Privacy Policy

This Privacy Policy explains how Stonehill Labs Limited (“we”, “us”, “our”) collects, uses, and protects personal data when you or your organisation uses Alivio (the “Service”). It applies to visitors to our website at alivio.org.uk and to customers of the Alivio app and related services.

We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Stonehill Labs Limitedis a company registered in England and Wales, company number 17184769, with registered office at 61 Bridge Street, Kington, HR5 3DJ, United Kingdom. We are the data controller for personal data collected through our website and marketing activities. For personal data processed on behalf of our customers within the Alivio app, we act as a data processor — see the section “When we are a processor, not a controller” below.

Stonehill Labs Limited is registered with the UK Information Commissioner’s Office under registration number ZC134416.

For data protection matters — including any of the rights described in this policy — email dpo@alivio.org.uk. General privacy queries can be sent to privacy@alivio.org.uk.

What personal data we collect

When you visit our website

• Email address if you submit our “Get early access” form or otherwise contact us
• Basic technical information including IP address, browser type, and pages visited, collected by our hosting provider (Vercel) and CDN (Cloudflare) for security and operational purposes

We do not use marketing or advertising cookies on our website. We do not use Google Analytics or comparable third-party analytics services.

When you use the Alivio app

If you are a yard staff member, instructor, or other user of a customer’s Alivio account, we process:

• Your name and email address as provided by your yard manager when adding you as a team member
• Login records — when you sign in, what device, IP address
• Activity logs — what records you create or modify within the app
• Photographs you upload which may incidentally include images of people
• Anonymous product analytics — aggregated, non-identifying events about how the app is used (for example, which screens are opened or which features are used), processed via PostHog. We do not link this data to your personal identity and we do not build user profiles from it.

Within customer accounts, customers (the yards using Alivio) may also record names and contact information of horse owners, vets, farriers, and other practitioners. We process this data on behalf of our customers under the terms of our Data Processing Agreement.

Horse welfare and health records themselves are not personal data under UK GDPR.

Why we collect this data — and our lawful bases

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Contract— to provide the Alivio service to customers and their team members, and to communicate about the service
• Legitimate interests— to keep our service secure, prevent abuse, improve the product, and respond to enquiries. Our legitimate interests do not override your fundamental rights and freedoms.
• Consent— where required, such as for optional marketing emails. You can withdraw consent at any time by emailing privacy@alivio.org.uk.
• Legal obligation— to comply with tax, accounting, and other legal requirements

How long we keep your data

• Marketing list emails (from the early-access form): until you unsubscribe, or 24 months of inactivity, whichever is sooner
• Customer account data: for the duration of your subscription, plus 30 days after cancellation, after which it is permanently deleted unless you request earlier deletion
• Backups: encrypted backups are retained for up to 30 days after primary deletion before being overwritten
• Financial records: 7 years, as required by UK tax law

Who we share your data with

We do not sell personal data and do not share it for advertising purposes. We share data only with the third-party service providers (“sub-processors”) who help us deliver the service. See our full sub-processors page for the current list.

Where any sub-processor is based outside the UK, we rely on the UK Information Commissioner’s Office–approved transfer mechanisms, including the UK International Data Transfer Agreement, the EU-US Data Privacy Framework where applicable, and signed Data Processing Agreements.

When we are a processor, not a controller

When you use the Alivio app as part of a customer’s account, the customer (your yard or organisation) is the data controller for the data they enter and we act as their data processor. We process that data only according to their instructions and our Data Processing Agreement. For data protection requests relating to data held within a customer account, contact the customer (your yard or organisation) directly.

Your rights

Under UK GDPR you have the following rights:

• Access— request a copy of the personal data we hold about you
• Rectification— ask us to correct inaccurate data
• Erasure— ask us to delete your data, subject to certain exceptions
• Restriction— ask us to stop using your data in certain ways
• Portability— receive your data in a portable format
• Objection— object to our processing in certain circumstances
• Withdraw consent— where we rely on consent

To exercise any of these rights, email dpo@alivio.org.uk. We will respond within one calendar month.

You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

Security

We protect your data with appropriate technical and organisational measures. These include encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logging, principle of least privilege across our team, multi-factor authentication for administrative access, and regular review of our security practices.

No system is completely secure. If we ever experience a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.

AI and machine learning

We do not use customer data to train artificial intelligence or machine learning models — either our own or those of any third party. We do not sell customer data to AI developers.

Children

Alivio is a tool for adults working at riding schools and livery yards. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

When we update this policy, we will change the “Last updated” date at the top. For material changes, we will notify customers by email at least 30 days before the changes take effect.

Contact

For any questions about this policy or about how we handle personal data, email privacy@alivio.org.uk. Our full contact details are on our contact page.