Privacy Policy

1. Introduction

Pathpal Inc. (“Pathpal,” “we,” “our,” or “us”) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Pathpal application and related services (collectively, the “Services”).

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use our Services.

2. Who We Are

Pathpal Inc. is a workplace grief and wellbeing support platform headquartered in Oakville, Ontario, Canada. We provide peer-led communities, AI-facilitated workshops, on-demand resources, and HR analytics tools to employers and their employees.

For privacy-related inquiries, please contact our Privacy Officer:

Privacy Officer, Pathpal Inc. 418 Iroquois Shore Rd, Unit 207 Oakville, Ontario, Canada Email: privacy@mypathpal.com Website: mypathpal.app

3. Information We Collect

3.1 Information You Provide Directly

• Account information: Name, email address, password, date of birth (used for age verification), and profile details when you register
• Profile information: Job title, employer, and optional biographical information
• Session information: Responses to pre-session questions including what brings you to a session, how you are feeling, and what you hope to get from a session
• Workshop and session content: Information you share during AI-facilitated or live workshops, including text, voice audio, and chat messages
• Communications: Messages you send to us, feedback you provide, and support requests
• Payment information: Billing details processed securely through our payment processor (Stripe); we do not store full payment card details

3.2 Information Collected Automatically

• Usage data: Pages visited, features used, session duration, clicks, and interactions within the app
• Device information: Device type, operating system, browser type, IP address, and unique device identifiers
• Log data: Access times, error logs, and technical diagnostics
• Safety detection data: During AI-facilitated sessions, session transcripts are analysed in real time by automated safety detection systems for the presence of risk indicators. Where a risk indicator is detected, a timestamped record is created and retained separately from standard session data. See Section 4.3 for full details.
• Cookies and tracking technologies: Session cookies, analytics cookies, and similar technologies (see Section 9)

3.3 Information From Third Parties

• Employer-provided data: If your employer provides Pathpal as a benefit, we may receive your name, email address, and employment information from your employer
• Authentication providers: If you use Google OAuth or similar services to sign in, we receive basic profile information from those providers

3.4 Sensitive Information

Given the nature of our Services, you may choose to share sensitive personal information including information relating to your mental health, emotional wellbeing, bereavement, and personal loss. We treat this information with the highest level of care and apply additional safeguards as described in this policy. You are never required to share sensitive information to use our Services.

Session content shared during AI-facilitated workshops is processed by Anthropic (Claude API) solely to generate facilitator responses. Anthropic does not use your session content to train its AI models. See Section 12.1 for details.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 Providing and Improving Our Services

• Creating and managing your account, including verifying that you meet the minimum age requirement of 18 years
• Facilitating AI-facilitated workshops (delivered via LiveKit and the Anthropic Claude API) and Live Workshops (delivered via Zoom)
• Personalizing your session experience based on your pre-session responses
• Matching you with appropriate workshop content and facilitators
• Generating HR analytics and wellbeing insights for your employer (in aggregate and anonymised form only — see Section 6)
• Improving our AI facilitator personas (Ember, Sage, Arden, and Rowan), workshop content, and platform features

4.2 Communications

• Sending session reminders, booking confirmations, and follow-up emails
• Notifying you of platform updates, new features, and relevant content
• Responding to your support requests and feedback
• Sending crisis support resources where appropriate

4.3 Safety and Crisis Support

Pathpal operates a two-tier automated safety detection system during all AI-facilitated sessions. Session content is analysed in real time by the Claude API (Anthropic) using semantic detection — not keyword matching — for the presence of safety risk indicators.

Tier 1 — Passive flag

If passive risk indicators are detected (such as expressions of hopelessness or disappearance language, without explicit intent or method), the session continues uninterrupted. The session is timestamped and flagged in our backend systems and routes to a same-day clinical review queue. A second Tier 1 flag within the same session automatically escalates to Tier 2.

Tier 1 flags are not visible to you during the session.

Tier 2 — Active escalation

If active risk indicators are detected (such as explicit intent to self-harm, reference to method or means, imminence language, or a second Tier 1 flag), the AI facilitator pauses the session immediately. A crisis resource overlay is presented to you. Other session participants see a brief pause message. The session does not resume.

In the event of a Tier 2 escalation, a qualified clinician engaged by Pathpal is notified in real time and receives a session excerpt sufficient to assess the nature of the concern. The clinician’s professional duty-to-warn obligations exist independently of Pathpal’s platform policy. Pathpal does not contact emergency services directly; we provide crisis resources and encourage you to reach out yourself.

The legal bases for this processing are: (a) your explicit consent, obtained through the pre-session consent screen (see Section 4.6); and (b) where disclosure is necessary to prevent serious harm, PIPEDA Section 7(3)(e), which permits disclosure without consent in such circumstances.

Safety flag records are retained for 24 months from the date of the flag and are accessible only to the designated clinician and our Privacy Officer. They are never shared with your employer.

4.4 Legal and Compliance

• Complying with applicable laws and regulations including PIPEDA, GDPR, and other applicable privacy legislation
• Enforcing our Terms of Service
• Protecting the rights, property, and safety of Pathpal, our users, and the public
• Responding to lawful requests from regulatory or law enforcement authorities

4.5 Business Operations

• Processing payments and managing billing
• Conducting internal research and analytics to improve our Services
• Maintaining the security and integrity of our platform

4.6 Pre-Session Consent

Before each AI-facilitated workshop session, you are required to complete a consent screen with five mandatory checkboxes. These cover: the nature of AI facilitation; the non-clinical status of the service; processing by third-party AI providers; automated safety detection and potential clinician notification; and confirmation of your age and legal capacity to consent. An optional checkbox covers use of session content to improve Pathpal’s AI systems. You may not proceed to a session without completing all five mandatory checkboxes. This consent is separate from and in addition to your acceptance of our Terms of Service.

5. Legal Basis for Processing (GDPR)

In accordance with GDPR Article 6, we rely on the following lawful bases for processing your personal data:

Where we rely on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

6. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

6.1 With Your Employer

If your employer has provided Pathpal as a benefit, we may share aggregated and anonymised wellbeing insights and analytics through our HR analytics dashboard. We never share individually identifiable session content, personal disclosures, sensitive information, or safety flag data with your employer under any circumstances.

Aggregated analytics data provided to employers is anonymised such that no individual user can be identified. Employers are contractually prohibited from using this data to identify individual employees or to make, inform, or influence any employment decision affecting any individual.

6.2 With Service Providers

We share information with trusted third-party service providers who assist us in operating our platform, subject to appropriate data processing agreements. Our current sub-processors are:

6.3 For Legal Reasons

We may disclose your information where required by law, court order, or governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of Pathpal, our users, or others. Where disclosure without consent is necessary to prevent serious physical harm, we may rely on PIPEDA Section 7(3)(e).

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

6.5 With Your Consent

We may share your information for any other purpose with your explicit prior consent.

6.6 Internal Administrative Access

In limited circumstances, authorised Pathpal personnel and designated clinical advisors may access session content, including transcripts and session summaries, for the following purposes only:

• Platform safety and crisis protocol administration, including Tier 1 clinical review and Tier 2 real-time response
• Quality assurance and AI facilitator improvement
• Legal compliance and regulatory response
• Technical support and error investigation

All personnel with access to session content are subject to strict confidentiality obligations and data handling training. Access is logged, timestamped, and audited. Session content is never accessed for commercial purposes or shared with your employer.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The following retention periods apply:

When you delete your account, we will delete or anonymise your personal information within 30 days, except where we are required to retain it by law (such as payment records) or for legitimate compliance purposes (such as safety flag records where required by our breach response obligations).

8. Your Privacy Rights

8.1 Rights Under GDPR (EEA and UK Users)

In accordance with GDPR Articles 15–22, you have the following rights:

• Right of access (Article 15): Request a copy of the personal data we hold about you
• Right to rectification (Article 16): Request correction of inaccurate or incomplete data
• Right to erasure (Article 17): Request deletion of your personal data where there is no compelling reason for its continued processing
• Right to restrict processing (Article 18): Request that we limit how we use your data
• Right to data portability (Article 20): Receive your data in a structured, machine-readable format
• Right to object (Article 21): Object to processing based on legitimate interests
• Rights related to automated decision-making (Article 22): Not be subject to solely automated decisions that significantly affect you

Note: Safety flag records may be retained beyond a deletion request where retention is necessary to comply with legal obligations or to protect vital interests.

8.2 Rights Under PIPEDA (Canadian Users)

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access your personal information held by us
• Challenge the accuracy and completeness of your information
• Request correction of inaccurate information
• Withdraw consent for the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions)
• File a complaint with the Office of the Privacy Commissioner of Canada

8.3 Rights Under US State Privacy Laws

If you are a resident of California or another US state with comprehensive privacy legislation (including the California Privacy Rights Act (CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act, or similar), you may have additional rights including the right to know, delete, correct, and opt out of the sale or sharing of your personal information.

Pathpal does not sell personal information. Where US state privacy laws apply to our processing of your personal information, we will honour requests consistent with those laws. Please contact privacy@mypathpal.com to make a request.

If you are accessing Pathpal through an employer benefit as an employee, your employer (as the contracting party) may have separate obligations under applicable US privacy law. Please refer to your employer’s privacy notices for further information.

8.4 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us at: privacy@mypathpal.com

We will respond to all requests within 30 days. We may need to verify your identity before processing your request. There is no fee for making a request unless it is manifestly unfounded or excessive.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our Services. You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of our Services. We do not use advertising or third-party tracking cookies.

10. Data Security

In accordance with GDPR Article 32, we implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 encryption
• Access controls: Role-based access controls limiting employee access to personal data on a need-to-know basis
• Authentication: Multi-factor authentication for all internal systems
• Security audits: Regular penetration testing and vulnerability assessments
• Vendor assessments: Security reviews of all third-party service providers
• Staff training: Regular privacy and security training for all employees
• Access logging: All access to personal data, including session content and safety flag records, is logged and timestamped’

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

11. Data Breach Notification

In accordance with GDPR Article 33, PIPEDA’s Breach of Security Safeguards Regulations, and other applicable Canadian privacy legislation, in the event of a data breach that poses a real risk of significant harm to individuals, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where required under GDPR)
• Notify the Office of the Privacy Commissioner of Canada as soon as feasible (where required under PIPEDA)
• Notify affected users without undue delay where the breach is likely to result in a risk to their rights, freedoms, or wellbeing
• Maintain an internal record of all data breaches for a minimum of 24 months, regardless of whether notification is required
• Take immediate steps to contain and remediate the breach in accordance with our Breach Response Procedure

12. International Data Transfers

Pathpal is headquartered in Canada. All permanent user data is stored on AWS infrastructure located in Canada (ca-central-1). Your information may be transferred to and processed in countries other than Canada, including the United States, where our sub-processors operate.

Where we transfer personal data outside of the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission and adequacy decisions where applicable.

12.1 AI-Facilitated Session Data Flows

To deliver AI-facilitated workshop sessions, your voice audio and session transcripts are processed in real time by the following third-party service providers located in the United States:

• ElevenLabs: Speech-to-text transcription of your voice input, and text-to-speech synthesis of the AI facilitator’s voice responses
• Anthropic (Claude API): AI response generation and automated safety detection from session transcripts
• LiveKit: Real-time audio and video transport for AI-facilitated sessions

Live Workshops (human-facilitated) are delivered via Zoom. Video and audio from Live Workshops are processed in the United States subject to Zoom’s data processing agreement with Pathpal.

Anthropic does not use your session content to train its AI models. This processing is transient — transcripts are not retained by sub-processors beyond the duration of the session. All permanent session data is stored in Canada (AWS ca-central-1).

These cross-border transfers are governed by Data Processing Agreements with each provider requiring a comparable level of protection to Canadian privacy law. By using our AI-facilitated sessions, you consent to this cross-border processing as described in this policy.

13. Children's Privacy

Our Services are designed exclusively for individuals aged 18 and over. We enforce this requirement through date-of-birth verification at account registration. If you provide a false date of birth to circumvent this restriction, you are in breach of our Terms of Service. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected personal information from a minor, we will take steps to delete that information promptly. If you believe we have collected information from a minor, please contact us at privacy@mypathpal.com.

14. Mental Health and Sensitive Data

We recognise that users of our Services may share deeply personal information related to grief, loss, and mental health. We are committed to:

• Treating all mental health and wellbeing information with the highest level of sensitivity and care
• Never sharing individual session content, personal disclosures, or safety flag data with employers
• Never using sensitive personal information for advertising or third-party marketing
• Providing crisis resources and routing to appropriate professional support through our two-tier safety protocol (see Section 4.3)
• Training all staff who may access sensitive information on appropriate handling practices
• Restricting access to sensitive data to authorised personnel and designated clinical advisors only

15. AI Facilitation and Automated Processing

Our platform uses artificial intelligence to facilitate workshops and provide support. In this context:

• AI-facilitated sessions are delivered by one of our AI Facilitator personas — Ember, Sage, Arden, and Rowan — powered by the Anthropic Claude API, with voice synthesis and transcription provided by ElevenLabs and real-time session infrastructure provided by LiveKit
• Pre-session responses you provide are used to personalise your AI-facilitated experience
• Session transcripts are processed for automated safety detection as described in Section 4.3
• Session transcripts may be retained in accordance with our data retention policy (Section 7)
• We do not make significant automated decisions about you based solely on AI processing without human oversight
• You may request a human-facilitated session at any time by selecting a Live Workshop (delivered via Zoom)

The AI Facilitator personas (Ember, Sage, Arden, and Rowan) are not licensed therapists, counsellors, psychologists, or mental health professionals. The Services are not a substitute for professional medical or mental health advice, diagnosis, or treatment.

16. Third-Party Links and Services

Our platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through our platform.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy
• Notify you by email or in-app notification
• Where required by law, obtain your consent to the updated policy

Your continued use of our Services after the effective date of any changes constitutes your acceptance of the updated policy.

18. Record of Processing Activities

In accordance with GDPR Article 30 and PIPEDA’s accountability principle, Pathpal maintains an internal record of all processing activities carried out under our responsibility, documented in our Data Protection Impact Assessment (DPIA-003) and Privacy Management Program (PMP-001). These records include the purposes of processing, categories of data subjects and personal data, recipients of personal data, and retention periods, and are available to supervisory authorities upon request.

19. Contact Us and Supervisory Authority

For any privacy-related questions, requests, or concerns, please contact our Privacy Officer:

Privacy Officer, Pathpal Inc. Email: privacy@mypathpal.com Website: mypathpal.app Mail: Pathpal Inc., Oakville/Mississauga, Ontario, Canada

If you are located in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en

If you are located in Canada and wish to file a complaint, you may contact the Office of the Privacy Commissioner of Canada at: https://www.priv.gc.ca

If you are located in California or another US state with applicable privacy legislation and wish to exercise your rights, please contact privacy@mypathpal.com.

© 2026 Pathpal Inc. All rights reserved.