Pathem operates this service. This notice explains how we use information in the Pathem app and patient website. For privacy questions or requests, contact tech@pathem.health.

Information we use

We use your account details, information you choose to record, personal tasks and notes, check-in answers, and relevant technical information needed to operate and secure the service. If you connect a device health service, we use only the data types explained in its permission and consent screens.

Google calendars and optional contact photos

Calendar connection is optional and read-only. We identify your connected Google account and import events only from calendars you select. We store event titles, dates, times, timezones, source links and, when you agree to the updated attendee consent, attendee names and email addresses. We do not import event descriptions or attachments, edit Google events, or access Gmail messages.

If you separately enable attendee photos, we request read-only Google Contacts access. We read contact email addresses and photo links to match meeting attendees. We keep only matching attendee photo links, not a copy of your address book. Photos may be unavailable; initials are used instead.

Google credentials are encrypted and kept on the server. We use Google data only to provide these features. We do not sell it, use it for advertising, or use it to train AI models. We follow the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring Google data.

Google API Services User Data Policy

Privacy and sharing

Personal calendars, attendee information and tasks remain private to your account, including tasks labelled Care. They are not shared with clinicians. Check-in sharing is separate: enabling it gives your currently assigned clinician access to your past and future check-ins. You can turn it off. If your assigned clinician changes while sharing is enabled, access transfers to the new clinician and ends for the previous clinician.

We use service providers for hosting, authentication and, where enabled, messages and other requested features. They receive only information needed for their role. We may disclose information where legally required or necessary to protect the service. Where your clinic maintains a clinical record through Pathem, the clinic is responsible for its clinical use and retention of that record.

Why we use information

We use account and service information to provide the features you request, support your account and keep the service secure. Our legal bases include providing our service under a contract and legitimate interests in security and support. Optional integrations and consent-based sharing depend on your consent. Your clinic can explain the legal basis and health-data safeguards for processing its clinical records.

Retention and disconnecting

Calendar imports cover a short rolling window around today. The last successful cache may remain during a sync failure. Deselecting a calendar deletes its imported events; disconnecting an account deletes its calendar selections, events and attendee data. If Google access cannot be revoked immediately, an encrypted token may remain solely to retry revocation. Retries are limited to 24 hours; the token is removed when revocation succeeds or expired-token cleanup runs. We keep consent and necessary security records to demonstrate and protect these choices.

We retain other account information while needed to provide the service. You can request deletion by emailing us. Legal, security or clinical-record obligations may require some information to be retained; we will explain this when handling your request. Records held by your clinic may have a separate retention period.

Your choices and rights

You can disconnect Google accounts in Settings and withdraw optional permissions or check-in sharing. Withdrawal does not affect processing that was lawful before it. Depending on applicable law, you may request access, correction, deletion, restriction, objection or a portable copy of your information. Contact tech@pathem.health; we may need to verify your identity. You can complain to your local data-protection authority, including the UK Information Commissioner's Office.

Contact the ICO

Security, transfers and updates

We use access controls, secure connections and encrypted credentials to protect information. Providers may process information outside your country; where required, appropriate contractual or other legal safeguards apply. We use essential account and security storage to operate the website. We will update this notice when the service changes and ask for fresh consent where it is required.

tech@pathem.health