SereneMind Consulting Inc. ("SereneMind", "we", "us") is a BC Benefit Company committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal information when you use our website, the SHIFT program, or the SereneMind app. It is the same policy that applies inside the app.
Governing law: This policy is governed by BC's Personal Information Protection Act (PIPA). Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply where personal information is collected or used in the course of commercial activity or transferred across provincial borders. Where both apply, we comply with the stricter standard.
On this page
Our Privacy Officer is AJ Kaur, responsible for all privacy-related inquiries and complaints. Contact: ajkaur@serenemindcalm.org · 604-723-1920 · British Columbia, Canada.
You must be 16 years of age or older to create an account. By signing up you confirm you meet this requirement. If we become aware that a user is under 16 we will immediately close the account and delete associated data.
We collect only the minimum personal information necessary to operate the app and deliver the SHIFT program. We do not ask for your age, gender identity, ethnicity, immigration status, income, postal code, or any other demographic information, and there are no fields in the app to record them.
1. Account information — mandatory to use the app
Your email address and password, and your name if you choose to provide one. Used to create your account and let you log in securely. If you sign in with Google, we receive your email address, name, and profile picture from Google.
2. Wellness and program data — voluntary, you choose what to enter
Mood check-ins, journal entries, gratitude entries, thought-reframing exercises, reflections, and breathwork or meditation session records. The free-text parts of these are encrypted before they leave your device — see Security. Program participation records (attendance, week completion) are used for program administration and outcome reporting.
3. Voice recordings NEW — optional, only if you use the voice journal
If you record a voice journal, the audio file is stored in a private storage bucket on our Canadian database, readable only by you. Your browser also produces a written transcript using its own built-in speech recognition. In some browsers, including Google Chrome, that speech recognition is performed on the browser vendor's servers rather than on your device. This happens at the browser level and is outside our control, so please do not use the voice journal if that concerns you.
4. Community content NEW — optional
Anything you post to a circle, the community forum, a shared toolkit, or a Heart Connection request. See Community and peer support — this content is not private.
5. Pre- and post-program wellbeing surveys — voluntary
Collected at the start and end of each cohort to measure outcome change. The SHIFT check-in uses two published wellbeing scales, the Warwick-Edinburgh Mental Wellbeing Scale (WEMWBS) and the Kessler-10 (K10). These are wellbeing measures, not diagnostic tools, and we do not use them to diagnose anything. Results are used for anonymised aggregate reporting.
6. Testimonials — entirely optional, separately consented
Collected only with explicit consent after program completion. You choose anonymous or first-name-only, and can withdraw at any time.
7. Organisation membership NEW — only if your employer or a partner organisation sponsors your access
The name of the organisation, and a department or team label if your organisation provides one. See Workplace deployments.
8. Technical data — automatic
Your IP address is handled by our hosting and database providers as part of delivering a secure connection, and appears in their security logs. We do not build profiles from it or use it for advertising.
The Brain Dump Vault stores nothing at all. Whatever you type into the vault stays in your browser's memory and is destroyed when you release it. It is never transmitted to us, never written to our database, and there is no table in our system that could hold it. This is a deliberate design decision, not a technical limitation — the point of the vault is that the words genuinely disappear. The only thing recorded from a day-mode session is the energy level and tag you picked, with no text.
By creating an account you consent to the collection, use, and storage of your personal information as described in this policy. You may withdraw consent at any time by closing your account. Separate, additional consent is asked for the Serene AI coach, for testimonials, for email updates, and for optional analytics — declining any of these does not affect your access to the rest of the app.
Serene is an optional AI chat feature inside the app. It is the only part of SereneMind that sends anything you write outside our own systems, so it asks for its own separate consent before you can send a first message. You can use every other part of the app without ever turning it on.
Please do not identify yourself to Serene. You never need to. Avoid typing your full name, address, health-card or immigration file numbers, or other people's personal details. Once a message is sent to the United States it is subject to United States law, including lawful access by United States authorities.
SereneMind includes shared spaces: SHIFT circles, a community forum, shared coping toolkits, and Heart Connection. These work differently from the private parts of the app and it is important you understand how.
Some people reach SereneMind through an employer, health authority, school, or nonprofit partner that has paid for access. If that is you, this section applies in addition to everything else in this policy. If you signed up on your own, it does not apply to you at all.
How you get linked to an organisation: either by entering an invite code, or because your email domain matches one your organisation has registered with us. We record which organisation you belong to and, if your organisation supplies one, a department or team label.
What your organisation can see:
What your organisation can never see:
If you leave the organisation, your account and your personal content remain yours. Your organisation cannot delete your account, transfer it, or request a copy of your data. Your sponsored access may end, in which case you can continue on a personal plan or delete your account.
After completing the 4-week SHIFT program you may be invited to share your experience. This is voluntary, it asks whether you want to share anonymously or with your first name only, and it shows you exactly what will be shared before you confirm. Testimonials reflect individual experiences, may not be representative of typical outcomes, and are not clinical claims. You may withdraw your testimonial at any time by emailing ajkaur@serenemindcalm.org.
Canadian data storage: Your account, wellness, program, and voice data are stored on AWS cloud servers in the Canada Central region, managed through Supabase. All personal data remains subject to Canadian and British Columbia privacy law.
Two exceptions are worth stating plainly: messages you send to the Serene AI coach are processed in the United States, and browser-level speech recognition for the voice journal may be performed by your browser vendor outside Canada. Both are described above and both are optional features.
When the app cannot reach the database — for example if you lose connection mid-entry — some non-sensitive progress data may be held temporarily in your own browser's local storage until it can be synced. That copy sits on your device and is cleared when you sign out or clear your browser data.
These are every third party that receives data from the SereneMind app or this website. All are bound by contractual confidentiality and security obligations, and we review their privacy and security practices before engaging them.
| Service | Where | What it receives |
|---|---|---|
| Supabase | Canada Central | Database and file hosting — account, wellness, program and voice data. Privacy |
| Netlify | United States | Delivers the app and website code to your browser and runs our serverless functions. May collect aggregate page-view counts and general geographic region; no individual IP is stored by us. Privacy |
| OpenAI | United States | Powers the optional Serene AI coach. Receives your chat messages only. Not used for model training; deleted after up to 30 days. Privacy |
| Stripe | United States | Payment processing for paid plans only. Card data goes directly to Stripe and is never stored on our servers. Privacy |
| Resend | United States | Sends transactional email — reminders you opted into, Heart Connection notifications, and program updates. Receives your email address and the message content. Privacy |
| United States | Three separate things: optional Google sign-in (receives your email, name, and profile picture); web fonts on every page (receives your IP address as part of the request); and, in Chrome, the browser's own speech recognition for the voice journal. Privacy | |
| Base44 | United States | Content delivery network for the audio soundscapes in the app. Receives your IP address as part of the media request. No wellness data. |
| Calendly | United States | Booking for personal wellness sessions and Wellness Circle. Receives the name, email, and time you enter when booking. Privacy |
| Web3Forms | United States | Delivers the contact form on this website to our inbox. Receives the name, organisation type, email address, and message you submit. Privacy |
Where personal information is transferred outside British Columbia, we require recipients to provide protection equivalent to what PIPA requires. Please be aware that data held outside Canada may be subject to the laws of the receiving jurisdiction, including lawful access by foreign governments. We cannot guarantee confidentiality against lawful government access.
We would rather be specific than reassuring. Here is the honest picture.
No one at SereneMind can read: your journal entries, voice journal transcripts, mood notes, thought-reframing entries, reflections, gratitude entries, or your conversations with the Serene AI coach. These are encrypted with a key derived per user, and they are unreadable to us in the database.
Program administrators can see: your SHIFT check-in answers and scores, feedback and survey responses you submit to us directly, community and circle posts, Heart Connection requests including the contact email you supplied, your onboarding profile, and records of when the in-app crisis screen was shown to you. This access exists to run the program, respond to support requests, and act on safeguarding concerns. It is limited to the small number of people running SereneMind and is not used for any other purpose.
Your employer, if you joined through one, sees aggregates only — see Workplace deployments.
We never sell, rent, or trade your personal information. We may share anonymised, aggregated outcome data — grouped totals with no individual identifiers, suppressing groups smaller than five — with grant co-applicants and program partners for reporting purposes only. Testimonials are shared only as you consented when you submitted them. You own your journal entries, reflections, and personal content; we hold a limited licence to host and process it solely to provide the service to you.
We may disclose personal information if required by applicable law, court order, regulatory authority, or to protect the rights and safety of our users or others. Where legally permitted, we will notify you before disclosing your information in response to such a request. Note that encrypted content is unreadable to us, so we cannot produce it even if compelled — but data held by our processors outside Canada may be reachable by authorities in those jurisdictions.
We will respond to access and correction requests within 30 calendar days, as required by PIPA. Where PIPA allows — for example a request that needs a large volume of records retrieved — we may extend this by up to a further 30 calendar days, and we will tell you if we do. We aim to respond sooner in every case.
You can delete your account yourself, at any time, from inside the app: Settings → Delete My Data & Account → "Yes, delete everything". This is immediate and permanent. Your account and personal data are removed from our active systems straight away, not after a waiting period, and residual backup copies purge within 90 days on a rolling schedule. There is no recovery window, so please export anything you want to keep first. You can also email ajkaur@serenemindcalm.org and we will do it for you.
If a data breach occurs that poses a real risk of significant harm to you, we will notify affected users by email and by in-app notice as soon as reasonably practicable, and report to the OIPC where required. Our notification will describe what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.
If you have a concern about how we handle your personal information, please contact our Privacy Officer first at ajkaur@serenemindcalm.org. We will investigate and respond within 30 calendar days. If you are not satisfied with our response, you may file a complaint with the Office of the Information and Privacy Commissioner for BC (OIPC BC) at oipc.bc.ca.
We use no advertising cookies, no behavioural tracking, and no analytics scripts that profile you across sites. The app stores a login session and your preferences in your browser's local storage, and shows you a consent banner explaining this on first visit. Stripe sets payment-related cookies only when you interact with a payment link.
Two third parties do receive a request from your browser on ordinary page loads, which necessarily discloses your IP address to them: Google Fonts, which serves the two typefaces used across this site and the app, and Netlify, which serves the pages themselves and may count page views by general geographic region. Neither is used for advertising or profiling, and no wellness data is involved. You may adjust your browser settings to manage or block cookies at any time.
We want to describe this accurately rather than impressively.
No security system is perfect and we will not claim otherwise. If you believe your account has been compromised, contact us immediately.
We may update this policy from time to time. We will notify you of material changes by posting a notice in the app or by email. Continued use after changes constitutes acceptance. The current version is always available at serenemindcalm.org/privacy-policy.html and is mirrored inside the app.
SereneMind Consulting Inc. · British Columbia, Canada · ajkaur@serenemindcalm.org · 604-723-1920