Privacy Policy.

1. Our Privacy Approach

Elah is designed to provide useful practitioner context without making traditional client identity profiles the center of the system.

Our design principles include:

• minimizing unnecessary client identifiers;
• organizing cases around secure case references;
• not retaining AI Intake audio as stored client recordings;
• not using client case information to train Elah's underlying AI models;
• isolating practitioner account and case information;
• allowing deletion requests.

2. Information We Collect

Practitioner account information

When you create or use an Elah practitioner account, we may collect information such as:

• name;
• email address;
• account and authentication information;
• subscription and billing status;
• support communications;
• preferences and account settings.

Payment information

Payments may be processed by third-party payment processors. Elah does not store complete payment-card numbers within the practitioner platform.

We may receive transaction identifiers, subscription status and other limited billing information needed to administer access.

New Practitioner applications

If you apply for the New Practitioner Rate, we may collect information needed to review eligibility, including:

• verified email address;
• name;
• certification date;
• training organization;
• school or training representative information;
• certification documentation.

Application documentation is used for eligibility review and related administration.

Client and case information

Practitioners may store case information needed to use Elah's practitioner tools.

Depending on the features used, this may include:

• client first name or initials;
• secure case reference;
• intake responses and transcripts;
• structured assessment information;
• Case Journal entries;
• Progress Tracker responses;
• session-related information;
• practitioner-created content associated with a case;
• Signals Fusion Reports and other generated practitioner analysis.

Elah's normal case workflow does not require storing client email addresses, phone numbers or last names.

3. AI Intake Audio

Voice is processed during conversational AI Intake so spoken responses can be interpreted and converted into usable intake information.

Client audio is not retained by Elah as a stored session recording after the intake workflow.

4. How We Use Information

We may use information to:

• provide and operate Elah;
• create and manage practitioner accounts;
• process subscriptions and verify access;
• operate AI Intake and practitioner workflows;
• generate requested practitioner-facing analysis and content;
• provide support;
• detect abuse, fraud or security threats;
• maintain platform reliability;
• understand website and product usage;
• comply with legal obligations;
• improve platform functionality using appropriate operational and aggregate information.

5. AI Processing and Model Training

Elah uses AI services to provide functions such as conversational intake, analysis, organization and content generation.

Client information submitted through Elah is not used to train Elah's underlying AI models.

Information may be transmitted to service providers as necessary to perform an AI-requested function, subject to the applicable service configuration and safeguards.

6. Service Providers

Elah relies on service providers to operate portions of the platform. These may include providers of:

• cloud hosting and infrastructure;
• artificial intelligence services;
• speech processing and text-to-speech services;
• payment processing;
• email delivery;
• security and fraud prevention;
• analytics and website measurement.

Service providers receive only the information reasonably necessary to perform the services for which they are used.

7. Connected Services and Integrations

Elah may allow practitioners to connect supported third-party services.

When you authorize a connection, Elah may receive or display information from that provider as necessary to support the requested workflow.

Connected providers remain responsible for their own platforms and privacy practices and generally remain the system of record for information maintained by them.

8. Website Analytics and Cookies

Elah may use cookies, local storage and similar technologies that are necessary for website or account functionality.

We may also use analytics and measurement services, including Google Analytics or similar services, to understand how visitors use Elah.io and to improve the website and product experience.

Analytics information may include:

• IP address;
• browser and device information;
• pages visited;
• referring pages;
• general geographic information;
• interaction and performance information.

Where applicable law requires consent for non-essential tracking technologies, we will use appropriate consent controls.

9. Open Case Information

Where the Open Case Program is available, Elah may create a minimized or anonymized case summary for review by eligible participating practitioners.

Contact information used for the referral or acceptance process is handled separately from the practitioner-facing case summary and is not released to a participating practitioner until the applicable acceptance process is completed.

10. When Information May Be Disclosed

Information may be disclosed:

• to service providers operating on our behalf;
• to connected services at the user's direction;
• when required by law, court order or valid legal process;
• where reasonably necessary to investigate fraud, abuse or security threats;
• in connection with a merger, acquisition, financing or sale of business assets, subject to appropriate protections.

Elah does not sell client case content.

11. Data Retention

We retain information for as long as reasonably necessary to provide the Service, maintain legitimate business records, comply with legal requirements, resolve disputes and protect platform security.

Different categories of information may have different retention periods depending on their purpose.

12. Deletion Requests

Practitioners may request deletion of account or associated platform data, subject to information we are required or permitted to retain for legal, billing, security or dispute-resolution purposes.

Client-related deletion requests may be submitted through the responsible practitioner or through Elah where appropriate.

Deleted information may remain in limited backups for a period of time before routine backup rotation is complete.

13. Security

Elah uses commercially reasonable administrative, technical and organizational safeguards designed to protect information against unauthorized access, loss, alteration or disclosure.

No internet-based system can guarantee absolute security. Users are responsible for protecting their login credentials and devices.

14. Your Privacy Rights

Depending on your location, applicable law may provide rights to request access to, correction of, deletion of or information about certain personal information.

Elah will respond to valid privacy requests in accordance with applicable law and may need to verify the identity or authority of the requester before completing a request.

15. International Processing

Elah and its service providers may process information in countries other than the country in which the user or client is located.

Where required, appropriate safeguards may be used for cross-border processing.

16. Changes to This Privacy Policy

We may update this Privacy Policy as Elah, our technology or applicable privacy requirements change.

The current version will be published on Elah.io with an updated revision date.

17. Contact

Privacy questions, deletion requests and other privacy inquiries may be submitted through the Elah contact form.