Privacy Policy
Alice Chatbot – Privacy Policy
Last updated: 1 October 2026
1. Who we are
Alice is an AI chatbot operated by Haemochromatosis.help, which is responsible for the personal information processed through this service. We are the data controller for the personal information we collect and determine how to use.
Our contact details:
Organisation: Haemochromatosis.help
Email: privacy@haemochromatosis.help
Website: http://Haemochromatosis.help
2. What information we collect
When you use Alice, we may process:
The questions and messages you enter into the chatbot.
Health or genetic information you voluntarily choose to share.
Technical information such as your IP address, device information and interaction logs.
Information you provide when contacting us about the service or exercising your privacy rights.
You do not need to tell Alice your name or provide identifying details to ask general questions. However, information in your conversations may still identify you, particularly if it includes details about your health, family or medical history.
3. How we use your information
We process information for the following purposes:
To understand your questions and generate Alice's responses.
To operate, maintain and secure the chatbot.
To investigate technical problems, misuse or safety concerns.
To respond to your enquiries and requests concerning personal information.
To comply with our legal obligations.
We will not use your chatbot conversations to send you marketing communications without an appropriate separate lawful basis and, where required, your consent.
4. Our legal basis for processing
Under Article 6(1)(a) of the UK GDPR, we rely on your consent to process the personal information you voluntarily provide in your chatbot conversations to generate responses.
If you share personal health or genetic information, this is special category data. We rely on your explicit consent under Article 9(2)(a) to process that information for the same purpose.
We may also rely on our legitimate interests under Article 6(1)(f) to process necessary technical and security information to protect the service, prevent misuse and maintain its reliability, having considered your rights and interests.
Where processing is necessary to meet a legal obligation, we rely on Article 6(1)(c).
You are not legally required to provide personal information to Alice, but the chatbot needs to process the content of your messages to generate responses.
5. How AI processes your information
Alice is powered by Chatling.ai, a chatbot service provided by Envision Labs Inc. Chatling uses third-party artificial intelligence providers to understand your questions and generate responses. We currently use AI technology supplied by OpenAI. We may use different AI models or providers in the future to improve the quality, reliability and accessibility of Alice's responses. Your messages are processed by Chatling and the AI provider selected to generate your response. According to Chatling's published terms, its AI model providers do not use chatbot conversations to train their general-purpose AI models. This does not mean that conversations are never stored or processed for operational, security or other permitted purposes.
Where changes to AI providers materially affect the handling of your information, we will update this Privacy Policy and seek further consent where legally required.
6. Who we share information with
We use the following providers to operate Alice:
Chatling.ai (Envision Labs Inc.) – provides the chatbot software, manages conversations and connects Alice to AI technology.
OpenAI – currently provides the AI technology that generates Alice's responses.
Other authorised technology providers may assist with hosting, security and related services.
Chatling maintains a list of its technology subcontractors at https://chatling.ai/eu-data-protection.
We will not sell your personal information or use your health information for advertising.
7. Where information is processed
Chatling uses European hosting infrastructure, but information may also be processed outside the United Kingdom, including in the United States when AI providers process chatbot messages.
Where required by UK data protection law, we will ensure appropriate safeguards are in place, including relevant contractual protections or applicable adequacy arrangements.
8. How long we keep information
Chat conversations may be stored by Chatling and processed by the relevant AI provider. We aim to minimise the amount of information retained and keep it only for as long as necessary. Our retention arrangements are :
Chat conversations: 24 hours
Technical and security records: 12 months
Backups and provider-held records: 12 months
You may contact us at privacy@haemochromatosis.help to request access to, or deletion of, your personal information, subject to applicable legal rights and exceptions.
11. Cookies and chatbot identifiers
Information may be retained for longer where necessary to comply with a legal obligation or establish, exercise or defend legal claims.
Alice may use cookies or similar technologies supplied by Chatling to support conversations, recognise a returning browser and maintain the chatbot's functionality. Chatling's published cookie information describes identifiers that may remain on your device for up to 365 days, depending on the version of its chatbot and the features used. Details of the cookies actually used by Alice, and any choices available to you, are provided in our Cookie Notice.
We will periodically review our retention arrangements.
9. Your rights
Under UK data protection law, you may have the right to:
Ask for a copy of your personal information.
Ask us to correct inaccurate information.
Request deletion of your information.
Ask us to restrict certain processing.
Object to processing based on legitimate interests.
Request transfer of information where the right to data portability applies.
Withdraw your consent at any time.
These rights are subject to applicable legal conditions and exceptions.
To exercise your rights, email privacy@haemochromatosis.help.
You can withdraw consent to the processing of your chatbot information by stopping its use and contacting us to request withdrawal and, where applicable, deletion of retained information. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
If you have used Alice without identifying yourself, we may need information such as a conversation identifier to locate your records. In some circumstances we may be unable to associate stored information with you.
10. Security
We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse and disclosure.
However, no online service can guarantee absolute security. Please avoid entering identifying information, passwords, NHS numbers or medical documents containing unnecessary personal details.
11. Cookies and similar technologies
Our website may use cookies or similar technologies needed for the chatbot to function, maintain security or remember your settings.
Where consent is legally required for optional cookies or tracking technologies, we will obtain it before using them.
Details of the technologies actually used, including their purposes and durations, will be provided in our Cookie Notice.
12. Children
Alice is intended for adults aged 18 and over. It is not designed to collect personal information from children.
If you believe a child has provided personal information, please contact us so that we can review the matter and take appropriate action.
13. Complaints
If you have concerns about how we handle your personal information, please contact us at privacy@haemochromatosis.help
We will acknowledge a data protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO):
Website: https://ico.org.uk
Telephone: 0303 123 1113
14. Changes to this policy
We may update this Privacy Policy to reflect changes in our services, technology or legal requirements.
The latest version will be published on our website with its last-updated date. Where legally required, we will provide additional notice or seek fresh consent before making material changes to how we process your information.