This policy explains what Elena collects when you use getelena.com or work with our team, what we do with it, and what you can ask us to do. It is written to be read, not skimmed. If a sentence here is unclear, email us and a person will answer.
Elena is operated by Elena Technologies LLC, a Wyoming limited liability company, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Questions about this policy or about your information:legal@getelena.com.
1. Two policies, on purpose
Almost everything you tell Elena is about your health, because you contact us about a treatment. Washington's My Health My Data Act requires that kind of information to have its own policy, so we keep two:
- The Consumer Health Data Privacy Policy covers your health data: what you tell us about your treatment, your messages, photos you send, and the contact details attached to them. It also explains your rights over that data and how to use them. We apply it to every patient, not just people in Washington.
- This general policy covers everything else: how the website itself works, payment records, how long we keep things, security, children, and how we tell you about changes.
Where the two overlap, the Consumer Health Data Privacy Policy wins.
2. What we collect
What you give us on our forms. Your name, email, and phone number. The treatment you are considering, what you wrote for a doctor to read, your budget range, when you can travel, how you prefer to pay, whether you need English support, and how you want us to reach you. If you ask us to check a doctor: that doctor's name, clinic, and social handle. If you send us a quote you already have: who quoted you, the price, and the city.
What you send us later. Your emails and messages to us and to the clinic, and any photos, files or documents you choose to upload or send. Only share what is needed for your request. The clinic remains responsible for its clinical records and medical decisions.
What the clinic sends us about you. When a clinic prepares your quote, we receive the treatments it is quoting and any notes it writes.
Payment records. If you pay a booking fee, we keep the amount, the date, the payment provider, and the payment reference. We never see or store your card number: the payment happens on the provider's page, not ours.
Technical information. Your IP address, which we use for two things and nothing else: to stop one computer from flooding our forms, and to pass to Cloudflare's bot check when you submit a form. It is kept for 15 minutes and is not attached to your request. Our site analytics are described in section 6.
We do not ask for your Social Security number or buy information from data brokers. A file you or your clinic adds may contain health or identity information, so avoid sending unnecessary documents. Any clinical document the clinic stores through our tools stays subject to its own duties and your rights.
3. How we use it, and who chooses
Elena provides technology and administrative communication services to clinics. In a clinic's own inbox, that clinic determines the purposes of patient communication and Elena processes information on its instructions. When the clinic hires managed support, our team may answer administrative messages, collect information for its review and present clinic-approved quotes. The clinic's privacy notice also applies to what it does with your information.
Elena separately handles its own account, payment, security and legal records. We use necessary information to respond to your request, carry messages, support a booking and resolve questions. Your request goes to the clinic you contact or expressly choose. We do not choose a provider for you based on the compensation it pays us.
We do not sell your health information, use it to build advertising audiences or train general AI models on it. Permission to contact you about a request is separate from permission for promotional messages or publication of a case or photo.
This policy is information, not a substitute for consent. Where consent is required, the form or relevant interaction asks for it separately and records the version you saw.
4. Who we share it with
- The clinics you pick. They receive your name, your contact details, what you wrote about your treatment, and your conversation, so they can quote you and treat you. They are independent licensed clinics in Colombia, and your relationship with them is direct.
- Cloudflare, Inc. (United States). Hosts our website, our database, and our files, and runs the bot check on our forms. Everything we hold is stored there.
- Resend (United States). Delivers our emails to you and carries your replies to us.
- Telnyx (United States). Only if you choose SMS or a phone call. It carries those messages and calls, and receives your phone number.
- Meta Platforms (United States). Only if you write to us on Instagram or WhatsApp. Meta sees those messages and the account or number you write from. Pick email, SMS, or phone if you would rather it did not.
- Our payment provider. If you pay a booking fee, the provider identified at checkout receives payment details, your name and an opaque booking reference. We do not send it your clinical conversations or medical files as payment metadata.
- Automated drafting (Cloudflare). We use an automated system to preparedrafts for a person to review: a draft quote, a draft note from a voice message. It runs on Cloudflare, the same company that already hosts everything we hold, on infrastructure Cloudflare operates in the United States and England. Nothing it drafts reaches you until a person approves it, we do not use it to decide anything about you, and no model provider is allowed to train on what you write. Only if you tick the separate box that asks for it, Elena uses your conversation, with your name, email and phone number removed, to improve its own assistant; you can withdraw that permission at any time.
We have no corporate affiliates or subsidiaries. Commercial promoters who introduce clinics to Elena do not receive patient conversations or identifiable health information. We do not share your information with advertising networks, data brokers, or anyone who would use it for their own marketing. If a law or a court requires us to disclose something, we will, and we will tell you unless the law forbids it.
5. Text messages
Elena runs the text-message line of some of the clinics we work with. When you write to one of those clinics through its own website and tick the box that asks for texts, the messages you get come from that clinic's number and are handled by Elena (Elena Technologies LLC) on the clinic's behalf. That box is never required, and the clinic's own privacy policy names the number and describes the program.
Those texts are of two kinds, and each has its own box on the clinic's form: service texts, about your quote, your treatment and your booking; and, only if you also ticked a second, separate box, promotional texts from that clinic, at most one per quote. We keep a record of when you agreed, which boxes you ticked and the exact wording you agreed to.
To stop, reply STOP to any message and every text from that number stops. To withdraw only the promotional permission, email legal@getelena.com or write to the clinic. You never have to use one particular channel to say stop, and we act on it within ten business days at the outside. The messages travel through Telnyx, already listed in section 4.
We do not rent, sell or share your number or your agreement, and an agreement you gave for one clinic's line never carries over to another sender. getelena.com itself does not run a text line today. If you pick SMS as your contact preference on one of our forms, the clinic you chose may answer you by text from its own line, handled by Elena; those are service texts only. If Elena ever runs a line of its own, we will add its number and its own box here first.
6. Cookies, analytics, and tracking
getelena.com sets no cookies. The pages we email you a link to, where you read your quote or pick your doctors, work from the link alone and set no cookies either.
We count visits in two cookieless ways. Cloudflare Web Analytics counts page loads; it does not identify you and does not follow you to other websites. We also run our own count. It uses a second random number kept in your browser's session storage for that tab, separate from the "How you found us" number below and never sent with a form, so a visit is not tied to a request you send. It also uses an estimate of how many different people visited each day: our server mixes your network address and browser type with a random code that changes daily and is destroyed within 48 hours, and keeps only the result. It never stores your address or browser type, and once that code is gone the result cannot be turned back into you. Cloudflare, our hosting provider, separately keeps technical request records (including network address and browser type) for security and troubleshooting, and deletes them within 7 days. We treat this visit information only in a form that cannot identify you, and we will not try to identify you from it.
How you found us. When you open getelena.com, your browser keeps a random session number and a note of how you arrived: the page you landed on, the website that sent you (its address and page), and any campaign tags or ad-click codes in the link (such as utm_source or gclid). This lives in your browser's session storage, not in a cookie, and disappears when you close the tab. If you send a form, that note travels with your request, together with your approximate country and state as seen by our network provider, so we can learn which pages and campaigns help patients find a clinic. We keep it with your request and delete it with your request. We never send it to an advertising platform.
No other party collects information about your online activity across other websites when you use our site, because there are no advertising or tracking pixels on any Elena page or form. Because we do not track you across sites, browser "do not track" signals change nothing on our site: there is nothing to turn off.
Our forms use Cloudflare Turnstile to tell people from bots. It runs in your browser and sends Cloudflare technical signals about your browser. It does not tell us who you are.
7. Where your data lives
Our systems run on Cloudflare, a US company whose network is worldwide. The automated drafting described in section 4 runs on infrastructure Cloudflare operates in the United States and in England. The clinics that quote and treat you are in Colombia, so getting you a quote necessarily means your request travels there. We do not promise that your data stays inside the United States, because with a Colombian clinic it cannot.
8. How long we keep it
We keep what you give us only as long as we need it, and then we delete it. Our scheduled retention process uses the periods below. A documented legal hold can pause deletion of the specific records needed for a dispute or legal obligation; it does not authorize keeping unrelated health information indefinitely.
- If you contacted us and never booked, we delete your request and your messages 12 monthsafter we last heard from you.
- If you booked through us, we keep your request and your messages for 3 years after the treatment, so we can help if something comes up afterwards.
- Photos and files you sent us are deleted sooner, 90 days after your case closes.
- If you left a voicemail, we delete the recording 30 days after we write down what it said.
- We keep the record of the booking fee you paid for 7 years, under our financial-record retention policy. A legal duty or dispute may require a different period for a specific record, which we restrict to that purpose. After the periods above, that record is no longer connected to anything about your health.
- Our nightly database backups are encrypted and kept for about 30 days, then overwritten.
You do not have to wait for any of this. Section 8 explains how to ask us to delete now.
9. Your rights and how to use them
Email legal@getelena.com and tell us what you want. You do not need an account, and we will never ask you to create one to use these rights. We may ask you to confirm you are you, usually by replying from the email address we have for you.
You can ask us to:
- confirm whether we hold information about you, and give you a copy of it;
- tell you who we shared it with, and how to contact each of them;
- correct your name or contact details if they are wrong;
- withdraw your consent to us collecting or sharing your health data;
- delete it.
Deleting. We remove your data from our live systems. Copies also sit in our nightly backups, which roll off within 30 days of your request. If we ever restore a backup, we do not put deleted data back.
Timing. These requests are free, up to twice a year. We answer within 45 days. If we need longer, we may take one more 45-day period, and we will tell you why inside the first 45 days.
If we say no. Reply to our answer and say you want to appeal. We respond in writing, with reasons, within 45 days. If you are still not satisfied, you can complain to your state's attorney general. Washington residents can useatg.wa.gov/file-complaint.
We will not treat you differently, charge you more, or give you worse service because you used any of these rights.
10. Security
Access to your record is restricted by role: a clinic can only see the patients who chose it, and administration is limited to Elena's own team. Our nightly backups are encrypted before they are stored. Our chat runs over ordinary email, and email is not encrypted end to end, so treat it the way you would treat any other email about your health.
No system is perfectly secure and we will not tell you otherwise. If we ever have a breach that affects you, we will tell you what happened and what we are doing about it.
11. Changes to this policy
When we change this policy, we post the new version on this page with a new effective date and version number. If a change would let us collect, use, or share a category of your health data this policy and the Consumer Health Data Privacy Policy do not already describe, or share it with a kind of recipient they do not already name, we will ask you first, and we will not apply that change to data we already hold unless you say yes.
12. Children
Elena is for adults. You must be 18 or older to use our services, and we do not knowingly collect information from anyone under 18. If you believe a minor has sent us information, emaillegal@getelena.com and we will delete it.
13. Contact
Elena Technologies LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States.legal@getelena.com.