Reference: for everyone
18. Data and privacy reference
This chapter lists every kind of data involved in using Elvyn. Four places hold data: Elvyn’s database, the sign-in service (Clerk), the avatar service (LiveAvatar) and SurveyMonkey. Elvyn’s operator, RMGN, runs the first and holds the accounts for the other three.
Where Elvyn depends on another service to delete something, this chapter says what Elvyn asks for and when. Elvyn repeats a deletion request on its background pass, every five minutes, until the service confirms.
18.1 Where each kind of data lives
| Data | Where | How long | Who can see it | How it is deleted |
|---|---|---|---|---|
| Email and optional name | Elvyn’s database | Until the person is erased, or removed before ever signing in | Course staff of the person’s cohorts; platform administrators | Erase person replaces the email and clears the name |
| Email (sign-in account) | Sign-in service | While the person has an account | Platform operator | Elvyn asks the sign-in service to delete the account on erasure, and when someone who never signed in is removed from their only cohort (if that request fails after a removal, the account can remain and the failure is logged); the old address is removed on an email change |
| Minutes and membership per cohort | Elvyn’s database | Kept; a membership with a session is not deleted | Course staff of that cohort; the person | Remove from this cohort (only without sessions); erasure suspends |
| Session record: patient, language, times, time charged, keep and staff settings | Elvyn’s database | Kept, for minutes and totals | The person; course staff of the cohort (Live) | Not deleted; after erasure it is linked to no identifiable person |
| Conversation text (transcript) | Avatar service | Downloadable for the cohort’s keeping period after the end (30 days by default) if kept; not downloadable at all if not kept | The person; course staff of the cohort only if staff access was on when it started | Elvyn asks the avatar service to delete it when the keeping period ends, as soon as the conversation ends if it was not kept, and on erasure; it repeats the request until the service confirms |
| Voice and video during the conversation | Streamed through the avatar service | Elvyn records neither | Nobody in Elvyn | Not stored by Elvyn |
| Patient memory (a summary) | Avatar service | Created only if the avatar service accepts the conversation; expires the keeping period after its creation or after the start of the latest conversation that used it | Nobody in Elvyn; the patient uses it | Elvyn asks the avatar service to delete it on expiry, when the person turns memory off, on erasure, and on Delete all patient memories |
| Memory reference and memory choice | Elvyn’s database | The reference as long as the memory; the choice until changed | Nobody in Course staff or Platform | The reference is removed once the memory’s deletion is confirmed; erasure sets the choice to off |
| Short-form answers | Elvyn’s database | Kept | Course staff of the cohort (CSV) | Not linked to anyone, so not deleted per person |
| Full survey answers | SurveyMonkey | As the survey owner decides | The survey owner | In SurveyMonkey |
| Survey code | Nowhere: computed when needed | Not stored | Course staff (the list of valid codes) | Nothing to delete |
| Audit log: who changed what, with reason codes | Elvyn’s database | 400 days | Platform operator | Removed by the background pass once older than 400 days |
| Import progress (emails only) | Your browser tab | Until the import finishes or the tab closes | You | Discard, or closing the tab |
| Guide video preference | Your browser | Until you change it or clear the browser’s data | You | Clearing the browser’s data |
18.2 Principles
- Elvyn stores no conversation text. It fetches the transcript from the avatar service when someone downloads it, and passes it on without writing it to its database or its logs.
- Staff access is decided before the conversation. The student sees, before starting, whether staff can read it. A later change to the setting does not open an earlier conversation.
- Each staff read is logged. Every transcript download by staff writes an audit row.
- Reason codes, not free text. Minute changes and stopped conversations record a code such as “technical-problem”, so no names reach the audit log.
- The short form is anonymous by construction. An answer is stored with the week, case and language only, and one set of answers is accepted per finished conversation.
- The SurveyMonkey survey follows its collector. Elvyn sends it no name or email; whether answers are anonymous and whether a person can answer twice are set in SurveyMonkey. The pilot’s collectors have anonymous responses on.
- Survey codes identify conversations, not people. Only someone holding both Elvyn’s database and its secret key could link a code to a session.
18.3 What Elvyn does not do
- It does not record audio or video, and does not turn on the camera.
- It does not grade students or analyse what they said.
- It does not send students’ names or emails to the avatar service or to SurveyMonkey.
- It does not use real patient information. Students confirm before each conversation that they will not share any.