GabrielGabriel privacy notice
Last updated: [to be confirmed]
This notice explains what Gabriel collects, why, who sees it, how long we keep it, and your rights. It is written for four groups of people:
- People who are looked after by Gabriel — you have Gabriel on your phone, and it lets the people you choose know whether there are signs you are up and about.
- Caregivers — you have Gabriel on your phone to receive alerts about somebody.
- Emergency contacts — somebody asked us to text you if they don’t answer a check-in or ask for help. You don’t have the app. Jump to the section for you.
- Visitors to our website — you visited www.mygabriel.care, and perhaps joined the waitlist to hear when Gabriel is available. Jump to the section for you.
Who we are
Gabriel is provided by Matix Ventures, 71-75 Sheldon Street, Covent Gardens, London, WC2H 9JQ (“we”, “us”). We are the controller of your personal data. You can contact us at support@mygabriel.care.
Gabriel is not an emergency service. We never contact the emergency services. If someone is in danger, call your local emergency service provider.
The short version
- Gabriel uses your phone’s record of movement and steps to tell whether you have been up and about. It never knows where you are. It never reads your messages, photos, contacts or which other apps you use.
- The people you choose see simple updates — for example “movement around 9:15” and whether a check-in was answered. They never see your step counts or where you are. If you choose, you can let one person see more (for example “walking 9:02–9:11”).
- If there are no signs of activity for a while, we send you a check-in. If it isn’t answered, or you press “I need help”, we tell the people you chose.
- We keep the detailed record of your movement for 90 days.
- You can download your data and close your account at any time. When you close your account, the people looking after you stop receiving updates straight away and your data is erased within 30 days.
What we collect, and why
If you are looked after by Gabriel
| What | Examples | Why |
|---|---|---|
| Your account | Your first name, your email address, your time zone | To sign you in, to tell your caregivers who an alert is about, and to apply your local times |
| Your phone | A random id we create for the installation, the phone’s push address, the app and system version, whether notifications and background updates are on, whether it is a phone or a tablet, and when it last contacted us | To send you check-ins, and to tell whether monitoring is working. If your phone stops contacting us, we say we don’t know how you are — we never treat silence as inactivity |
| Your movement and steps | From your phone’s built-in motion record: the kind of movement (walking, running, cycling, or being in a vehicle) and its times; how many steps you took in each hour; the 5-minute periods in which the phone was moved or picked up; when you opened Gabriel | To decide whether there are recent signs that you are up and about, and to show your day’s activity |
| Your settings | When your day usually starts and ends, the time we check in each morning, quiet times when you’d rather not be asked, pauses (for example while you are away) | So we only check in when it makes sense |
| Check-ins and help requests | When we checked in, whether it reached your phone, your answer (“I’m fine” or “I need help”), when you pressed “I need help”, and when someone said they had been in touch | To make sure an unanswered check-in or a call for help reaches someone |
| Your routine (only if this feature is switched on for you) | Which 15-minute periods of your day are usually quiet, worked out from your movement record; suggested quiet times and your answers | To suggest quiet times you can accept or decline |
| Who you share with | Your caregivers, their role, what each of them can see, and a monthly reminder of who can see your updates | So you stay in control of who sees what |
| Your emergency contacts (if Gabriel looks after you) | The name, mobile number and relationship (“Daughter”) you give us for each contact | To text them if a check-in goes unanswered or you ask for help |
On iOS, Gabriel may also ask to be told by Apple Health when new step data arrives. This only wakes Gabriel up so your updates are current: we never read any Health data, and never share it.
If you are a caregiver
| What | Why |
|---|---|
| Your first name and email address | To sign you in and to show the person who is looking after them |
| Your phone (as above, without movement) | To send you alerts |
| The alerts you receive and whether you read them; when you said you had been in touch | To run alerts and to keep a history |
| Changes you make to the person’s settings (for example quiet times, if you are the primary caregiver) | So the person is told about the change and can undo it |
| Your mobile number (if you are the primary caregiver and agree to be texted) | To text you as well as alerting you in the app |
| The name you type when you invite someone, until they join | To show you who you invited |
| When you last opened Gabriel (to the minute; only the latest, no history) | To show the people you look out for when you were last around (“Last seen”). We keep this only while nobody looks after you |
If you are an emergency contact
Somebody using Gabriel gave us your name, your mobile number and how you know them (for example “Neighbour”). We use them only to text you:
- once, to ask whether you agree to be their emergency contact;
- and, only if you agree, if they don’t answer a check-in for a while or ask for help.
Each text contains their first name, what happened and when, and a link. When you open the link we record your answer (“yes”, “no”, or “I’ve been in touch with them”). The page uses no cookies and no tracking. To protect the page from abuse, we keep a scrambled code derived from your network address for a short time — never the address itself.
If you say no, or follow the “stop” link, we delete your name and number straight away and keep only a scrambled code of the number so nobody can ask you again. If you said no, that code goes after 30 days; if you opted out, it is kept until you ask to receive texts again.
You can ask us about your data at support@mygabriel.care. You have the rights described below.
If you visit our website or join the waitlist
Visiting www.mygabriel.care. Our website sets no cookies and uses no analytics and no tracking. Like any website, it can only reach you by your browser telling it your network address, so two providers see that address when a page loads:
- Render, which serves the website’s pages and pictures, sees your network address and what your browser asked for. [to be confirmed]
- Google provides the website’s fonts (Google Fonts), so your browser sends your network address and its browser details to Google when a page loads. We don’t send Google the address of the page you are reading. [to be confirmed]
Joining the waitlist. If you leave your email address, we keep:
| What | Why |
|---|---|
| Your email address | To email you when Gabriel is available |
| Which phone you’re interested in — iPhone or Android — if you chose one of the store buttons | So we tell you when Gabriel is available for your phone |
| When you joined | To know how long we have kept it |
That is all: no name, and nothing that links your email address to your network address. We never tell anyone whether an email address is on the waitlist, and we don’t use it for anything else.
To stop automated sign-ups, when you send the form we keep a scrambled code derived from your network address (never the address itself) to limit how many sign-ups come from one connection. It is not linked to your email address, and it is deleted within two hours.
You can leave the waitlist at any time: [to be confirmed] or email support@mygabriel.care. We then delete your email address. [to be confirmed]
What we don’t collect
- Your location — Gabriel asks for no location permission, on iPhone or Android.
- Raw sensor readings — only summaries leave your phone.
- What you do in other apps, your messages, photos, contacts or calendar.
- Health data from Apple Health — see above.
- Advertising or tracking identifiers. There is no advertising, no analytics and no tracking in Gabriel, and we never sell or share your data for marketing.
Special category data
Information about your movement, routine, check-ins and requests for help is collected to judge whether you might need help. It is likely to be information about your health, which the law protects more strongly.
[to be confirmed]
Our lawful bases
[to be confirmed]
| Purpose | Whose data | Options for the lawful basis (Art. 6) | Note |
|---|---|---|---|
| Running your account and sign-in | everyone with an account | contract (6(1)(b)) | |
| Monitoring and check-ins for the person looked after | person looked after | contract (6(1)(b)) or consent (6(1)(a)) — plus the Art. 9 condition above | Consent is withdrawable at any time; contract fits a service the person signed up for |
| Telling caregivers (alerts, updates, the activity view) | person looked after | as above; the person chooses each caregiver and what they see | The detailed view is an explicit per-caregiver choice |
| Caregivers’ own data | caregiver | contract (6(1)(b)) | |
| Texting emergency contacts | emergency contact | legitimate interests (6(1)(f)) for the first text asking whether they agree, then their agreement (consent, 6(1)(a)) for alerts | A legitimate-interests assessment is needed for the first text |
| Keeping records after an event (history, audit trail) | person, caregiver | legitimate interests (6(1)(f)) / legal obligation (6(1)(c)) | Depends on the retention decisions below |
| Security and abuse prevention (rate limits, logs) | everyone | legitimate interests (6(1)(f)) | |
| Emailing you when Gabriel is available (the waitlist) | waitlist | consent (6(1)(a)) | You ask by joining, and withdraw by leaving the list |
| Loading the website’s fonts from Google | website visitors | legitimate interests (6(1)(f)) | Google receives the visitor’s network address |
| Improving how Gabriel decides when to check in (check-in outcomes; the routine learner’s comparison records) | person looked after | legitimate interests (6(1)(f)) or consent | Health data: needs an Art. 9 condition too; consider making it opt-in during the beta |
| The name a caregiver types for someone they invite | named third party | legitimate interests (6(1)(f)) | Deleted 30 days after the invitation is used or expires |
Who sees your data
The people you choose. Your caregivers see whether there are recent signs of activity, whether your phone is in touch with us, whether you have answered a check-in, whether you have asked for help, any pause, your quiet times, and a simple timeline of your day (for example “movement around 9:15”). They never see your step counts, where you are, or “in a vehicle”. You can let a caregiver see a detailed view that also shows periods of walking, running or cycling; you choose this for each person separately, and can turn it off at any time. Your primary caregiver can change your quiet times; you are told and can undo it. Once a month we remind you who can see your updates.
If you are a caregiver, the people you look out for see when you last opened Gabriel (“Last seen”, to the minute), while they are sharing with you. This is always shown. We don’t record when someone who is looked after opens Gabriel.
Your emergency contacts (if Gabriel looks after you) receive only the texts described above.
Us. A small number of people who run Gabriel can access the data to keep the service working, to investigate problems, and [to be confirmed]. [to be confirmed]
Service providers who process data for us under contract:
| Provider | What for | What they receive | Where | Transfer safeguard |
|---|---|---|---|---|
| Render | Hosting our servers and database | Everything we hold | Frankfurt, Germany (EU) | EU — UK adequacy regulations. [to be confirmed] |
| Render | Serving our website | A visitor’s network address and the pages and pictures they load | Render’s worldwide network [to be confirmed] | [to be confirmed] |
| Google (Google Fonts) | The website’s fonts | A visitor’s network address and browser details | USA and elsewhere [to be confirmed] | [to be confirmed] |
| Resend | Sending emails [to be confirmed] | Your email address and the email | Sent from Ireland; account data, including email addresses, stored in the USA | [to be confirmed] |
| Twilio | Sending texts to emergency contacts | The contact’s mobile number and the text | USA | [to be confirmed] |
| Apple | Delivering notifications to iPhones | The phone’s push address and the notification (for caregivers, the person’s first name and the kind of alert) | USA and elsewhere | [to be confirmed] |
| Google (Android only, when Android is released) | Delivering notifications to Android phones | As for Apple | [to be confirmed] | [to be confirmed] |
We don’t sell your data. We don’t use it for advertising. We don’t use artificial intelligence to make any decision about you: every decision is made by fixed rules.
We may disclose data if the law requires it. [to be confirmed]
How long we keep it
| Data | How long |
|---|---|
| Detailed movement and step records | 90 days |
| Routine picture, quiet-time suggestions log, daily comparisons | 90 days (decided suggestions: 30 days after) |
| Change-by-change record of your status | 90 days |
| Check-ins, help requests, pauses, caregivers’ alerts | [to be confirmed] |
| Emergency contacts | While they are your contact. If a contact says no or stops texts, their name and number are deleted at once |
| The words of texts we sent | 30 days |
| Sign-in codes | 1 day after they expire |
| Ended sign-in sessions | 30 days |
| Invitations | 30 days after use or expiry |
| Monthly sharing reminders | 90 days |
| Server logs (which never contain email addresses, phone numbers or network addresses) | 14 days |
| Backups | Up to 7 days |
| Waitlist email addresses | [to be confirmed] |
| The scrambled code that limits website sign-ups | Two hours |
| The audit trail (a record of what the system did and when, using account numbers, not names or email addresses) | [to be confirmed] |
| Everything, after you close your account | Erased within 30 days (backups: up to 7 days more) |
Your rights
You have the right to:
- access your data — in the app, [to be confirmed] gives you a copy of everything your account holds, as a file [to be confirmed]; or ask us;
- erase it — in the app, [to be confirmed]; or at [to be confirmed] if you no longer have the app; or email us;
- correct it — change your name or email address in the app, or ask us;
- object to processing based on legitimate interests, and to restrict processing;
- withdraw consent at any time, where we rely on it — this does not affect what we did before. For a person looked after by Gabriel, withdrawing means pausing or closing the account, and the people looking after you will no longer be updated;
- data portability — the download is a machine-readable file;
- complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We’d like the chance to help first: support@mygabriel.care.
We answer requests within one month. Emergency contacts, invited people and people on the waitlist, who have no account, can use the email address.
Children
[to be confirmed]
Automated decisions
Gabriel decides automatically when to send a check-in and when to alert caregivers or emergency contacts, using fixed rules about the time since the last sign of activity, your settings and whether your phone is in touch. It never draws a conclusion about how anyone is; it only asks, and tells the people you chose. [to be confirmed]
Security
Data travels encrypted (HTTPS). The database is not reachable from the internet. Sign-in codes, invitation codes and links are stored only in scrambled (hashed) form. Logs are scrubbed of email addresses, phone numbers and network addresses.
Changes to this notice
If we change this notice in a way that affects you, we will tell you in the app [to be confirmed] before the change takes effect.
Contact
support@mygabriel.care · [to be confirmed]