Home How it works Pricing Contact
contact@getalvia.com
IMAGIC P.C. / IMAGIC ΙΚΕ — N. Misirli & Andronikou corner, 691 00 Komotini · Tel. +30 25310 25620
Legal

Privacy Policy

Last updated: 8 September 2026

This policy explains how I MAGIC I.K.E. (IMAGIC P.C.) handles personal data in the ALVIA service — the account, the equipment, the alerts and the support around them — and on the website getalvia.com. It is the canonical version, and it applies wherever you use ALVIA, including through the ALVIA application when it becomes available.

ALVIA exists to notice things about a person's day. That means it processes information about someone who may not be the person who bought it, and information that can say something about how they are. We have tried to describe that plainly rather than generically.

1. Who is responsible

The controller is I MAGIC I.K.E. (IMAGIC P.C.), 10 N. Misirli & Andronikou, 691 00 Komotini, Greece. VAT (ΑΦΜ) 801249689, ΓΕΜΗ 152693511000. For anything in this policy: privacy@getalvia.com, or +30 25310 25620.

2. Whose data this is about

  • The Subscriber — the person who orders, holds the account and pays.
  • The Wearer — the person whose wellbeing is monitored, who is often not the Subscriber.
  • Designated Contacts — the people nominated to receive alerts.
  • Website visitors and people who contact us through the form, by email or by telephone.

If you are a Wearer or a Designated Contact, your details usually reach us from the Subscriber. Section 11 explains what you can do about that. Under section 20 of our Terms of Service the Subscriber undertakes to have the authority or the lawful basis to give them to us, and to tell you.

3. What we process, and why

Account, order and subscription. Name, email address, telephone number, delivery address, the contents and value of the order, the subscription term, records of the consents you gave at checkout (including the time, the version of the terms and the technical details of that submission), renewal and cancellation records. We need these to conclude and perform the contract, to ship, to invoice and to keep the accounting records the law requires.

Equipment and connectivity. Identifiers of the wearable and the gateway, device status, battery and other device telemetry, connection and disconnection information. We need these to make the service work at all and to tell you when it is not working.

Movement and event information. Movement-related data from the wearable, and the event classifications our systems derive from it: possible fall events, prolonged immobility, panic-button presses, disconnections. This is the core of the service; without it there is no service.

Alerts. The history of alerts raised, to whom they were sent, and the delivery status reported back to us. We use this to operate the service, to answer "did it work" questions, and to investigate complaints.

Support and communications. What you write or tell us when you contact us, and our replies.

Technical, security and audit logs. Records of access to and operation of our systems, kept to keep the service secure, to detect abuse and to diagnose faults.

Payment-related information. The fact, amount, currency, time and status of a payment, and the identifiers our payment provider gives it. We never receive or store your full card number. The card details are entered into Stripe's own fields and go to Stripe, not to us.

Website use. IP address, browser and device information, and — only where you have consented — analytics and marketing identifiers. What is set, by whom, and for how long is listed name by name in our Cookie Policy.

ALVIA does not use GPS or any other positioning technology, and does not collect location data. A lost connection between the wearable and the gateway tells us that a connection was lost. It does not tell us, and cannot tell you, where anyone is.

4. Movement data and information about health

We do not treat every movement record as medical data, and ALVIA is not a medical device: it does not diagnose anything. But we recognise that information about how a specific, identifiable person moves through their day — and in particular a record of falls, of immobility, or of pressing an emergency button — can reveal or imply something about their wellbeing or health.

We therefore handle this category with particular care: access inside our organisation is limited to what operating and supporting the service requires, it is not used for advertising or profiling, and it is not sold. Where the applicable rules on special categories of data apply to a given processing operation, we rely on the explicit consent obtained for the monitoring, or on another lawful basis available under Article 9 GDPR. The precise classification of this data is one of the points we have flagged for legal review.

5. Legal bases

  • Performance of the contract (Art. 6(1)(b)) — for the account, the order, delivery, the subscription, and the operation of detection and alerting for the Subscriber.
  • Legal obligation (Art. 6(1)(c)) — for invoicing, tax and accounting records, and for answering lawful requests from authorities.
  • Legitimate interests (Art. 6(1)(f)) — for the security of our systems, fraud prevention, diagnosing faults, and defending legal claims. Where the Wearer or a Designated Contact is not the Subscriber, our legitimate interest in providing the service the household asked for also applies, balanced against their interests.
  • Consent (Art. 6(1)(a), and Art. 9(2)(a) where relevant) — for analytics and marketing cookies, for optional communications, and for the monitoring itself where consent is the basis on which it rests.

Not everything runs on consent. Where a processing operation is necessary to provide a service you have bought, withdrawing consent is not the mechanism that stops it — ending the subscription is.

6. Who else sees it

We do not sell personal data. We share it only where the service requires it:

  • Stripe — payment processing and, for card data, as its own controller.
  • The ALVIA / SCMS platform and the partner portal that provision and manage accounts, subscriptions and renewals, and through which alerts are configured and delivered.
  • Telecommunications and messaging providers — who carry the alert to your Designated Contacts. We cannot deliver a call or an SMS without them.
  • Hosting and infrastructure providers for the website and our systems.
  • Google (Google Analytics through Google Tag Manager, and Google Apps Script, which receives what you submit through the contact form on our website), Microsoft (Clarity) and Meta (Pixel) — the last three only where you have consented to analytics or marketing cookies. The contact-form route runs regardless of cookie consent, because it is how your message reaches us.
  • Our task-management tool, where enquiries from the contact form are recorded so that someone actually answers them.
  • Professional advisers, and public authorities where the law requires it.

Those acting on our instructions do so as processors, under a contract that meets Article 28 GDPR.

7. Where the data goes

Our website and service infrastructure are hosted in the European Union. Some of the providers above are established outside the EEA or may process data outside it; where that happens, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses together with any additional measures required. You may ask us which mechanism applies to a specific provider.

8. How long we keep it

We keep personal data for as long as it is needed for the purpose it was collected for, and then for as long as the law requires or a legal claim may still be brought. In practice that means: account, order and subscription data for the life of the subscription and afterwards for the statutory retention periods that apply to invoicing and accounting; alert and event history for as long as it is useful to the service and to answering questions about how it behaved; security and technical logs for a period proportionate to their security purpose; contact-form enquiries for as long as needed to deal with them and to keep a record of the exchange.

The exact retention period for each category is being finalised and will be published here. We would rather say that than publish a number we have not verified.

9. Automated processing

ALVIA classifies movement data automatically — that is what fall and immobility detection are. Those classifications trigger notifications to the people you designated; they do not produce decisions with legal or similarly significant effects for anyone, and no automated decision-making of that kind under Article 22 GDPR takes place. Section 5 of our Terms of Service and our Safety & Service Information page explain the limits of that classification.

10. What we need in order to provide the service

The account, order, equipment, connectivity, movement, event and alert data described in section 3 are necessary for ALVIA to work. Without them there is no detection and no alert. Analytics and marketing cookies are not necessary and the site works fully without them.

11. Your rights

You may ask us to give you access to your data, to correct it, to erase it, to restrict its processing, to give it to you or another controller in a portable form, and to object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time, without affecting what was done before.

This applies to Wearers and Designated Contacts as much as to Subscribers. If your details were given to us by someone else and you want them removed, write to us and we will act on it — and, where removing them would stop the service working for the household, we will tell the Subscriber that the configuration must change, without disclosing more about you than necessary.

Write to privacy@getalvia.com. We answer within one month, and will tell you if we need longer.

12. Complaints

If you think we have handled your data wrongly, please tell us first — it is usually the fastest way to fix it. You also have the right to complain to the supervisory authority. In Greece that is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, dpa.gr. If you live in another EU country you may complain to your own authority.

13. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access restricted to the people who need it, and logging of access to our systems. No system is perfectly secure; if a breach occurs that is likely to result in a high risk to you, we will inform you as the GDPR requires.

14. Children

ALVIA is not directed at children and is not intended to be bought by them. We do not knowingly collect data about a child through this website.

15. Changes to this policy

We may update this policy. The current version is always the one published here, with its date at the top. We will notify Subscribers of material changes.

16. Contact

I MAGIC I.K.E. (IMAGIC P.C.), 10 N. Misirli & Andronikou, 691 00 Komotini, Greece. Privacy: privacy@getalvia.com. Everything else: contact@getalvia.com, +30 25310 25620.