1. What we collect
- Account & role — name, email, password (hashed), and whether you're a mentee, mentor, or both.
- Profiles — a private mentee profile (school, stage, goals) or a public mentor profile (career, specialty, location, bio, optional photo).
- Verification info — mentors' LinkedIn URL and, for physicians, an NPI.
- Introductions — the subject and message you send, and delivery metadata.
- Quiz & AI — your quiz answers/results if you're signed in, and the messages you send to the AI Career Guide (see §5).
- Operational — referral attribution and security logs (e.g. IP for rate-limiting).
2. How we use it
We use this information to run the directory, verify eligibility and mentor identity, deliver introductions, provide the optional quiz and AI tools, keep the Service secure, and comply with the law. We do not sell or share your personal information for advertising.
3. Age & birth date
This MVP is for U.S. adults 18 and older. We process an exact birth date once at registration only to compute eligibility, then retain only a verification timestamp and the age-gate version — the birth date itself is discarded.
4. One-way introductions
When a mentee contacts a mentor, the mentor receives the mentee's verified email, message, and a link to the mentee's private profile. The mentor's email is never disclosed to the mentee. Any reply and all further communication happen over regular email, outside Health Mentors, and are not hosted or monitored by us.
5. Quiz & AI Career Guide data
If you take the career quiz while signed in, your answers and generated results are saved to your account so you can return to them and so the AI Career Guide can ground its responses on them. If you're not signed in, quiz results are not stored on our servers. Messages you send to the AI Career Guide are processed by a third-party AI provider to generate a response; do not enter sensitive personal, medical, or confidential information.
6. How long we keep it
| Data | Retention |
|---|---|
| Account & profiles | Until you delete your account (or we remove it). |
| Birth date | Discarded at registration; only a verification timestamp is kept. |
| Introduction message body | Available to authorized staff for 90 days, then auto-erased. |
| Delivery metadata | Retained for security, rate-limiting, and aggregate reporting. |
| Quiz results (signed-in) | Until you delete them or your account. |
| AI conversations | Kept in your account until you delete the conversation or account. |
| Security logs | Short-term, for abuse prevention. |
7. Service providers (sub-processors)
We rely on a small set of vendors that process data only as needed to operate the Service:
- Railway — application and database hosting (United States).
- PocketBase — the database/auth layer running on our hosting.
- Resend — transactional email (verification, introductions).
- Google (Gemini) / OpenAI — the AI model behind the AI Career Guide, which processes the messages you send it.
8. Cookies & sessions
We use a first-party authentication token to keep you signed in. We do not use third-party advertising or cross-site tracking cookies.
9. Verification
Approved mentor profiles undergo manual LinkedIn review and, where required, public NPI Registry review. This limited review confirms that submitted public information was reviewed — it is not a background check, endorsement, or guarantee.
10. Security
Passwords are hashed, access to message content is limited to authorized staff, and profile data is protected by per-record access rules (for example, a mentee's private profile is visible to a mentor only after that mentee initiates contact). No system is perfectly secure, but we aim to collect little and protect what we hold.
11. Your rights
You can request access to, correction of, or deletion of your personal information, subject to legitimate security or legal retention needs. Depending on where you live (for example under the CCPA/CPRA), you may have additional rights; note that we do not sell or share your personal information. To make a request, use the contact page.
12. Children
The Service is for adults 18 and older. We do not knowingly collect personal information from minors; if we learn we have, we will delete it.
13. Changes
We may update this notice; we'll revise the “last updated” date and, for material changes, provide reasonable notice.
14. Contact
Privacy questions or requests? Reach us through the contact page.