Empathy Connections is a service operated by Empathy Adventures, a registered business name of Sean Baker, a sole trader based in the Republic of Ireland (CRO Business Name Registration No. 788523). We provide an AI companion calling service ("Erin") that makes daily check-in calls to elderly users, with monitoring and care management tools for family carers.
Data controller. Empathy Adventures is the data controller for personal data processed through Empathy Connections. Contact: hello@empathyadventures.com.
Whose data this covers. This policy covers carers (people who use the Empathy Connections app) and carees (the people Erin calls). Carees do not use the app; their information is provided by their carer and collected during calls.
Information you provide directly - Your name, email address and phone number - Relationship information (carer and caree profiles) - Notes and reminders created during calls or in the app - Medication information entered into the app - Calendar access when a caree connects their Google Calendar - Contacts: people in the caree's life (name, relationship, optional phone number and notes)
Information collected during calls - Voice call recordings and transcripts - Wellbeing and mood data mentioned during calls - Appointment and scheduling information - Call duration and timing
Technical data - Device type and operating system - Push notification tokens - App usage data
Some information we process is health data, which the GDPR treats as a special category of personal data (Article 9). This includes medications entered by carers; mood and wellbeing scores; wellbeing alerts generated when something said during a call may indicate distress or a health concern; and anything health-related said during a call, which appears in transcripts and summaries.
We only process health data to provide the service a carer has asked for. We never use it for advertising or marketing, and we never sell it.
| What we do | Legal basis (Article 6) | Health data condition (Article 9) |
|---|---|---|
| Providing calls, reminders and the carer app | Performance of a contract with the carer (Art. 6(1)(b)) | — |
| Recording and showing the caree's medications, mood, wellbeing and call content | Consent (Art. 6(1)(a)) | Explicit consent of the caree, or of a person legally authorised to act for them (Art. 9(2)(a)) |
| Wellbeing alerts to carers | Consent (Art. 6(1)(a)); in a genuine emergency, vital interests (Art. 6(1)(d)) | Explicit consent (Art. 9(2)(a)); vital interests where the caree cannot consent (Art. 9(2)(c)) |
| Billing and accounts | Contract and legal obligation (Art. 6(1)(b), (c)) | — |
| Security, fraud prevention and improving the service | Legitimate interests (Art. 6(1)(f)) | — |
How consent is given. When a carer sets up a caree, the app asks the carer to confirm, by ticking a box, that the caree (or someone legally authorised to act for them, such as an attorney under an Enduring Power of Attorney or a decision-making representative) has given explicit consent to: receiving calls from an AI; calls being recorded and transcribed; and their health information being stored and shared with their carers. We record when this confirmation was given and by whom.
Withdrawing consent. Consent can be withdrawn at any time by the caree, their representative or the carer, by emailing hello@empathyadventures.com. Calls will stop, and we will delete the caree's health data within 30 days unless the law requires us to keep it. Withdrawal does not affect processing that happened before it.
Other carers. The main carer on an account can invite other carers (for example family members or a paid carer). Each invited carer has their own login and can see the same information about the caree as the main carer — call summaries, wellbeing, calendar, medications, contacts and notes. The main carer can remove any invited carer's access at any time. Carees are not automatically notified when a carer is added; the main carer is responsible for having the caree's agreement to share with the people they invite.
Service providers. We do not sell personal data. We use the following providers, each under a data processing agreement, only to run the service:
| Provider | What they do | Where data is processed |
|---|---|---|
| Supabase | Database and app sign-in | EU (Ireland) |
| n8n | Workflow automation that connects the service | EU |
| Vapi | AI calling platform | USA |
| Anthropic | AI language model that powers Erin's conversation | USA |
| ElevenLabs | Erin's voice | USA |
| Deepgram | Speech-to-text transcription | USA |
| Twilio | Phone call routing | USA |
| Calendar integration (only if connected) | USA | |
| Stripe | Payments (carers only; no health data) | USA / EU |
| Apple | Sign in with Apple and push notifications | USA |
Some of the providers above process data in the United States. Where data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework (where the provider is certified) or the European Commission's Standard Contractual Clauses, together with safeguards such as encryption in transit. You can ask us for details of the safeguards for any provider by emailing hello@empathyadventures.com.
Calls between Erin and carees are recorded and transcribed to provide the service. Transcripts and summaries are visible to the carers linked to that caree.
You can ask us to delete call recordings and transcripts at any time by contacting hello@empathyadventures.com.
When a caree connects their Google Calendar (we currently support Google Calendar only):
Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google Calendar data to serve advertisements, and we do not allow humans to read this data except as necessary for security purposes, to comply with applicable law, or with your consent.
| Data | How long we keep it |
|---|---|
| Call recordings and transcripts — free trial | 30 days, then deleted |
| Call recordings and transcripts — active subscription | While the subscription is active; deleted within 30 days of it ending |
| Medications, wellbeing and mood data | While the caree's account is active |
| Contacts and notes | While the caree's account is active |
| Carer account details | While the carer's account is active |
| Billing records | 6 years, as required by Irish tax law |
When an account is closed, or consent is withdrawn, we delete the data above within 30 days, except records we must keep by law.
Under EU GDPR (General Data Protection Regulation), you have the right to:
To exercise any of these rights, contact us at hello@empathyadventures.com. We will respond within 30 days.
Rights of carees. These rights belong to carees as well as carers. A caree, or someone legally authorised to act for them, can contact us directly — they do not need to go through their carer. We may ask for reasonable proof of identity or authority before acting on a request.
AI and automated processing. Erin and our wellbeing alerts use AI to hold conversations, summarise calls and flag possible concerns. These outputs support carers; they do not make decisions with legal or similarly significant effects about anyone. A person (the carer) always decides what to do.
Empathy Connections is designed for use by adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us immediately.
We use encryption for data in transit, and our database provider encrypts stored data. Access rules in our database ensure each carer can only see the carees they are linked to. We carry out regular security checks of our systems and fix issues we find.
We may update this privacy policy from time to time. We will notify you of significant changes by email or through the app. The date at the top of this page shows when it was last updated.
If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (DPC) Ireland at dataprotection.ie, or the UK Information Commissioner's Office (ICO) at ico.org.uk if you are based in the UK.