Privacy
Privacy policy
Helpwell is a self-help check-in tool, not therapy and not a crisis service. This page explains what we collect, why, where it goes, how long we keep it, and how you can get it back or have it deleted. It is written to be read, not to be survived.
The short version. Your email is encrypted and is never written into a check-in. Check-ins and notes are filed under a random code. The assistant sends your check-ins, notes and messages to a model provider outside Canada to write a reply; you turn that on yourself, and your email, name, account ID and anonymous code are never included. The words you wrote are. Voice audio is transcribed on our own server and discarded. We do not sell your data, run advertising, or use analytics trackers. You can export or delete everything from your account page.
1. Who we are
Helpwell (“Helpwell”, “we”, “us”) operates helpwell.ca and app.helpwell.ca. We are based in Alberta, Canada, and our application servers are hosted by OVH in Beauharnois, Quebec. Our domain and DNS are managed by EasyDNS, a Canadian provider.
We are a self-help and peer-support tool. We are not a hospital, clinic, regulated health professional, or health information custodian, and using Helpwell does not create a clinical relationship. The assistant does not diagnose, treat, or make decisions about your care.
This policy covers the marketing site, the application, the assistant, the notes journal, voice notes, and the peer thread when it is enabled. It does not cover a third-party site you reach through a link.
2. What we collect
| What | Details | Why |
|---|---|---|
| Account | Email address, stored encrypted with AES-256-GCM; a keyed lookup value so you can sign in; a password hash (scrypt); an anonymous account code; tier and subscription dates; timestamps. Two-factor authentication is optional, and required for peer responders. | To create and secure your account, keep your history across devices, and operate billing or promo access. Email is used for account and billing purposes and support, not for marketing. |
| Check-ins | Energy, sleep and stress scores (0–100), an optional note of up to 500 characters, the time, and an anonymous code. No email, name or billing identifier is written into a check-in. | To show your trend, monthly cards, and what your record shows. |
| Notes journal | Text you write, up to 4,000 characters per note, up to 200 notes per account, with timestamps. | Context you choose to give the assistant, and a record you can edit or delete. |
| Assistant | Your messages, the assistant’s replies, a provider label and timestamps. The newest 500 messages per account are kept. A one-time consent record and its version are stored when you turn the assistant on. | To keep the conversation coherent and to record that you agreed to the model processing described below. |
| Peer thread | When enabled: messages between you and a peer supporter, direction, timestamps, and the member number the responder sees. The responder does not see your email. | To provide the paid Circle peer conversation. |
| Voice notes | Audio you record is sent to our own transcription service on our server, converted to text, and then discarded. We do not store the audio. The text is placed in the composer and is saved only if you press Add note or Save today’s check-in. | To let you dictate instead of typing. No third-party speech service is used. |
| Technical | A session cookie; server and proxy logs that may include IP address, user agent, requested path and time; in-memory rate-limit counters. We do not use these for profiling, advertising or analytics. | To keep you signed in, secure the service, and diagnose failures. |
| Public “Ask the research” box | The question text is processed in memory to produce an answer. There is no account, no history, and no stored question. If the question indicates a crisis, the 9-8-8 answer is returned in code before any model call. | To answer questions from the public without collecting a person. |
What we do not collect: your name (sign-up does not ask for one), phone number, mailing address, precise location, contacts, advertising identifiers, or analytics profiles. We do not take payment card details because no payment provider is connected today; if that changes, this policy will be updated before cards are taken.
3. Why we collect it
We collect personal information for purposes a reasonable person would consider appropriate in the circumstances, and only as much as those purposes require. In practice:
- To provide the service you asked for — an account, check-ins, your journal, your trend, and the assistant if you turn it on.
- With your consent — for the assistant’s model processing, voice transcription, and the peer thread. Consent is asked at the point it matters, in plain language, and the assistant consent is versioned so a material change asks again.
- For safety — to return crisis resources when a message indicates harm to you or someone else, and to keep the service secure.
- To meet legal obligations — for example, tax and accounting records if paid access is introduced, or responding to a lawful demand.
Health-related information is sensitive. We treat check-ins, notes, assistant messages and peer messages as sensitive personal information, and we limit access to the operator and, for the peer thread, the responder assigned to it.
4. The assistant, AI and safety
What the assistant is
The Circle assistant is a conversational interface backed by a large language model. It can read your own check-ins and notes and talk through what they show. It is not a clinician, it does not diagnose, and it cannot prescribe or provide treatment. Its answers can be wrong; verify anything important, and do not rely on it in an emergency.
Where your words go
When you turn the assistant on, you agree that your check-ins, notes and the messages in the conversation may be sent to our model provider, DeepSeek, which processes them outside Canada (DeepSeek is based in China) to write a reply. The request includes the recent check-ins, notes and messages needed for context, but not your email address, name, account ID, anonymous code or your device’s IP address — it is made from our server, not your device. Because the text you wrote is included, this is de-identification at our layer, not anonymization: if you put identifying details in a note or message, those details travel with the request. Nothing is sent until you accept the consent panel, and the consent is recorded with a version number. If you decline, the assistant does not call the model; you can still use the local, non-model parts of the assistant and the rest of the app.
We send the minimum needed to answer. We do not use your content to train models ourselves. The model provider processes the request under its own terms and privacy policy, which may include retention and processing outside Canada. You can withdraw consent at any time by contacting us; we will stop future model calls for your account and record the change.
Safety check, and what it is not
Every assistant message passes through an automated safety check in our code, before the model. If the message indicates possible harm to yourself or harm to another person, the assistant is told that classification and the reply includes 9-8-8 and 911 in code, so the numbers do not depend on the model noticing.
This is not a monitored service. No one is watching the conversation in real time, and a safety check is not a human responder. There is no queue of flagged conversations being reviewed today. If you are in danger, call 9-8-8 or 911 now — do not wait for a reply.
We do not use AI to make decisions that have legal or similarly significant effects about you. Access to Circle is determined by your tier and subscription, not by a model. The assistant does not decide whether you can sign in, export your data, or delete your account.
Accuracy and the library
The public “Ask the research” box answers only from a written library of findings, each with a source and locator. It will sometimes say it does not know. The in-app assistant is more conversational and can be wrong. Neither is a medical device, a diagnosis, or a substitute for a professional.
Voice notes
Voice notes are transcribed by a self-hosted model on our own server, not by a third-party speech service. The audio is held in memory, transcribed, and discarded; it is not written to disk and is not included in backups. The transcript is editable text and is saved only when you save the note or check-in.
5. Sharing and cross-border transfers
We do not sell your personal information, and we do not share it for advertising.
We share it only with service providers who help us run the service, and only as needed:
| Provider | Purpose | Location |
|---|---|---|
| OVHcloud | Hosting the application and database | Beauharnois, Quebec, Canada |
| EasyDNS | Domain name and DNS | Canada |
| DeepSeek | Writing assistant replies when you consent | Outside Canada (China) |
| Operator backup device | Encrypted off-host backup copy | Alberta, Canada |
Cross-border transfer. The assistant transfer to DeepSeek is the significant one. It may be subject to the laws of the country where the provider operates, including lawful access requests. We disclose it here and ask for your consent before it happens. Under Quebec’s privacy law, a transfer outside Quebec must be assessed for comparable protection; we treat this disclosure and your consent as the basis for the assistant transfer, and we do not enable the assistant for an account that has not accepted the current terms.
We may also disclose information if required by law, a warrant, or a court order, or to protect someone from serious harm where we are legally permitted to do so. Because we do not monitor conversations, we cannot promise to notice a message; the emergency numbers above are the reliable path.
6. Cookies and local storage
We use one session cookie, hw_session. It is HttpOnly,
Secure in production, SameSite=Lax, and lasts up to 30 days. It
keeps you signed in. There are no advertising cookies and no analytics scripts.
In your browser’s local storage, anonymous use stores a random device code
(helpwell.anon_id) so your check-ins stay together without an account. The
operator dashboard, when used with an admin key, keeps that key in the tab’s session
storage and wipes it from the address bar. We do not use these for tracking across sites.
Our fonts are served from our own domain. Pages do not call Google Fonts, analytics, or advertising networks.
7. How long we keep it
| Data | Retention |
|---|---|
| Check-ins | Until you delete that day or your account. We do not auto-delete your record. |
| Notes | Until you delete them or your account; up to 200 notes per account. |
| Assistant conversation | Newest 500 messages per account; older messages are removed automatically. |
| Peer messages | Until your account is deleted. The peer thread is not enabled today. |
| Sign-in sessions | Expire after 30 days; expired sessions are removed automatically. |
| Harness audit rows | 365 days. |
| Voice audio | Not stored. Transcribed in memory and discarded. |
| Public questions | Not stored. |
| Encrypted backups | 14 daily copies on the server, 30 off-host. |
| Backup and maintenance logs | Rotated weekly, up to 8 weeks. |
| Server and proxy logs | Rotated by size (10 MB × 3 per container). |
When you delete your account, we delete your live account row and the check-ins filed under your code, and your notes, assistant conversation, peer messages, harness rows, sessions and subscriptions are deleted by cascade. Encrypted backups can still contain a copy until they age out — up to 14 days on the server and 30 days off-host. They are kept for disaster recovery, not for restoring a deleted account. Download your export first if you want a copy.
8. Security
We protect personal information with measures proportionate to its sensitivity:
- TLS in transit, including HSTS on the application host.
- Email encrypted at rest with AES-256-GCM; passwords hashed with scrypt; TOTP secrets encrypted; recovery codes hashed.
- Session cookies are
HttpOnly,SecureandSameSite=Lax; sign-in and other sensitive endpoints are rate-limited. - Two-factor authentication is available, and required for anyone who can read peer conversations.
- Administrative access is limited to the operator, by an owner session or a separate admin key.
- Backups are encrypted with AES-256-CBC and PBKDF2; the key is held on the server and must be escrowed separately.
- The voice transcriber runs on our own server, on an internal network, with no public port; it does not write audio to disk.
No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by PIPEDA, and the relevant provincial authority where applicable. We will also tell you what happened and what we are doing about it.
9. Your rights
You can ask us to:
- Access your personal information. The account page has Download everything, which exports your check-ins, notes, assistant conversation, peer conversation and subscription history as JSON.
- Correct it. Notes and check-in notes are editable in the app. For an email change or another correction, contact us; we may need to verify your identity.
- Delete it. Notes and check-ins can be deleted in the app; the account page deletes your account and the live rows described above. Backups age out on the schedule above.
- Withdraw consent to the assistant’s model processing. Contact us and we will stop future model calls for your account and record the change. You can still use the rest of Helpwell.
- Ask how a decision was made. We do not make automated decisions with legal or significant effects about you, but you can ask us to explain any handling of your information.
We will respond within the time required by applicable law — generally 30 days under PIPEDA and Quebec’s private-sector law, and 45 days under Alberta’s PIPA. We may extend that where the law allows and will tell you why. We may need to verify your identity before acting, and we will not delete data we are legally required to keep.
10. Children and young people
Helpwell is intended for people 16 and older. It is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child under 16 has created an account, contact us and we will delete it. We are reviewing an age confirmation at sign-up as part of that commitment.
11. Changes to this policy
We will update this page when our practices or the law change. The version and date at the top tell you which text you are reading. If a change materially affects what we do with your information, we will tell you in the app and, where required, ask for your consent again. The assistant consent is already versioned for this reason.
12. The law we work within
This section is current to October 18, 2026. It describes the framework we have designed against; it is not legal advice, and it is not a claim that every obligation has been finally determined for a service of this kind.
| Instrument | Status | What it means here |
|---|---|---|
| PIPEDA | In force | The federal private-sector privacy law. It requires appropriate purposes, valid consent, openness, accuracy, access and correction, retention limits, safeguards and accountability. It applies to our commercial activity across Canada. |
| Bill C-36 / PPCDA | Tabled 2026, not in force | Would repeal Part 1 of PIPEDA and enact the Protecting Privacy and Consumer Data Act, with a new regulator and stronger order-making powers. We are tracking it and will update this policy when it comes into force. |
| Bill C-27 / AIDA | Did not become law | The proposed Artificial Intelligence and Data Act was part of Bill C-27, which did not proceed. Canada does not currently have a general AI-specific statute in force. Bill C-27. |
| AI for All | Strategy, not law | Canada’s 2026 national AI strategy. It sets direction on safety, adoption, sovereignty and modern privacy law, but it is not itself a statute. |
| OPC generative AI principles | Guidance | Federal, provincial and territorial commissioners’ principles on legal authority and consent, appropriate purposes, necessity, openness, accountability, access, limiting collection, accuracy and safeguards. |
| OPC joint investigation of OpenAI (2026) | Enforcement guidance | The 2026 federal/provincial findings on ChatGPT emphasise valid consent, plain transparency about what is sent and why, accuracy limits, retention schedules and accountability. We apply those lessons to the assistant. |
| Voluntary Code of Conduct on Generative AI | Voluntary | Accountability, safety, fairness, transparency, human oversight and robustness. We use it as a checklist, not as a substitute for law. |
| Quebec Law 25 / Private Sector Act | In force | Applies to personal information of Quebec residents. It requires a serious and legitimate purpose, transparency, consent, a privacy officer, breach handling, and rules for transfers outside Quebec and automated decisions. We disclose the assistant transfer and do not make automated decisions with significant effects. |
| Alberta PIPA | In force | Applies to private-sector organizations in Alberta. It requires reasonable purposes, consent, access and correction, safeguards and accountability. |
| British Columbia PIPA | In force | Applies where BC law governs the personal information. We apply the same practices described here. |
| CASL | In force | Canada’s anti-spam law. We do not send marketing email today. If we do, we will ask for consent and include an unsubscribe path. |
This summary is provided for transparency and is current to the date above. It is not legal advice. We review it as the law and our practices change, and we will correct it if it is wrong.
13. Contact and complaints
Questions, access requests, corrections, deletion requests, consent withdrawal, or a privacy concern: privacy@helpwell.ca. Our privacy officer is the operator of Helpwell. We will acknowledge your request and respond within the time required by law.
If you are not satisfied with our response, you may complain to:
- Office of the Privacy Commissioner of Canada — priv.gc.ca/en/report-a-concern
- Commission d’accès à l’information du Québec — cai.gouv.qc.ca (Quebec residents)
- Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca (Alberta)
- Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca (British Columbia)
Helpwell is a self-help tool. If you are in immediate distress, call or text 9-8-8, or call 911. This policy does not replace emergency care.