Privacy Policy

Last updated: July 10, 2026 · Effective: July 10, 2026

MentaImage Inc. ("MentaImage", "we", "us") provides a mobile application that helps users reflect on stress and wellbeing patterns through voice, text, and creative-expression check-ins. This Privacy Policy describes what personal information we collect, how we use it, who we share it with, and your rights.

mentAImage is a wellbeing and stress-awareness platform. It is not a medical device and does not diagnose, treat, cure, or prevent any disease or medical condition.

1. Who we are

MentaImage Inc., based in Quebec, Canada. For privacy questions, contact our Privacy Officer at privacy@mentaimage.com.

2. What we collect

Account information

Email address, name, date of birth, language preference
Authentication credentials (passwords hashed with bcrypt; never stored in plaintext)

Check-in and wellbeing data (sensitive personal information)

Voice recordings and voice-derived stress and wellbeing features
Text reflections and responses to check-in questions
Drawing, handwriting, and creative-expression inputs
Self-reported stress, burnout, and emotional context
Session timestamps, exercise completion, and participation data
Optional: cognitive or neurodivergent profile (only if you choose to provide it)
Optional: organization or pilot participation information

Technical data

Device type, operating system version, app version
IP address (encrypted, retained for audit and security only)
Crash reports and aggregated, de-identified analytics

3. How we use your information

Provide the check-in and reflection experience
Generate personal stress and wellbeing trend insights for you
Analyze your check-in data via AI models to support those insights
Provide coping-skills suggestions and psychoeducational content through Monai
Produce aggregated, de-identified organizational insights for employers or pilot sponsors (never individual-level content)
Improve user experience, evaluate product performance, and develop stress-pattern models, using de-identified or aggregated data only
Secure the service, prevent abuse, and meet legal obligations
Communicate service messages (account changes, security alerts)

We do not sell your personal information. We do not use your check-in data for advertising. We do not provide employers with individual check-in content, voice recordings, text reflections, drawings, or individual mental health profiles. We do not use identifiable personal data to train AI models without appropriate consent and legal basis.

4. Third-party AI services and data sharing

What data is sent to AI services, who receives it, and your consent

To deliver the core features of mentAImage, we send certain check-in data to third-party AI services. We ask for your explicit permission before any of this processing begins, during app onboarding. You may withdraw consent at any time from Settings. Each third-party provider is bound by a data-processing agreement and is required to protect your personal information to a standard equivalent to this policy.

Your check-in data is processed by the following third-party AI services:

1. Voice prosody analysis — Hume AI

What is sent: Your voice audio recording from PulseKey check-ins
Who receives it: Hume AI, Inc. (United States)
Why: To analyze vocal patterns (tone, rhythm, energy) and generate your Voice Stress Index score
Safeguards: Your recordings are not used to train Hume AI's models. Processed under a data-processing agreement.
Your permission: You consent to voice analysis during onboarding. You may opt out of voice check-ins at any time without losing access to other features.

2. Voice transcription quality check — Google Cloud Speech-to-Text

What is sent: Your voice audio recording from PulseKey check-ins
Who receives it: Google LLC, via Google Cloud Speech-to-Text API (Canada — Montreal region)
Why: To verify the recording quality before prosody analysis. The resulting transcript is used only for this check and is never stored or displayed.
Safeguards: Processed in the Google Cloud Montreal region. Your audio is not used to train Google's models. Processed under Google's data-processing agreement.
Your permission: Covered by the same voice check-in consent as above.

3. AI companion, text analysis, and drawing engagement — Anthropic Claude via Google Cloud

What is sent: Your text responses to check-in questions, your chat messages to Monai, summaries of your recent check-in sessions (no raw audio), and images of your hand-drawn sketches (for engagement scoring)
Who receives it: Anthropic, PBC (United States), accessed through Google Cloud Vertex AI. Processing occurs within MentaImage's own Google Cloud environment under our Google Cloud data-processing agreement.
Why: To power Monai, our AI reflection and coping-skills companion, to score your text responses for stress indicators, to generate end-of-session summaries, and to assess drawing engagement
Safeguards: Your data is not used to train Anthropic's or Google's AI models. Processed under our Google Cloud data-processing agreement.
Your permission: You consent to AI analysis of your check-ins and use of Monai during onboarding. You may choose not to use Monai without losing your account.

4. Drawing description and stylization — Google Cloud Vertex AI (Gemini)

What is sent: Images of your hand-drawn sketches from creative check-in exercises
Who receives it: Google LLC, via Google Cloud Vertex AI (United States)
Why: To generate a description of your drawing and produce a stylized variation as part of the creative reflection experience
Safeguards: Your drawings are not used to train Google's models. Processed under Google's data-processing agreement.
Your permission: Covered by the same AI check-in analysis consent as above.

No other third-party AI services receive your personal check-in data. We do not sell, rent, or share your personal information with advertisers or data brokers.

5. Legal basis and consent (Quebec Law 25 / PIPEDA)

We process your data based on your express, informed, opt-in consent, captured in-app during onboarding. For sensitive personal information (voice recordings, text reflections, drawings, wellbeing scores), we use separate express consent checkboxes. You may withdraw consent at any time from Settings.

6. Organization-sponsored use

When mentAImage is provided through an employer, institution, or partner organization, the organization may receive aggregated and de-identified group-level insights only. Individual check-in content, voice recordings, text reflections, drawings, and individual mental health profiles are not shared with employers. mentAImage is not an employee surveillance tool. Individual data is not used for employment decisions.

7. Research and model improvement

We may use de-identified, aggregated, or pseudonymized data to improve the service or support research, where permitted by applicable law, consent, ethics review, and internal governance. Where identifiable data is used for research or model development, this requires separate explicit consent.

8. How we protect your data

Sensitive check-in data is encrypted at rest using AES-256-GCM with keys in Google Cloud KMS (90-day automatic rotation)
All data in transit is encrypted with TLS 1.2+
Access to production systems is restricted, logged, and audited
Voice recordings are stored in access-controlled object storage in Canada
Primary server infrastructure is hosted in Google Cloud's northamerica-northeast1 (Montreal) region

9. Data retention

Active account data: retained while your account is active
Check-in and wellbeing data: retained for up to 6 years from creation, consistent with health records standards
Account deletion: sensitive data is purged within 30 days of your deletion request
De-identified or aggregated data may be retained for research and product improvement where permitted by law

10. Cross-border processing

Your personal information is stored at rest in Canada (Google Cloud Montreal region). Voice transcription quality checks are also processed in the Montreal region. When your check-in data is processed by Hume AI, Anthropic Claude (via Google Cloud Vertex AI), or Google Cloud Vertex AI for drawing analysis, it is transferred to the United States under data-processing agreements. Before transferring personal information outside Quebec, we assess the sensitivity of the information, the purpose, the safeguards, and the legal framework of the destination jurisdiction.

11. Your rights

Under Quebec Law 25 and PIPEDA, you have the right to:

Access the personal information we hold about you
Correct inaccurate information
Withdraw consent where applicable
Request deletion of your account and personal information
Receive a portable copy of your data
File a complaint with the Commission d'acces a l'information du Quebec or the Office of the Privacy Commissioner of Canada

To exercise these rights, email privacy@mentaimage.com. We respond within 30 days.

12. Confidentiality incidents

If we become aware of a confidentiality incident, we will take reasonable measures to reduce the risk of harm. Where required by law, we will notify the Commission d'acces a l'information du Quebec, the Office of the Privacy Commissioner of Canada, and affected individuals.

13. Children

The service is not intended for children under 14. Users aged 14 to 17 require verifiable parental or guardian consent, collected via email confirmation.

14. Changes to this policy

Material changes are notified in-app at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.

15. Contact

Privacy Officer
MentaImage Inc.
Quebec, Canada
privacy@mentaimage.com