Hellō has an interesting protocol that prevents Hellō staff from knowing what data is stored in the system.

There's an step-by-step overview of the protocol at https://www.hello.coop/pages/protocol.html