Privacy Policy

1. Introduction and scope

AyaCall is a service operated by Eccordia Corp (“AyaCall,” “we,” “us,” or “our”). AyaCall provides daily AI voice wellness check-in calls for older adults (“seniors”) and a dashboard through which family members and other caregivers (“caregivers”) can view summaries, insights, and alerts about the senior they have enrolled.

This Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It applies to our website, the AyaCall dashboard and application, our check-in calls, and our text-message notifications (together, the “Services”).

Because AyaCall collects information about health and wellbeing, certain data is also governed by our separate Consumer Health Data Privacy Notice, which supplements this Policy for residents of Washington and other states with consumer-health-data laws. Where that Notice applies, it controls as to the specific data it covers.

This Policy is written for the United States. AyaCall is offered to U.S. residents only and is not directed to individuals outside the United States.

2. Information we collect

We collect the following categories of personal information. Not every category applies to every person.

• a. Account and contact information. Caregiver name, email address, mobile phone number, account credentials (managed by our authentication provider), organization/family name, and role within the family workspace.
• b. Senior enrollment information. The senior’s name (or the name the caregiver chooses to use), phone number, preferred language, relationship to the caregiver, time zone, call schedule, and topics or context the caregiver chooses to provide.
• c. Call content and wellbeing information. Audio recordings and transcripts of the AI check-in calls; information the senior shares during a call; AI-derived analytics such as a per-call mood indicator and counts of wellbeing-related mentions; standardized wellbeing screener responses and scores (for example, UCLA-3 and PHQ-2); and the summaries, insights, narratives, and alerts we generate for caregivers. This category is sensitive and is also covered by our Consumer Health Data Privacy Notice.
• d. Billing information. Subscription plan, billing status, and transaction records. Payment-card details are collected and processed directly by our payment processor; we do not store full card numbers.
• e. Usage, device, and log information. IP address, device and browser type, pages viewed, actions taken in the dashboard, timestamps, and similar diagnostic data.
• f. Communications. Messages you send us (for example, support requests) and records of notifications we send you.

We map these to the statutory categories used by California and other state privacy laws (identifiers; customer-records information; commercial information; internet/network activity; audio/electronic information; and sensitive personal information, including health-related information) in Section 10 and in the Consumer Health Data Privacy Notice.

3. Sources of the information

We collect personal information from:

• You — when a caregiver creates an account, enrolls a senior, configures the Service, contacts us, or makes a payment.
• The senior — through what they say during the recorded check-in calls.
• Automatically — through your use of the website and dashboard (usage, device, and log data).
• Our own processing — analytics, scores, summaries, and insights that our systems derive from the above.
• Service providers acting on our behalf (for example, our payment processor confirms a payment).

4. How we use personal information

We use personal information to:

• provide the Services — schedule and place check-in calls, transcribe and analyze them, and produce caregiver summaries, insights, and alerts;
• create and manage accounts, families, and senior enrollments;
• process payments and manage subscriptions;
• send service-related communications, including wellness alerts and account notices;
• maintain, secure, debug, and improve the Services;
• conduct analytics to understand and improve how the Services perform;
• prevent fraud and misuse and protect the safety and integrity of the Services; and
• comply with legal obligations and enforce our agreements.

We use personal information only for the purposes described above. We do not sell it (see Section 6).

5. How and with whom we share personal information

We share personal information only as described here. We do not sell your personal information (see Section 6).

a. Within your family workspace

Information is visible to the caregivers in the family workspace according to their role. The account owner can manage members and access.

b. Service providers (processors)

We share information with vendors who process it on our behalf, under contracts that limit them to providing services to us. Our current service providers include:

Text-to-speech is handled within Retell (no separate TTS sub-processor at launch). Each provider operates under a data-processing agreement.

c. Affiliates

AyaCall is operated solely by Eccordia Corp and has no corporate affiliates that receive your personal information.

d. Legal, safety, and protection

We may disclose information when we believe in good faith it is necessary to comply with law or legal process; to enforce our terms; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of AyaCall, our users, or others.

e. Business transfers

If AyaCall is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

6. We do not sell or “share” your personal information

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under California and other state privacy laws. We do not use advertising cookies, third-party advertising trackers, or analytics resellers on pages that handle health-related information. Because we do not sell or share in this sense, there is nothing to opt out of.

7. Cookies and similar technologies

We use cookies necessary to operate the Services (for example, to keep you signed in) and to understand performance. We do not use advertising or cross-site tracking technologies on health-context pages. You can control cookies through your browser settings; disabling some may affect how the Services work.

8. Data retention

We retain each category of personal information only as long as reasonably necessary for the purposes described in this Policy, after which we delete or de-identify it. The length depends on the type of information, how it is used, your account status, and our legal and record-keeping obligations. We may retain or decline to delete information where the law allows or requires it — for example, to meet a legal obligation, to preserve information for actual or anticipated legal claims, to prevent fraud, or to maintain the security and integrity of the Services.

Voice recordings. We retain raw call audio only as long as necessary to provide and improve the Service, after which it is deleted or de-identified.

When you ask us to delete your data, we handle the request as described in Section 9. Information held in routine backups is removed as those backups expire on our regular cycle.

After we honor a deletion request, we may retain de-identified and aggregated information for analytics and to improve our services. We maintain and use such information only in de-identified form and will not attempt to re-identify it.

9. Your privacy rights and choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• to know/access the categories and specific pieces of personal information we hold about you;
• to delete personal information we have collected from you;
• to correct inaccurate personal information;
• to data portability (a copy of certain information);
• to opt out of any sale or “sharing” for targeted advertising (note: we do not sell or share — Section 6); and
• to limit the use of sensitive personal information.

You will not be discriminated against for exercising any of these rights.

How to exercise your rights. Submit a request by emailing privacy@ayacall.com. We will verify your request and respond as described below.

How requests are handled. We respond to verified requests within the timeframes required by law — generally within 45 days, extendable by up to an additional 45 days where permitted, with notice. On a verified deletion request, we stop further processing and begin removing the requested data; certain records may be retained where the law allows or requires (see Section 8). We do not promise a fixed deletion-completion date and do not represent that deletion is immediate.

Verifying your identity. To protect your information, we verify your identity before acting on a request — for example, by confirming you control the email address associated with the account, or by asking for information needed to verify the request. Verification time does not extend our response deadline.

Authorized agents. You may use an authorized agent to submit a request on your behalf; we may require written authorization and verification of both your identity and the agent’s authority.

Appeals. If we decline a request, you may ask us to reconsider by replying to our decision or emailing privacy@ayacall.com; we will review and respond.

10. Consumer health data

Some of the information we collect — including what a senior says during calls, recordings and transcripts, wellbeing scores, and the insights we derive — is consumer health data under laws such as Washington’s My Health My Data Act. Our handling of that data, including the specific categories, sources, who we share it with, named affiliates (if any), and how to exercise your rights, is described in our separate Consumer Health Data Privacy Notice, which supplements and, for the data it covers, takes precedence over this Policy.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

12. Children's privacy

The Services are intended for adults. AyaCall is designed for adult caregivers and the older adults they enroll. We do not knowingly collect personal information from children under 13, and the Services are not directed to children. If we learn we have collected personal information from a child under 13, we will delete it.

13. Calls, voice, and recordings

AyaCall places automated calls that use an artificial/AI-generated voice, and it records and transcribes those calls to provide the Service. The senior is asked for permission to call and to record at the start of the first call. How we use, secure, and retain recordings and transcripts is described in Sections 4, 8, and 11 and in the Consumer Health Data Privacy Notice. Use of the calling features is also governed by our Terms of Service.

14. Text messages (SMS)

If a caregiver opts in, we send wellness alert text messages to the mobile number they provide. Message frequency varies; message and data rates may apply. You can reply STOP to cancel or HELP for help at any time. We do not share mobile opt-in information or consent records with third parties or affiliates for their own marketing. SMS messages are delivered through our messaging provider solely to provide the Service.

15. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and provide notice as appropriate (for example, by email or through the dashboard). Your continued use of the Services after an update means you accept the updated Policy.

16. Contact us

Questions about this Policy or your privacy can be directed to:

Eccordia Corp — AyaCall
Email: privacy@ayacall.com