Privacy Policy

Effective Date: September 3, 2026

Purpose

The purpose of this privacy policy (this “Privacy Policy”) is to inform users of our Site of the following:

• The personal data we will collect;
• Use of collected data;
• Who has access to the data collected; and
• The rights of Site users.

This Privacy Policy applies in addition to the terms and conditions of our Site.

Consent

By using our Site users agree that they consent to:

• The conditions set out in this Privacy Policy; and
• The collection, use, and retention of the data listed in this Privacy Policy.

Communications and SMS Notifications

In connection with the safety features of our service, we may send SMS text messages to a designated caregiver's phone number that you provide in our admin portal.

Types of messages we send via SMS

• Caregiver safety alerts when concerning signals are detected in a user's conversations with our voice assistant; and
• Confirmation and opt-out acknowledgement messages.

Daily check-in summaries to designated family members or caregivers are sent only via email, not SMS.

SMS consent and opt-out

• Consent is required before any SMS notifications are sent. We use a double opt-in process: when a caregiver phone number is added in our admin portal, we send a confirmation message to that number, and the recipient must reply YES before any further SMS messages are delivered.
• Recipients may reply STOP at any time to opt out of further SMS messages.
• Recipients may reply HELP for assistance and information about how to contact us.
• Message frequency varies based on user activity in our service.
• Message and data rates from the recipient's mobile carrier may apply.

Authorization to provide caregiver contact information

When you provide a caregiver's phone number or email address in our admin portal, you attest that you have authorization from that person to provide their contact information and that they consent to receive the messages described above. The caregiver's separate confirmation through the double opt-in process is the operative consent for SMS delivery.

Personal Data We Collect

We collect data that helps us achieve the purpose set out in this Privacy Policy.

Data Collected in a Non-Automatic Way

When you, a designated family member, or a designated caregiver use our admin portal, we collect:

Account and identity information

• First and last name;
• Age;
• Date of birth;
• Sex;
• Email address;
• Phone number;
• Address; and
• Account credentials and authentication tokens.

Designated caregiver contact information

When you designate a caregiver, we collect that person's name, phone number, and email address so that we can deliver the caregiver notifications described in the Communications and SMS Notifications section.

User-provided content

Our admin portal lets the user, a designated family member, or a designated caregiver enter information the user wants the assistant to recall by voice later. This may include:

• Medical information such as conditions, medications, doctors, appointments, prescriptions, and insurance details;
• Family and relationship information such as names, dates, relationships, photographs, and stories;
• Personal preferences, routines, and reminders; and
• Other free-form notes you choose to enter.

We do not require any specific item of user-provided content. Whatever is entered is stored so that the user can ask for it back later through the voice assistant.

Please do not enter government identification numbers such as Social Security numbers, driver's license numbers, or passport numbers. We do not request this information and do not need it to provide our service.

Voice assistant interactions

When you use our voice assistant, audio of your speech is processed in real time to operate the assistant. Most audio is not retained. Audio you record as part of the family-tree and story features (for example, recorded stories) is stored so those features can function. Transcripts are created and stored for your recorded stories, your spoken notes, and all of your conversation turns with the assistant — see “How Long We Store Personal Data” below.

Transcripts and other interaction data are used to deliver and improve the service, to perform the safety analysis described in the next section, and — only for users who have opted in — for the research described in the Research Program section below.

All of the data described above is collected directly from the user, from a designated family member, or from a designated caregiver. We do not collect personal data from third-party sources.

How We Use Personal Data

Data collected on our Site will only be used for the purposes specified in this Privacy Policy or indicated on the relevant pages of our Site. We will not use your data beyond what we disclose in this Privacy Policy.

Specifically, we use personal data for the following purposes:

• To personalize the AI voice assistant experience using the documents and information the user has provided;
• To analyze conversation turns for language that may indicate emotional distress or a safety concern — such as expressions of loneliness, depression, or thoughts of self-harm — and route alerts to a designated caregiver. This analysis runs on all conversation turns;
• To send transactional and informational emails such as account verification messages and daily check-in summaries to a designated family member or caregiver;
• To send SMS notifications to designated caregivers as described in the Communications and SMS Notifications section above;
• To operate, maintain, and improve our service, including through aggregate, de-identified analytics;
• To conduct the research described in the Research Program section below, only for users who have opted in; and
• To respond to user requests and to comply with legal obligations.

Google User Data

When you connect your Google account, Evoca requests access to events on Google Calendars you own, using the calendar.events.owned scope. We use this access solely to let you list, create, update, and delete your own calendar events through voice commands.

We do not store Google Calendar data as structured calendar records, and we do not retain the responses returned by the Google Calendar API. Because our service stores transcripts of your voice interactions, those transcripts may include calendar-related details that you spoke or that the assistant spoke back to you (for example, an appointment you asked to create). Transcripts are retained as described in “How Long We Store Personal Data.”

We do not use Google Calendar data for advertising, and we do not sell it or transfer it to third parties except as needed to provide this feature or as required by law.

Evoca Labs' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Evoca's access to your Google account at any time through your Google account permissions at https://myaccount.google.com/permissions, and you can request deletion of stored data by contacting our privacy officer.

Research Program

We run an optional research program to better understand how voice AI can support older adults, and to give participants insights drawn from their own data. Participation is a separate choice — it is not part of signing up, and declining or withdrawing never affects the service you receive or its price.

Opting in

Research participation requires an explicit opt-in, recorded in our admin portal. Because many of our users have help managing their accounts, the opt-in may be given either:

• By the user themselves; or
• By a family member or caregiver managing the account on the user’s behalf. In that case, the person opting in attests that they have the authority to make this choice for the user — for example, as the user’s agent under a power of attorney, as their legal guardian, or with the user’s own agreement.

We record who gave the consent, their relationship to the user, when it was given, and the version of the consent language they agreed to.

What data is used

For participants only: stored voice recordings (such as recorded stories) and stored transcripts of conversations and notes. Calendar details originating from a connected Google account are excluded from research use, in accordance with the Google API Services User Data Policy.

How we use research data

• To help you with your own data. We analyze a participant’s own recordings and transcripts in order to provide that participant — and, where designated, their family members or caregivers — insights from their own information.
• To publish general findings. We analyze de-identified data across participants and publish only anonymized, general findings in research reports. We never publish audio recordings, voices, names, or story details that could identify a participant.
• To work with research partners. We may share de-identified research data with outside research partners, such as a university or clinical collaborator, under a written agreement that prohibits re-identification and any other use. We never share identifiable research data with outside partners. Access within Evoca Labs is limited to employees and contractors bound by written confidentiality obligations.

Withdrawing

Participants, or the person who opted in on their behalf, can withdraw at any time through the admin portal or by contacting our privacy officer. After withdrawal, the participant’s data is no longer used in research. Findings already published in anonymized, aggregate form cannot be recalled, but they do not identify anyone.

Service Providers

We use the following third-party service providers to operate our service. Each operates under their own privacy and security policies. We share only the personal data necessary for each service provider to perform its function on our behalf.

• Amazon Web Services, Inc. — data storage (Amazon S3, Amazon DynamoDB), compute (AWS Lambda, AWS Lightsail), email delivery (Amazon SES), and related infrastructure;
• Anthropic, PBC — artificial intelligence inference for the voice assistant and supporting analytics features (the Claude API);
• AssemblyAI, Inc. — speech-to-text transcription of voice interactions;
• ElevenLabs, Inc. — text-to-speech audio synthesis;
• FalkorDB, Inc. — hosted graph database used to store and retrieve the structured information that personalizes the assistant;
• Google LLC — Google Calendar integration for users who connect their Google account, as described in the Google User Data section above;
• LangChain, Inc. (LangSmith) — tracing and observability of AI inference calls, used for service operation, debugging, and quality monitoring;
• Twilio Inc. — SMS message delivery to designated caregivers.

We may add, change, or remove service providers from time to time and will update this Privacy Policy when we do.

Who We Share Personal Data With

Employees

We may disclose user data to any member of our organization who reasonably needs access to user data to achieve the purposes set out in this Privacy Policy.

Designated Caregivers

When you designate a caregiver in our admin portal, the safety alert messages and digest emails described in the Communications and SMS Notifications section are sent to the caregiver's contact information you provide.

Service Providers

We share personal data with the third-party service providers listed in the Service Providers section above as necessary to operate our service.

Other Disclosures

We will not sell or share your data with any other third parties, except in the following cases:

• If the law requires it;
• If it is required for any legal proceeding;
• To prove or protect our legal rights;
• To a buyer in the event the company is sold, in which case the data would remain subject to this Privacy Policy or a successor policy with equivalent protections; and
• De-identified research data shared with research partners, only for users who have opted in to the Research Program and as described in that section.

Google user data accessed under the Google API Services User Data Policy is not transferred to third parties except as that policy permits, including its restrictions on transfer to a buyer.

If you follow hyperlinks from our Site to another Site, please note that we are not responsible for and have no control over their privacy policies and practices.

Healthcare Context

Evoca's voice AI assistant is designed for senior citizens and may be used in connection with medical record management, medication tracking, appointment information, and similar healthcare-related tasks. While our service may store and process information that constitutes Protected Health Information (PHI) under the U.S. Health Insurance Portability and Accountability Act (HIPAA), Evoca is currently in an invite-only beta period and is not yet operating under a HIPAA Business Associate Agreement (BAA). HIPAA-grade compliance is a goal we are actively working toward as we approach general availability.

Our service is not a medical device and is not a substitute for professional medical advice, diagnosis, or treatment. The safety detection features identify observable conversational signals so that a designated caregiver can check in; they do not constitute clinical diagnosis. If you or someone in your care is experiencing a medical or psychiatric emergency, please call 911 or your local emergency number.

How Long We Store Personal Data

We retain personal data — including profile information, stored family-tree audio recordings, and conversation transcripts — until you delete it or close your account, after which it is deleted. You can request deletion of your data at any time by contacting our privacy officer.

If you opt in to our Research Program and later withdraw, your data is removed from the research data set going forward. Findings already published in anonymized, aggregate form cannot be withdrawn, but they do not identify you.

How We Protect Your Personal Data

In order to protect your security, we use the strongest available browser encryption and store all of our data on servers in secure facilities. Data in transit is encrypted using industry-standard TLS. All data is only accessible to our employees and our service providers as described in this Privacy Policy. Our employees are bound by strict confidentiality agreements and a breach of this agreement would result in the employee's termination and likely prosecution.

While we take all reasonable precautions to ensure that user data is secure and that users are protected, there always remains the risk of harm. The Internet as a whole can be insecure at times and therefore we are unable to guarantee the security of user data beyond what is reasonably practical.

Children

We do not knowingly collect or use personal data from children under 13 years of age. If we learn that we have collected personal data from a child under 13 years of age, the personal data will be deleted as soon as possible. If a child under 13 years of age has provided us with personal data their parent or guardian may contact our privacy officer.

How to Access, Modify, Delete, or Challenge the Data Collected

If you would like to know if we have collected your personal data, how we have used your personal data, if we have disclosed your personal data and to who we disclosed your personal data, or if you would like your data to be deleted or modified in any way, please contact our privacy officer here:

Do Not Track Notice

Do Not Track (“DNT”) is a privacy preference that you can set in certain web browsers. We do not track the users of our Site over time and across third party websites and therefore do not respond to browser-initiated DNT signals.

Modifications

This Privacy Policy may be amended from time to time in order to maintain compliance with the law and to reflect any changes to our data collection process. When we amend this Privacy Policy we will update the “Effective Date” at the top of this Privacy Policy. We recommend that our users periodically review our Privacy Policy to ensure that they are notified of any updates. If necessary, we may notify users by email of changes to this Privacy Policy.

Contact Information

If you have any questions, concerns or complaints, you can contact our privacy officer, James Murphy, at:

California Consumer Privacy Act Privacy Notice

Website: https://www.evoca-labs.com

This Privacy Notice supplements the https://www.evoca-labs.com Privacy Policy and applies solely to California consumers who visit https://www.evoca-labs.com. Any terms defined in the California Consumer Privacy Act of 2018 (“CCPA”) have the same meaning when used in this Privacy Notice.

Information We Collect

We have collected the following categories of personal information about consumers in the past twelve (12) months:

• Identifiers such as real name, postal address, email address, phone number, and account name;
• Categories of personal information described in California customer records law (Cal. Civ. Code § 1798.80(e)) limited to name, address, telephone number, and the medical and health insurance information that the user chooses to provide;
• Characteristics of protected classifications under California or federal law that the user chooses to provide, such as age and sex;
• Audio and transcript information created when the user interacts with the voice assistant; and
• Inferences drawn from the information above to personalize the user's voice assistant experience.

We do not request or knowingly collect Social Security numbers, driver's license or state identification card numbers, passport numbers, financial account numbers, geolocation data, or professional or employment-related information.

Sources of Information

We collect the categories of personal information listed above from the following categories of sources:

• The user;
• A designated family member; and
• A designated caregiver.

Use of Personal Information

We may use or disclose personal information for one or more of the following business purposes: We allow the user to personalize their AI experiences by inputting documents and information about themselves. We also use personal information to analyze conversation turns for language that may indicate emotional distress or a safety concern and to route alert notifications to designated caregivers as described in the Communications and SMS Notifications section above. For users who have opted in, we also use audio and transcript information for the research described in the Research Program section of our Privacy Policy.

Sharing Personal Information

We share personal information with the third-party service providers listed in the Service Providers section above as necessary to operate our service. We do not otherwise disclose consumer personal information.

Sale of Personal Information

We have not sold consumer personal information in the past twelve (12) months.

Your Rights and Choices

The CCPA provides California residents with specific rights regarding their personal information. This section describes your CCPA rights and explains how you can exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that https://www.evoca-labs.com disclose to you certain information about our collection and use of your personal information in the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you;
• The categories of sources from which we collected personal information about you;
• Our business or commercial purpose for collecting or selling personal information;
• The categories of third parties with whom we share personal information; and
• The specific pieces of personal information we have collected about you (also called a data portability request).

Deletion Request Rights

You have the right to request that we delete any of your personal information that we collected and retained, subject to certain exceptions. Once we have received and confirmed your verifiable consumer request, we will delete, and direct any of our service providers to delete, your personal information from our records, unless an exception applies.

Exercising Your Access and Deletion Rights

To exercise your access and deletion rights described above, please submit a verifiable consumer request to us at:

Non-Discrimination

You have the right to not be discriminated against in pricing and services because you exercise any of your CCPA rights. Unless permitted by the CCPA, we will not use whether or not you have exercised your CCPA rights to deny you goods or services, charge you different prices, provide different levels of service, or suggest different pricing.

Changes To This Privacy Notice

We may amend this Privacy Notice from time to time to maintain compliance with the law and to reflect any changes to our data collection process. We recommend you check this Privacy Notice from time to time to ensure you are aware of any changes. If necessary, we may notify you by email of changes to this Privacy Notice.

Contact Information

If you have any questions or concerns, you can contact us at: