Privacy policy
The short version
- Bellpull is an alert service. When someone holds their button, we text, push and phone the people they chose until one of them responds.
- To do that we hold names, phone numbers, an address, practical access notes and a record of each alert.
- We hold no health information. There is no field for a condition, medication or diagnosis anywhere in Bellpull.
- We do not sell your information or use it for advertising.
- Routine alerts, when they arrive, are optional and only switched on with the agreement of the person being looked after. The button works whether or not they agree.
Who we are
Bellpull is run by Weftworks Limited, a company registered in England and Wales (company number 17439248), registered office 2 Ravenscroft Gardens, Trowbridge, Wiltshire, BA14 7JU. Weftworks is the controller of the personal information described here. We are registered with the Information Commissioner's Office under registration ZC241086.
Write to us about privacy at [email protected].
Whose information we hold
- Account holders. The person who signs up, pays and manages Bellpull.
- The people who carry a button. We call each of them the person being looked after.
- Responders. Family, friends and neighbours who agreed to be contacted when a button is held. No number is called or texted until its owner has accepted the invitation.
- Visitors to bellpull.app.
If you set up Bellpull for someone else, you confirm when you sign up that they agreed to carry the button, or that you have the authority to decide for them. The kit includes a card for the person being looked after that tells them, in plain words, what Bellpull holds about them.
What we hold
| Whose | What | Why |
|---|---|---|
| Account holder | Name, email, phone number, sign-in details (Apple, Google or an email link), billing address, subscription and payment status. Card details are held by Stripe, not by us. | To run your account and take payment. |
| Person being looked after | First name or the name responders know them by, home address, access notes (for example, where the key safe is or which door to use), their buttons and hub. | So a responder knows who needs them and how to get in. |
| Responders | Name, mobile number, optional fallback number, their order in the list, and, if they use the app, a device token so we can send alerts to their phone. | To reach them when a button is held. |
| Alerts and tests | When a button was held or tested, each text, push and call we made, whether it was delivered or answered, who responded and when, and any note added when the alert was closed. | To run the escalation, show you the history, and look into anything that went wrong. |
| Equipment | Hub and button serial numbers, when the hub last checked in, button battery level, and the hub's internet address when it contacts us. | To tell you if the hub is offline or a battery is low. |
| Support | What you tell us when you contact us. | To help you. |
What we never hold
Bellpull is not a healthcare product. We do not ask for, and have nowhere to store, any condition, medication, diagnosis or care need. The access notes are for practical things like a key safe code location, which door to use, or the dog. Please do not write health details there. If we find any, we will ask you to remove them.
We do not track anyone's location. The button only tells us that it was held and which hub heard it.
Bellpull never calls 999. When an alert opens, a person decides whether emergency services are needed.
Why we use it, and our lawful basis
- Running the service for the account holder: performance of our contract with you.
- Alerting responders and holding details of the person being looked after: our legitimate interest, and theirs, in getting help to someone who asked for it by holding their button. We keep this to what an alert needs and nothing about health.
- Keeping alert records: legitimate interests, so you can see what happened and we can show that the service worked or find out why it did not.
- Billing and tax records: legal obligation.
- Product news by email: your consent, which you can withdraw with one click.
Routine alerts (coming soon)
We are building an optional feature that uses a sensor in the home to learn the usual rhythm of the day, such as what time someone is usually up and about, and lets responders know when today is later or quieter than usual.
- It is off by default and is only switched on with the agreement of the person being looked after, given in their own words and recorded with the date, the wording they agreed to and who was present.
- Where the person cannot decide for themselves, it can only be switched on by someone who confirms they hold a lasting power of attorney for health and welfare, or that a best-interests decision was made and recorded.
- The button service never depends on agreeing to routine alerts.
- We would hold only the time of the last movement and an hourly count of movement. We would not learn sleep, bathroom visits or anything about health.
- Our lawful basis would be consent, which can be withdrawn at any time from the app. Withdrawing deletes the routine history.
We will update this policy with the full details before the feature is available.
Who we share it with
We use these suppliers to run Bellpull. Each acts on our instructions under a written contract.
| Supplier | What they do | Where |
|---|---|---|
| Cloudflare | Hosts the service, the database and this website | Global, including the US |
| Twilio | Sends texts and places phone calls | US |
| Google (Firebase Cloud Messaging) | Delivers app alerts to Android, and to iPhone through Apple | US |
| Apple (Push Notification service) | Delivers app alerts to iPhones | US |
| Stripe | Takes payments | UK, EU and US |
| Fastmail | Our own email | US |
| Maileroo | Delivers account emails and runs our help desk | See transfers below |
The button and hub are made by Flic (Shortcut Labs AB, Sweden). Alerts go from the hub straight to Bellpull. The hub may also contact Flic for its own software updates; see Flic's privacy policy for that.
Alert texts and calls contain the name of the person being looked after, the time, the address and the access note. They go only to the responders on that person's list.
We share information with the police or other authorities only where the law requires it. We never sell it.
Information outside the UK
Cloudflare, Twilio, Google, Apple, Stripe, Fastmail and Maileroo may process information in the US and other countries. Where they do, we rely on the UK Extension to the EU-US Data Privacy Framework where the supplier is certified, or on the UK International Data Transfer Addendum to the standard contractual clauses.
How long we keep it
| Information | How long |
|---|---|
| Account, people, responders | While the account is open, then deleted within 30 days of closing |
| Alert history and call and text records | 24 months from the alert |
| Billing records | 6 years, as tax law requires |
| Routine alert history | 90 days, and deleted at once if agreement is withdrawn |
| Records of agreement to routine alerts | While the feature is on, then 6 years |
| Support conversations | 24 months after the conversation ends |
Your rights
You can ask to see the information we hold about you, have it corrected or deleted, object to how we use it, ask us to limit its use, or ask for a copy to take elsewhere. Responders can leave a person's list at any time from the invitation link or by emailing us. To use any of these rights, email [email protected]. We reply within one month.
If you are unhappy with how we handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.
Cookies
bellpull.app uses only the cookies needed to keep you signed in and to take payment. We do not use advertising or tracking cookies, so we do not ask you to accept any.
Security
Information is encrypted in transit. Each button has its own secret, which can be changed at once if it is lost. Alert links in texts work for one alert only. Only the account holder and that person's responders can see an alert, and only Weftworks staff who need to for support can see account details.
Changes and contact
If we change this policy in a way that matters, we will email account holders before it takes effect. The version and date are at the top.
Weftworks Limited, 2 Ravenscroft Gardens, Trowbridge, Wiltshire, BA14 7JU. [email protected]