Glim Privacy Notice

Updated 27 October 2026. This version adds quizzes taken without an account, the Glim Profile, sharing, premium readings and quizzes given through schools, workplaces and local governments.

1. Why this notice exists

Glim is a mental health platform. Almost everything you share with us is sensitive personal information under Philippine law, and some of it is privileged information protected by the confidentiality of the professional relationship. We treat it that way.

This notice explains what we collect, why we collect it, who can see it, how long we keep it, and what you can require us to do with it. It is issued in compliance with Republic Act No. 10173 (the Data Privacy Act of 2012), its Implementing Rules and Regulations, the issuances of the National Privacy Commission, and Republic Act No. 11036 (the Mental Health Act) and its Implementing Rules and Regulations.

Read it before you create an account. If any part of it is unacceptable to you, do not use Glim.

2. Who is responsible for your information

Glim Health Inc., operating the Glim platform, is the personal information controller for the information described in this notice.

For anything concerning your information, write to the Data Protection Officer at privacy@thrivewithglim.com.

Licensed mental health professionals who accept you as a client through Glim are separately responsible, in their own right, for the clinical records they create about you. Section 7 explains how that responsibility is divided.

3. What we collect

3.1 Information you give us

• Account information. Name or preferred name, date of birth, email address, mobile number, password credentials, and your city or region.
• Screening and assessment responses. Your answers to any screening instrument, questionnaire, quiz, check-in, mood check-in, journal entry or intake form you complete on Glim, including answers you give before creating an account. Until you sign in, a reading is linked only to a private link on your device; when you sign in, it moves to your account.
• Your Glim Profile. A handle, a short bio, and your choice for each reading: private, visible to people with your link, or public.
• Institution details. When you take a quiz through your school, workplace or local government's link: the group you choose (for example your year level and section, or your department), whether you agreed to share your result with them, and for learners under eighteen, the confirmation that a parent or guardian agreed.
• Support requests. If you ask your institution's support contact to reach out to you, the name and contact details you type for that purpose.
• Kumusta check-ins and your Tala diary. Your daily light (a level from dim to bright), the word and line you add, your diary entries, the questions you ask Glim to check back on, and your answers. These are private to you. They are never shown to your school, workplace, local government, circle, or other users. Glim personnel never see the text; for safety response they may see that an entry showed signs of distress, and when. Entries you delete are removed for good after thirty days. You can download all of it at any time.
• Free-text you write. Messages to our support team, notes you save, and anything you write to a professional through the platform.
• Professional matching preferences. Language, gender preference, area of concern, schedule, budget range and mode of consultation.
• Payment information. Billing name, transaction records and the last digits and card type retained by our payment processor. We do not store full card numbers on our systems.
• Information you volunteer about other people. If you name a family member, partner or dependent in what you write, that information becomes part of your record.

3.2 Information generated when you use Glim

• Scores, risk indicators, summaries and recommendations produced by our screening and triage tools.
• Appointment history, attendance, cancellations and reschedules.
• Usage data: pages and features accessed, timestamps, session duration.
• Device and connection data: device model, operating system, application version, general location inferred from IP address, and crash diagnostics.
• Communications metadata: when a message was sent and to whom, not read by our staff as a matter of routine.

3.3 Information from professionals

Licensed professionals working through Glim may record consultation notes, treatment plans, referrals and progress observations about you inside the platform.

3.4 Information from other sources

• Payment processors and telecommunications providers, for transaction confirmation.
• Identity and credential verification providers, for professionals only.
• An organisation that sponsors your access to Glim, which may confirm to us only that you are eligible for the benefit it is paying for.

We do not buy personal information from data brokers and we do not scrape social media to build profiles of our users.

4. Sensitive personal information and privileged information

Under the Data Privacy Act, information about your health, including mental health, is sensitive personal information. Information exchanged between you and a licensed professional in the course of a professional consultation may also be privileged information.

We process sensitive personal information only where one of these applies:

1. You have given consent, specific to the purpose, recorded before processing begins, and withdrawable at any time.
2. Processing is necessary for medical treatment, carried out by a professional bound by an equivalent duty of confidentiality, with adequate safeguards in place.
3. Processing protects your life and health, or the life and health of another person, where you are not legally or physically able to give consent.
4. A law or regulation requires it, subject to the guarantees of the Data Privacy Act.

Withdrawing consent stops future processing for that purpose. It does not undo processing already lawfully carried out, and it does not delete clinical records a professional is required to keep.

5. What we use it for

We do not use your mental health information to target advertising to you. We do not sell your personal information. We do not disclose your identified mental health information to any employer, school, insurer or government agency except in the narrow circumstances set out in Sections 8 and 9.

6. Artificial intelligence, and what it does not do

Glim uses artificial intelligence to score screening instruments, summarise what you have written, suggest possible areas of concern, route you to an appropriate professional, and prepare draft notes for that professional to review.

The following limits are commitments, not aspirations:

• AI output is not a diagnosis. Only a licensed professional can diagnose a mental health condition. A screening result is an indication that a conversation is worth having.
• A person decides anything that matters. No decision that materially affects you, including any risk escalation, referral to emergency services, or restriction of your account, is made by an automated process alone. A qualified human reviews it.
• Your content is not used to train third-party foundation models. Where we use external AI providers, we contract for zero-retention processing and for exclusion of your content from provider model training.
• Improvement of our own models uses de-identified data. Where we use your information to improve accuracy, direct identifiers are removed first and the data is handled in aggregate.
• Diary reflections happen only when you ask. When you tap "Ask Glim to reflect" on a Tala entry, the text of that one entry (and your first name, if you gave one) is sent to the AI provider we use at the time to write a short reflection. Nothing else is sent: no other entries, no readings, no contact details. We choose providers that do not keep the text after answering where that option exists and that do not use it to train their models. Before anything is sent, the entry is checked for signs that you may be in danger; if it shows them, it is not sent at all and you see people who can help instead. If the AI is unavailable or its reply does not meet our safety checks, you get a written reflection prepared by Glim. A reflection is not advice or a diagnosis.
• You can object. You may object to automated processing of your information, in which case we will either process it manually or tell you plainly which features become unavailable.

7. Who can see your information

The professional you choose. When you book a consultation, the professional receives your relevant history, screening results and notes. Professionals cannot browse the records of clients who are not theirs.

Glim personnel, on a need to know basis. Access to clinical content is restricted to a small number of authorised personnel, is logged, and is permitted only for support, safety response, technical fault resolution or investigation of a complaint. Every person with access is bound by a confidentiality undertaking that survives their engagement.

Service providers acting on our instruction. Cloud hosting, communications infrastructure, payment processing, analytics, customer support tooling and AI processing. Each is engaged under a written agreement that limits them to our documented instructions, requires security measures at least equivalent to ours, prohibits use of your information for their own purposes, and requires deletion or return on termination.

An organisation that sponsors your access. If an employer, school or other organisation pays for your access to Glim, that organisation receives utilisation and wellbeing reporting in aggregate only. It does not receive your name, your screening results, your session content, the identity of your professional, or any figure derived from a group small enough to identify you. Whether you used the service at all is not reported at the individual level.

Quizzes given through your institution. When you take a quiz through a link from your school, workplace or local government, the institution sees group totals only. A group smaller than the minimum set for that quiz, never fewer than three people, is combined with others or shown as a count only. Your written answers never appear in what the institution sees. Two exceptions apply, and only with your choice: (a) for schools, and for quizzes that are not about mental health, the join screen may ask whether you agree to share your own result with the institution, and it is shared only if you say yes; (b) if you ask the institution's support contact to reach out, they receive the name and contact details you type, never your answers. Reports to institutions are prepared under the supervision of a licensed psychologist or psychometrician. Your own reading is always yours to see.

People you choose to share with. Readings are private by default. If you share a reading, the share page shows its headline only, never your answers or scores. If you make a reading public on your Glim Profile, anyone with the profile link can see that reading's headline and summary. A reading that showed signs of distress cannot be shared, and readings about mental health cannot be made public on a profile. When someone takes a quiz from your share, we count it so we can show you how many friends took it; we do not tell you who they are or what they got.

Kasama circles. A circle is a private group of up to six people you invite. Members see your first name and last initial, and, if you choose to share it, only the color of your light check-in for today. They never see your readings, your diary, the words you write, or your email. You can stop sharing your light, leave a circle, or remove someone at any time, and they stop seeing you at once. Kumustas (short messages between members) are kept for the members they were sent between. A note that suggests someone may be at risk is not delivered as written; a plain kumusta is sent instead. If you turn on dim alerts for a circle, and only then, the other members get one gentle note to check on you when your light has been dim for a few days in a row. They are never told why.

The wall. Notes on the wall are anonymous to everyone who reads them. We keep who wrote each note so we can enforce the community rules, limit posting and keep people safe; moderators see a coded tag, not your name. Every note is read by a moderator before it shows. A note that suggests the writer may be at risk is never published, and the writer is shown support lines. Candles and reports are counted, not shown with names.

Successors in a corporate transaction. If the business is merged, acquired or reorganised, information may transfer to the successor entity, which remains bound by this notice until you are given notice of any change and, where required, asked for fresh consent.

No one else, unless Section 8 or Section 9 applies.

8. When confidentiality has limits

Confidentiality is the rule. These are the exceptions, and they are narrow:

1. Imminent risk of serious harm. Where there is a clear and present danger to your life or to the life or safety of another person, we or your professional may disclose the minimum information necessary to emergency services, a crisis facility, or a person in a position to help, including a contact you have nominated.
2. Harm to a child or a vulnerable person. Where disclosure is required by laws protecting children and vulnerable persons from abuse, exploitation and neglect.
3. Lawful orders and legal process. Where a court order, subpoena or other legally enforceable demand requires disclosure. We assess every demand, refuse those that are defective or overbroad, disclose only what is required, and notify you unless we are legally barred from doing so.
4. Establishing or defending a legal claim. Where necessary and proportionate for legal proceedings involving you and us.

Where a disclosure is made under this section, we record what was disclosed, to whom, when, and on what basis, and that record is available to you on request.

9. If you are at risk right now

Glim is not an emergency service and does not provide crisis intervention in real time.

If you or someone else is in immediate danger, contact emergency services on 911, or the National Center for Mental Health Crisis Hotline:

• 1553 (Luzon-wide landline, toll free)
• 0917 899 8727 (Globe or TM)
• 0966 351 4518 (Globe or TM)
• 0908 639 2672 (Smart, Sun or TNT)

These lines operate 24 hours a day.

10. Where your information is stored and processed

Your information is hosted on secured cloud infrastructure. Some of our service providers process information outside the Philippines.

Where information leaves the country, it remains under our accountability. We use written contracts imposing the standards of the Data Privacy Act on the recipient, we assess the recipient's security posture before engagement, and we remain answerable to you and to the National Privacy Commission for what happens to it.

11. How long we keep it

At the end of the applicable period, information is securely deleted or anonymised beyond re-identification. Where a legal hold, investigation or pending claim applies, the affected records are retained until the matter concludes.

12. How we protect it

Organisational. A designated Data Protection Officer, reachable at the address in this notice. Our registration with the National Privacy Commission is being completed. Privacy impact assessments before new processing, confidentiality undertakings for personnel and contractors, privacy training when people join, and a written incident response plan.

Technical. Encryption of information in transit and at rest, role based access control with least privilege, multi factor authentication for all staff and professional accounts, segregation of clinical data from analytics environments, logging of every access to clinical content, monitoring for unusual access, regular vulnerability checks and patching. We plan independent penetration testing as the service grows.

Physical. Our hosting providers run their own security-certified data centres with controlled access. Our own workstations are secured, and media is disposed of safely.

No system is absolutely secure. What we commit to is a standard of protection proportionate to the sensitivity of mental health information, which is the highest standard we apply to anything.

13. If a breach happens

If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we notify the National Privacy Commission and the affected users within seventy two hours of knowledge of the breach, as required by law.

The notification tells you what happened, what information was involved, what we have done about it, what we recommend you do, and how to reach our Data Protection Officer. We do not delay notification to complete an investigation.

14. Your rights

Under the Data Privacy Act you have the right to:

• Be informed that your personal information is being processed, and of the purpose, scope, recipients and retention period.
• Access a copy of your information held by us, in an intelligible format, together with the reasons for processing and the identity of recipients.
• Object to processing, including automated processing and direct marketing, and to withdraw consent previously given.
• Correct information that is inaccurate, incomplete, outdated or misleading, and require us to inform recipients of the correction.
• Erasure or blocking of information that is unlawfully obtained, no longer necessary, or processed in violation of your rights, subject to records we are legally required to keep.
• Data portability, meaning a copy of your electronically processed information in a commonly used, machine readable format.
• Damages for inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your information.
• Lodge a complaint with the National Privacy Commission.

How to exercise them. Write to the Data Protection Officer at privacy@thrivewithglim.com. We verify your identity before acting, so that no one can exercise your rights in your name. We respond within fifteen calendar days. Where a request is complex, we tell you within that period why more time is needed and when to expect the outcome. There is no charge unless a request is manifestly excessive or repetitive, in which case we tell you the cost before proceeding.

If you are not satisfied. You may bring the matter to the National Privacy Commission, 25th to 27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103, email info@privacy.gov.ph, telephone +632 5322 1322, or through privacy.gov.ph.

15. Minors

Glim is intended for users eighteen years of age and older.

A person aged fifteen to seventeen may use Glim only where a parent or legal guardian has given documented consent through our verified consent process and a licensed professional has accepted the engagement. In that case, the parent or guardian exercises the rights in Section 14 on the minor's behalf, subject to the minor's right to have certain matters kept confidential from the guardian where a professional judges disclosure to be contrary to the minor's welfare and the law permits it.

Quizzes through a school. A learner aged fifteen to seventeen may take a quiz given by their school through Glim when the school has obtained the consent of a parent or guardian and the learner confirms that consent and gives their own agreement on the join screen. The school sees group totals only, unless the learner agrees to share their own result with the school's guidance office. Learners under fifteen take part only through a process the school runs with parents directly, and may not create a Glim account.

If we learn that we hold information about a person under fifteen, or about a minor without valid guardian consent, we stop processing and delete the information, except where doing so would compromise the minor's immediate safety.

16. Cookies and similar technologies

Today, Glim uses only strictly necessary cookies and similar storage in your browser: to keep you signed in, secure your session, and remember choices you make, such as your language. These work without consent because the service cannot function without them.

When you arrive through a link with a campaign tag (for example from a post or an ad), we note that tag with your visit so we can tell which invitations reach people. It is never sold and never used to show you advertising.

We do not use analytics or advertising cookies, and we do not permit third party advertising trackers on Glim. If we add analytics, we will ask for your consent first.

Reminders and notifications. Glim sends nothing to your phone or email until you turn it on in your reminder settings. If you turn on phone notifications, we store the address your browser gives us for that device (a push endpoint and its encryption keys), the device type, and when we last reached it. If you turn on email reminders, we use the email on your account. We also store your chosen times, quiet hours and timezone, and a record of each notice we sent, so nothing is sent twice. Notifications never contain your answers, readings or diary entries. You can turn any of this off at any time in your reminder settings, remove a device there, block notifications in your browser, or use the link at the bottom of every reminder email.

17. Changes to this notice

We update this notice when our processing changes.

For a material change, meaning any change in purpose, in the categories of recipients, or in your rights, we notify you at least fifteen days before it takes effect, and where the change requires it, we ask for fresh consent rather than assuming it from continued use.

18. Contact

Office of the Data Protection Officer Glim Health Inc. privacy@thrivewithglim.com

Every enquiry about your information is handled by the Data Protection Officer, not by a general queue.