Privacy Policy
Draft for review. Last updated October 2026.
Sahaya is an AI companion built for older adults and the families who care about them. Because the people who use Sahaya share some of the most personal parts of their lives with it, privacy is not a feature we added later. It is the foundation the product is built on. This draft explains what Sahaya collects, how that information is used, and the control the user keeps over all of it.
Our core principle
The older adult who uses Sahaya owns their data. They decide what is remembered, what is shared, and with whom. Family members and caregivers receive information only through permissions the user has explicitly granted, and those permissions can be changed or withdrawn at any time.
Information we collect
- Conversations. Voice and text exchanges with Sahaya, so it can understand requests, respond, and remember what matters to the user.
- Wellness observations. Self-reported notes about sleep, energy, appetite, mood, and routine that the user chooses to share in conversation. These are conversational observations, not clinical measurements.
- Care details. Medication schedules, grocery and meal preferences, and reminders the user sets up.
- Financial information. Bills, invoices, and account details the user provides or authorizes Sahaya to review for its Finance features.
- Trusted contacts. Family members, caregivers, and emergency contacts the user adds, along with their chosen sharing permissions.
- Device and usage data. Basic technical information needed to run the service reliably and keep it secure.
How we use information
Information is used to deliver the features the user has asked for: to answer and assist in conversation, deliver medication and appointment reminders, recognize suspicious or scam-like requests, review bills and flag possible issues, notice meaningful changes in self-reported well-being, and coordinate help from trusted contacts. Sahaya does not sell personal information.
Sharing with family and caregivers
Wellness summaries, activity, and alerts are shared with family or caregivers only with the user's consent. The user controls each permission individually and can review, change, or revoke what is shared at any time. Emergency notifications follow the escalation preferences the user has set up in advance.
How each agent handles data
- Guardian processes interactions to recognize scams and coordinate emergency help. It does not take protective or financial action on the user's behalf without their involvement.
- Care stores medication and shopping preferences to prepare reminders and draft requests. Purchases always require the user's authorization.
- Wellness keeps a personalized memory of self-reported observations to notice patterns over time. Summaries reach family only with permission.
- Finance reviews only the financial data the user authorizes and never moves money or submits a dispute on its own.
Service providers
Sahaya relies on trusted technology providers for AI processing, secure storage, and communication. These providers process information only to operate the service and are expected to protect it with appropriate safeguards. A full list of processors will accompany the released policy.
Your controls
- Review what Sahaya remembers about you.
- Correct or delete information, including specific memories.
- Change or revoke family-sharing permissions at any time.
- Request a copy of your data or close your account.
Security and retention
Information is protected with technical and organizational safeguards and kept only as long as needed to provide the service or as required by law. When data is no longer needed, it is deleted or de-identified.
Who Sahaya is for
Sahaya is designed for adults. It is not directed to children, and we do not knowingly collect information from anyone under 18.
Changes and contact
A complete privacy policy will be published, and reviewed by qualified advisers, before any public release. Until then this draft reflects our intended approach. For questions, please use the contact page.
This is a draft for transparency and does not yet constitute a legally binding privacy policy.