Skip to main content
Eleva Wellbeing

Privacy Notice

Last updated: 25 October 2026

This Privacy Notice explains how Eleva Wellbeing Ltd ('Eleva Wellbeing', 'we', 'us', 'our') collects, uses, stores, and protects your personal data. We are committed to handling your data with care and transparency, and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. What This Notice Covers

Eleva Wellbeing is currently available as a public website and waitlist at elevawellbeing.com. This notice describes the personal data we process for the website and waitlist today.

The Eleva Wellbeing mobile app, including user accounts and wellbeing features such as daily check-ins and the PHQ-9 and GAD-7 screening tools, is in development and is not yet available. We do not collect that data today. Section 9 summarises the processing planned for the app, and we will update this notice before those features launch.

2. Who We Are

Eleva Wellbeing Ltd, a company registered in England and Wales, is the data controller for your personal data.

Contact: support@elevawellbeing.com | elevawellbeing.com

3. Data We Collect

3.1 Waitlist Data

When you join the waitlist, we collect:

  • Your email address
  • Your country/region of residence, if you provide it, used to manage availability and waitlist updates
  • An optional referral code, if you arrived through a referral link
  • A record that you accepted our Terms of Service and acknowledged this Privacy Notice and our Cookie Policy, together with the version of the consent wording you were shown
  • Your marketing preference (by default, you are not opted in to marketing)

3.2 Security and Anti-Abuse Data

To protect our public forms from automated abuse, spam, and fraud, we process security signals through Cloudflare Turnstile (provided by Cloudflare). These signals may include browser, device, interaction, network, user-agent, site identifier, provider token, and provider-visible IP-address information. This processing is for security only. It is not used for analytics, advertising, or marketing.

3.3 Technical Data

When you use the website, we may process limited technical data, such as device type, browser, and error or performance information, needed to operate and secure the site.

3.4 Communications You Send Us

If you contact us, for example by email, we process the information you choose to provide so that we can respond.

4. How We Use Your Data

4.1 To Operate the Waitlist

  • To register your interest and hold your place on the waitlist
  • To send you a one-off email to confirm (verify) your email address
  • To send you a one-off confirmation email that includes your personal referral link, so that you can share it and return to your referral page
  • To manage availability and waitlist updates for your country/region of residence
  • To notify you and send your invite or early-access instructions when early access opens

These are service messages that are necessary to operate the waitlist you asked to join. We do not send marketing emails to waitlist members, and there is nothing to unsubscribe from.

4.2 To Protect Our Public Forms

  • To verify browser-integrity signals and protect the waitlist form from automated abuse, spam, and fraud, using Cloudflare Turnstile
  • To send the resulting security token from the website to our private backend so that the backend can validate the request

4.3 To Communicate With You

  • To respond to your enquiries and support requests
  • To send essential service messages, such as material changes to this notice

We do not sell your personal data. We do not share it with third parties for their own marketing. We do not use it for advertising.

We process your data on the following legal bases under UK GDPR:

  • Taking steps at your request before a contract (Article 6(1)(b)): to operate the waitlist and to send the related service emails (email verification, your referral confirmation, and your invite or early-access notification when access opens), because this processing is necessary to provide the waitlist you asked to join.
  • Legitimate interests (Article 6(1)(f)): to protect our public forms and services from abuse, spam, and fraud, and to keep the website secure and working, where these interests are not overridden by your rights.
  • Legal obligation (Article 6(1)(c)): where we are required by law to process or retain certain data.

6. Data Retention

We keep your waitlist data only for as long as we need it for the purposes above:

  • We retain your waitlist data until the Eleva Wellbeing app launches or you ask to be removed from the waitlist, whichever happens first.
  • When either of those occurs, we delete your identifiable waitlist data within 30 days.
  • We keep a minimal record of consent and security events for as long as needed to meet our legal and accountability obligations.

7. Who We Share Your Data With

We do not sell or rent your personal data. We share it only with service providers who process it on our behalf under data processing agreements, and only as needed:

  • Website hosting (Vercel): hosts the website and runs the backend that receives waitlist requests, in Germany (Frankfurt). Vercel processes request data, such as IP address and browser information, as part of serving the website.
  • Database (Supabase): stores your waitlist data within the European Economic Area (Ireland). Your email address is stored in protected (encrypted) form.
  • Email delivery (Mailjet, part of Sinch): processes your email address to send the waitlist service emails. Mailjet stores this data within the European Economic Area.
  • Security and anti-abuse (Cloudflare Turnstile, provided by Cloudflare): processes the security signals described above to protect our public forms. Cloudflare may process some of these signals as described in Section 8 (International Data Transfers), and acts as an independent controller of those signals when it uses them to improve Turnstile's bot detection.
  • Professional advisers: such as legal or financial advisers, under confidentiality.
  • Authorities: where required by law or to protect the safety of users.

8. International Data Transfers

We store waitlist data in the European Economic Area: our database (Supabase) runs in Ireland, the backend that handles waitlist requests (Vercel) runs in Germany, and our email provider (Mailjet) stores email data on Google Cloud in Germany and Belgium. Transfers of personal data from the UK to the European Economic Area are permitted under UK adequacy regulations.

Two providers may process limited data outside the UK and the European Economic Area, including in the United States:

  • Website hosting (Vercel): Vercel delivers the website through a global network, so your request, including the waitlist form while it travels to our backend in Germany, may pass through Vercel servers in the country you are visiting from.
  • Security and anti-abuse (Cloudflare Turnstile, by Cloudflare): when you use our public forms, browser-integrity signals may be processed by Cloudflare.

Both providers process this data under data processing agreements that incorporate the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and under their certification to the EU-US Data Privacy Framework and its UK Extension.

9. Future Processing (Not Active Yet)

The Eleva Wellbeing app is in development. It is not available today, and we do not yet collect any of the data described in this section. When the app launches, we expect to process additional personal data, and we will update this notice and obtain any required consent before we do so. The planned processing includes:

  • Account data, such as your name and account details
  • Wellbeing and check-in data, including responses to the PHQ-9 and GAD-7 screening tools. This is special category health data, and we will process it only with your explicit consent.
  • App usage data, to operate and improve the service

Until the app launches, none of this data is collected.

10. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Erase your data (the 'right to be forgotten')
  • Restrict how we use your data
  • Object to processing based on legitimate interests
  • Data portability for data you provided to us

To leave the waitlist or have your waitlist data removed, email us at support@elevawellbeing.com, and we will remove it. To exercise any other right, contact us at the same address. We will respond within one month.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113.

11. Cookies

We use a small number of strictly necessary technologies to keep the website secure. We do not currently use analytics, preference, or marketing cookies. Please see our Cookie Policy for details.

12. Children

Eleva Wellbeing is intended for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe we have, please contact us at support@elevawellbeing.com, and we will delete it.

13. Changes to This Notice

We may update this Privacy Notice from time to time. Where changes are material, we will say so on the website or by email. The date at the top of this document reflects when it was last updated.

14. Contact

Eleva Wellbeing Ltd

Email: support@elevawellbeing.com

Website: elevawellbeing.com

Back to top