EDDI ("we" or "us" or "our") operates the EDDI mobile application (the "Service"). This policy explains what we collect, why, how long we keep it, and your rights. It's written to meet Quebec's Law 25 (and equivalent privacy law in any other jurisdiction we operate in).
Plain-language version of this same content is shown in-app during onboarding (the "Before you start" step).
Who We Are
What We Collect
When you use EDDI we collect:
- Your date of birth — used only to compute your age band (12–14, 15–17, 18+) so EDDI's tone and consent path match your age. We don't store the full date in a way that identifies you.
- Your school name — if you choose to enter or select it.
- Your access code — issued by the partner organisation that invited you (e.g. MDJ Anjou).
- Your messages — the things you send to EDDI and the replies EDDI gives.
- Your consent choices — which of the per-purpose toggles you've turned on or off.
- Anonymous usage events — only when you've left the "Anonymous usage analytics" toggle on. Includes onboarding step, language, age band, school, and event names like
chat.message_sent (counts only — never the message content).
We do not collect: your name, your email, your phone number, your address, your school's email or roll, biometric data, or anything that lets us identify you personally.
Why We Collect It
- Service delivery — to give you a working chat companion (required; can't be turned off if you want to use EDDI).
- Safety routing — to point you to the right local helplines if your wellbeing seems at risk.
- Anonymous usage analytics — to see which features are used, where users drop off in onboarding, which schools are joining the pilot. Aggregated, never linked to you. You can turn this off.
- Help improve EDDI — to let us review anonymised chats to improve EDDI's responses. You can turn this off.
- Updates and news — only if you opted in. Off by default.
Who Receives Your Data
- Anthropic (United States) — your messages, to generate AI replies. Subject to a documented cross-border transfer assessment under Law 25 §17.
- Microsoft Azure Speech (Canada Central) — your voice audio if you use the microphone. Stays in Canada.
- Microsoft Application Insights (Canada Central) — anonymous event data, only when analytics consent is on. Stays in Canada.
- AWE Digital Wellness staff — only for support, safety review, or compliance investigations. No name or identifying data is attached.
We do not share data with your school, your parents, advertisers, or third parties outside the list above.
How Long We Keep It
- Chat messages: configurable — default 1 year (so EDDI can pick up where you left off across a school year), then auto-deleted from your device. Change in About → Memory (30 days, 90 days, 1 year, or keep forever). Server-side mirror (when our backend is live) follows the same per-user window.
- Anonymous usage events: up to 18 months in Application Insights, then auto-purged.
- Consent ledger: 7 years (regulator audit window).
- Account metadata (DOB band, locale, age band, anonymous device id): until you delete your account, plus a 30-day backup window.
Your Rights (Law 25 §§ 27–28)
You can:
- See the data we hold about you — ask via the in-app "Request my data" button or by emailing privacy@awedigitalwellness.com.
- Correct anything that's wrong.
- Export your data in a machine-readable file.
- Delete your account and all associated data — use the "Delete my account" button in the About screen.
- Withdraw consent at any time — flip any of the per-purpose toggles in the About screen.
- Ask a human to review an AI reply — email privacy@awedigitalwellness.com.
We will respond within 30 days of your request.
How We Keep It Safe
- All data in transit uses HTTPS.
- Anonymous device identifiers — never linked to real names.
- Consent is recorded with timestamp and version so we can prove what you agreed to.
- Confidentiality incidents (data breaches) that present a risk of serious injury are reported to Quebec's Commission d'accès à l'information (CAI) and to affected users without delay.
Children
EDDI is built for K–12 and university students. Users under 14 access EDDI through a partner organisation (e.g. MDJ Anjou) that obtains parental consent offline before issuing an access code. We do not allow direct sign-up for users under 14 without a code.
Changes to This Policy
If we make material changes, we'll prompt you to re-consent on next launch. Significant changes get an updated consent_version so we can tell who consented under which version.