Overview
FHL Pathways ("Pathway," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use our digital wellness platform.
By creating an account or using Pathway, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.
Data Controller
The data controller responsible for your personal information is:
FHL Pathways, Inc.
[Registered address — to be confirmed by legal before launch]
Jurisdiction: United States
Privacy contact: privacy@fhlpathways.com
For EU/EEA residents: if you believe your data protection rights have been violated, you also have the right to lodge a complaint with your local supervisory authority (e.g., your country's data protection authority under GDPR).
Information We Collect
To provide personalized wellness services, we may collect the following categories of information:
Personal Information
- Full name
- Email address
- Account credentials (stored securely and encrypted)
Health & Wellness Data
- Weight and body metrics
- Wellness habits and indicators
- Exercise, nutrition, and hydration logs
- Mental and spiritual wellness indicators
Socioeconomic Information
- Income level
- Insurance status
- Financial wellness indicators
Behavioral & Usage Data
- Feature usage patterns
- Challenge participation and progress
- Device information and browser type
- IP address and general location data
Some of this information may be considered sensitive under applicable law (including GDPR Article 9 health data and California CPRA sensitive personal information). We handle all data with the highest level of care and security.
How We Use Your Information
We use your information for the following purposes:
- Personalization — Tailoring wellness recommendations, goals, and content to your unique needs
- Progress Tracking — Monitoring your wellness journey and providing insights on your growth
- Platform Improvement — Enhancing our services, features, and user experience
- Communication — Sending account-related notifications, wellness reminders, and relevant updates
- Research — Using anonymized and aggregated data to develop insights and improve wellness outcomes
- Analytics — Understanding usage trends to improve service quality and develop new features
- Safety & Risk Monitoring — Detecting and responding to crisis or risk indicators to protect participant welfare
Legal Basis & Your Consent
By using Pathway and creating an account, you:
- Confirm that you are voluntarily providing your information
- Acknowledge that some data you provide may be sensitive in nature
- Give explicit consent for Pathway to collect, store, process, and analyze this data for the purposes described in this policy
You may withdraw your consent at any time by deleting your account (see Section 10) or contacting us at . Please note that withdrawal of consent may impact our ability to provide personalized services. privacy@fhlpathways.com.
Subprocessors & Third Parties
We do not sell your personal information to third parties.
We use the following third-party data processors ("subprocessors") to operate the platform. Each subprocessor processes data only as necessary to provide their service and under a Data Processing Agreement (DPA) or equivalent legal instrument:
| Subprocessor | Purpose | Jurisdiction |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, edge compute | United States |
| Vercel, Inc. | Web hosting, CDN, serverless functions | United States |
| Functional Software, Inc. (Sentry) | Error monitoring and performance observability | United States |
| MailerSend, Ltd. | Transactional email and SMS delivery | European Union |
| Upstash, Inc. | Redis caching and background job queue (QStash) | United States |
| Google LLC | Maps API — used only on the "Find Support" page to display nearby resources | United States |
We may also share data when required by law, court order, or governmental regulation, or in anonymized / aggregated form with research partners who cannot identify individual users.
HIPAA Status Disclosure
Pathway is not a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA).
While we are not subject to HIPAA regulations, we take the security of your health-related information seriously. We apply reasonable administrative, technical, and physical safeguards inspired by industry best practices to protect your data.
Pathway is not a healthcare provider and does not provide medical diagnosis, treatment, or clinical services. All wellness content is educational and informational in nature.
Data Security
We implement a range of security measures to protect your personal information, including:
- Encryption — Data is encrypted both in transit (TLS/SSL) and at rest
- Access Controls — Strict role-based access ensuring only authorized personnel can access sensitive data
- Secure Infrastructure — Our platform is hosted on industry-leading cloud infrastructure with built-in security
- Regular Audits — We conduct periodic reviews of our security practices and protocols
While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining the highest practical standards.
Data Retention
We retain your personal information only for as long as necessary for the purposes described in this policy or as required by law.
| Data Category | Retention Period |
|---|---|
| Account & profile data | Until account deletion + 14-day grace period, then permanently deleted |
| Daily check-ins & mood data | 24 months from collection; anonymized or deleted after |
| Crisis / risk alerts | 7 years (safety record obligation); anonymized after |
| Audit logs | 7 years for compliance purposes; anonymized after |
| Authentication tokens | Until session expiry or account deletion |
Following account deletion, certain anonymized or aggregated data may be retained for research or legal compliance purposes, but will not identify you personally.
Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal data. We will respond to all requests within 30 days.
1. Right of Access (GDPR Art. 15)
Request a copy of the personal data we hold about you. How to exercise: Profile Visit your Profile page to view your data, or email privacy@fhlpathways.com.
2. Right to Rectification (GDPR Art. 16)
Correct inaccurate or incomplete data. How to exercise: Update your information directly from the Profile page.
3. Right to Erasure / "Right to be Forgotten" (GDPR Art. 17)
Request permanent deletion of your account and personal data. How to exercise: Use the "Request account deletion" button on your Profile page. A 14-day grace period applies — you may cancel by signing back in within that window.
4. Right to Data Portability (GDPR Art. 20)
Receive a copy of your data in a structured, machine-readable format. How to exercise: Use the "Download your data" button on your Profile page (feature coming soon), or email us.
5. Right to Restriction of Processing (GDPR Art. 18)
Request that we limit how we use your data in certain circumstances. How to exercise: privacy@fhlpathways.com.
6. Right to Object to Processing / Profiling (GDPR Art. 21)
Object to processing based on legitimate interests, including automated risk profiling. How to exercise: privacy@fhlpathways.com Email privacy@fhlpathways.com to request opt-out from automated risk scoring.
California residents may also exercise rights under CCPA/CPRA (including the right to know, opt-out of sale, and limit use of sensitive personal information). Brazil residents may exercise rights under LGPD.
Children's Privacy
Pathway is not intended for use by individuals under the age of 18. For users in EU/EEA member states, the minimum age is 16 under GDPR Article 8. For users in the United States, COPPA applies to children under 13.
We do not knowingly collect personal information from minors below these thresholds without verifiable parental or guardian consent. If we become aware that we have collected data from a minor without appropriate consent, we will take steps to delete that information promptly.
Note: The platform currently relies on policy acceptance for age verification. We are evaluating technical age-gate controls and will implement them in a future update.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.
When we make material changes, we will notify you through the Platform or via email. Continued use of the Platform after such updates constitutes your acceptance of the revised policy.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team:
FHL Pathways Privacy Team
Email: privacy@fhlpathways.com
We aim to respond to all privacy requests within 30 days.