Legal

Privacy Policy

Version 2.1 · Effective from our launch in October 2026 · Last updated 8 October 2026

SilaCares (“SilaCares”, “we”, “us”, “our”), a sole proprietorship registered in Bangladesh with its registered office at 67 Kazi Nazrul Islam Avenue, Farmgate, Tejgaon, Dhaka 1215, Bangladesh, provides AI-assisted remote care services for elderly people and the families who love them.

Privacy is not a compliance checkbox for us. We are asking families to trust us with the daily rhythms, medication routines and health of the person they care about most. That trust is the product. This policy explains, in plain language and in full detail, what personal data we collect, why we collect it, the legal basis on which we do so, who we share it with, how long we keep it, how you can have it deleted, and the rights you can exercise at any time.

The short version

We collect only what is needed to deliver care check-ins, reminders, summaries and emergency alerts.
We never sell your data, never use it for advertising, and never train general-purpose AI models on your family’s conversations.
Health information is processed only with explicit consent, which you can withdraw at any time.
You can export or delete your data at any time. Deletion completes within 30 days, and within 90 days in backups.
You have the full set of GDPR rights, and we honour them for the person receiving care as well as the account holder.
We are building SilaCares to meet Saudi Arabia’s Personal Data Protection Law (PDPL) — see section 12.

1. Who we are

SilaCares is the data controller for the personal data described in this policy. That means we decide why and how your data is processed, and we are accountable for it.

Controller: SilaCares, a sole proprietorship registered in Bangladesh (proprietor: Mirza Ferdous Ohid)
Trade licence: No. TRAD/DNCC/020914/2026, issued by Dhaka North City Corporation
Registered address: 67 Kazi Nazrul Islam Avenue, Farmgate, Tejgaon, Dhaka 1215, Bangladesh
Telephone: +880 1711 081888 (Bangladesh) · +966 50 606 2411 (Saudi Arabia)
Privacy contact: privacy@SilaCares.com
General contact: hello@SilaCares.com

Where we process data on documented instructions from a partner organisation — for example a clinic or care agency that deploys SilaCares to its own patients — that organisation may be the controller and we act as their processor. In those cases the partner’s own privacy notice governs, and our processing is bound by a written data processing agreement.

2. Who this policy covers

This policy applies to four groups of people, and we are transparent with each of them:

Account holders — the family caregiver who creates and manages the account.
People receiving care — the elderly loved one whom Sila checks in on. They are a data subject with full rights in their own name, independent of the account holder.
Care circle contacts — emergency contacts, neighbours or “local buddies” whose contact details the account holder provides.
Healthcare professionals — doctors or clinics named on a care profile, or who receive reports.

It also covers visitors to our website at SilaCares.com.

3. Data we collect

Account data

Your name, email address, password (stored only as a salted hash — we never see or store your plaintext password), phone or WhatsApp number, preferred language, country and time zone, and your subscription plan.

Care profile data

Information you provide about the person receiving care: their name, age or date of birth, location, spoken language, chosen messaging channel and number, daily routine and meal preferences, medication names, doses and schedules, mobility or memory notes you choose to add, and details of their doctor, hospital or local buddy.

Interaction data

Messages, voice notes and calls exchanged between the person receiving care and Sila; transcriptions and AI-generated summaries of those exchanges; medication adherence confirmations; mood and wellbeing entries; and SOS events including the time, trigger and who was alerted.

Care circle contact data

Names, relationships, phone numbers and email addresses of the emergency contacts the account holder configures.

Payment data

Billing name, billing address, subscription history and invoices. We do not collect or store full payment card numbers. Card details are captured and processed directly by our payment provider under PCI-DSS; we receive only a token, the card brand and its last four digits.

Technical and usage data

IP address, browser and device type, operating system, timestamps, pages viewed, referring page, and application and security logs needed to keep the service reliable and to detect abuse.

Support communications

Emails, chat messages and any attachments you send us when requesting support, plus our replies.

4. Where we get it from

Most data comes directly from you. Some comes from others, and we are explicit about this because of the transparency duty under Article 14 GDPR:

From the account holder: the care profile and care circle contact details are typically entered by the family caregiver, not by the person receiving care themselves. If your details were added by a family member, you have the right to be informed — and we will tell you on first contact who added you and why.
From the person receiving care: their replies, voice notes, mood entries and adherence confirmations.
From messaging platforms: delivery and read receipts and the sender identifier, as passed to us by WhatsApp or Telegram.
From our payment provider: the outcome of a payment, and the card token and last four digits.

If you were added by someone else: when Sila first contacts a person receiving care, or when we first contact a care circle member, we identify ourselves, explain who added them, explain what will happen, and tell them how to object or be removed. Nobody is enrolled silently.

5. Why we process it, and our legal bases

Under Article 6 GDPR we must have a lawful basis for every processing activity. Here is exactly what we do and why we are permitted to do it.

What we do	Data used	Legal basis
Create and operate your account	Account data	Performance of a contract — Art 6(1)(b)
Send check-ins, medication and routine reminders; understand replies	Care profile, interaction data	Performance of a contract — Art 6(1)(b)
Process medication, health and mood information	Health data	Explicit consent — Art 9(2)(a), on top of Art 6(1)(a)
Generate daily and weekly family summaries and doctor-ready reports	Interaction data	Performance of a contract — Art 6(1)(b); explicit consent for health content
Operate the SOS alert chain in an emergency	Care profile, care circle contacts, relevant health context	Vital interests — Art 6(1)(d) and Art 9(2)(c); contract — Art 6(1)(b)
Contact care circle members and doctors you nominated	Care circle contact data	Legitimate interests — Art 6(1)(f): enabling the safety net the account holder set up
Take payment and issue invoices	Payment data	Performance of a contract — Art 6(1)(b); legal obligation — Art 6(1)(c)
Keep the service secure, prevent fraud and abuse	Technical data	Legitimate interests — Art 6(1)(f): protecting our users and our service
Improve reliability and fix faults	Aggregated and pseudonymised usage data	Legitimate interests — Art 6(1)(f): running a service that works
Answer your support requests	Support communications	Performance of a contract — Art 6(1)(b)
Send service announcements (outages, policy changes)	Account data	Legitimate interests — Art 6(1)(f): keeping you informed about a service you pay for
Send marketing emails	Account data	Consent — Art 6(1)(a); withdrawable in one click
Comply with legal, tax and accounting duties	Account and payment data	Legal obligation — Art 6(1)(c)
Establish, exercise or defend legal claims	As strictly necessary	Legitimate interests — Art 6(1)(f); legal obligation — Art 6(1)(c)

Where we rely on legitimate interests, we have carried out a balancing assessment weighing our interest against your rights and freedoms, and we have concluded that our processing does not override them. You may request a summary of that assessment, and you may object to this processing at any time — see Your privacy rights.

What we never do: we do not sell personal data. We do not share it with data brokers. We do not use it for behavioural advertising or profiling for marketing. We do not use your family’s conversations to train general-purpose or third-party AI models.

6. Health and special category data

Medication schedules, health conditions, mood entries and the content of care conversations are special category data under Article 9 GDPR and receive heightened protection.

We process it only on the basis of explicit consent — Art 9(2)(a) — captured separately during setup, in clear language, as a specific opt-in rather than a pre-ticked box or a condition buried in our terms.
In a genuine emergency, where the person is physically or legally incapable of giving consent, we may also rely on vital interests — Art 9(2)(c) — to pass relevant health context to the emergency contacts you configured. This is limited to what is necessary to help them respond.
Access to special category data inside SilaCares is restricted to the minimum number of staff who need it, on a role-based basis, and every access is logged.
You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand, but it will materially limit or stop the care service, since medication reminders cannot function without medication data.

SilaCares is not a medical device and does not provide medical advice, diagnosis or treatment. It supports routine, communication and family awareness. It does not contact emergency services on your behalf. In a life-threatening situation, always call your local emergency number.

This is the part most elder-care services get wrong, so we want to be precise about it.

The person receiving care is a data subject in their own right. They are not merely the subject of the account holder’s subscription. Accordingly:

We tell them. On first contact, Sila introduces herself as an AI care companion, names the family member who set the service up, and explains what will be shared with whom.
They can object. They may ask to stop the check-ins, limit what is shared with family, or have their data deleted — directly, and without needing the account holder’s permission. We will honour that request and inform the account holder that the service has stopped, without disclosing the content of the individual’s communications with us.
Authority to enrol. When creating a care profile, the account holder must confirm that the person receiving care is aware of and agrees to the service, or that the account holder holds legal authority to act for them (for example a power of attorney, deputyship or equivalent). We may ask for evidence of that authority.
Diminished capacity. If a person cannot give informed consent, the account holder must have appropriate legal authority under the law of the person’s country of residence. If we have reason to believe consent or authority is absent, we may suspend a profile until it is resolved.

8. How our AI works

Sila is built on a retrieval-based (RAG) architecture. In practice this means:

Sila draws her answers from the rules, care plan and knowledge configured for your family, and from her defined care role — not from open-ended generation about your loved one’s health.
Conversations are used to deliver the service: sending reminders, recognising replies, producing summaries and triggering alerts.
Your family’s conversations are not used to train general-purpose AI models, ours or anyone else’s.
Where a third-party AI provider performs inference on our behalf, they act as our processor under a data processing agreement, are contractually prohibited from training on your data, and are bound to delete it after processing.
We tell elderly users clearly and repeatedly that Sila is an AI assistant, not a human and not a clinician.

9. Automated decision-making

We do not make decisions producing legal effects or similarly significant effects on you based solely on automated processing, within the meaning of Article 22 GDPR.

Sila does automate routine actions — sending a reminder, flagging a missed dose, escalating an SOS to your care circle. These are designed to prompt human judgement, not replace it: an alert goes to a person, who decides what to do. No automated process denies you the service, changes your billing, or makes a clinical determination. If we ever introduce processing that would fall under Article 22, we will tell you in advance, explain the logic involved, and give you the right to obtain human intervention, express your point of view and contest the decision.

We share personal data only where the service requires it, and only to the extent necessary.

With you: summaries, reports and dashboards in the family portal.
With your care circle: SOS alerts, including the relevant health context, doctor and hospital details you configured — sent to the emergency contacts you nominated, at the same moment rather than one after another.
With doctors you nominate: care summaries and reports, where you have asked us to share them.
With messaging platforms: message content is delivered through WhatsApp (Meta) or Telegram, under each platform’s own terms and privacy policy. We cannot control their independent processing, and we encourage you to read their policies.
With our processors: carefully selected suppliers who provide hosting, AI inference, messaging infrastructure, payment processing, email delivery, error monitoring and customer support tooling. Each is bound by a written data processing agreement under Article 28 GDPR, may process data only on our documented instructions, and must maintain appropriate security.
With professional advisers: lawyers, auditors and insurers, where necessary and under a duty of confidentiality.
With authorities: only where we are legally compelled. We assess every request, refuse those that are overbroad or unlawful, and where we are legally permitted to do so we will notify you before disclosing.
In a business transfer: if SilaCares is involved in a merger, acquisition or sale of assets, data may transfer to the successor entity. It would remain subject to this policy, and we would notify you before it becomes subject to a materially different one.

11. International transfers

SilaCares operates from Bangladesh and serves families across multiple countries, so personal data may be transferred to, stored in, or accessed from countries outside the European Economic Area (EEA) and the United Kingdom, including Bangladesh.

Some of these countries have not received an adequacy decision from the European Commission. Where we transfer personal data of individuals in the EEA or UK to such a country, we commit to putting in place an appropriate safeguard recognised under Chapter V GDPR — such as the European Commission’s Standard Contractual Clauses, together with the UK Addendum where applicable — supported by a transfer impact assessment and any supplementary technical and organisational measures the assessment identifies as necessary.

You may request a copy of the safeguards we rely on by writing to privacy@SilaCares.com.

12. Users in Saudi Arabia (PDPL)

We are building SilaCares to meet the requirements of the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) and its Implementing Regulations, supervised by the Saudi Data & AI Authority (SDAIA). For people in the Kingdom, this means:

Consent and purpose. We process personal data, and health data in particular, only for the care purposes described in this policy and on the legal bases the PDPL recognises, including explicit consent where it is required.
Your PDPL rights. You may be informed about how your data is used, access it, obtain a copy, have it corrected or completed, and have it destroyed when it is no longer needed — using the same channels set out in section 17.
Transfers outside the Kingdom. Where personal data of people in the Kingdom is transferred abroad, we will do so only in the circumstances and with the safeguards the PDPL and its transfer regulations permit.
Breaches. We will notify SDAIA and affected individuals of a personal data breach within the timeframes the PDPL requires.

A formal PDPL compliance review is part of our launch programme for the Kingdom. Until it is complete, we extend to every user in Saudi Arabia the full protections set out in this policy, and we will update this section once the review concludes.

13. How long we keep data

We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. Our current retention schedule is:

Category	Retention period
Account data	For the life of the account, then deleted within 30 days of closure
Care profile data	For the life of the profile, then deleted within 30 days of removal
Message and chat content	Rolling 12 months, then deleted automatically
Voice recordings	30 days after transcription, then the audio is deleted and only the transcript is retained
Transcripts and AI summaries	For the life of the account, then deleted within 30 days of closure
Medication adherence and mood records	For the life of the account, then deleted within 30 days of closure
SOS event records	24 months, to support safety review and the defence of legal claims
Billing and invoice records	As required by applicable tax and accounting law, typically 6–7 years
Support tickets	24 months from resolution
Security and access logs	12 months
Marketing consent records	Until consent is withdrawn, plus 24 months as proof of consent
Backups	Rolling 90-day cycle, after which deleted records are permanently overwritten

Inactive accounts

If an account has had no login and no care activity for 24 consecutive months, we will email the account holder at least 30 days before deleting it. If we receive no response, the account and its associated personal data are deleted.

14. Data deletion policy

The right to have your data erased is meaningless unless it is easy to use. Ours is.

How to request deletion

In the portal: Settings → Account → Delete account, or Loved ones → Remove profile to delete a single care profile.
By email: write to privacy@SilaCares.com from the address on the account, or from the address of the person whose data it is.
By post: to the registered address in section 1.

The person receiving care may request deletion of their own data directly, without going through the account holder.

What happens, and when

We acknowledge every deletion request within 72 hours.
We may need to verify your identity first, to make sure we are not deleting someone’s care data on the say-so of a stranger. We ask for the minimum needed to be confident.
Deletion from live production systems completes within 30 days.
Deletion from encrypted backups completes within a further 60 days — 90 days in total — as backups roll over. During that window, backup data is not used for any purpose other than disaster recovery.
We instruct our processors to delete the data they hold on our behalf, and confirm they have done so.
We confirm to you in writing when deletion is complete.

What gets deleted

Account details, care profile data, message and voice content, transcripts, AI summaries, adherence and mood records, care circle contact details, and the portal history associated with the account or profile.

What we may keep, and why

Erasure is a strong right, but it is not absolute. Article 17(3) GDPR permits us to retain limited data where it remains necessary. We may keep:

Billing and tax records, for the period required by law. These are retained for legal compliance only and are not used for any other purpose.
A minimal suppression record — typically a hashed email address — so that we can honour a marketing opt-out or a deletion request and not re-enrol you by mistake.
Records necessary for the establishment, exercise or defence of legal claims, for the limited period the claim requires.
Limited SOS event records where a safety or liability question is live.
Irreversibly anonymised or aggregated data, from which you cannot be identified by us or anyone else. Once data is anonymised to this standard it is no longer personal data, and it is not covered by a deletion request.

If we rely on one of these grounds to keep something, we will tell you what we kept and why.

What deletion means in practice

Deletion is permanent and irreversible. Care check-ins stop immediately, summaries and history disappear from the portal, and we cannot restore the account afterwards. If you want a copy of your data, export it before you delete — see Your privacy rights.

15. How we protect your data

We maintain technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. These include:

Encryption of data in transit (TLS) and at rest.
Passwords stored only as salted hashes, never in plaintext or reversible form.
Role-based access control on the principle of least privilege, with access to care data restricted to staff who need it.
Audit logging of access to personal and special category data.
Multi-factor authentication for staff access to production systems.
Network segregation, hardened infrastructure and managed patching.
Encrypted, access-controlled backups with tested restore procedures.
Written data processing agreements and security review of every processor.
Confidentiality obligations and privacy training for all staff with data access.
Data minimisation and pseudonymisation wherever a purpose can be achieved without identifying data.
An incident response plan, tested and reviewed.

No system is perfectly secure, and we will not claim otherwise. What we commit to is proportionate protection, honest disclosure if something goes wrong, and continuous improvement.

16. Your privacy rights

If you are in the EEA or the UK, the GDPR gives you the rights below. We extend the same rights to all our users regardless of where they live, because we think that is the right way to run this service.

Right of access (Art 15) — obtain confirmation of whether we process your data, a copy of it, and information about how it is used.
Right to rectification (Art 16) — have inaccurate data corrected and incomplete data completed.
Right to erasure (Art 17) — the “right to be forgotten”. See our data deletion policy.
Right to restriction (Art 18) — ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
Right to data portability (Art 20) — receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
Right to object (Art 21) — object to processing based on legitimate interests. You may object to direct marketing at any time and we will stop, without exception.
Right to withdraw consent (Art 7(3)) — withdraw consent at any time, as easily as you gave it. This does not affect processing already carried out lawfully.
Rights relating to automated decision-making (Art 22) — see section 9.
Right to lodge a complaint (Art 77) — see Complaints.

We honour these rights for the person receiving care in their own name, not only for the account holder.

17. How to exercise your rights

Email privacy@SilaCares.com, use the tools in the family portal, or write to our registered address. Please tell us which right you want to exercise and, if relevant, which care profile it concerns.

Identity verification. We will ask for enough information to be confident you are who you say you are. We ask for the minimum necessary and do not use it for anything else.
Timeframe. We respond within one month. If a request is complex or you have made several, we may extend by up to two further months — we will tell you within the first month, and explain why.
Cost. Free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, and we will explain our reasoning if so.
Third-party data. Where fulfilling your request would disclose another person’s data — for example a conversation involving both you and your loved one — we may redact the parts that are not yours.
If we refuse. We will tell you why, and tell you how to complain to a supervisory authority and how to seek a judicial remedy.

18. Cookies and similar technologies

Our marketing website does not use advertising cookies, analytics cookies or third-party tracking pixels. We do not track you across other websites.

Essential cookies and local storage. The family portal uses strictly necessary cookies to keep you signed in and secure, and browser local storage to remember interface preferences such as light or dark mode. These are exempt from consent requirements because the service cannot function without them.
Web fonts. Our pages load typefaces from Google Fonts. When your browser requests a font, your IP address is transmitted to Google’s servers. If you would prefer to avoid this, you can block third-party font loading in your browser; the site remains fully usable with system fonts.
Server logs. Our hosting infrastructure records standard request logs, including IP address, for security and reliability. See section 13 for how long we keep them.

If we ever introduce analytics or marketing cookies, we will ask for your consent first through a cookie banner that makes refusing as easy as accepting, and we will update this section before doing so.

19. Children’s data

SilaCares is designed for adults. Our services are not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child’s data has been provided to us, contact privacy@SilaCares.com and we will delete it promptly.

20. Data breach notification

If a personal data breach occurs, we will:

Notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms (Art 33).
Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in clear and plain language, describing what happened, the likely consequences, what we are doing about it, and what you can do to protect yourself (Art 34).
Maintain an internal record of all breaches, including those we are not required to report.
Where we act as a processor for a partner organisation, notify that controller without undue delay.

21. Complaints

If you are unhappy with how we handle your data, please tell us first at privacy@SilaCares.com. We would rather hear about it and fix it.

You also have the right to complain to a data protection supervisory authority. If you are in the EEA, that is the authority in the country where you live, work, or where the alleged infringement took place — a list is published by the European Data Protection Board. If you are in the UK, it is the Information Commissioner’s Office (ICO) at ico.org.uk. If you are in Saudi Arabia, it is the Saudi Data & AI Authority (SDAIA) at sdaia.gov.sa. You may also seek a judicial remedy. Complaining to us first does not affect that right in any way.

22. Changes to this policy

We will update this policy as the service evolves. When we do, we will change the version number and the “last updated” date at the top of this page.

For material changes — a new purpose, a new category of recipient, a change to your rights — we will notify account holders by email at least 30 days before the change takes effect, so you have time to review it and, if you disagree, to export your data and close your account. Where a change requires your consent, we will ask for it rather than assume it. We keep previous versions of this policy and will provide them on request.

23. Contact us

For any privacy question, to exercise a right, or to raise a concern:

Email: privacy@SilaCares.com
General enquiries: hello@SilaCares.com
Telephone & WhatsApp: +880 1711 081888 (Bangladesh) · +966 50 606 2411 (Saudi Arabia)
Post: SilaCares, 67 Kazi Nazrul Islam Avenue, Farmgate, Tejgaon, Dhaka 1215, Bangladesh