1. Who we are

Saalvio is the operating name of Zen Mind Inc., an Ontario corporation. Our head office is 3300 Highway 7, Suite 600, Vaughan, Ontario L4K 4M3, Canada. For the purposes of this Privacy Policy, "Saalvio," "we," "us," and "our" refer to Zen Mind Inc. operating as Saalvio.

Our Privacy Officer can be reached at [email protected].

2. The laws that apply to Saalvio

Saalvio operates under several privacy laws at once because our users live in different places and use different services:

PHIPA (Personal Health Information Protection Act, 2004) governs our handling of personal health information for Ontario residents who use our psychotherapy service.
PIPEDA (Personal Information Protection and Electronic Documents Act) governs our handling of personal information across Canada for commercial activities.
HIPAA (US Health Insurance Portability and Accountability Act) shapes the infrastructure we use to deliver Thrive AI, our separate guided CBT self-help tools, calming music, cognitive games, and our future US psychotherapy expansion. We have signed Business Associate Agreements with the US cloud vendors that hold protected health information.
Law 25 (Quebec): Saalvio does not currently provide services in Quebec. A formal Law 25 assessment is part of our Phase 2 Quebec expansion. We do not currently claim Law 25 compliance.

3. The information we collect

We collect different categories of information depending on which Saalvio service you use:

3.1 Information you give us directly

Your name, email, phone number, and similar contact information you submit on forms.
Therapy intake information you provide when you sign up for a session, including symptoms, history, and goals.
Session notes recorded by your therapist during or after each session.
Conversations you have with Thrive AI, our CBT chatbot.
Usage records from our separate guided CBT self-help tools, calming music, and cognitive games (which sessions you opened, when, and progress where the tool tracks it).
Payment information for therapy sessions, processed by our payment processor. Saalvio does not store full credit-card numbers.
Saalvio app subscription identifiers (hashed Apple ID or Google account ID) and subscription state. The Saalvio app is sold through the Apple App Store and Google Play; Apple, Google, and our payment processor Stripe handle the billing data, and Saalvio receives only the subscription state needed to grant access to features. We never see your card data for app purchases.

3.2 Information collected automatically

IP address, browser type, device type, referring page, and similar standard log data.
Country (derived from IP) used to route you to the right country variant of the site.
Cookies and similar storage. See our Cookie Policy for the full list.
Aggregate usage analytics. We use privacy-friendly analytics tools that do not collect personally identifying information.

4. How we use your information

To provide psychotherapy services to Ontario residents.
To run Thrive AI (our CBT chatbot) and our separate guided CBT self-help tools, calming music, and cognitive games.
To reply to inquiries and book sessions.
To process payments and issue receipts.
To meet legal and regulatory obligations under PHIPA, PIPEDA, HIPAA, and CRPO standards of practice.
To improve our services in aggregate, using data that does not identify you.

We do not sell your information. We do not share your therapy records with advertisers, data brokers, or any third party for marketing purposes.

5. Who we share information with

We share information only as needed to provide our services and only with vendors who are contractually bound to protect it:

Our therapists, for the purpose of providing your care.
Cloud infrastructure providers (AWS, Cloudflare). US providers handling protected health information have signed Business Associate Agreements with us.
Our payment processor, only the payment data needed to complete a transaction (therapy session payments).
Apple App Store, Google Play, and our payment processor Stripe for Saalvio app subscription purchases. Saalvio app subscription billing data is held by Apple, Google, and Stripe under their terms; Saalvio receives only the subscription state needed to enable your access.
Our transactional email provider, for emails like appointment confirmations and password resets.
Government bodies or courts where the law requires disclosure (for example, a court order, a child-protection report, or a duty to warn).

6. Where your information is stored

Therapy records for Ontario residents are stored in Canadian regions of our cloud providers. Thrive AI (our CBT chatbot) infrastructure, along with the infrastructure for our separate guided CBT self-help tools, calming music, and cognitive games, runs on US-region cloud providers with signed Business Associate Agreements. Backup copies may be replicated across regions for disaster-recovery purposes. We do not transfer personal health information outside Canada or the United States.

7. How long we keep information

Therapy records: retained for the period required by CRPO and applicable Ontario health-records legislation, currently a minimum of 10 years after the last session for an adult and 10 years after the client reaches age 18 for a minor.
Thrive AI conversations and usage records from our separate guided CBT self-help tools, calming music, and cognitive games: 24 months by default. You can ask us to delete them sooner.
Marketing contact data: until you unsubscribe.
Server logs: 90 days.

8. Your rights

Under PHIPA, PIPEDA, and HIPAA you have rights over the information we hold about you. Specifically:

Access: ask us for a copy of the personal information we hold about you.
Correction: ask us to correct information that is wrong or incomplete.
Deletion: ask us to delete information we no longer need to keep. Some records (such as therapy records subject to legal retention) cannot be deleted before the retention period ends.
Withdrawal of consent: you can withdraw consent for processing at any time, with the same caveat above for records subject to legal retention.
Complaint: you can complain to us at [email protected]. You can also complain to the Information and Privacy Commissioner of Ontario, the Office of the Privacy Commissioner of Canada, or the US Department of Health and Human Services Office for Civil Rights, depending on which law applies.

9. How to exercise a right

Email [email protected] with a clear description of what you are asking for. We respond within 30 days. For complex requests we may extend that by a further 30 days, and we will tell you in advance if we need to.

10. Security

We use industry-standard safeguards: encryption in transit (TLS) and at rest, access controls, employee training, mandatory two-factor authentication on internal systems, and incident-response procedures. No system is perfectly secure, but we work to make Saalvio meet or exceed PHIPA, PIPEDA, and HIPAA Security Rule expectations. Our Security and Compliance page has more detail.

11. Breach notification

If we discover a breach that poses a real risk of significant harm, we will notify affected individuals and the relevant privacy regulators as required by PHIPA, PIPEDA, and HIPAA. We follow our internal incident-response plan, which is reviewed annually.

12. Children

Saalvio does not knowingly accept clients under the age of 14 without explicit parent or guardian consent. Where a client under 16 is involved, our therapists follow CRPO guidance on capable consent. Thrive AI, our guided CBT self-help tools, calming music, and cognitive games are intended for users 14 and older.

13. Changes to this policy

We update this Privacy Policy when our practices change. Material changes are announced on our site and, where appropriate, by email. The 'Last updated' date at the top of this page reflects the most recent change.

14. Contacting us about privacy

Privacy Officer, Saalvio (Zen Mind Inc.), 3300 Highway 7, Suite 600, Vaughan, Ontario L4K 4M3, Canada. Email [email protected].