This page is a plain-language summary of how we handle data. The full detail is in our Privacy Policy, which is the governing document if the two ever differ.
SereneMind Consulting Inc. is a British Columbia Benefit Company committed to complying with BC's Personal Information Protection Act (PIPA). Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply where personal information is collected or used in the course of commercial activity or transferred across provincial borders. Where both laws apply, we comply with the stricter standard.
PIPA is BC's private sector privacy law governing how organisations like SereneMind collect, use, disclose, and protect personal information about individuals in BC. It requires us to collect only what is necessary, be transparent about how we use it, protect it appropriately, and respond to your access and correction requests within 30 calendar days.
AJ Kaur, Privacy Compliance Officer
SereneMind Consulting Inc. · British Columbia, Canada
ajkaur@serenemindcalm.org · 604-723-1920
We respond to privacy requests within 30 calendar days, as PIPA requires, and aim to respond sooner.
We collect no demographic information. No age, gender identity, ethnicity, newcomer or immigration status, income, or postal code. There are no fields in the app to record them and no such columns in our database.
The Brain Dump Vault stores nothing. What you type there never leaves your browser and is never written to our database. That is a deliberate design choice — the point of the vault is that the words genuinely disappear.
Serene is optional and asks for its own separate consent before your first message. Your messages are sent to OpenAI in the United States to generate a reply. Nothing else goes with them — no journal, no mood history, no profile. Our OpenAI account is configured so this content is not used to train their models; OpenAI holds it for up to 30 days for abuse monitoring, then deletes it. SereneMind never stores your conversations, and no member of our team can read them. Serene is software, not a clinician, and cannot help in an emergency.
The free-text parts of your journal entries, voice transcripts, mood notes, reflections, gratitude entries and SHIFT check-in answers are encrypted with AES-256-GCM on your device before they reach our database, using a key derived for your account. We hold the ciphertext and cannot read them.
Not everything is encrypted, and we would rather say so: metadata such as mood scores, dates and tags, plus your email address, community posts, Heart Connection requests, feedback and voice audio files, are stored unencrypted on infrastructure that is encrypted at rest by the provider. Entries created before our encryption shipped are still plain text and are being migrated.
Administrator access exists to run the program, answer support requests, and act on safeguarding concerns. It is limited to the small number of people running SereneMind and is not used for anything else.
Your organisation sees aggregate reporting only: participation counts, grouped mood bands, completion rates, and workplace survey averages that stay hidden until at least five people in that organisation have answered. That five-person threshold is enforced by the database, not by the screen design.
Your organisation never sees your journal entries, your individual mood, your AI conversations, your community posts, your individual survey answers, or whether you personally logged in. It cannot access, transfer, or delete your account, and cannot request a copy of your data — we will refuse. Using SereneMind is not a condition of employment.
Canadian servers: Your account, wellness, program and voice data are stored on AWS cloud servers in the Canada Central region, managed through Supabase. All personal data is subject to Canadian and BC privacy law.
Third parties that process data outside Canada:
| Service | Where | What it receives |
|---|---|---|
| Netlify | US | Serves the app and website code; runs serverless functions |
| OpenAI | US | Serene AI coach messages only; not used for training |
| Stripe | US | Payments; card data never touches our servers |
| Resend | US | Transactional email — your address and message content |
| US | Optional sign-in, web fonts, and Chrome's speech recognition | |
| Base44 | US | Audio soundscape CDN — IP address only |
| Calendly | US | Session booking — name, email, chosen time |
| Web3Forms | US | Delivers this website's contact form to our inbox |
All processors are bound by contractual confidentiality and security obligations, and we conduct due diligence before engaging them. Data transferred outside BC may be subject to the laws of the receiving jurisdiction, including lawful access by foreign governments.
We may disclose personal information if required by applicable law, court order, or regulatory authority, or to protect the rights and safety of our users or others. Where legally permitted, we will notify you first. Encrypted content is unreadable to us, so we cannot produce it even if compelled — but data held by processors outside Canada may be reachable by authorities in those jurisdictions.
We retain your personal information for as long as your account is active. If you do not log in for 12 months, your personal content is automatically deleted while your account stays open. On account deletion, personal information is removed from active systems immediately, and residual backup copies purge within 90 days on a rolling schedule. Security and access logs may be retained for up to 12 months for fraud prevention. Financial records are retained as required by accounting and tax law. Anonymised aggregate outcome data may be retained beyond account deletion. Testimonials are retained until you withdraw consent. Serene AI conversations are never retained by us.
You can do it yourself, immediately, from Settings → Delete My Data & Account inside the app. There is no waiting period and no recovery window, so export anything you want to keep first. You can also email our Privacy Officer and we will do it for you.
We respond to access and correction requests within 30 calendar days as required by PIPA. Where PIPA permits we may extend by up to a further 30 calendar days, and we will tell you if we do.
To exercise any of your rights under PIPA, contact our Privacy Officer at ajkaur@serenemindcalm.org. If you are not satisfied with our response, you may file a complaint with the Office of the Information and Privacy Commissioner for British Columbia:
oipc.bc.ca · PO Box 9038 Stn Prov Govt, Victoria BC V8W 9A4 · Tel: 250-387-5629
SereneMind Consulting Inc. · British Columbia, Canada · ajkaur@serenemindcalm.org · 604-723-1920