Privacy Notice

Effective date: July 15, 2025

This Privacy Notice describes the methods and purposes by which Eliyahu.AI, LTD and its wholly-owned subsidiaries (referred to as "Eliyahu.AI," "we," "us," and "our") collect, process, and store information pertaining to individuals and users of our website, Eliyahu.AI.com ("Website"). The information presented in this Privacy Notice includes the following topics:

  • Notice & Consent
  • Network Activity
  • Cookies (and Analytics)
  • AI Processing of User Data
  • Research
  • Marketing
  • Recruitment
  • Children’s Online Privacy Protection
  • Transfer of Personal Information
  • Data Subject Rights
  • Exercising Your Rights
  • California Consumers’ Privacy Rights
  • Security
  • Data Retention
  • International Data Transfers (EU-U.S. & Swiss-U.S. Data Privacy Framework)
  • How to Contact Us
  • Changes to This Privacy Notice

Eliyahu.AI is a global company and works with sponsor organizations to ensure compliance with all applicable global and local data privacy requirements. This includes, but is not limited to, the Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and its adoption into UK law through the Data Protection Act 2018. Additionally, Eliyahu.AI recognizes the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Eliyahu.AI is not a “Covered Entity” under the U.S. Health Insurance Portability and Accountability Act (HIPAA). However, Eliyahu.AI may process protected health information (“PHI”) subject to HIPAA requirements through contractual agreements with partner organizations, including instances where Eliyahu.AI acts as a “Business Associate” as defined under HIPAA. Robust data privacy controls are in place throughout Eliyahu.AI to ensure that the highest applicable standards of data privacy laws are met.

Collection of Personal Information

Eliyahu.AI collects personal information only when an individual provides it to us directly. This can occur through actions such as registering on our Website, completing forms or sending emails, applying for job vacancies, placing orders for products or services, making inquiries or requests, volunteering for research, or similar situations in which an individual chooses to provide information. All personal information collected is stored in our secure databases and remains with Eliyahu.AI or with data processors/servers acting on our behalf (and under our instruction). We do not pass an individual’s personal information on to third parties for their own use without proper consent from the individual or unless legally required.

Notice & Consent

We collect and retain personal information in accordance with a relevant legal basis under data protection laws. We will inform individuals of the legal basis for processing their data (for example, consent, contractual necessity, legal obligation, or legitimate interest). If the legal basis is consent, we will provide appropriate information about how the data will be used and obtain the individual’s explicit consent. This consent can be withdrawn at any time. If consent is withdrawn and it was the only legal basis for processing, we will stop processing that data (except in certain limited circumstances as allowed by law).

Where consent is not the legal basis for processing, Eliyahu.AI may still choose to seek consent as a best practice or due to regulatory requirements (for instance, in research contexts), even if we also have another legal basis to continue processing the data. In such cases, we will clarify to individuals that although we are seeking consent, we may continue to use the data if another legal basis applies, even if consent is later withdrawn.

Network Activity

In general, you are not required to provide personal information just to use our Website. However, like most websites, certain information about your network activity is collected automatically for security and statistical purposes. This information may include the name of your Internet service provider, the website that referred you to our Website, the pages that you visit on our Website, and your device’s IP address. This data could potentially be used to identify you, but we do not use it for that purpose. Instead, we use network activity data in aggregate form for statistical analysis (for example, to understand overall user traffic patterns), all while maintaining the anonymity of individual users.

In cases where personal information is provided to third parties to enable services you requested (or for other purposes you authorize), we rely on technical and organizational measures to ensure that all applicable data security regulations are followed. For example, your IP address may be logged by our systems for security monitoring and performance measurement, but it is retained for only a limited period (currently, IP logs are kept for approximately 4 weeks) and solely for those purposes.

Cookies

Cookies are small text files that are stored in a website visitor’s browser cache. We use cookies to recognize your browser and optimize our Website’s performance and usability. The data collected via cookies is not used to determine your personal identity. Most browsers are configured to accept cookies automatically, but you can adjust your browser settings to refuse cookies or to alert you when a cookie is being placed on your computer. Please note that if you disable cookies, some features of our Website may not function properly.

Google Analytics

We use Google Analytics to analyze user activity in order to improve our Website. Google Analytics uses cookies to collect information such as how often users visit the site, which pages they visit, and how they interact with page elements. We use this aggregated data to gain insights into site usage and to improve the functionality and user experience of the Website. Google Analytics operates independently from Eliyahu.AI and has its own privacy policy, which we encourage you to review for information on how Google processes data. If you wish, you can opt out of Google Analytics tracking by installing a browser add-on provided by Google (for example, the Google Analytics Opt-out Browser Add-on).

Processing of Personal Information

Eliyahu.AI will retain control and responsibility for any personal information you provide to us. We may store or process some data on servers located in jurisdictions outside of your home country (for example, in the United States), where data protection laws may differ from those in your jurisdiction. In all such cases, Eliyahu.AI ensures that appropriate safeguards are in place. For instance, when personal information is processed in another country, we require that the data processor in that country protects the information to the same standards that apply under the laws of your country. These safeguards may include, as applicable, standard contractual data protection clauses, binding corporate rules, or an adequacy decision by relevant authorities.

AI Processing of User Data

If you submit files or other data to Eliyahu.AI for processing (for example, by uploading text, tables, or documents and providing your email address to receive results), we will use automated tools to process that data for the purpose of delivering the service you requested. In particular, Eliyahu.AI utilizes third-party artificial intelligence API services (currently including providers such as Anthropic and Perplexity) to analyze your submitted content and generate outputs. These third-party service providers may change from time to time, but in all cases they are bound to process your data only for our instructed purposes and to maintain adequate data protection standards. By using our AI-powered services, you acknowledge that your data will be transmitted to these third-party processors (which may be located in other countries, including the United States) solely to carry out the requested analysis.

Any processing of personal information through these AI services is fully automated. Importantly, this automated processing does not involve any profiling or automated decision-making that produces legal or similarly significant effects on you – it is used only to provide you with the requested analysis or information. Eliyahu.AI does not use the content you submit to make decisions about you, and we do not profile individuals based on their submissions.

Eliyahu.AI will retain a copy of the data you submit, as well as any resulting output, on our secure cloud storage (such as Amazon Web Services S3). We retain this data for up to one year, unless a longer retention period is required or permitted by law, or unless you request that we delete it sooner. We keep these submissions for purposes of facilitating any follow-up services you request, for debugging and troubleshooting our systems, and for improving the robustness of our tools (for example, by testing our algorithms on a variety of inputs to ensure they perform well). We implement industry-standard security measures to protect data stored on our cloud servers, including encryption of data at rest and in transit, as well as access controls to ensure that only authorized personnel can access your files.

We will not use or share the content of your submissions for any purposes other than those described above, unless we obtain your consent or are otherwise legally permitted to do so. In particular, we do not use your submitted content to train our own or third-party machine learning models. Our agreements with our AI service providers stipulate that they will not use your data for their own purposes (such as improving their algorithms) without our permission.

Finally, if you provide an email address in connection with these services, we will use that email to send you the results of the processing or to communicate with you about your request. We may ask you to verify your email address to ensure that information is sent to the correct recipient. Any communications containing your results or personal data will be sent only to the email address you have provided (and confirmed).

Research

Individuals who wish to volunteer for research studies or activities with Eliyahu.AI may be given the opportunity to register their interest. With the individual’s consent, we may collect and maintain a database of personally identifiable information provided by the volunteer solely for the purpose of contacting them about relevant study opportunities (e.g., to recruit volunteers for specific research projects). Volunteers can choose to revoke their consent and withdraw from our research contact list at any time, as described above in the Notice & Consent section.

Eliyahu.AI uses personal information collected from research participants to conduct scientific and health-related research aimed at improving healthcare and outcomes. As a research organization, Eliyahu.AI has a legitimate interest in using information related to participants’ health and care for research studies (when participants have agreed to take part in those studies). In practice, this means that when you act as a research subject, Eliyahu.AI will use your data collected during the study in whatever ways are necessary to conduct and analyze the research.

Please note that certain data subject rights may be limited during a research study. For example, a participant’s rights to access, change, or move their information might be restricted if fulfilling those requests could compromise the integrity of the research (we need to manage information in specific ways for research to remain reliable and accurate). If a participant withdraws from a study, Eliyahu.AI will keep the information that has been gathered up to that point, but will not collect any new information going forward. To safeguard participants’ privacy, we strive to use the minimum personally identifiable information necessary for our research purposes.

If you have volunteered for research and have concerns about how Eliyahu.AI is handling your personal information, you may contact our Data Protection Officer (or equivalent privacy official) to investigate the issue. We will attempt to resolve any research-related privacy concerns. If you are not satisfied with our response, or if you believe we are processing your personal information unlawfully in the research context, you have the right to lodge a complaint with the appropriate data protection authority (for example, the UK Information Commissioner’s Office (ICO) in the United Kingdom, or the Federal Trade Commission (FTC) in the United States, as applicable).

Marketing

If you provide us with your contact details (such as an email address) for direct marketing purposes, and you give consent for us to use it, we will send you communications about the latest news, updates, and information about Eliyahu.AI. We will only retain minimal, non-sensitive contact information needed to carry out this marketing purpose. We will not share your contact details with third parties for their own marketing use without informing you and obtaining any necessary consent. You have the right to opt out of our marketing communications at any time – each marketing email will contain an unsubscribe link, or you can contact us directly to be removed from our marketing list.

Recruitment

If you apply for a job at Eliyahu.AI (or otherwise engage with us regarding employment opportunities), we will process your personal information for purposes related to recruitment and hiring. This may include using your information to evaluate your application, to contact you about the recruitment process, to schedule interviews, and to facilitate any hiring decisions. We process job applicant data based on our legitimate interest in finding qualified candidates for our roles (and, where applicable, as necessary to potentially enter into an employment contract with you).

Eliyahu.AI utilizes a third-party recruitment management system called TrackStar to organize and manage applications. Applicant data may be stored on TrackStar’s servers for the duration of the recruitment process and in accordance with our retention policies. (TrackStar’s own privacy policy can provide more details on how they protect applicant data.)

If you consent to it, Eliyahu.AI may also consider you for job opportunities other than the specific one you applied for – for example, if we think you might be a good fit for a different position. With your consent, we can keep your profile data in our central recruitment database and reach out about such opportunities.

In some cases, we may collect your professional information from publicly available sources or third parties – for example, from job boards or through recruitment agencies – if we believe you could be suitable for an open position at Eliyahu.AI. This information might include your name, contact details, and resume/CV. If we reach out to you based on such information, we will give you the option to let us know if you’re interested (or not) in pursuing the opportunity. Any personal data gathered in this way will be used solely for recruitment purposes.

Eliyahu.AI will use and share Personal Information about applicants and employees only in ways that are consistent with the purposes for which the information was originally collected or subsequently authorized by the individual. We take reasonable steps to ensure that personal information is accurate, complete, and up-to-date for its intended use.

Children’s Online Privacy Protection

Protecting children’s privacy is extremely important to us. Our Website and services are not intended for children under 13 years of age, and we do not knowingly collect or process personal information from anyone under 13 without the verifiable consent of a parent or legal guardian. If we learn that we have inadvertently collected personal information from a child under 13 without proper consent, we will delete that information as soon as possible. If a parent or guardian has provided consent for a child’s use of our Website, they have the right to review the information provided by the child and/or request that it be deleted at any time.

Transfer of Personal Information

When we transfer personal information to any third party, we do so in a manner consistent with the principles of notice and consent described above. If Eliyahu.AI discloses personal information to an external third party (for example, a service provider), we will either: (i) ensure that the third party is subject to privacy obligations that align with the principles of this Privacy Notice (for instance, by verifying they adhere to a recognized data protection framework), or (ii) establish a contractual agreement with that third party requiring them to provide the same level of data protection as we do.

If we transfer your personal information outside of the European Economic Area (EEA) (or other regions with data transfer restrictions), we will make sure that one of the following conditions is met: (a) the destination country has been deemed to provide an “adequate” level of protection for personal data by the relevant authority (for example, the European Commission has issued an adequacy decision for that country), or (b) we have put in place appropriate safeguards to protect your data, such as a contract incorporating standard data protection clauses approved for use by the European Commission (or other competent authority), or binding corporate rules within our organization.

For any onward transfer of your personal information (meaning if a third party processes data on our behalf and then transfers it further), Eliyahu.AI will remain responsible and liable under this Privacy Notice and applicable law if the subsequent third party fails to protect your information, unless we can prove we are not responsible for the event giving rise to the damage.

Please be aware that any personal information you submit for publication on our Website or through our services (for example, posting on a public forum or a comment section) may become publicly available around the world. We cannot prevent others from viewing or misusing personal information that you have made public in such a manner, so please exercise caution when deciding to disclose any personal information in public areas of our Website.

Data Subject Rights

Under applicable data protection laws (such as the GDPR and similar regulations), individuals have certain rights regarding their personal information. Please note that these rights are not absolute and may be subject to conditions or legal exceptions. In particular, we may need to verify your identity before fulfilling your request, and we may decline requests that are unfounded or excessive. We might also refuse a request if complying would adversely affect the rights and freedoms of others. Subject to these considerations, your rights include:

  • Right to Access: You have the right to ask us to confirm whether we are processing your personal information and, if so, to obtain a copy of the personal information we hold about you, as well as information on how we use it. We will provide the first copy of your data free of charge, but may charge a reasonable fee for additional copies if requested.
  • Right to Rectification: If any of your personal information held by Eliyahu.AI is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay.
  • Right to Erasure: You have the right to request that we delete your personal information without undue delay in certain circumstances. These include, for example, when the information is no longer necessary for the purposes for which it was collected, if you withdraw consent (where the processing was based on consent) and no other legal basis applies, if you object to processing and we have no overriding legitimate grounds to continue, or if we unlawfully processed your personal information. Note that this right is subject to general exclusions (for instance, we may retain data as needed to comply with legal obligations or to establish, exercise, or defend legal claims).
  • Right to Restrict Processing: You have the right to ask us to limit the processing of your personal information in certain situations. This right is available, for example, if you contest the accuracy of your data (for a period enabling us to verify it), if the processing is unlawful but you prefer restriction over deletion, if we no longer need the data but you need us to keep it for the establishment, exercise, or defense of legal claims, or if you have objected to our processing and are awaiting verification of whether our legitimate grounds override yours. When processing is restricted, we will still store your personal information but will not use it for other purposes without your consent or unless required for legal reasons.
  • Right to Object: You can object to our processing of your personal information when such processing is based on our legitimate interests (or those of a third party) or on a task carried out in the public interest, and your objection is based on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing is required for us to establish or defend legal claims. Additionally, you have an unconditional right to object at any time to the processing of your personal information for direct marketing purposes. If you exercise this right, we will cease using your data for marketing. You may also object to processing of your data for scientific or historical research or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for a task carried out for reasons of public interest.
  • Right to Data Portability: For personal information that you have provided to us, and where we are processing that information by automated means on the legal basis of your consent or a contract with you, you have the right to obtain it in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit this data to another data controller, where technically feasible, without hindrance.
  • Right to Withdraw Consent: If we are processing your personal information based on your consent, you are entitled to withdraw that consent at any time. If you do so, we will stop the processing that was based on consent. Withdrawal of consent does not affect the lawfulness of any processing carried out before you withdrew consent.
  • Right to Complain: If you believe that our handling of your personal information infringes applicable data protection laws, you have the right to lodge a complaint with a supervisory authority. For example, in the UK you can contact the Information Commissioner’s Office (ICO); in an EU country, you can contact your national or local data protection authority; and in the United States, you can contact the Federal Trade Commission (FTC) or your state’s Attorney General’s office.

Exercising Your Rights

If you wish to exercise any of these rights, you may contact us by sending a written request. The simplest way is to email us at Eliyahu@Eliyahu.AI with your request. You may also reach out by mail using the contact information provided in the How to Contact Us section below. Please include “Privacy Rights Request” in the subject line or correspondence, and clearly indicate which right(s) you wish to exercise and any relevant details.

We will respond to your request within the time frame required by law. In general, for requests under GDPR or similar laws, we will respond within one month of receiving your request (with the possibility of a reasonable extension, if needed, which we will communicate to you). For requests under the CCPA/CPRA (California law), we will respond within 45 days of receipt (with the possibility of a 45-day extension, if necessary).

Before fulfilling your request, we may need to ask for additional information to verify your identity (to ensure that we do not disclose or modify someone else’s information improperly). For example, we might ask you to confirm some details we already have on file, or to provide a copy of an ID. If you are making a request through an authorized agent, we will require proof of that agent’s authority to act on your behalf. We will not discriminate against you for exercising any of your privacy rights.

California Consumers’ Privacy Rights

In addition to the rights outlined above, California residents have specific privacy rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Please note that certain data collected for clinical research trials is exempt from CCPA/CPRA; however, the CCPA/CPRA does apply to personal information collected in other contexts (for example, information collected for job applications, employment, or when you use our Website and services in California).

California residents have the following rights with respect to their personal information:

  • Right to Know: You have the right to request that we disclose to you the following information about our data collection and data disclosures in the 12-month period preceding your request:

    • The categories of personal information we have collected about you.
    • The categories of sources from which the personal information was collected.
    • The categories of third parties to whom we disclosed personal information.
    • The business or commercial purpose for collecting your personal information.
    • The specific pieces of personal information that we have collected about you.

  • Right to Delete: (With certain exceptions) you have the right to request that we delete personal information we have collected from you. Once we receive and confirm a verifiable deletion request, we will delete (and direct our service providers/contractors to delete) your personal information from our records, unless an exemption applies. Please note that we may deny deletion requests if retaining the information is necessary for us or our service providers to complete a transaction or provide a service you requested, to detect security incidents or protect against malicious activity, to comply with legal obligations, or for certain other internal and lawful purposes as permitted by CCPA/CPRA.

  • Right to Correct: You have the right to request that we correct any inaccurate personal information we maintain about you. Upon receiving a verifiable request, we will use commercially reasonable efforts to correct the information as directed by you, taking into account the nature of the information and the purposes of processing.

  • Right to Opt-Out of Sale/Sharing: You have the right to opt out of the sale of your personal information, or the sharing of your personal information for cross-context behavioral advertising. However, Eliyahu.AI does not sell personal information, and we do not share personal information in a manner that would be considered a “sale” or “sharing” under CCPA/CPRA. Because we do not engage in these practices, the opt-out right is not applicable to our operations.

  • Right to Limit Use of Sensitive Personal Information: You have the right to limit our use or disclosure of your sensitive personal information (as defined by California law) if we were to use it for purposes beyond those necessary to perform the services or provide the goods you request, or as otherwise permitted by law. At this time, Eliyahu.AI does not use sensitive personal information for any purpose that would trigger this right beyond what is necessary to provide our services or as required by law.

  • Right to Non-Discrimination: You have the right not to receive discriminatory treatment from us for exercising any of your rights under CCPA/CPRA. We will not deny you goods or services, charge you a different price, or provide a different level or quality of services just because you exercised your privacy rights. (However, if you request the deletion of data that is necessary for us to provide a service, we may need to discontinue that service; we will inform you if that is the case so you can make an informed decision.)

Verification of Requests: If you are a California resident making a request to know, delete, or correct, we will need to verify your identity (and California residency) before acting on your request. We may ask you to provide information that matches data we already have (for instance, details of a recent transaction or interaction with us) or request a copy of a government-issued ID, in order to ensure we are dealing with the correct individual. If you use an authorized agent to submit a request on your behalf, we will require proof of the agent’s authorization (for example, a signed permission from you). Absent such proof, we reserve the right to refuse the request.

We aim to respond to verifiable consumer requests within 45 days of receipt. If we need more time (up to an additional 45 days, for a maximum total of 90 days), we will inform you of the reason and extension period in writing within the initial 45-day period. Any personal information collected from you in connection with verifying or fulfilling your request will be used solely for that purpose and will be deleted after the request has been processed, in accordance with CCPA requirements.

Security

Eliyahu.AI takes reasonable and appropriate precautions to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, and destruction. We employ a variety of security measures to safeguard data, including technical measures such as encryption (both in transit and at rest, where applicable), firewalls, and secure server infrastructure. We also implement organizational measures, like strict access controls, so that employees and contractors only access personal data on a need-to-know basis for legitimate business purposes. We continuously review and update our security practices to maintain the confidentiality, integrity, and availability of personal information under our control.

Data Retention

Eliyahu.AI retains personal information only for as long as is necessary to fulfill the specific purposes for which it was collected, and to comply with our legal or contractual requirements. This means that we will keep your data no longer than is justified by the reason it was collected. For example, if you submit content (such as files or text) for our AI services, we may retain that content for up to one year to allow for any follow-up processing you request, to debug or improve our services, or to use as test inputs to ensure our tools remain robust. We may retain data for longer periods if required by law, to protect our legal rights (such as in connection with litigation), or for other legitimate business purposes. In those cases, we will, where feasible, either isolate and securely store the data or maintain it in an archived form that limits access to only what is necessary for the stated purposes.

Once personal information is no longer needed for the purposes for which it was collected (and we are not legally required to retain it), we will either securely delete the information or anonymize it so that it can no longer be associated with an identifiable individual.

International Data Transfers (EU-U.S. & Swiss-U.S. Data Privacy Framework)

Eliyahu.AI is strongly committed to protecting the privacy of individuals when transferring personal information internationally. We comply with the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (collectively, the DPF) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Economic Area (EEA), the United Kingdom, and Switzerland to the United States. Eliyahu.AI has certified to the Department of Commerce that it adheres to the DPF Principles for all such data. If there is any conflict between the terms in this Privacy Notice and the DPF Principles, the DPF Principles shall govern.

As part of our DPF compliance, Eliyahu.AI commits to resolve any complaints about your privacy and our collection or use of your personal information. We encourage EEA, UK, and Swiss individuals who have questions or complaints (including any unresolved privacy or data use concerns) to contact us first, using the contact information provided at the end of this Privacy Notice. For any complaints that we cannot resolve directly, we have committed to cooperate with the appropriate independent dispute resolution bodies: for individuals in the EU/EEA, we will work with the panel of European data protection authorities (DPAs); for UK individuals, we will cooperate with the UK Information Commissioner’s Office (ICO); and for Swiss individuals, we will cooperate with the Swiss Federal Data Protection and Information Commissioner (FDPIC). These independent authorities will help investigate and resolve any DPF-related complaints or disputes, free of charge to the individual.

Eliyahu.AI is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) with respect to our adherence to the DPF. Under certain conditions, if you are an EU, UK, or Swiss individual and you feel that your issue has not been resolved through the above channels, you may have the option to invoke binding arbitration as a final recourse. The binding arbitration option is described in Annex I of the DPF Principles and on the official Data Privacy Framework website.

Note: The prior EU-U.S. Privacy Shield Framework was invalidated by the Court of Justice of the European Union in July 2020. However, Eliyahu.AI continued to uphold the privacy principles of that framework and has since transitioned to the new Data Privacy Framework. We maintain our certifications under these programs as a testament to the robust privacy controls we have in place.

How to Contact Us

Questions, comments, or complaints regarding the collection and processing of your personal information by Eliyahu.AI can be directed to our team as follows:

Elliot Greenblatt – Founder, Eliyahu.AI, LTD 222 Concord Ave, Unit 1, Cambridge, MA 02138, USA Email: Eliyahu@Eliyahu.AI

We welcome your inquiries and will do our best to address any concerns you have about your privacy or this Privacy Notice.

Changes to This Privacy Notice

We may update or amend this Privacy Notice from time to time. When we make changes, we will also revise the “Effective Date” at the top of this document to indicate when the changes take effect. For any material changes to this Privacy Notice, we will provide prominent notice – for example, by posting an updated notice on our Website or via other appropriate communication channels – so that you are made aware of the changes. We encourage you to review this Privacy Notice periodically to stay informed about how we are protecting your information.