Privacy Policy
1. Controller
The controller for the processing of personal data in connection with Elyvite is:
Flowprimo LLC, a limited liability company (LLC) under the laws of the State of Delaware, USA, 8 The Green, Suite A, Dover, Delaware 19901, USA
Delaware File Number: 10072739
Authorised representative: Christian Saur, Sole Member
Email: privacy@elyvite.com
2. Scope and purpose of Elyvite
Elyvite is a professional health research workspace for health professionals. The platform helps users research health topics, compare different expert perspectives, draw on scientific sources and organise their research.
This privacy policy applies to the use of the Elyvite websites and the Elyvite application unless stated otherwise below.
Elyvite is not intended for processing personal health data about patients, clients or any other third party, and it does not replace medical advice, diagnosis or treatment.
Elyvite is intended solely for people aged 18 and over who use the service in the course of their professional or business activity.
3. What personal data we process
Depending on how you use Elyvite, the following categories of personal data may be processed.
3.1 Account and profile data
When you register and use an Elyvite account, we process in particular:
- your name or the profile details you provide,
- email address,
- account ID,
- authentication and sign-in data,
- the language you choose,
- professional details and the information given during registration,
- settings, and
- your Elyvites balance within Elyvite.
Passwords are never stored in plain text.
3.2 Research, chat and project data
When you use Elyvite for research, we process in particular:
- research queries,
- chat messages,
- research results,
- projects and categories,
- content you select or save, and
- the context needed to answer a query.
Part of this content is sent to external AI, search and re-ranking services in order to answer your query. See section 7 for details.
3.3 Feedback and screenshots
When you use the feedback function you may attach a screenshot. JPEG, PNG and WebP files are supported.
Feedback screenshots are stored in our file storage and are not sent to our AI providers for processing.
Elyvite does not offer a general document upload to regular users.
3.4 Payment and contract data
When you take out a paid subscription or buy additional services, in particular additional Elyvites, the following data may be processed:
- name,
- email address,
- billing details,
- payment information,
- order information,
- subscription status, and
- transaction history.
Sales and payments are handled by Lemon Squeezy. See section 9 for details.
3.5 Communication data
When you contact us, we process the data you send us, in particular:
- email address,
- your name, if given,
- the content of your enquiry, and
- the related communication and case records.
3.6 Technical and security data
When you visit and use Elyvite, the following technical information may be processed:
- IP address,
- browser and user agent,
- the page or path requested,
- the time of an access,
- request and server information,
- session identifiers,
- sign-in events,
- whether a sign-in attempt succeeded or failed,
- technical error and diagnostic data, and
- security and risk indicators.
Our sign-in logs may contain the IP address, user agent, event type, success or failure of the sign-in, error details, session identifier, MFA attributes, a risk score, partially masked email addresses and technical event details.
Elyvite does not create a device fingerprint for the product purposes described here.
4. Purposes and legal bases of processing
4.1 Providing Elyvite and performing the contract
We process personal data to register and manage accounts, to authenticate users and to provide the research, chat, project and other product features.
Legal basis: Article 6(1)(b) GDPR.
4.2 Payments and subscription management
We process the contract, order and billing information required to perform the contract and to meet statutory retention and record-keeping obligations.
Legal basis: Article 6(1)(b) GDPR and, where statutory obligations apply, Article 6(1)(c) GDPR.
Lemon Squeezy's own processing of data for the purchase and payment is governed by the Lemon Squeezy privacy terms. See section 9 for how the roles are split.
4.3 Operational security, error analysis and abuse prevention
We process technical data to keep Elyvite secure, stable and functional, to diagnose errors and to prevent abuse, spam and unauthorised access.
Legal basis: Article 6(1)(f) GDPR.
Our legitimate interest is the secure, reliable and abuse-free operation of our platform.
4.4 Audience measurement
On certain publicly accessible pages we use privacy-friendly, cookie-free audience measurement.
Legal basis: Article 6(1)(f) GDPR, where the specific processing does not require consent.
Where processing, or storing information on or accessing information from your device, does require consent, that processing only takes place once consent has been given.
4.5 Communication and support
We handle enquiries in order to perform or prepare a contract, or on the basis of our legitimate interest in handling and answering general enquiries.
Legal basis: Article 6(1)(b) or (f) GDPR.
Where we are legally obliged to handle or document a request, Article 6(1)(c) GDPR may apply.
4.6 Processing based on consent
Where we ask for your consent for individual features or technologies, the processing is based on Article 6(1)(a) GDPR.
You can withdraw your consent at any time with effect for the future.
5. Hosting, database and technical infrastructure
5.1 Supabase
We use Supabase for our database, authentication and file storage.
Depending on your use, this may cover account and profile data, authentication information, research and chat histories, projects, feedback screenshots and other data needed to provide your account.
The primary data storage is located in an EU region.
Authentication emails such as registration confirmations, invitations, magic links or one-time codes (OTP), email changes, password resets and re-authentication messages are sent through Supabase.
5.2 Vercel
Vercel hosts our front end and runs certain serverless, edge, authentication, feedback and cron functions.
This may involve processing IP addresses, request logs and technical access information.
Research and chat queries are not routinely passed to the AI back end through Vercel; the browser sends them directly to our back end at Render.
5.3 Render
Our back end and the agents needed for research run on Render.
This involves processing IP addresses, request logs, research queries and chat content.
6. Email communication
Alongside the authentication emails sent through Supabase, we use Resend for the application's transactional email.
This includes welcome messages, invitations, trial notices and messages about subscription events.
The data processed includes the email address, your name where applicable and the content of the message.
Resend is not used for a general newsletter.
7. AI-assisted research and external research providers
Elyvite uses external AI and research services to answer user queries, research information, assess sources, rank search results and compose answers.
7.1 OpenRouter and AI model providers
Most language model requests are routed through OpenRouter.
Depending on the feature in use, OpenRouter may forward requests to services or models from:
- Anthropic,
- OpenAI,
- Perplexity, and
- Google.
The content of the query and the context needed to answer it are transmitted.
Your email address and account ID are not passed to OpenRouter as structured user identifiers. If you include personal information in your own free-text input, however, that information can form part of the request sent to the service in question.
Storage and processing terms differ between model providers. We limit what is transmitted to what the respective feature needs and configure the services for data minimisation wherever possible.
7.2 OpenAI
OpenAI is also used directly to create mathematical representations of text (“embeddings”) for semantic search.
This may involve text from a user query or from the content required for the search.
7.3 Cohere
Cohere is used to re-rank search results in the consensus agent.
The wording of the query and relevant result snippets are transmitted for this purpose.
The result cache Elyvite uses for this does not store the query in plain text, only a hash of the query plus technical information such as result order, number of hits and timestamp. This cache data is kept for 24 hours.
7.4 OpenAlex and Semantic Scholar
OpenAlex and Semantic Scholar may be used to search the scientific literature.
Search terms derived from the user query are sent to these services. Semantic Scholar may in particular be used as an alternative search service.
8. Do not enter personal health data
Elyvite is a professional research space and is not intended for processing personal health data about patients, clients or any other third party.
Please do not enter information that would allow health information to be linked to an identified or identifiable person.
This applies above all to personal health data about clients, patients or other third parties. Elyvite should also not be used to process a user's own personal health data.
In particular, please do not enter names or other identifying details combined with diagnoses, symptoms, medication, lab values, medical histories or comparable health information.
Case-based research questions may only be used if they are sufficiently anonymised and abstracted so that the person concerned cannot be identified or made identifiable.
Research and chat fields are free-text fields by design. It is therefore not technically possible to prevent such information from being entered.
If users enter personal health data or other special categories of personal data into free-text fields despite this notice, that data may be stored and transmitted to the services described in section 7, depending on the feature used.
Elyvite does not ask users to enter such personal health data. Entering it is not necessary to use the service as intended.
9. Sales, payments and Lemon Squeezy
For paid subscriptions and other purchases, in particular additional Elyvites, we use:
Sold through Link, LLC f/k/a Lemon Squeezy LLC, 222 South Main Street, Suite 500, Salt Lake City, UT 84101, USA (“Lemon Squeezy”)
Flowprimo LLC is the supplier of the Elyvite product.
For purchases, Lemon Squeezy acts as authorised reseller and merchant of record and handles checkout, order and payment processing, subscription management, invoicing, tax processes, refunds and chargebacks.
For this processing of purchase and transaction data, Lemon Squeezy acts as an independent controller within its own purposes and legal obligations.
The data processed may include name, email address, billing and payment information as well as order, transaction and subscription data.
In addition, Lemon Squeezy processes certain personal data on behalf of Flowprimo LLC where this is necessary for processing instructed by Flowprimo and for the technical provision and administration of the relevant features. A data processing agreement (DPA) is in place for this processing.
Which data protection role Lemon Squeezy takes therefore depends on the processing operation in question.
We receive from Lemon Squeezy the information needed to activate and manage the Elyvite subscription and any additional services purchased, for example the email address, product and subscription information and transaction or order identifiers.
The legal basis for Flowprimo LLC's processing of this data is generally Article 6(1)(b) GDPR.
10. Affiliate attribution through Lemon Squeezy
Separately from payment processing, we use the Lemon Squeezy affiliate feature to attribute purchases to our partners.
The affiliate script is only loaded if a visitor reaches Elyvite through such a partner link or has previously arrived through one.
For other visitors, this affiliate feature creates no connection to Lemon Squeezy before they start a purchase.
When the affiliate script is loaded, the following information may be sent to Lemon Squeezy:
- IP address,
- browser information,
- the page requested, and
- partner attribution information.
The script may store a partner identifier in the browser. It can be passed to checkout on a later purchase so that the purchase is attributed to the right partner.
Where consent is required to store information on or access information from your device, the feature is only activated once that consent has been given.
Consent can be withdrawn at any time with effect for the future through the cookie settings.
11. Error and performance monitoring with Sentry
We use Sentry to detect technical errors and monitor the stability of Elyvite.
Data is ingested through an EU region.
The following information may be sent to Sentry:
- the account ID, but not the email address as user context,
- the error message,
- the stack trace,
- the page path, and
- browser information.
We do not use Sentry Session Replay. Sessions are not recorded.
Research text and chat content are not sent to Sentry as console breadcrumbs.
Authentication headers, cookies, tokens and JWTs are stripped before transmission. Sending default personal information is disabled.
Legal basis: Article 6(1)(f) GDPR.
Our legitimate interest is detecting and fixing technical errors and operating Elyvite securely and reliably.
12. Audience measurement with Plausible Analytics
On selected publicly accessible pages we use Plausible Analytics for audience measurement.
Plausible runs without cookies and does not build individual user profiles.
It records page views, referrers and coarse origin information.
Plausible is loaded only on a defined set of publicly accessible pages. These are mainly the home and sign-in pages as well as the public legal texts and the AI transparency information.
Plausible is not loaded in the signed-in product area.
The legal basis is Article 6(1)(f) GDPR, where the specific processing does not require consent. Our legitimate interest is the data-minimising statistical analysis and improvement of our publicly accessible web pages.
13. Cloudflare and Turnstile
We use Cloudflare for technical infrastructure and Cloudflare Turnstile to protect registration and forms against automated access, spam and abuse.
This may involve processing the IP address and technical browser or connection signals.
The purpose is to protect our systems and to tell legitimate access apart from automated abuse.
Legal basis: Article 6(1)(f) GDPR.
Our legitimate interest is protecting our platform and our users against abuse and automated attacks.
14. YouTube content
Elyvite may embed videos and preview images from YouTube.
There are different forms of embedding.
For certain research results the YouTube player itself is only loaded once the user actively opens the video. Preview images may, however, already be loaded from YouTube servers before that.
In certain help and onboarding content, YouTube players may be embedded directly.
Loading YouTube content establishes a connection to Google or YouTube servers. This may transmit the IP address, browser information and information about the page requested.
Where consent is required to load such third-party content or to store information on or access information from your device, the content is only loaded once that consent has been given.
Consent can be withdrawn at any time with effect for the future through the cookie settings.
15. Cookies, local storage and consent management
Elyvite uses strictly necessary cookies and similar storage mechanisms where they are required for authentication, security, session management and for providing the platform features you have expressly requested.
Beyond that, optional services may set cookies or use other storage mechanisms in your browser, for example for affiliate attribution or embedded third-party content.
Where storing information on or accessing information from your device requires consent, this only happens once you have given it.
You can change or withdraw your consent at any time with effect for the future through the cookie settings.
You will find more about the technologies, categories and choices on our “Cookie settings” page.
16. Recipients of personal data
Depending on how you use the service, personal data may be passed to the following categories of recipients:
- hosting and infrastructure companies,
- database and authentication providers,
- email service providers,
- payment and billing providers,
- AI and language model providers,
- scientific search and research services,
- security and error monitoring services,
- audience measurement services, and
- providers of embedded third-party content.
The relevant service providers and external recipients we currently use include:
Supabase, Vercel, Render, OpenRouter, Anthropic, OpenAI, Perplexity, Google, Cohere, OpenAlex, Semantic Scholar, Lemon Squeezy, Resend, Sentry, Plausible and Cloudflare.
Depending on the processing, these providers act as processors, sub-processors or independent controllers. Where a provider processes personal data on our behalf, we conclude the required data processing agreements.
We do not sell or rent our users' personal data for advertising purposes.
Services that only process public content as part of our internal editorial content production, and that receive no personal data about our users, are not listed here as recipients of user data.
17. Transfers to third countries
Some of the service providers we use are based in the USA, Canada or other countries outside the European Economic Area, or may process data there.
This applies in particular to parts of our hosting, AI, email, payment, security and third-party content infrastructure.
Where personal data is transferred to a country outside the European Economic Area, we make sure that the conditions required by the GDPR are met.
Depending on the provider and the processing, a transfer may rely on an adequacy decision of the European Commission, a valid certification under the EU-U.S. Data Privacy Framework, or the standard contractual clauses adopted by the European Commission under Article 46 GDPR.
Where necessary, additional safeguards are taken into account.
You can request information about the safeguards used for a specific transfer at privacy@elyvite.com.
18. Retention and deletion
We keep personal data only as long as it is needed for the respective purpose or as long as statutory retention obligations apply.
The following rules apply to the main categories of data.
18.1 Account deletion
When you request deletion of your account, the account is first deactivated or marked for deletion on the scheduled deletion date.
After a grace period of 7 days, the associated account data is permanently deleted.
This covers your profile, projects, categories, chats and messages, playlists and related content, shares, the usage data of your Elyvites balance, the authentication account and any feedback screenshots you uploaded.
During the seven-day grace period, the account information needed to reverse the deletion is retained.
Statutory retention obligations and the limited retention periods described below remain unaffected.
18.2 Cancelling a subscription
Cancelling a paid subscription does not automatically delete your Elyvite account.
As long as the account exists, account and research information may be retained in line with the retention rules described here.
18.3 Research and chat data
The content of chat messages is removed from the relevant records after 12 months or replaced by a neutral retention note.
Chat histories are deleted after 12 months.
18.4 Sign-in and security logs
Sign-in and security logs are kept for up to 24 months and then deleted.
18.5 Technical production data
Certain technical pipeline and processing runs are reduced to the metadata still required after 6 months.
18.6 Support
General support correspondence is deleted 12 months after the case is closed.
Where correspondence is needed for contractual, billing, tax or other statutory record-keeping obligations, it may be kept longer in line with the statutory retention periods.
18.7 Data protection requests
Correspondence and records relating to data protection requests are generally kept for 3 years, unless a longer period is required because of a specific legal dispute or a statutory obligation.
18.8 Payment and billing data
Contract, payment and billing information is kept in line with the applicable statutory commercial, tax and accounting retention obligations.
Where Lemon Squeezy processes data as an independent controller, the retention periods set by Lemon Squeezy apply to that data as well.
18.9 Backups
Automatic backups of the database are created and kept for 7 days.
Data deleted from the live system may therefore still be present in an existing database backup for up to seven days. Those backups are then overwritten automatically.
File storage is not covered by these database backups.
19. No solely automated decisions with legal effect
Elyvite uses AI-assisted systems to research, analyse, structure and present information.
There is, however, no solely automated decision-making within the meaning of Article 22 GDPR that produces legal effects concerning users or similarly significantly affects them.
20. Data security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
Depending on the processing, these include access controls, role-based permissions, authentication and security measures, encrypted transmission and measures to detect errors and abuse.
No method of electronic transmission or storage can, however, guarantee absolute protection.
21. Use only from the age of 18
Elyvite is intended solely for people aged 18 and over and is designed as a professional research space for health professionals.
People under 18 may not create an Elyvite account or use the platform as registered users.
Registration asks users to confirm this.
If we learn that personal data of a minor is being processed contrary to these rules, we will assess the necessary steps, including deleting that data.
22. Your data protection rights
Where the statutory conditions are met, you have the right:
- to request access to your personal data under Article 15 GDPR,
- to request the correction of inaccurate or incomplete data under Article 16 GDPR,
- to request the erasure of your personal data under Article 17 GDPR,
- to request the restriction of processing under Article 18 GDPR,
- to request the transfer of certain personal data under Article 20 GDPR,
- to object under Article 21 GDPR to processing based on Article 6(1)(e) or (f) GDPR, and
- to withdraw consent at any time with effect for the future under Article 7(3) GDPR.
Withdrawal does not affect the lawfulness of processing carried out before it.
To exercise your rights, contact us at privacy@elyvite.com.
Where necessary, we may ask for additional information to verify your identity and to protect personal data against unauthorised access.
23. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority about how we process your personal data.
This applies in particular to a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.
24. Changes to this privacy policy
We may amend this privacy policy when Elyvite, the services we use, the legal requirements or our processing activities change.
The current version is always available through Elyvite.
We will inform users appropriately about material changes where the law requires it.
25. Data protection contact
For questions about data protection, the processing of your personal data or exercising your rights, contact us at:
Flowprimo LLC, 8 The Green, Suite A, Dover, Delaware 19901, USA
Delaware File Number: 10072739
Authorised representative: Christian Saur, Sole Member
Email: privacy@elyvite.com