Privacy Policy

1. Introduction

Eve operates an AI-assisted mental health support platform used by licensed clinics and their patients across Canada. This Privacy Policy explains how we collect, use, store, and protect your information.

We comply with the Personal Health Information Protection Act, 2004 (PHIPA, Ontario) and the Personal Information Protection and Electronic Documents Act (PIPEDA, Canada).

Eve acts as a Health Information Agent under PHIPA. Clinics (Health Information Custodians) are responsible for obtaining patient consent and providing patients with their own Notice of Privacy Practices.

2. Information We Collect

2.1 Account Information

• Full name and email address
• Password (stored as a cryptographic hash — never in plain text)
• Profile image (optional)
• Role (patient or therapist) and clinic association

2.2 Personal Health Information (PHI)

The following constitute personal health information under PHIPA when associated with an identifiable individual:

• Full text of chat conversations with Eve (AI therapist)
• Voice session data: duration, recap, summary, plan, emotional reflection, and conversation turns
• Daily mood check-ins: mood, energy, anxiety, and sleep scores (1–10), notes, and tags
• Therapy goals: title, description, category, status, and target dates
• AI-generated insights: patterns and recommendations derived from your data
• Session memory: short-term context used to maintain continuity across sessions
• Vector memory: semantic embeddings derived from your conversations and check-ins
• Clinical notes authored by your assigned therapist
• Crisis follow-up records: records of therapist contact following a crisis alert

2.3 Usage and Technical Data

• Message count and voice session minutes
• Timezone, language, and app preferences
• Notification history

2.4 Billing Data

Stripe customer and subscription IDs. Payment processing is handled entirely by Stripe — we never store card numbers or banking information.

3. How We Use Your Information

• Deliver AI-assisted therapy conversations, voice sessions, mood tracking, and goal tracking
• Share relevant data with your assigned therapist at your clinic (as directed by the clinic)
• Maintain session continuity using memory and embeddings
• Send email notifications such as reminders and crisis alerts to therapists
• Process clinic subscription payments via Stripe
• Detect and respond to security incidents
• Comply with applicable Canadian law and respond to lawful requests

We do not sell your personal information or PHI, use your PHI for advertising, or share your data with third parties except as described in Section 4.

4. How We Share Your Information

4.1 With Your Clinic

Your assigned therapist and clinic administrators can access your session summaries, mood history, goals, and clinical notes as part of your care, as authorized under our Agent Agreement with the clinic.

4.2 With Service Providers

We share data with trusted providers under written Data Processing Agreements:

4.3 Legal Requirements

We may disclose information if required by Canadian law, court order, or government authority, or to prevent serious harm to you or others.

5. Data Residency

Your data may be stored on servers in Canada or the United States (Amazon Web Services). All subprocessors are contractually bound to protect your information. If your clinic requires Canadian data residency, contact us to discuss options.

6. Data Retention

7. Data Security

• All data transmitted over TLS 1.2 or higher
• All databases encrypted with AES-256 at rest
• Role-based access controls — therapists can only access their own clinic's patients
• Passwords hashed with bcrypt
• Written Data Processing Agreements with all subprocessors
• Regular privacy and security risk assessments

In the event of a privacy breach that creates a real risk of significant harm, we will notify affected individuals and the Information and Privacy Commissioner of Ontario as required by PHIPA, and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

8. Your Rights

Under PHIPA (Ontario)

• Request access to your personal health information
• Request correction of inaccurate or incomplete information
• Withdraw consent to collection, use, or disclosure (subject to legal exceptions)
• File a complaint with the Information and Privacy Commissioner of Ontario

Under PIPEDA (Canada)

• Know what personal information we hold and how it is used
• Request correction of your information
• Withdraw consent at any time, subject to legal or contractual restrictions
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email dannykupiie5@gmail.com. We will respond within 30 days.

9. Complaints

If we have not resolved your concern to your satisfaction:

• Information and Privacy Commissioner of Ontario (PHIPA)
  Phone: 1-800-387-0073  ·  www.ipc.on.ca
• Office of the Privacy Commissioner of Canada (PIPEDA)
  Phone: 1-800-282-1376  ·  www.priv.gc.ca

10. Children's Privacy

Our Service is not directed at individuals under 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided information, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or in-app notification at least 30 days before they take effect.

12. Contact Us