PRIVACY POLICY
Last updated September 30, 2026
This policy explains how Glen Technologies Limited ('Glen', 'we', 'us' or 'our'), a company registered in England and Wales under company number 17039707, of 66 Paul Street, London EC2A 4NA, United Kingdom, handles personal information when you visit our website, use the Glen web and mobile apps (the 'Services'), or deal with us as a customer. Questions about it go to privacy@joinglen.com.
TABLE OF CONTENTS
- OUR ROLE: CONTROLLER AND PROCESSOR
- INFORMATION WE COLLECT
- HOW WE USE IT
- AUTOMATED FEATURES
- WHO WE SHARE IT WITH
- INTERNATIONAL TRANSFERS
- COOKIES AND SIMILAR TECHNOLOGIES
- HOW LONG WE KEEP IT
- HOW WE PROTECT IT
- YOUR RIGHTS
- CHILDREN
- CHANGES TO THIS POLICY
- CONTACT US
1. OUR ROLE: CONTROLLER AND PROCESSOR
Glen is used by senior living communities (our 'Customers') and the staff, residents and family members they invite. We handle personal information in two different roles.
As a processor, for the communities we serve. The information a community keeps about its residents, families and staff in Glen (its 'Customer Data') belongs to the community. The community decides what is recorded and who can see it, and we process that information only to provide the Services on its instructions. For those records, the community is the controller and its own privacy notice applies. Where a community is a covered entity under the US Health Insurance Portability and Accountability Act (HIPAA), we act as its business associate and will sign a Business Associate Agreement on request. If you have a question or request about a resident's records, please contact the community; we will help it respond.
As a controller, for our own purposes. We are responsible for the information we collect about visitors to our website, people who contact us or start a trial, account holders' sign-in and usage information, and our billing and support records. We handle that information under the UK General Data Protection Regulation and the Data Protection Act 2018, and the other laws that apply to us.
2. INFORMATION WE COLLECT
| Whose | What |
|---|---|
| Website visitors | Pages visited, the site or campaign that brought you to us, device and browser details, and IP address, through cookies and similar technologies (section 7). Messages you send us through the chat window. |
| People who contact us or start a trial | Name, email address, phone number, community name, number of licensed beds, and how you heard about us. |
| Account holders (staff, residents and family members) | Name, email address, phone number, profile photo, the communities you belong to and your role, sign-in records (including IP address and device), the token that lets us send you notifications, and your settings. If you sign in with Apple or Google, we receive your name and email address from them. |
| Customers' billing contacts | Billing email address, business name, billing address and tax ID. Card details are collected and held by Stripe, not by us. |
| Residents, families and staff, as recorded by the community (Customer Data) | Resident profiles: name, date of birth, room, photo, contact details, life history, dietary needs and allergies, and move-in and move-out details. Care records: reminders, including medication prompts, and whether they were completed; voice notes and their transcripts; and notes. Documents: for example ID, insurance cards, medication lists, medical history, advance directives and DNR orders, vaccination and TB records, and move-in paperwork and signed agreements, which can include financial and bank details. Family contacts and their relationship to the resident. Attendance and RSVPs, meal ratings and comments, and posts, photos, comments and reactions shared in the community. |
| People who use our exercise programmes | Workout history, ratings and progress, any health conditions, injuries or mobility limits you tell us about so we can tailor the programme. |
| Everyone who uses the Services | How the Services are used (for example which features, and the app version), error reports linked to your account ID, and messages with our support team. |
Health information. Customer Data and exercise information include information about health, which is special category data under UK and EU data protection law and may be protected health information under HIPAA. We use it only to provide the Services: Customer Data on the community's instructions, and the health details you give us for exercise with your consent, which you can withdraw at any time.
On your device. The mobile App asks for access to your camera and photo library so you can take or choose photos to share, your microphone so staff can record voice notes, and permission to send notifications. It does not use your location. You can change these permissions in your device settings at any time.
3. HOW WE USE IT
| Purpose | Legal basis (where we are the controller) |
|---|---|
| Providing the Services: accounts, sign-in, and the features the community uses | Contract. For Customer Data, we act on the community's instructions. |
| Taking payments and keeping accounting and tax records | Contract; legal obligation |
| Sending service messages, such as sign-in codes, notifications, activity recaps and trial reminders | Contract; legitimate interests |
| Answering support requests | Contract; legitimate interests |
| Keeping the Services secure, preventing misuse, and fixing errors | Legitimate interests |
| Understanding how the Services are used, so we can improve them | Legitimate interests |
| Following up on enquiries and trials, and telling businesses about Glen | Legitimate interests. You can opt out at any time. |
| Tailoring exercise programmes to health details you give us | Explicit consent |
| Meeting legal obligations and responding to lawful requests | Legal obligation |
We do not sell personal information. We do not use Customer Data for advertising, and we do not use it to train artificial intelligence models.
4. AUTOMATED FEATURES
Some features use automated processing, including artificial intelligence provided by Google Cloud. For example, voice notes recorded by staff are transcribed automatically, and exercise programmes may be put together or adjusted automatically. Transcripts and suggestions can contain errors, and staff should check them. We do not make decisions that have legal or similarly significant effects on anyone solely by automated means.
5. WHO WE SHARE IT WITH
Within the community
The community controls who can see what. Staff can see residents' records. Family members can see their relative's name, room, date of birth, photo and activity attendance, and the community's posts and photos. Residents can see the community's posts, menus and activities.
Our service providers
We use the following providers to run the Services. They process personal information on our instructions and only for the purpose listed.
| Provider | Purpose |
|---|---|
| Google Cloud | Hosting, file storage, and AI transcription of voice notes |
| Neon | Database hosting |
| Stripe | Payments and billing |
| DocuSeal | Electronic signing of documents |
| Resend | Email delivery |
| Prelude | Sign-in codes by text message |
| Expo, Apple and Google | Push notifications and app updates |
| Intercom | Customer support chat |
| Mixpanel | Product analytics |
| Sentry | Error monitoring |
| Google Analytics | Website analytics |
| Cloudflare | Website hosting and protection against automated abuse |
| Attio | Managing sales enquiries |
| Slack | Internal notifications to our team about account and billing activity |
| Dext | Bookkeeping of our invoices |
Others
We may also share personal information with our professional advisers, with authorities where the law requires it, and with a buyer or successor if our business, or part of it, is sold or reorganised. In that case this policy will continue to apply to the information.
6. INTERNATIONAL TRANSFERS
Our main database and file storage are hosted in the European Union (Germany and Belgium). We are based in the United Kingdom, and some of our providers are based in, or process information in, the United States and other countries. Where personal information leaves the UK or the European Economic Area, we protect it with a recognised safeguard, such as the UK International Data Transfer Agreement, the EU standard contractual clauses with the UK Addendum, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified.
7. COOKIES AND SIMILAR TECHNOLOGIES
- Essential: a cookie that keeps you signed in to the web app.
- Analytics: Mixpanel sets a cookie across joinglen.com and its subdomains that records how you found us and how you use the site and app. Google Analytics measures visits to our website.
- Support: Intercom sets cookies so the chat window can keep your conversation.
- Fonts: our pages load fonts from Google Fonts, which receives your IP address.
You can block or delete cookies in your browser settings. Blocking the essential cookie will stop you signing in to the web app.
8. HOW LONG WE KEEP IT
- Customer Data is kept while the community's account exists, including after its subscription ends, so that it can come back to it or ask for an export. The community decides how long its records are kept and can ask us in writing to delete them, and we will, except where the law requires us to keep them.
- Your account. You can delete your account in the App. This deletes your profile, sign-in details, workout history, and the posts, comments and reactions you made. Records a community keeps about a resident or family contact are the community's, and stay until the community deletes them.
- Billing records are kept for as long as tax and accounting law requires, usually six years.
- Enquiries and sales records are kept while they are relevant to our relationship with you. Ask us and we will delete them.
- Deleted information can remain in backups for a limited time before it is overwritten.
9. HOW WE PROTECT IT
Information is encrypted in transit and at rest. Access within a community follows the roles the community gives its members. Within Glen, only authorised staff can access a community's information, and only where needed to operate and support the Services, for example to answer a request from the community. Error reports are linked to an account ID only, without the content of what was entered. If a breach affects personal information, we will tell the affected community, and the authorities and individuals where the law requires it, without undue delay.
10. YOUR RIGHTS
Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw consent you have given. To use these rights, email privacy@joinglen.com. We may need to confirm your identity first.
For information a community keeps about you as a resident, family member or staff member, please contact the community. If you contact us instead, we will pass your request to the community and help it respond.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office (ico.org.uk) or the data protection authority where you live. We would appreciate the chance to put things right first.
11. CHILDREN
The Services are not intended for anyone under 16, and we do not knowingly collect information from them.
12. CHANGES TO THIS POLICY
We may update this policy. We will change the date at the top when we do, and tell Customers about significant changes before they take effect.
13. CONTACT US
Glen Technologies Limited (company number 17039707)
66 Paul Street
London EC2A 4NA
United Kingdom
privacy@joinglen.com