Privacy Policy

1 · Who we are and what this policy covers

Mendovia Inc. (MENDSKY) (“we”, “us” or “our”) operates the MENDSKY platform. This policy explains how we handle personal information about website visitors, clients, therapist applicants and participating therapists in connection with accounts, therapist profiles, bookings, payments, communications and online sessions.

Our business address is Suite 114 – 150 Consumers Road, North York, ON, M2J 1P9, Canada. Our Privacy Officer can be reached at privacy@mendsky.com, or by mail at that address marked “Attention: Privacy Officer”.

We serve clients in Canada. Our handling of personal information is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including provincial health-information laws where they apply. Which rules apply depends on the information, the activity, your province and our relationship with the treating professional.

Therapists maintain their own clinical records under their own professional and legal obligations. This policy covers the information MENDSKY controls, and it does not replace your therapist's own privacy notice.

2 · Information we collect

We collect information you give us, information created when you use the service, and limited technical information.

• Account and contact details — your name, email address, telephone number, display name and communication preferences.
• Booking records — the therapist you chose, appointment date, time and type, booking status, price and payment status, the province, city and country you confirm when booking, intake notes, free-session eligibility, sliding-scale agreements and reschedule history.
• Questionnaires — answers to intake or matching questions asked by a therapist or by our matching service. These can include sensitive information about your circumstances or health.
• Consent records — including parental or guardian consent forms, the wording agreed to, the signature provided and timestamps.
• Therapist applications and profiles — onboarding information such as credentials, licence, insurance, resume and certificates, plus the profile content a therapist publishes.
• Messages and files — your conversations with a therapist inside the platform, files you upload to My files, and documents a therapist uploads.
• Reviews — the rating, comment, your choice about showing your name, and internal moderation records.
• Payment and transaction records — amounts, status, payment references and verification details. We never hold full card numbers or card security codes.
• Technical information — IP address, browser and device information, service logs, and cookie identifiers. Our contact form also uses a salted, one-way hash of your IP address to limit automated abuse, so the raw address is not stored for that purpose.
• Assistant conversations — the messages you type into the Mendy assistant.

3 · How and why we use your information

We use information to create and administer accounts; assess therapist applications and manage profiles; arrange and administer bookings; take and verify payments; facilitate sessions and deliver audio and video services through your therapist's chosen platform; send booking confirmations and reminders; answer support requests; maintain consent records; moderate reviews; prevent spam and abuse; and meet security, fraud, dispute and legal obligations.

Answers you submit in an intake questionnaire are used for the purpose explained when they are collected — typically to prepare for your first session with the therapist you selected. We do not use questionnaire answers or your therapy information for advertising, and we do not sell personal information.

If we want to use your information for a materially new purpose, we explain that purpose and obtain consent where required before doing so.

4 · Consent and your choices

We explain the purposes, the information involved and the relevant recipients when we ask for consent. Where the law requires it, including for sensitive information, we ask for your express consent.

You can withdraw consent at any time by contacting our Privacy Officer, subject to legal and contractual restrictions and reasonable notice. We will explain the consequences — for example, if you withdraw permission to use the contact information needed to arrange an appointment, we may be unable to administer that booking. Withdrawing optional advertising or analytics consent never affects your access to care.

You can update your contact details and available communication preferences in your account, or by contacting us. Booking confirmations and reminders are service communications; they are not permission to send you unrelated marketing.

5 · Who can access or receive your information

Authorized MENDSKY staff can access account information, bookings, intake questionnaire answers, applications and consent records. Access is limited to personnel who need it for a defined support, safety or operational purpose, and administrative access is logged.

The therapist involved in your care receives the information needed for the bookings and services you request. Providers who support hosting, payments, email, SMS or WhatsApp delivery, video and telephone services, abuse prevention and security may process relevant information in order to provide those services to us.

We may disclose information when the law requires or permits it, including responding to valid legal process or acting to protect someone's safety where disclosure is legally authorized. Any business transfer would be handled within applicable legal limits and with confidentiality safeguards. Nothing here authorizes unrestricted disclosure of health information.

6 · Where your information is stored and processed

MENDSKY runs on third-party hosting and infrastructure. Based on our current configuration, application records — including accounts, bookings, applications, consent records and therapist profiles — are stored in the United States, and files you upload are held in private storage in the same environment. Payment card details are never stored by MENDSKY.

Some of these providers process information outside your province or outside Canada, including in the United States. Providers act on our instructions and are bound by data-protection agreements, and we remain accountable for information transferred to them for processing. Information held outside Canada is subject to the laws of that country, which may include access by courts, law enforcement or national security authorities there.

Where provincial law requires an assessment or specific arrangements before a transfer outside the province or Canada, we complete those steps. You can contact our Privacy Officer for information about our service providers and our international processing practices.

7 · Payments

Card payments for sessions and optional paid placements are processed by our third-party payment processor through a secure hosted checkout, and are settled through Mendsky's banking arrangement. Your card details are entered on the processor's own page and are never collected or stored by MENDSKY. We retain the transaction reference, amount, currency and status, and a receipt is generated for your records.

Interac e-Transfer payments are sent by you directly to our published business email address and are verified by our team before the booking is confirmed. For those payments we record the transfer reference, amount, claim and verification details. A client's first session is offered free of charge, in which case no payment is collected.

Refunds are issued through the original payment method and recorded against the booking or placement.

8 · Sessions and service messages

Sessions take place over the video or telephone service your therapist uses. MENDSKY does not record audio or video sessions. Technical information needed to establish, route and secure a session may still be processed by the communications provider, and appointment records and service logs continue to exist.

We send booking confirmations, reminders, reschedule notices and related service messages to the contact details you provide. These are delivered through our email service provider, and by SMS or WhatsApp where you provide a mobile number and enable those channels in your account.

Be aware that a confirmation or reminder on your phone can reveal your association with MENDSKY to anyone who has access to your device or account. You can change your channel preferences at any time in your account settings.

9 · Reviews you write

When you review a therapist, you can choose to have your name hidden. If you do, your review is shown publicly as “Anonymous client” and your name is not stored with the review.

A review becomes publicly readable — with the rating, the comment and your display name, if you chose to show it — only after a MENDSKY moderator approves it. We keep an internal record of which account submitted each review so we can moderate fairly, prevent misuse and respond to abuse; that record is available only to authorized staff. We may decline to publish a review that breaks our guidelines, for example one that identifies another person.

10 · Files and documents you upload

Files you upload — documents in My files, attachments in your conversations with a therapist, therapist application documents such as a licence, insurance or resume, and therapists' credential documents — are stored in private storage. They have no public link: opening one creates a short-lived signed link that expires after a few minutes, and it can only be created by someone entitled to see that file.

Those files are visible to you, to authorized staff who need them for reviews or support, and to the therapist where the document is part of your shared correspondence.

A few uploads are public by design, because they are published content: a therapist's public profile photo (shown in the directory, chosen by the therapist), our advisor portraits, and article cover images and PDFs. When a therapist application is approved, the photo supplied with it becomes the therapist's public directory photo.

11 · Cookies, analytics and advertising

We use strictly necessary cookies and browser storage to keep you signed in, protect your account, remember your language and make booking and contact forms work. These are always on, and they are not used to measure you.

Everything optional is off until you choose it. The privacy banner offers three equally visible actions — Accept all, Reject optional and Manage preferences — and the preference list has two separate switches, Analytics and Marketing, each starting off. Refusing optional cookies never limits booking or any other part of the service.

Marketing currently means the Meta Pixel, which measures how our advertising performs. It runs on only two pages, the Home and About pages, and never on therapist profiles or searches, condition pages, registration, login, booking, checkout, confirmation pages, forms, dashboards, messages or sessions. Automatic event collection and advanced matching are switched off, and we send no events of our own beyond a single page view, so no form field, questionnaire or intake answer, symptom, message, appointment detail, name, email address, phone number or account identifier — not even a hashed one — is ever sent to Meta. Meta receives the address and title of one of those two pages. An address carrying anything beyond campaign tags disables measurement for that page view, so a reset, invitation or consent link can never be measured; we also refuse to measure a page reached from one of our own non-public addresses; and visitors browsing with JavaScript disabled are not measured at all.

Analytics means Google Analytics 4, installed by MENDSKY itself rather than through an advertising or tag container. It runs on only two pages, the Home and About pages, and only after you allow analytics. Google receives the clean path of the page you are on and an approved page title we set ourselves, never the address as it appears in your browser: any query string is removed before it is sent, so a campaign, reset, invitation or consent link can never be measured, and neither can a page reached from one of our own non-public addresses. Automatic page views, Google Signals, advertising personalisation and User-ID are all switched off, enhanced measurement is switched off in the Google Analytics property, and no event of any kind is sent beyond that single controlled page view. This is basic consent mode: no request of any kind is made to Google before you allow analytics, and none after you withdraw, including so-called cookieless pings. No form field, questionnaire or intake answer, symptom, message, appointment detail, name, email address, phone number or account identifier is ever sent to Google. Analytics is its own switch: allowing marketing never turns analytics on, and allowing analytics never turns marketing on. Withdrawing takes effect at once, in this tab and in every other open tab, and clears the analytics cookies it set, typically _ga and its per-property companion.

You can change or withdraw your choice at any time using the Privacy choices control, which is also in the footer of every page. Withdrawing takes effect immediately: measurement stops and the optional cookies it set are cleared. Your choice is saved in your browser rather than in a cookie.

12 · Artificial intelligence and the Mendy assistant

Mendy is an AI assistant that helps you find your way around MENDSKY. It only receives the messages you type into its chat window — never your questionnaire answers, your therapy information, your files or your sessions. Its replies are generated by third-party AI services acting as our service providers under our agreements.

Mendy is not a therapist and does not provide therapy, diagnosis or crisis support. Please do not share information with it that you would want to keep strictly confidential. We may also use AI services to suggest articles that could be helpful to you.

13 · Retention and deletion

We keep your account information while your account is active and as long as needed for the purposes described in this policy.

You can request deletion of your account and your personal information from your account settings, and every role — client, therapist or administrator — has that option. Our published commitment is to complete deletion within up to 120 days of receiving your request. We verify your identity proportionately, explain anything that must be kept, and confirm the outcome. This period allows for identifying and separating records that the law requires us to keep; it is not a reason to delay a request unnecessarily.

Some records are retained longer where the law requires or permits it: payment, tax and accounting records; consent evidence; security and breach records; and records needed for legal claims or disputes. Closing your MENDSKY account does not delete the clinical record your therapist keeps independently, and it does not affect records a payment provider holds under its own legal obligations. Where a request concerns records held on a therapist's behalf, we coordinate with the responsible professional.

Invoices and receipts for sessions you have paid for are financial records. We keep them for at least six years after the end of the tax year the session falls in, and longer where a longer period applies or where a record is under a legal hold. They stay available to you in your account throughout that period. Because they are records we are required to keep, deleting your account does not remove them: we separate and retain only those records, hold them for no purpose other than meeting our accounting, tax and legal obligations, restrict access to the staff who need them for that purpose, and delete them under our approved retention process once the period ends. You can ask us about this at any time, and we explain it again in the deletion flow itself.

14 · Access, correction and privacy requests

You can contact our Privacy Officer to ask for access to the personal information we control, information about how it is used and disclosed, correction of inaccurate or incomplete information, withdrawal of consent, or deletion where it applies. We may ask for proportionate information to verify your identity and protect against unauthorized disclosure.

For access requests governed by PIPEDA we respond within 30 calendar days, subject to lawful extensions or exceptions. If an extension is permitted and needed, we tell you within the original period and explain the reason, the timing and your complaint rights. Other laws may set different procedures.

Access is generally provided at no or minimal cost. If we refuse an access or correction request, we explain why and what recourse is available, except where the law limits that explanation. You can also ask us to direct a clinical-record request to the responsible therapist.

15 · Security and incidents

We apply safeguards appropriate to the sensitivity of the information we hold: encryption in transit and at rest, access controls on accounts and administrative tools, private file storage reached only through short-lived signed links, administrative activity logging, and review of our providers' contractual protections.

No electronic service can promise absolute security. If a privacy breach occurs we assess it, contain and remediate it, and notify affected individuals and regulators where the law requires it — under PIPEDA, that includes reporting a breach of security safeguards that creates a real risk of significant harm and keeping records of such breaches for at least 24 months.

16 · Children, minors and authorized representatives

MENDSKY policy requires parental or guardian consent before a patient under 16 receives services. Where consent is required, we send a consent request to the parent or guardian, who signs it electronically, and we review the submitted form before the application proceeds.

Consent for a minor, or for someone represented by another person, is assessed according to applicable law and the individual's capacity. Age does not by itself make an account holder entitled to receive confidential therapy information about someone else, and questions about clinical confidentiality or treatment consent should also be raised with the treating professional. Minors are never subject to advertising tracking.

17 · Complaints, contact and changes to this policy

For questions, access or correction requests, or complaints, contact:

• Privacy Officer, Mendovia Inc. (MENDSKY)
• Suite 114 – 150 Consumers Road, North York, ON, M2J 1P9, Canada
• Email: privacy@mendsky.com

We investigate privacy complaints and explain the outcome and any corrective measures taken. You can also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or the provincial privacy regulator with jurisdiction over the matter — including the Information and Privacy Commissioner of Ontario and the Commission d'accès à l'information du Québec.

We may update this policy to reflect changes in our practices or legal requirements. We display the effective date at the top of this page and provide additional notice of material changes where appropriate. An updated policy does not replace fresh consent where a new purpose requires it.