Pathverse App Builder Privacy Policy

Effective Date: April 2, 2024

Pathverse Inc. built the Pathverse app and a web interface to support health research. It is free to use with limited functionality, advanced features would require payment of fees to access.

Pathverse Inc. (“Pathverse”, “we”, “us” or “our”) aims to accelerate mobile health research and learning. We respect your privacy and are committed to being transparent about how we collect, use and share your personal information.

This policy applies to all Pathverse services, products, and mobile applications (“Service”).

This page is used to inform visitors regarding our policies with the collection, use, and disclosure of Personal Information if anyone decided to use our Service.

If you choose to use our Service, then you agree to the collection and use of information in relation to this policy. The Personal Information that we collect is used for providing and improving the Service. We will not use or share your information with anyone except as described in this Privacy Policy.

The terms used in this Privacy Policy have the same meanings as in our Terms and Conditions, which are accessible at Pathverse unless otherwise defined in this Privacy Policy.

What information does Pathverse collect?

Researchers

Pathverse collects information directly from you for your registration and user profile. We also automatically collect your usage information to help us improve the platform.  We only collect the minimum amount of personal information necessary from you, unless you choose to provide more. We don’t knowingly collect information from children under 13.

From researchers we collect:

Registration Information

Email address
Password
Full name
Organization they work for
How they heard about Pathverse (optional)
Ethics approval certificate for study uploaded on Pathverse

User Personal Information

Email address

Full name
Organization they work for
How they heard about Pathverse (optional)

Study Information

Study name
Study description
Study module content
Study card content

Analytics Information

Admin portal usage data

How we use this information

We use your Registration Information to create your account and to provide you the Service.
We use your User Personal Information, specifically your email address, to identify you on Pathverse.
We use your organization information to verify you are who you say you are.
We use your email to communicate with you if you’ve said that’s okay, and only for the reasons you’ve said that’s okay.
We may use your User Personal Information if it is necessary for security purposes or to investigate possible fraud or attempts to harm Pathverse or our Users.
We may use User Personal Information to invite you to take part in surveys, beta programs, or other research projects, subject, where necessary, to your consent.
We may use the ethics approval certificate to verify the uploaded study.
We may use your study information to verify the validity of your study.
We may use your Analytics Information to improve our platform and the Service.

App User

Pathverse collects information directly from you for your registration and user profile. We only collect the minimum amount of personal information necessary from you, unless you choose to provide more. We don’t knowingly collect information from children under 13.

From App Users we collect:

Registration Information

Email address (can be fake, for anonymity)
Password

Analytics Information

Lesson completion log
Survey answers
Login log

How we use this information

We use your Registration Information to create your account and to provide you the Service.
We use your User Personal Information, specifically your email address, to identify you on Pathverse. If you use a fake email, for anonymity, we won’t be able to personally identify you.
We use your email to communicate with you if you’ve said that’s okay, and only for the reasons you’ve said that’s okay and have used a real email. If you use a fake email, for anonymity, we may not be able to contact you. In case you need to reach us, we are at support@pathverse.ca.
We may use your Analytics Information to improve our platform and the Service.
Study admins and creators (researchers) may use your Analytics Information to conduct on relevant research, after which you have consented.
Study admins and creators (researchers) may use your provided email address to enroll you in their study. You may provide a non-existent email to stay anonymous.

Steps – from Google Fit

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.

It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
If this feature is enabled, we may use your steps from Google Fit to provide a custom daily step goal dashboard to promote health.
We DO NOT collect your Step Data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your steps in our secure servers.
All stored data is encrypted with industry-standard encryption and de-identified.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your step data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Active Minutes – from Google Fit

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
If this feature is enabled, we may use your active minutes from Google Fit to provide a custom daily active minute’s dashboard to promote health.
We DO NOT collect your Active Minutes Data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your active minutes in our secure servers.
All stored data is encrypted with industry-standard encryption and de-identified.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your active minutes data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Steps – from Apple Health

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
If this feature is enabled, we may use your steps from Apple Health to provide a custom daily step goal dashboard to promote health.
We DO NOT collect your Step Data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your steps in our secure servers.
All stored data is encrypted with industry-standard encryption and de-identified.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your step data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.

All your data on the local device is encrypted at rest with industry-standard encryption.

Exercise Minutes – from Apple Health

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
If this feature is enabled, we may use your exercise minutes from Apple Health to provide a custom daily exercise minutes dashboard to promote health.
We DO NOT collect your Exercise Minutes Data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your exercise minutes in our secure servers.
All stored data is encrypted with industry-standard encryption and de-identified.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your exercise minutes data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Sedentary, Lightly Active, Moderately Active, Very Active Minutes (collectively, Active Minutes) – from Fitbit

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
If this feature is enabled, we may use your Active Minutes from Fitbit to provide a custom daily Active Minutes from Fitbit dashboard to promote health.
We DO NOT collect your Active Minutes from Fitbit Data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your Active Minutes from Fitbit in our secure servers.
All stored data is encrypted with industry-standard encryption and de-identified.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your Active Minutes from Fitbit data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Step Data – from Fitbit

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
If this feature is enabled, we may use your Step Data from Fitbit to provide a custom daily Step Data from Fitbit dashboard to promote health.
We DO NOT collect your Step Data from Fitbit in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your Step Data from Fitbit in our secure servers.
All stored data is encrypted with industry-standard encryption and de-identified.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your Step Data from Fitbit to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Heart Rate Data – from Fitbit

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
If this feature is enabled, we may use your Heart Rate Data from Fitbit to provide a custom daily Heart Rate Data from Fitbit dashboard to promote health.
We DO NOT collect your Heart Rate Data from Fitbit in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your Heart Rate Data from Fitbit in our secure servers.
All stored data is encrypted with industry-standard encryption and de-identified.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your Heart Rate Data from Fitbit to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Sleep Data – from Fitbit

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
If this feature is enabled, we may use your Sleep Data from Fitbit to provide a custom daily Sleep Data from Fitbit dashboard to promote health.
We DO NOT collect your Sleep Data from Fitbit in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your Sleep Data from Fitbit in our secure servers.
All stored data is encrypted with industry-standard encryption and de-identified.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your Sleep Data from Fitbit to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Blood Pressure – Self-reported

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
We DO NOT retrieve your blood pressure information from any other services. This feature is strictly user-self-input.
If this feature is enabled, we may use your self-input blood pressure data to provide a custom dashboard to help you track.
We DO NOT collect your blood pressure data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your steps in our secure servers.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your blood pressure data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Blood Sugar A1C – Self-reported

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
We DO NOT retrieve your blood sugar (A1C) information from any other services. This feature is strictly user-self-input.
If this feature is enabled, we may use your self-input blood sugar (A1C) data to provide a custom dashboard to help you track.
We DO NOT collect your blood sugar (A1C) data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your steps in our secure servers.

We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your blood sugar (A1C) data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Weight – Self-reported

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
We DO NOT retrieve your weight information from any other services. This feature is strictly user-self-input.
If this feature is enabled, we may use your self-input weight data to provide a custom dashboard to help you track.
We DO NOT collect your weight data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your steps in our secure servers.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your weight data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Waist Circumference – Self-reported

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.

It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
We DO NOT retrieve your waist circumference information from any other services. This feature is strictly user-self-input.
If this feature is enabled, we may use your self-input waist circumference data to provide a custom dashboard to help you track.
We DO NOT collect your waist circumference data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your steps in our secure servers.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your waist circumference data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Heart Rate – Self-reported

This feature is not available to everyone.
It is ONLY available to users participating in a research study that requires it.
It is ONLY enabled if all the participants of that study have signed a consent form allowing it.
We DO NOT retrieve your heart rate information from any other services. This feature is strictly user-self-input.
If this feature is enabled, we may use your self-input heart rate data to provide a custom dashboard to help you track.
We DO NOT collect your heart rate data in our servers UNLESS it is a part of your study requirement. Then, only after your signed consent, we may collect and save your steps in our secure servers.
We DO NOT sell or use your data for advertising purposes.
If you are a part of a research study, we may transfer your heart rate data to the research coordinator, ONLY after being presented with a signed consent form from the user permitting the data transfer.
You can request to delete all your data at any time.
All your data on the local device is deleted when the app is deleted.
All your data on the local device is encrypted at rest with industry-standard encryption.

Survey and Lesson Completion and Goal Setting Data

Survey and lesson completion data collected through Pathverse will be stored on Amazon servers in Canada. Although your data is stored in Canadian servers, Amazon is a US-owned and operated company. As such, there is a possibility that information about you that is gathered for this research study may be accessed without your knowledge or consent by the U.S. government, in compliance with the U.S. Freedom Act. Data will be deleted from these servers after three years. Goal setting data that is added by the user along with fitness data, collected through Google Fit or Apple Health Kit, is stored on the device and is strictly for display purposes. Therefore, uninstalling the app will permanently delete all data related to them. 

Study Consent Process

In order to enrol in studies, you will need to give consent to the study admin (researcher). Each study will have its respective consent forms and processes you would need to go through. This process is between the app user and the study admin (researcher). All study admins must ensure their study participants give relevant consent before they are enrolled and gain access to their study content.

For questions about the enrolment process please email admin@pathverse.ca.

Health and Health Research

Health, fitness, and medical studies are especially sensitive and apps in this space have some additional rules to make sure user privacy is protected:

Studies must not write false or inaccurate data into Pathverse.
Studies conducting health-related human subject research must obtain consent from participants or, in the case of minors, their parent or guardian. Such consent must include the (a) nature, purpose, and duration of the research; (b) procedures, risks, and benefits to the participant; (c) information about confidentiality and handling of data (including any sharing with third parties); (d) a point of contact for participant questions; and (e) the withdrawal process.
Studies conducting health-related human subject research must secure approval from an independent ethics review board. Proof of such approval must be provided upon request.

For researchers who want to deliver content on Pathverse and conduct research, you must provide proof that your study has been approved by an ethics review board, this can be done by uploading a certificate of approval in the admin portal.

For questions about the ethics process please email admin@pathverse.ca.

Cookies are files with a small amount of data that are commonly used as anonymous unique identifiers. These are sent to your browser from the websites that you visit and are stored on your device’s internal memory.

This Service does not use these “cookies” explicitly. However, the app may use third-party code and libraries that use “cookies” to collect information and improve their services. You have the option to either accept or refuse these cookies and know when a cookie is being sent to your device. If you choose to refuse our cookies, you may not be able to use some portions of this Service.

Service Providers

We may employ third-party companies and individuals due to the following reasons:

To facilitate our Service;
To provide the Service on our behalf;
To perform Service-related services; or
To assist us in analyzing how our Service is used.

We want to inform users of this Service that these third parties have access to their Personal Information. The reason is to perform the tasks assigned to them on our behalf. However, they are obligated not to disclose or use the information for any other purpose.

Security

We value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and we cannot guarantee its absolute security.

Links to Other Sites

This Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by us. Therefore, we strongly advise you to review the Privacy Policy of these websites. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Children’s Privacy

These Services do not address anyone under the age of 13. We do not knowingly collect personally identifiable information from children under 13. In the case we discover that a child under 13 has provided us with personal information, we immediately delete this from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we will be able to do the necessary actions.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Thus, you are advised to review this page periodically for any changes. We will notify you of any changes by posting the new Privacy Policy on this page.

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at admin@pathverse.ca.

Pathverse StudyFlow Privacy Policy

Effective Date: September 22, 2026

This Privacy Policy explains how Pathverse Inc. ("Pathverse," "we," "us," or "our") collects, uses, stores, protects, and discloses personal information in connection with StudyFlow.

StudyFlow is a study participant management and research workflow platform used by researchers and research organizations to recruit, screen, enroll, manage, collect survey data and communicate with research participants.

This Privacy Policy applies to researchers, research staff, participants, and other individuals who access or use StudyFlow.

1. The Important Distinction Between Pathverse and the Research Team

StudyFlow is a technology platform used by researchers and research organizations.

There are two distinct categories of information processed through StudyFlow.

Information Pathverse collects to operate StudyFlow

Pathverse collects limited information necessary to register researcher accounts, provide researcher and Participant access, operate the platform, provide technical support, and communicate with users.

Depending on whether you are a researcher or participant, this may include:

name
email address
optional telephone number
researcher passwords and authentication information; Participant time-limited access links and tokens
participant identifier
IP address
device and browser information
technical information associated with authentication and access, where generated by the platform; this does not mean that audit logging is implemented
account activity
technical information required to operate StudyFlow

Information researchers collect using StudyFlow

Researchers and research organizations determine what research information they collect through their Studies.

Depending on the Study, this may include:

screening responses
eligibility information
survey responses
demographic information
behavioural information
study-arm or group information
appointment information
consent status
compensation information
withdrawal status
researcher notes
custom study fields
other sensitive or research-related information

Pathverse does not decide what research questions a researcher asks or what research information a Study collects.

The researcher or research organization is responsible for determining the purpose of the Study, what Participant Data is collected, how it is used, how long it is retained, and what research ethics or institutional approvals are required. Pathverse provides the technology used to collect and manage that information on behalf of the researcher or research organization.

2. Information We Collect From Researchers

When a researcher or research staff member creates or uses a StudyFlow account, Pathverse may collect:

name
email address
password and authentication information
Study information
survey, screening, and workflow configurations
questions created within StudyFlow
communications with Pathverse
support requests
IP address
device and browser information
login activity
usage information generated through use of StudyFlow

Researchers may also enter information about Studies, Participants, study stages, eligibility criteria, groups, surveys, and other research activities.

3. Information We Collect From Participants

Participants access StudyFlow through time-limited links and tokens. They do not create username-and-password accounts. Pathverse may process information provided by Participants or the research team and technical information needed to provide this access.

Pathverse may collect:

name
email address
optional telephone number
time-limited access links and tokens
participant identifier
IP address
device and browser information
technical information associated with access, where generated by the platform
security-related activity
other technical information necessary to provide Participant access

StudyFlow Does Not Require Participant Age for Access

Pathverse does not currently require or collect a Participant’s age as part of providing access through time-limited links and tokens. Age, date of birth, or age-related eligibility information may be collected separately if a researcher chooses to ask for it as part of a Study. When age information is collected through a Study, it is collected because the researcher or research organization configured the Study to request that information. Pathverse does not independently determine whether a Participant meets a Study’s age eligibility requirements.

4. Studies Involving Children or Minors

StudyFlow may be used for research involving individuals under the age of majority. Because StudyFlow does not independently collect or verify Participant age when providing access, Pathverse does not determine whether a Participant is a minor and does not independently determine what consent or assent process is required for a particular Study.

The researcher and research organization are responsible for:

determining whether minors may participate in the Study
establishing appropriate age eligibility criteria
collecting age information where necessary
obtaining any required parental or guardian permission
obtaining Participant assent where required
complying with the Study's REB, IRB, institutional, or regulatory requirements
implementing appropriate recruitment and consent procedures

Where a Study is limited to Participants above a particular age, the researcher should configure the Study's screening or eligibility process to verify that requirement where appropriate. Pathverse provides the technical infrastructure but does not replace the researcher's responsibility for age eligibility, parental consent, guardian authorization, or Participant assent.

5. Research Ethics and Informed Consent

Researchers and research organizations are responsible for obtaining any research ethics board ("REB"), institutional review board ("IRB"), institutional, legal, or regulatory approvals required for their Study. Researchers are also responsible for developing and administering the appropriate informed-consent process for Participants. Pathverse does not independently provide or approve a research consent form on behalf of a Study. Researchers are responsible for maintaining records of research consent where required by their Study protocol or institution. Pathverse may request evidence of ethics or institutional approval where appropriate.

6. Screening Information

Researchers may use StudyFlow to collect screening information before an individual is formally enrolled in a Study.

Screening information may include sensitive personal or health information, depending on the Study.

The researcher or research organization determines:

what screening questions are asked
what information is required
the eligibility criteria
whether a person is eligible or ineligible
how screening information is used
how long screening information is retained

StudyFlow may apply researcher-configured eligibility rules, but Pathverse does not independently determine whether a person should participate in a Study. Information from individuals who are screened but not enrolled may be retained for the duration specified by the researcher or research organization, subject to applicable laws, research ethics requirements, and institutional policies.

7. How Pathverse Uses Personal Information

Pathverse may use personal information to:

create and manage researcher accounts
authenticate researchers and provide Participant access through time-limited links and tokens
provide access to Studies
operate and maintain StudyFlow
deliver emails and system notifications
provide technical support
troubleshoot technical problems
maintain platform security
detect unauthorized or suspicious activity
perform backups and system recovery
improve reliability and usability
communicate with researchers about their accounts and with Participants about their access to StudyFlow
comply with legal obligations
protect the rights, security, and integrity of StudyFlow, Pathverse, researchers, Participants, and others

Pathverse does not use identifiable Participant research responses for advertising.

8. Researcher Use of Participant Data

Researchers and research organizations use Participant Data according to their Study protocol, informed-consent materials, research ethics approval, institutional policies, and applicable laws.

Questions about why particular information is being collected in a Study, how Study information will be used, or how long research data will be retained should normally be directed to the research team identified in the Study's participant-information or consent materials.

9. Research Data Ownership and Control

As between Pathverse and the research organization, the research organization or Customer retains ownership and control of its research data, subject to any rights that Participants may have under applicable law. Pathverse does not acquire ownership of Participant research responses merely because the information is stored or processed through StudyFlow. Pathverse processes Customer and Participant Data only as reasonably necessary to provide, maintain, secure, and support StudyFlow or as otherwise required by law.

10. Pathverse Access to Research Data

Pathverse does not routinely review identifiable research responses for its own purposes.

Authorized Pathverse personnel may access limited Customer or Participant Data where reasonably necessary to:

provide technical support
investigate or resolve technical problems
maintain or secure StudyFlow
investigate security incidents
perform backups or data recovery
respond to lawful requests
comply with applicable legal obligations

Where reasonably practicable, Pathverse will limit access to the information necessary for the applicable purpose.

11. No Sale, Rental, Advertising Use, or Data Brokerage

Pathverse does not:

sell Participant Data
rent Participant Data
provide Participant research data to data brokers
use identifiable research responses for behavioural advertising
use identifiable Participant research data for third-party advertising purposes

12. Artificial Intelligence and Machine Learning

StudyFlow does not currently use identifiable research data to train artificial intelligence or machine-learning models.

Pathverse does not use identifiable StudyFlow Participant Data or identifiable research responses to train artificial intelligence or machine-learning models.

If StudyFlow introduces AI-enabled functionality in the future that materially changes how personal information is processed, this Privacy Policy may be updated and additional notices or agreements may be provided where appropriate.

13. Aggregated and De-identified Information

Pathverse may generate and use aggregated, statistical, or de-identified information to understand and improve StudyFlow.

For example, Pathverse may analyze:

the number of Studies created
the number of Participants managed
the number of surveys or screening workflows completed
feature usage
general system performance
other platform-level usage patterns

Pathverse will not use this information in a manner that reasonably identifies an individual Participant or reveals identifiable research responses.

14. Hosting and Data Location

Unless otherwise agreed with the research organization, StudyFlow data is hosted in Canada.

StudyFlow currently uses Amazon Web Services ("AWS") infrastructure located in Canada.

Alternative hosting locations may be available through separate arrangements with Pathverse. Researchers and research organizations should confirm the location and availability of any backups with Pathverse and are responsible for determining whether the selected hosting arrangement satisfies their institutional, contractual, ethics, regulatory, and legal requirements.

15. Email Communications

StudyFlow uses AWS services to send platform and Study-related email communications.

These communications may include:

account authentication messages
Study invitations
Study-stage notifications
reminders
account-related communications
other researcher-configured Study communications

Researchers are responsible for the content, timing, recipients, and appropriateness of Study-related communications.

16. Service Providers

Pathverse may use service providers to operate StudyFlow. Currently, AWS provides hosting, infrastructure, storage, and email-delivery services associated with StudyFlow. The availability and configuration of backup services should be confirmed with Pathverse. Pathverse may add additional service providers as StudyFlow develops.

For example, Pathverse may use a payment provider such as Stripe if paid StudyFlow subscriptions are introduced. Where appropriate, this Privacy Policy will be updated to reflect material changes in service providers that process personal information.

17. Analytics

StudyFlow does not currently use Google Analytics to track researcher or Participant activity within the StudyFlow application. Pathverse may internally collect limited usage and system information necessary to understand how StudyFlow is being used, maintain security, troubleshoot issues, and improve the platform.

18. Data Security

Pathverse seeks to protect information processed through StudyFlow using safeguards appropriate to the current service. Security controls are being developed and may change as StudyFlow develops.

Multi-factor authentication for researchers and audit logging are not currently implemented. This policy does not represent that encryption at rest, backups, password hashing, or a regular security-update and patching programme have been verified as implemented. Researchers should contact Pathverse at admin@pathverse.ca to confirm the current safeguards before deciding whether StudyFlow is suitable for their Study.

Pathverse personnel may access information only where authorized and reasonably necessary for the purposes described in this policy.

No internet-based service or electronic storage system can guarantee absolute security. Researchers are responsible for evaluating whether the current safeguards meet their Study requirements and for maintaining appropriate security practices, including protecting researcher passwords, protecting Participant access links and tokens, managing access for research staff, and removing access when it is no longer required. Participants should keep access links and tokens confidential and contact their research team if they expire or may have been disclosed to someone else.

19. Security Incidents and Data Breaches

If Pathverse becomes aware of a confirmed security breach involving Customer or Participant Data, Pathverse will notify the affected research organization without undue delay, subject to applicable law and any applicable institutional agreement. The research organization remains responsible for determining whether notifications to Participants, research ethics boards, regulators, or other parties are required in connection with its Study, except where Pathverse has an independent legal obligation to provide notice.

20. Data Retention

During an active Study, research data may be retained according to the requirements established by the researcher or research organization. Pathverse does not determine the research-retention period for an individual Study. StudyFlow does not currently implement a fixed twelve-month post-termination retention period.

Retention and deletion arrangements depend on the applicable service or institutional agreement, research organization instructions, applicable legal requirements, and the technical capabilities available as StudyFlow develops. Researchers should contact Pathverse at admin@pathverse.ca to arrange data retrieval or request deletion and to confirm the applicable timing, including treatment of any backup copies. Termination does not itself guarantee immediate deletion or continued availability for a specified period.

Researchers are responsible for exporting and maintaining copies of research data required for their institutional, research, ethics, regulatory, or archival obligations.

21. Participant Requests to Access, Correct, or Delete Research Data

If a Participant wants to access, correct, withdraw, or request deletion of information collected as part of a Study, the Participant should normally contact the research team or research institution conducting the Study.

This is because the research organization determines why the research data was collected and may be subject to Study-specific ethics, legal, scientific, or retention requirements.

Pathverse generally cannot independently determine whether Study data should be deleted, changed, or retained.

Pathverse will reasonably assist the research organization in responding to appropriate requests where necessary.

admin@pathverse.caRequests specifically concerning Participant access links, tokens, or personal information processed by Pathverse to provide platform access may be directed to Pathverse at admin@pathverse.ca.

22. Researcher Account Access and Deletion

Researchers wishing to close or delete their StudyFlow account should contact Pathverse at:

admin@pathverse.ca

Before an account is deleted, researchers are responsible for exporting any research information they are required to retain.

Account deletion may be subject to applicable retention periods, active Studies, security requirements, backups, institutional agreements, or legal obligations.

23. International Research and Participants

StudyFlow may be used by research teams and Participants located outside Canada. Researchers conducting international research are responsible for determining which privacy, research, health-information, data-protection, consent, and institutional requirements apply to their Study.

Depending on the jurisdiction, Participants may have rights concerning their personal information, including rights of access, correction, deletion, restriction, objection, or data portability.

Where laws such as the European Union's General Data Protection Regulation ("GDPR") apply to a Study, the researcher or research organization is responsible for identifying the appropriate lawful basis for its research processing and satisfying Study-specific transparency, consent, ethics, and regulatory requirements.

Pathverse will reasonably support institutional privacy and data-processing requirements where agreed and may enter into additional data-processing agreements where appropriate.

The standard StudyFlow hosting environment remains in Canada unless another hosting arrangement has been agreed.

24. Participants Under the Age of Majority

StudyFlow may be used in Studies involving children or minors where permitted by the research protocol and applicable requirements.

Pathverse does not verify Participant age when providing access through time-limited links and tokens.

Researchers are therefore responsible for:

determining whether minors are eligible
determining whether parental or guardian permission is required
obtaining consent, permission, or assent where required
providing age-appropriate study information
complying with research ethics, institutional, and legal requirements relating to minors

A Participant’s ability to access StudyFlow does not by itself mean that the Participant has legally or ethically consented to participate in a Study.

25. StudyFlow

StudyFlow is currently a service and may change as features are developed and tested.

Pathverse may update its technical infrastructure, functionality, security controls, service providers, or data-processing practices as StudyFlow develops. Where changes materially affect how personal information is collected, used, or disclosed, Pathverse will update this Privacy Policy and provide additional notice where appropriate.

26. Changes to This Privacy Policy

Pathverse may update this Privacy Policy from time to time.The revised policy will include a new effective date. Where a change materially affects the handling of personal information, Pathverse may provide additional notice through StudyFlow, email, the Pathverse website, or another appropriate method.

27. Contact Us

Questions regarding this Privacy Policy or Pathverse's handling of personal information may be directed to:

Pathverse Inc.
British Columbia, Canada

Email: admin@pathverse.ca

For questions concerning a particular Study, its purpose, recruitment, eligibility requirements, informed consent, research data, withdrawal, or Study-specific privacy practices, Participants should contact the research team conducting that Study.