Privacy Policy
Effective Date: January 1, 2025
Last Updated: August 24, 2026
Calmshell is committed to protecting privacy and personal health information. This policy describes current practices and safeguards developed with reference to applicable Canadian privacy laws, including PIPEDA and provincial health-information laws where they apply. It is not a certification of legal compliance.
Account Information
Name, email address, date of birth, phone number (optional), and profile details.
Health & Wellness Data
Mood logs, journal entries, stress assessments, therapy session notes, goals, and progress metrics.
Usage Information
Pages visited, features used, time spent, device information, and IP address.
Voice Data (Optional)
Voice recordings for transcription services (only if you consent). Raw audio is NOT stored unless explicitly permitted.
Location (Optional)
Approximate location for finding nearby support resources (only with your consent). Calmshell does not automatically contact or dispatch emergency services.
Provide Services: Deliver mental health support, match you with therapists, track progress.
Personalization: Tailor content and recommendations based on your preferences and needs.
Optional Monitoring: With consent and an active care plan, fixed scoring and keyword rules may flag a check-in for a designated provider. Flags can be wrong, and notification or review is not guaranteed.
Research: Conduct anonymized mental health research following TCPS2 ethical guidelines (with consent).
Communication: Send service updates, appointment reminders, and wellness tips.
Legal Compliance: Meet regulatory requirements and protect rights.
⚕️ Important: Calmshell is a platform that connects you with licensed healthcare professionals who provide clinical advice and treatment. The app itself does NOT provide medical advice, diagnosis, or treatment.
How Healthcare Professionals Provide Care Through Calmshell:
- Live Video Sessions: Licensed therapists, psychologists, and counselors conduct confidential video therapy sessions through the configured video provider, subject to the provider’s and treating professional’s privacy obligations
- Secure Messaging: Asynchronous communication with your assigned therapist for ongoing support between sessions
- In-App Chat Support: Text-based counseling sessions with licensed mental health professionals
- Appointment Booking: Schedule and manage therapy appointments with healthcare providers
- Clinical Case Management: School counselors and care coordinators monitor student wellness and provide interventions
- Group Therapy Sessions: Licensed facilitators lead healing circles and group therapy sessions
- Progress Review: Healthcare professionals review your wellness data (with consent) to inform treatment plans
What Calmshell Provides (Non-Clinical):
- Self-help tools: Mindfulness exercises, breathing techniques, journaling, mood tracking
- Educational content: Mental health information, wellness resources, learning modules
- Matching services: Algorithm-based therapist matching based on your preferences
- Community support: Peer-to-peer forums and group discussions (moderated for safety)
- Administrative support: Scheduling, payment processing, data management
Professional Credentials: A “verified” profile means Calmshell recorded a verification step. Users should still confirm a provider’s current licence, jurisdiction, insurance, and scope directly with the applicable regulatory college.
Calmshell uses rule-based scoring and optional generative-AI features. Automated output can be incomplete, inaccurate, or biased and must not be treated as a diagnosis, treatment plan, or emergency-monitoring service.
- Rule-based check-in monitoring: When you consent and an active care plan exists, mood, sleep, and keyword rules may create an alert for a designated provider. No alert, delivery, or clinician review is guaranteed.
- Optional AI wellness features: AI Companion, progress reflections, assessment reflections, and AI-ranked soundscapes require explicit AI consent before health-related data is sent to an AI provider.
- Data minimization: Progress Insights excludes names, identifiers, free-text feedback, goal titles, and raw assessment responses. AI Companion sends the message you choose to submit and limited recent context.
- Provisional output: AI assessment and progress output is non-clinical and unreviewed. It must not be used alone for healthcare or safety decisions.
Provider and cross-border notice
Calmshell is built on Base44. When optional AI is enabled, Base44 may route requests to third-party model providers, which may include OpenAI, Anthropic, or Google. Provider selection can vary, and processing may occur outside Canada, where information may be subject to foreign laws. Storage location does not by itself determine every processing location.
- You can turn optional AI off in Privacy & Consent Settings.
- Do not include names or identifiers that are not needed.
- For immediate danger, call 9-1-1. In Canada, call or text 9-8-8 for suicide crisis support.
- Calmshell may suspend AI features while privacy, vendor, or clinical-governance safeguards are being reviewed.
We DO NOT sell your data. Ever.
✅ You Can Manually Share Your Data:
You have complete control to share your information through these actions:
- Export & Send: Download your wellness reports, progress data, or journal entries and send them via email or share with anyone you choose
- Share with Therapists: Manually share specific mood logs, journal entries, or assessment results with your assigned therapist within the app
- Family/Circle of Care: Add family members or caregivers to your Circle of Care to grant them access to specific wellness data
- Group Sessions: Choose to share reflections or progress in healing circles or group therapy sessions
- Community Forums: Post content, comments, or resources in public community spaces (only what you explicitly post)
- Insurance Claims: Generate and send receipts or treatment summaries to your insurance provider
Important: When you manually share data (via export, email, or posting), it leaves the security of our platform. We cannot control what happens to information once you've shared it externally.
🔒 We Share Information Only When:
- Service providers: Base44 supplies the application platform and hosting; other providers may support payments, email, maps, speech processing, and optional AI. Their processing locations and subprocessors may change.
- Legal requirements: When required by law, court order, or to prevent imminent harm
- Indigenous data: Follows OCAP® principles (Ownership, Control, Access, Possession) with community governance
Calmshell uses access controls and Base44 platform safeguards. Base44 states that platform data is encrypted in transit and at rest. No internet service can guarantee absolute security.
- Record access: Sensitive Calmshell entities use owner/admin or assigned-clinician row-level rules.
- Cross-border processing: Base44 and connected providers may store or process information outside Canada.
- AI controls: Health-related AI functions require authentication, consent, and a server-side governance switch.
- Incidents: Suspected privacy or security incidents should be reported to the Privacy Officer listed below.
Yes, you have granular control over automatic data sharing and processing:
Individual Sharing Preferences (Manage in Account Settings):
- Clinical Monitoring: Toggle rule-based scoring of check-ins for a designated provider when an active monitoring plan exists; alerts and review are not guaranteed
- Location Services: Control whether location can be used to find nearby resources; Calmshell does not dispatch emergency services
- Optional AI: Enable or disable AI processing of messages intentionally sent to AI features and minimized wellness data
- Research Participation: Opt in or out of anonymized research data sharing at any time
- Voice Processing: Control whether voice recordings are transcribed and whether audio is stored
- Analytics: Opt out of usage analytics while keeping essential functionality
✓ Important: Optional preferences can be changed in Account Settings → Privacy & Consent. Withdrawal applies prospectively; information already processed or retained for legal, security, backup, or professional-record obligations may not be removed immediately.
What You Cannot Control (Required for Service):
- Authentication and session management
- Payment processing through Stripe (required for paid services)
- Platform hosting and necessary service-provider processing, which may occur outside Canada
- Legal compliance and safety obligations
Under Canadian law, you have the right to:
- Access: Request a copy of your personal information.
- Correction: Update inaccurate or incomplete information.
- Deletion: Request deletion of your data (with exceptions for legal/health record retention).
- Withdraw Consent: Revoke consent for optional data uses at any time in Account Settings.
- Data Portability: Export your data in a machine-readable format.
- Complaint: File a complaint with the Privacy Commissioner of Canada if concerns are not addressed.
Users under 18 require parental/guardian consent before using Calmshell. We will not collect or process personal information from minors without verified guardian consent. Accounts remain inactive until consent is provided.
Account and wellness data is retained while needed to provide the service and for documented legal, security, billing, dispute, or professional-record obligations.
You may request access, correction, export, or deletion. Deletion timing and exceptions depend on applicable law, backups, fraud and security needs, and any treating professional’s independent record obligations. Contact the Privacy Officer for the retention schedule that applies to a specific record.
Yes, we collect limited data through cookies:
Essential Cookies (Required)
- Authentication: Maintains your login session securely
- Security: Prevents unauthorized access and protects against attacks
- Preferences: Saves language, theme, and accessibility settings
Analytics Cookies (Optional - You Can Opt Out)
- Usage patterns: Pages visited, features used, time spent
- Device information: Browser type, operating system, screen size
- Performance: Load times, errors encountered
Opt out in Account Settings → Privacy
What We DO NOT Use
- ❌ Third-party advertising cookies
- ❌ Social media tracking pixels
- ❌ Cross-site tracking
- ❌ Selling your data to advertisers
Note: Essential cookies cannot be disabled as they are necessary for the app to function. You can control optional cookies in your browser settings or Account Settings.
Calmshell relies on Base44 for the application platform and may use configured providers for payments, email, maps, speech processing, video, and other operational services.
- Base44: Application platform, authentication, database, functions, hosting, and integrations.
- Optional AI: Base44 may use model providers such as OpenAI, Anthropic, or Google; the provider used can vary.
- Other configured services: Payment, email, video, speech, and map providers process only the data needed for the enabled feature.
Provider locations and subprocessors can change. Review the current Base44 security and subprocessor information and contact Calmshell’s Privacy Officer for the current Calmshell vendor list before relying on a particular residency requirement.
Base44 security and subprocessorsWe may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification. Continued use of Calmshell after changes constitutes acceptance of the updated policy.
For privacy questions, data requests, or to exercise your rights:
Privacy Officer: privacy@calmshell.ca
Address: Calmshell Mental Health Services, Toronto, ON, Canada
Privacy Commissioner of Canada: If your concerns are not resolved, you may file a complaint at www.priv.gc.ca
© 2026 Calmshell. All rights reserved.