our AI providers. The only personal data sent in the context of an AI request is your first name and age, together with the data needed for the AI to respond to your specific request.
How long we keep your data
| Data category | Retention |
|---|---|
| AI Health Coach chat transcripts and uploaded analysis photos | 3 days from the message, then automatically deleted. The cleanup runs nightly at 03:00 UTC. |
| AI personalisation memory | For as long as your account is active; cleared when your account is closed. |
| Identity, demographic and health-metric records, wellbeing data, user-generated notes and AI-inferred data | For the lifetime of your account, unless you delete an individual record sooner. On account closure, this data is deleted except where legal retention is required. |
| Practitioner-access consent records | While the practitioner relationship is in place; on revocation, the consent record is retained as part of the audit log. |
| Records required by law | Retained for the period required by law, then deleted. |
Account closure. When you close your account from within the app, we will delete the personal data we hold about you within 30 days, save where retention is required for a legal obligation or for the establishment, exercise or defence of a legal claim.
Where your data is stored
Your data is held within the United Kingdom. The primary application infrastructure is hosted in Amazon Web Services eu-west-2 (London). Authentication is provided by AWS Cognito in eu-west-2. Encryption at rest and in transit is in force across all stores.
International transfers
Some specialist sub-processors operate outside the UK.
| Provider | Purpose | Location |
|---|---|---|
| Anthropic | AI Health Coach | United States |
| OpenAI | Meal analysis, recipe enhancement, scoring, image generation | EU and United States |
| ElevenLabs | Text-to-speech for meditation audio | United States |
| Stream Chat | Real-time in-app chat infrastructure | EU and United States |
| Strava | Workout data sync you initiate | United States |
| Apple App Store / Google Play; APNS / Firebase Cloud Messaging | App distribution and push notification delivery | United States |
Each transfer is supported by an appropriate Chapter V transfer mechanism, the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
Who we share your data with
We share your data only with the processors we use to operate the service, with practitioners you have authorised, and where we are legally required to do so.
| Sub-processor | Role |
|---|---|
| Black Pear Software Ltd (UK) | Software development, AWS hosting-stack configuration and management, and operational support. |
| Amazon Web Services EMEA SARL - eu-west-2 (London) | Application servers, relational database, object storage, in-memory cache, identity directory and document OCR. |
| Amazon Web Services EMEA SARL - Amazon SES (eu-west-2 London) | Transactional email for onboarding and password-change confirmations. |
| Anthropic PBC (US) | Large-language-model service for the AI Health Coach. |
| OpenAI Ireland Ltd / OpenAI L.L.C. (EU/US) | Large-language-model and image-generation services. |
| ElevenLabs Inc. (US) | Text-to-speech for meditation audio. |
| Stream.io Inc. (EU/US) | Real-time chat infrastructure. |
| Strava, Inc. (US) | Workout data sync at your authorisation. |
| Apple Inc. / Google LLC (US) | App distribution and push notification services. |
| Google LLC - Firebase Crashlytics (US) | Application crash diagnostics. |
You can choose to share your data with a PHC-accredited health coach. You give consent in the app, and the consent is granular. You can revoke consent at any time, and the coach's read access is removed immediately.
We may share your data where we are required to do so by law, by a court order or by a competent regulator, or where sharing is necessary to establish, exercise or defend a legal claim. We do not sell your data, and we do not share your data with third parties for their own marketing.
Payment data is not handled by Elevate. PHC takes membership payments separately on the PHC charity side, processed by PHC administrative staff using Stripe.
Marketing
We will not send you marketing communications about Elevate or PHC unless you have opted in. If you do opt in, you can unsubscribe at any time using the link in any email we send you.
Cookies and minimal device data
The Elevate mobile app does not use third-party cookies. The mobile app processes the minimal device data needed to authenticate you, deliver push notifications you have opted into, and operate the service. The Elevate web companion uses session cookies necessary to log you in.
Your rights
Under UK data protection law, you have the right to:
- Be informed about how your personal data is used.
- Access a copy of the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete your data.
- Ask us to restrict processing.
- Receive your data in a structured, machine-readable format.
- Object to certain processing, including processing based on legitimate interests.
- Withdraw consent at any time where consent is the basis for processing.
The Settings screen provides self-service data export and account-closure flows. For other rights, please contact our Data Protection Officer using the details below, or via the in-app chat.
Children
Elevate is for users aged 18 and over only. We do not direct Elevate at children, and we do not knowingly collect personal data from anyone under 18.
Complaints
If you are unhappy with how we have handled your personal data, please contact our Data Protection Officer. You also have the right to lodge a complaint with the Information Commissioner's Office.
Changes to this Policy
We may update this Privacy Policy from time to time. Where the change is material, we will notify you in advance, for example by an in-app notice or by email. The current version of this Policy is always available at https://elevate-me.life/privacy.
Contact us
Public Health Collaboration - Data Protection Officer
Sam Feltham
Email: sam.feltham@phcuk.org
Address: Public Health Collaboration, c/o Reed Smith, 1 Blossom Yard, London E1 6RS
Information Commissioner's Office
Website: ico.org.uk
Helpline: 0303 123 1113
Effective date: 6 May 2026
Version: 1.0