Your voice recordings.
The structured recording sessions during onboarding, plus any optional supplemental recordings you upload to refine the model.
Trust / Your data
Your data is yours. By design, we cannot access it without your permission.
What we collect and what we don't, where it lives, who can access it, and how you delete it.
What we collect.
Three categories. Nothing else.
The knowledge graph you built.
Everything you taught Proxi about your loved one. Names, biography, stories, current routines, sensitivities, redirection scripts, scope rules.
Conversation records, encrypted, your key.
Every interaction Proxi handles is encrypted and can be decrypted only with your key. We keep a system log of what happened and when (timestamps, escalation flags), but the conversation itself stays encrypted to us. You set whether, and how far back, our medical team may review flagged moments; by default, the last two minutes plus anything out of character, unless you opt into more thorough monitoring or out of monitoring entirely.
What we do not collect.
Background audio.
The smart speaker does not record the room. It wakes only when your loved one calls out, for you or for help, records just that conversation with Proxi until it ends, and nothing more. Only you hold the key to that audio.
Conversations outside the loop.
What you say in person, off-microphone, is not in the data.
Third-party voices.
Only your voice, by your consent. Not your spouse’s, not your children’s, not anyone else’s without their explicit, separately-recorded consent.
Medical records.
We are not pulling from EHRs.
Behavioral data outside conversations.
Browsing, typing, location, device usage. None of it.
Where the data lives
Encrypted, US-hosted, deletable.
- Voice models and conversation data: encrypted at rest with per-customer keys.
- Region: US-based hosting by default.
- Encryption: AES-256 at rest, TLS 1.3 in transit.
- Backups: retained per your retention settings, encrypted, deletable on command.
We host on generic commercial cloud infrastructure. What makes the data safe is not where it lives, it is what surrounds it: cryptographic encryption end to end, time-shredded keys for ephemeral conversation data, per-customer isolation, and audit trails on every access. We provide a separate technical writeup of the cryptography and key-custody architecture on request to clinical and partnership counterparties.
Access control
Who can see what.
You
Everything. Always. Logs, transcripts, summaries, your voice model, your knowledge graph. All exportable, all editable, all deletable.
Our team
Limited, audited, and only with your consent. For flagged moments our medical team reviews transcripts, not audio, within the lookback window you set. If you opt out of monitoring, you opt out of our safety review entirely and take responsibility for any resulting harm. Engineering can access infrastructure and system data only with documented cause, but cannot reach your conversation data even with a super-user password. All access is logged.
Clinicians
Only when you authorize specific information sharing. Default state is no clinical access.
Third parties
None, without your explicit consent.
Law enforcement
Per legal process. We resist overbroad requests, notify you when we are legally permitted to do so, and do not provide data outside the scope of a valid warrant or subpoena.
HIPAA
HIPAA-grade controls.
Proxi handles information that is health-adjacent at minimum and may constitute Protected Health Information depending on context. ProxiCare self-certifies as HIPAA-compliant. We treat all caregiver and patient data under HIPAA-grade controls and sign Business Associate Agreements with clinical partners on request.
Retention and deletion
Retention defaults.
These are defaults. You can shorten or extend each window, within the limits the law requires.
Conversation audio
30 days, then automatic deletion. You can extend.
Conversation transcripts and summaries
12 months, then automatic deletion. You can extend.
Voice model
Retained for the life of your service. Re-trainable.
Knowledge graph
Retained for the life of your service. Editable.
Deletion on demand.
At any time, you can delete a specific conversation log, all logs older than X, the knowledge graph, the voice model, or the entire account.
Deleting the entire account.
Voice model deleted. Knowledge graph deleted. Logs deleted (or exported first). Keys revoked. Service ended. Confirmed within 24 hours, audited, reportable.
After your loved one passes.
End-of-life is part of how the product works.
- Service does not auto-continue after notification of death.
- You can choose to retain the voice model and conversation history as a personal archive.
- You can choose to delete everything immediately.
- You can choose to retain selected conversations as memorial recordings, with the rest deleted.
This decision is yours. We will not pressure either way.
After you pass.
We need to know what you want. Setup includes a few questions about end-of-life data preferences for the caregiver, not just the patient.
Data rights
A baseline. We do not subtract.
Wherever you are, you have the following rights, as a baseline. Some jurisdictions add more. We do not subtract.
Access
See all data we hold about you. Exportable.
Correction
Fix anything wrong.
Deletion
Have it removed.
Portability
Get a machine-readable copy you can take elsewhere.
Restriction
Pause processing while you decide.
Objection
Refuse processing for any purpose outside delivering the service.
No automated decision-making
No automated decisions about you (pricing, eligibility) without explicit, transparent disclosure.
Independent verification
We will publish:
- Privacy policy version history with diffs.
- Notable security incidents within the disclosure windows required by law and our additional voluntary disclosure timelines.
- A separate technical writeup of our encryption and key-custody architecture on request to clinical and partnership counterparties.
Contact
Privacy questions, requests, complaints
privacy@proxi.care