HaloraFind out more

Privacy policy

Last updated: 11 September 2026 (version 0.5)

This policy covers our website, the Halora web app, and the Halora apps for iPhone and Android.

1. Introduction

1.1 This Privacy Policy (together with our terms and conditions and any other documents referred to in it) describes the types of information that we collect from you (“you/your”), how that information may be used or disclosed by us, and the safeguards we use to protect it. It covers all three places you may meet Halora:

1.2 Where something applies to one of these and not the others, this policy says so. We use “the app” to mean the web app and the mobile apps together, since they are the same service seen through different screens. This policy does not cover actualisedliving.com, which has its own.

1.3 Halora is a shared record for a group of people looking out for one person. Family, friends, neighbours and paid carers each leave a short note about how that person seemed, and Halora puts those notes together so that a change nobody could see on their own becomes visible. The Website explains what it is, and allows you to contact us, join our waiting list, or ask to take part in a pilot.

1.4 That means Halora holds information about someone who is often not the person using it. This policy tries to be clear about both: what we hold about you, and what we hold about the person you are looking out for.

1.5 Our Website and app may contain links to third party websites that are not covered by this Privacy Policy. We therefore ask you to review the privacy statements of other websites and applications to understand their information practices.

1.6 We have drafted this Privacy Policy to be as clear and concise as possible. Please read it carefully to understand our policies regarding your information and how we will treat it. By using or accessing our Website or app, you agree to the collection, use and disclosure of information in accordance with this Privacy Policy. This Privacy Policy may change from time to time and your continued use is deemed to be acceptance of such changes, so please check periodically for updates.

1.7 This Privacy Policy was last updated on 11 September 2026.

1.8 If you have any comments on this Privacy Policy, please email them to admin@actualisedliving.com.

1.9 You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

2. Who we are

2.1 Halora is owned and developed by Actualised Living Limited. We are a private limited company registered in England and Wales. We are not a charity, a community interest company or a public body. Here are the details that the UK General Data Protection Regulation (“UK GDPR”) says we must give you as a ‘data controller’:

2.2 We respect your right to privacy and will only process personal information about, or provided by, you in accordance with the Data Protection Legislation, which for the purposes of this Privacy Policy shall mean the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (as amended), and any successor or other applicable privacy legislation, in each case as amended or updated from time to time.

2.3 For the Website, and for a circle set up by a family or by a group of friends and neighbours, Actualised Living Limited is the data controller.

2.4 Where a care provider or a commissioner deploys Halora under its own arrangements, that organisation is the controller and we act as its processor.

3. What we collect through the Website

3.1 Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

3.2 Through the Website we may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

  • Identity Data includes first name, last name, and, where you tell us, your role or organisation, and your relationship to a person who might be supported through Halora.
  • Contact Data includes email address, telephone number and postal address.
  • Enquiry Data includes the content of any message you send us through a form on the Website or by email, and our reply.
  • Waiting List Data includes your name, your email address and any optional details you choose to give us, such as your postcode area, your role, or whether you would like to take part in a pilot.
  • Pilot Application Data includes your contact details, your relationship to the person who would be supported, and enough about the situation for us to judge whether a pilot would be a fit.
  • Technical Data includes internet protocol (IP) address, browser type and version, time zone setting and approximate location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Website.
  • Usage Data includes information about how you use the Website, including pages visited and how you arrived.
  • Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences. We do not currently track whether you have opened or clicked one of our emails. If we introduce that in future, we will update this policy before we begin.
  • Cookies Data. Like many websites, our Website uses cookies to gather information about visitors and visits. Please refer to section 6 for information about the cookies we use.
  • Analytics. We may use third-party analytics services to evaluate use of the Website, compile reports on activity, and analyse performance. These third parties use cookies and similar technologies to provide us with that data.

3.3 We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity. If we combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data and use it in accordance with this Privacy Policy.

3.4 We do not seek Special Categories of Personal Data through the Website. This includes details about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, and genetic or biometric data. Nor do we seek information about criminal convictions and offences. Special category data is held inside the app, and section 4 explains that.

3.5 Please do not send us health information, or details about a named person’s care, through the Website. If you need to tell us something sensitive, contact us at admin@actualisedliving.com and we will arrange a more appropriate way. Where you do include such information in an enquiry, we will hold it only for as long as we need to reply to you, and we will handle it in accordance with the Data Protection Legislation.

3.6 If you give us personal information about another person, for example when enquiring on behalf of a relative, you are responsible for ensuring that the contents of this Privacy Policy are brought to their attention.

4. What the app collects

4.1 Your account. Your name, your email address, and a password. We never store the password itself, only a one-way hash of it, which cannot be turned back into the password.

4.2 About the person being looked after. Their name, the address of the home, a postcode, optionally their year of birth, how they would like to be referred to, and what people call them. This is entered by whoever sets the circle up.

4.3 Notes.What each person writes or says about how the person seemed. This is the heart of the record, and it will often describe someone’s health, mood, mobility or state of mind. We treat it as special category data.

4.4 What the app works out from those notes. A sense of mood and of wellbeing, and short observations drawn from what was said. These are derived by the software from the note. Nobody is ever asked to score anybody, and the app does not ask contributors to rate a person.

4.5 Photos, if you choose to add them. A profile photo for your account, and one for the person a circle is about. Both are optional. What you upload is re-encoded on our servers before it is stored, which removes the hidden data cameras attach to photos, including location.

4.6 Voice recordings. If a note is spoken rather than typed, the recording is sent to us so it can be turned into text. See section 7.

4.7 Door markers. A sticker on a door carries a code. If it is scanned, the app records that a visit began at that door and when. The marker is a record of provenance, not a way of proving who anybody is.

4.8 Invitations. When you invite somebody into a circle: their name, the email address or phone number you invite them at, and how they are related to the person.

4.9 An access record. Every time a note or a derived insight is read, we record who read it and when. Sign-ins and failed sign-in attempts are recorded too. This exists so that the person being looked after, or somebody acting for them, can be told who has seen their record.

4.10 What the app does not collect.There is no advertising in Halora, no analytics or tracking software in the app, and no third-party software development kit that reports your behaviour to anyone. We do not collect your device’s location. The app does not track you across other apps or websites, and we do not sell or share information for advertising.

5. How we may collect and use your data

5.1 We (or third party data processors, agents and sub-contractors acting on our behalf) may collect, store and use your personal information through:

a) direct interactions: information you give us by filling in a form on the Website, by entering it into the app, or by corresponding with us by post, telephone, email or otherwise, including when you make an enquiry, join our waiting list, ask to take part in a pilot, request marketing, give us feedback or complete a survey;

b) automated technologies: as you browse the Website, through cookies, server logs and similar technologies; and

c) third parties: including our suppliers and our analytics provider.

5.2 We may use your information in the following ways:

a) to reply to your enquiry;

b) to add you to our waiting list, and to tell you when Halora becomes available;

c) to assess an application to take part in a pilot, and to contact you about it;

d) to provide the Halora service to you and to the circle you are part of, which means storing the notes people add, bringing them together, and showing each person what they have been given access to see;

e) to present the content of the Website effectively to you, and to personalise your experience of it;

f) to administer a survey, feedback exercise or other feature of the Website or app;

g) where you have opted in, to send you periodic emails about Halora. If you no longer wish to receive them, see section 14;

h) to understand how the Website is used, and to improve it;

i) to keep the access record described in section 4.9, so that we can tell a person who has seen their record;

j) to comply with the law, and to assist a government, regulatory or law enforcement body where we are required or authorised to do so.

5.3 We do not use any information collected through the Website or the app to train, develop or improve any artificial intelligence model.

5.4 If you are already in contact with us, we will only contact you electronically about matters similar to those we have already discussed. If you are new to us, you will only be contacted if you have agreed to it.

5.5 If you do not want us to use your personal data for any of the purposes set out in this section, you can tell us at any time by contacting us at admin@actualisedliving.com, and we will delete your data from our systems. You acknowledge that this may limit our ability to reply to you, to keep you informed about Halora, or to provide the service to you.

5.6 With your permission, and where permitted by law, we may use your data for marketing purposes, which may lead to us contacting you by email or telephone with information and news about Halora. We will not send you unsolicited marketing or spam, and we will not disclose your information to a third party so that they can market to you. We will take all reasonable steps to comply with our obligations under the UK GDPR and the Privacy and Electronic Communications Regulations 2003, as amended.

6. Cookies, analytics and tracking

6.1 All cookies used by and on our Website are used in accordance with current UK cookie law.

6.2 The Website itself sets no cookies. There is no login on the Website, so there is no session cookie. Your cookie choice is kept in your browser’s local storage, on your device only, and is never sent to us. This is strictly necessary and does not require your consent.

6.3 Optional cookies on the Website, including analytics and any embedded video or maps, are set only if you agree on the cookie banner. You may change your mind at any time using the “Cookie settings” link in the Website footer, and you may block or delete cookies through your browser, although parts of the Website may then not work properly.

6.4 With your consent, our analytics provider sets two cookies, _ga and _ga_M38W2VQGCD, each retained for two years unless you remove them sooner. If you withdraw consent, collection stops and both cookies are deleted. Our analytics do not record or store IP addresses.

6.5 The only other third party that may set cookies on the Website is our video host, and only if you consent to embedded video and then play our film. The player is loaded in its no-cookie mode. Our fonts are served from the Website rather than from a third party, and we use no maps, chat or advertising technologies.

6.6 The web app sets no cookies. Because you sign in to it, it keeps your sign-in token in your browser’s local storage, on your device only, together with two display preferences: whether you prefer the light or dark appearance, and which calendar view you last used. All three are strictly necessary or a convenience for you, and none is analytics.

6.7 There is no analytics, tracking or advertising technology in the web app or in the mobile apps, and no third-party software development kit that reports your behaviour to anyone.

7. Voice notes and transcription

7.1 A spoken note is recorded on your phone only while you are recording it, and only after you have given the app permission to use the microphone. You can withdraw that permission at any time in your phone’s settings; the app then falls back to typing.

7.2 When you finish, the recording is uploaded to us so it can be turned into text.

7.3 The recording is not kept once the text has been produced. What is kept is the text.

7.4 The transcription itself is done for us by a specialist provider within the European Union. Your recording is sent to them for that purpose and for no other.

7.5 We do not use anything you record to train an artificial intelligence model, and our arrangement with our transcription provider does not permit them to either.

7.6 That provider is inside the European Union rather than the United Kingdom, so sending a recording to them is a transfer. Section 10.3 describes the safeguards we apply to transfers.

8. Halora AI

8.1 Halora AI is an assistant you can ask questions of in your own words. It is a private conversation between you and Halora: nobody else in a circle sees what you ask it or what it answers.

8.2 To answer a question about how somebody has been, it reads the record. It sees exactly what you would see if you opened the app yourself, and never more. If you have been given a narrow view of a circle, that is the view it answers from.

8.3 What it reads is bounded. It looks back a fortnight and forward a fortnight, and no further, and there is a limit on how much of a record it can take in at once. Where it cannot see enough to answer, it says so rather than guessing.

8.4 Every time it reads a record in order to answer you, that is recorded in the access record described in 4.9, in the same way as a person opening the screen. It is marked as a Halora AI read, so the person being looked after, or somebody acting for them, can see that it happened and why.

8.5 The model that produces the answer is run for us by a provider inside the United Kingdom. What is sent to it is your question and the bounded extract described in 8.3, and it is sent for that purpose and for no other.

8.6 Nothing you or anybody else puts into Halora is used to train, develop or improve an artificial intelligence model, and our arrangement with our model provider does not permit them to do so either.

8.7 Halora AI does not make decisions. It answers questions and surfaces things worth asking about, and what it produces is shown alongside the notes it came from so you can see the basis for it and disagree. Section 18 sets out your rights about automated decision-making.

8.8 Separately from the assistant, Halora works out a sense of mood and wellbeing from the notes people add, as described in 4.4. That is also done by software rather than by a person, and the same points in 8.6 and 8.7 apply to it.

9. Our lawful basis

9.1 Under the UK GDPR we will ensure that your personal data is processed lawfully, fairly and transparently, without adversely affecting your rights. We will only process your personal data where at least one of the following applies:

a) you have given consent to the processing of your personal data for one or more specific purposes;

b) processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract;

c) processing is necessary for compliance with a legal obligation to which we are subject;

d) processing is necessary to protect the vital interests of you or of another natural person; and/or

e) processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where those interests are overridden by your fundamental rights and freedoms.

9.2 For the Website, most commonly our basis is our legitimate interests in replying to you and in running and improving the Website, where your interests and fundamental rights do not override those interests; or compliance with a legal or regulatory obligation; or your consent. We do not rely on consent as a legal basis other than in relation to marketing communications and optional cookies. You have the right to withdraw consent at any time by contacting us at admin@actualisedliving.com, and we will either delete your data from our systems or move your data to our unsubscribe list, as appropriate. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

9.3 For your own account information in the app, our lawful basis is legitimate interests: we cannot run an account-based service without knowing who holds the account. You can close it at any time (section 15).

9.4 For information about the person being looked after, including information about their health, our position depends on who is running the circle.

  • Where a family or a group of friends and neighbours set up a circle for somebody they know, we rely on the explicit consent of the person being looked after, or of somebody with lawful authority to consent for them.
  • Where a care provider or a commissioner deploys Halora as part of providing care, we rely on Article 9(2)(h) of the UK GDPR, the provision of health or social care under the responsibility of a professional bound by a duty of confidentiality.

10. Where we store your data, and security

10.1 Your personal data is stored and processed within the United Kingdom or the European Union. Personal data that you send us through the Website, such as an enquiry or a waiting list sign-up, is stored in the United Kingdom. Halora itself runs on cloud infrastructure in London, and information in a circle is stored in the United Kingdom. Transcription, described in section 7, is carried out within the European Union. Website analytics are the one exception, and are described in 10.2.

10.2 Website analytics are the exception. If you consent to analytics cookies, our analytics provider receives the data at a regional collection centre in the UK or the EU, where your IP address is used to derive an approximate location and is then discarded. It then forwards the remaining data to its own global infrastructure for processing, so that data does not stay within the United Kingdom or the European Union. This applies to Website analytics only: no information from a circle, and nothing you enter into the app, is processed outside the United Kingdom or the European Union.

10.3 Where it is necessary for a supplier to process personal data outside the United Kingdom or the EEA, we will take all reasonable steps to ensure that your data is treated as safely and securely as it would be here. Such steps include the use of the UK International Data Transfer Agreement, or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. For our analytics provider we rely on the data protection terms it provides to its analytics customers, which incorporate the International Data Transfer Addendum to the EU Standard Contractual Clauses.

10.4 Data security is of great importance to us. To protect your data we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the data we collect. The Website and the app are served over HTTPS, and personal data is encrypted in transit and at rest.

10.5 In addition, the content of every note is encrypted before it is written to the database, using AES-256-GCM, with a key held separately from the data. Somebody who obtained a copy of the database would not be able to read the notes.

10.6 Everything travels over an encrypted connection. The app refuses to talk to a server that does not offer one.

10.7 Who can see what inside a circle is controlled by the person who set it up. A neighbour who checks in can be given a much narrower view than a daughter or a district nurse, and the person being looked after can be given sight of their own record.

10.8 We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality. Access is protected by multi-factor sign-in.

10.9 We have put in place procedures to deal with any suspected personal data breach. We will assess a suspected breach within 24 hours, notify the ICO within 72 hours where we are legally required to do so, and tell you in plain language if there is a risk to you.

10.10 Notwithstanding the security measures that we take, it is important to remember that the transmission of data via the internet may not be completely secure. You are advised to take suitable precautions when transmitting data to us via the internet.

10.11 You must keep your Halora password confidential and must not share it.

11. How long we keep your data

11.1 We will keep personal data for no longer than is necessary.

11.2 For the Website, our current retention periods are: enquiries and our replies, 24 months after the conversation ends; waiting list subscribers, until you unsubscribe and then 6 months so that we do not contact you again in error; pilot applications not taken forward, 12 months; server and security logs, 12 months; analytics, 2 months for event data and 14 months for user data, the latter reset each time you visit again.

11.3 Records that we are required to keep for legislative, regulatory or accounting reasons are retained for as long as the law requires. We review our retention obligations to ensure we are not holding data for longer than we need to.

11.4 For the app, we want to be straightforward, because the honest answer is not yet the answer we want it to be. A circle can be given a retention setting, which is intended to delete notes older than a chosen number of days. That setting is not yet enforced by the software. Notes are currently kept until somebody deletes them, until the circle is closed, or until the account that owns a circle nobody else is in is closed. The access record described in section 4.9 is currently kept indefinitely.

12. Disclosing your information

12.1 We are allowed to disclose your information in the following cases:

12.1.1 to a potential buyer, if we wish to sell our business or our company;

12.1.2 to other businesses in our group, if we have any;

12.1.3 where we have a legal obligation to do so, or in order to protect other people’s property, safety or rights, including to protect somebody from serious harm; and

12.1.4 to others, in order to protect against fraud or credit risk.

12.2 We may contract with third parties to supply services to us or on our behalf. In some cases those third parties require access to some of your data. The third parties who have access to your information are:

  • Our cloud hosting provider– hosting and storage for the Website and for Halora itself, London, United Kingdom.
  • Our form handling and email provider– London, United Kingdom.
  • Our analytics provider– Website analytics only. See 10.2, which explains that this is the one thing processed outside the United Kingdom and the European Union.
  • Our transcription provider– turning voice notes into text, within the European Union. See section 7.
  • Our model provider– running the model behind Halora AI, within the United Kingdom. See section 9.
  • Our video host– only if you consent to embedded video and play our film. See 6.5.
  • Mailing list: we do not currently use a mailing list provider.
  • Error monitoring: we do not currently use an error monitoring provider.

12.3 We will tell you the identity of any of these providers if you ask us at admin@actualisedliving.com.

12.4 Inside Halora, the information in a circle is seen by the people in that circle, at whatever level of access they have been given.

12.5 Where any of your data is required for such a purpose, we will take all reasonable steps to ensure that your data is handled safely, securely, and in accordance with your rights, our obligations and the obligations of the third party under the Data Protection Legislation.

12.6 We do not sell personal information, we do not share it for advertising or marketing, and we do not use it to build advertising profiles.

13. Your rights

13.1 When you submit information, you may be given options to restrict our use of your data. We aim to give you strong controls over our use of your data, including the ability to opt out of receiving emails from us by using the unsubscribe link in any message.

13.2 Under the UK GDPR you have the right to:

a) request access to your personal data held by us, at no cost to you;

b) request the correction of your personal data;

c) request the deletion of your personal data, where we are not required to retain it;

d) request that your personal data be transferred to another person (data portability);

e) be informed of what processing is taking place;

f) restrict processing;

g) object to the processing of your personal data;

h) withdraw consent; and

i) complain to a supervisory authority.

13.3 A person being looked after has these rights over their own record, whether or not they use the app themselves. If they cannot exercise them directly, somebody with lawful authority can do so on their behalf. Write to us and we will help.

13.4 You also have rights in respect of automated decision-making and profiling, as set out in section 18.

13.5 You have the right to ask us not to process your personal data for marketing purposes. We will usually tell you, before collecting your data, if we intend to use it for such purposes.

13.6 To exercise any of these rights, or if you have any other question about Halora or this Privacy Policy, please contact us at admin@actualisedliving.com. Please include your name, your contact details and a clear description of your request. We will acknowledge your request promptly and respond within one month. There is no charge. We may need to verify your identity first, so that information is not disclosed to the wrong person. If we are unable to do what you have asked, we will explain why.

13.7 If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you came to us first so we can put it right.

14. Marketing and how to opt out

14.1 Every marketing email we send carries an unsubscribe link. You may also reply to any message, or write to us at admin@actualisedliving.com, and ask us to stop.

14.2 Opting out of marketing does not stop us replying to an enquiry you have made, contacting you about a pilot application you have submitted, or sending you the messages we have to send to run your account.

15. Closing your Halora account

15.1 You can close your account from inside the app, or ask us to close it for you. What is deleted, what stays, and why, is set out in full at haloraapp.co.uk/delete-account.

16. Children

16.1 Halora is not intended for use by anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, tell us and we will delete it.

17. Links to other sites

17.1 Please note that our terms and our policies do not apply to other websites that you reach via a link from our Website or app. We have no control over how your data is collected, stored or used by other websites, and we advise you to check the privacy policy of any such website before providing data to it.

18. Automated decision-making and profiling

18.1 Nothing on the Website makes an automated decision about you. Enquiries and pilot applications are read and assessed by a person.

18.2 Halora reads notes and works out a sense of how somebody has been. It surfaces questions for people to answer. It does not make decisions about anybody’s care, and nothing it produces has a legal effect or similarly significant effect on anyone. A person decides; the app only shows them what it noticed.

18.3 What the app works out is always shown alongside the notes it came from, so that anybody reading it can see the basis for it and disagree.

18.4 In the event that we were to use personal data for the purposes of automated decision-making, and those decisions had a legal or similarly significant effect on you, you would have the right to challenge such a decision, to request human intervention, to express your own point of view, and to obtain an explanation of the decision from us.

18.5 The right described in section 18.4 does not apply where the decision is necessary for the entry into, or performance of, a contract between you and us; where the decision is authorised by law; or where you have given your explicit consent.

18.6 Where we use your personal data for profiling purposes, the following shall apply:

a) clear information explaining the profiling will be provided, including its significance and its likely consequences;

b) appropriate mathematical or statistical procedures will be used;

c) the technical and organisational measures necessary to minimise the risk of errors, and to enable any errors to be easily corrected, will be implemented; and

d) all personal data processed for profiling purposes will be secured in order to prevent discriminatory effects arising out of profiling.

19. Changes

19.1 If we change this Privacy Policy, we will post the changes on this page and update the version and date at the head of this document. Where a change is significant we will tell people using the app before it takes effect, and if we decide to, we may also email you.

20. Your consent

20.1 By using our Website or app, and by way of acknowledgment, you consent to this Privacy Policy.

21. Governing law

This Privacy Policy is governed by the law of England and Wales.