Privacy Policy

1. Information Collected

Website visitors

The website uses Vercel Web Analytics, which collects aggregated, anonymized information about site traffic. This includes pages visited, referring websites, country of origin, device type, browser, and operating system. Vercel Web Analytics does not use cookies and does not track individuals across websites. No personally identifying information is collected through analytics.

The website stores one item in browser local storage: a flag confirming the visitor is 21 or older, used to remember the result of the age verification gate. This flag does not identify the visitor and is not transmitted off the visitor's device.

No other cookies, tracking pixels, session replay, or behavioral analytics are used.

Prospective clients

When a prospective client submits the contact form, the following information is collected: name, email address, and the message content. Form submissions are processed by Formspree, a third-party form service, and delivered to mackenzie@pliablepathways.com. Formspree retains submissions in accordance with its own data retention practices.

When a prospective client schedules a consultation through the Calendly booking widget, the following information is collected: first name, last name, email address, phone number, and any information voluntarily provided in the optional concerns field. This information is stored in the Calendly platform and visible to me through my Calendly account.

Clients

Before beginning services, each client completes an intake document through DocuSign. The intake collects sensitive personal and medical information necessary for evaluating candidacy for psilocybin services and providing those services safely. Categories of information collected include:

• Identifying information including legal name, contact information, date of birth, and address
• Emergency contact information
• Medical history including conditions, surgeries, and hospitalizations
• Mental health history including diagnoses and prior treatment
• Current medications and supplements
• Substance use history
• Family medical and mental health history
• Trauma history
• Pregnancy status, where applicable
• Allergies
• Intentions for the work

During and after sessions, I maintain practitioner notes documenting dosage, timing, observed reactions, and items relevant to integration. Practitioner notes are recorded in a handwritten notebook and transferred to a password-protected, encrypted laptop. A separate set of session notes is provided to the client in physical form to take with them.

Between sessions, communication with clients may occur through email at mackenzie@pliablepathways.com or by phone or text message at my personal phone number.

Clients using the mobile app

Clients may use the Pliable Pathways mobile application, available through the Apple App Store, to support the integration period that follows a psilocybin session. The following information is collected through the app:

• Account information.I create each client's account using their name and email address and an initial password. Passwords are stored only in encrypted (hashed) form and are never visible to me.
• Schedule information. Journey date, preparation and integration session dates, timezone, and a chosen daily reminder time.
• Private reflective content. The intentions, motto, and journal entries a client writes in the app. This content is private to the client. The app uses database access controls so that it is readable only by the account that created it; it is not accessible to me or to any other client.
• Practice activity.Whether a client completed each day's practice, and any request sent through the in-app support button. Whether a day was completed — never its written content — and support requests are visible to me so I can offer timely support.
• Daily check-ins. Each day the app invites the client to rate their overall wellbeing, sense of connection, and, on days with a practice, how useful that practice felt, on a 0–10 scale. These ratings are always visible to the client in the app. They become visible to me only if the client opts into research, described below.
• Notification token. If a client enables notifications, the app stores a device token used to deliver reminders. Notifications are delivered through the Expo push service and the Apple Push Notification service.

Separately, and only with a client's explicit opt-in consent, the app collects information for research intended to improve integration support for future clients. Research participation is entirely voluntary, is turned off by default, does not affect a client's care in any way, and can be turned off at any time in the app's settings. When a client opts in, the following may be collected:

• Demographic information the client chooses to provide: age range, gender, race or ethnicity, and prior experience with psychedelics. Every field is optional. Race or ethnicity is treated as sensitive information and is used only in aggregate.
• The daily check-in ratings described above.
• App usage information: the days the client opens the app and the general time of day — morning, afternoon, evening, or night, in the client's own timezone. Exact timestamps are not stored.
• A short end-of-period reflection, including a rating of how supported the client felt and any optional written comment.

Demographic and survey information is presented to me only in combined, de-identified form that does not identify any individual. For clients who opt in, the daily check-in ratings are also visible to me for that individual client, as part of supporting their integration.

2. How Information Is Used

Information is used solely for the following purposes:

• Operating and improving the website
• Responding to inquiries submitted through the contact form
• Scheduling and conducting consultations
• Evaluating candidacy for psilocybin services
• Providing psilocybin services safely and effectively
• Supporting integration after sessions
• Operating the mobile app and supporting integration between sessions
• Communicating with clients about their care
• With a client's opt-in consent, conducting aggregate research to understand and improve integration support
• Complying with applicable law

Information is not used for marketing, advertising, profiling, or any purpose unrelated to providing services. Information is never sold.

3. How Information Is Shared

I do not sell personal information.

Information is shared only with the third-party service providers necessary to operate the practice. These providers process information on my behalf and are bound by their own privacy practices:

• Vercel hosts the website and provides anonymized analytics
• Formspree processes website contact form submissions
• Calendly provides the consultation scheduling system
• DocuSign provides the intake document platform
• Google Workspace provides email service for mackenzie@pliablepathways.com
• Supabase provides the database and backend hosting for the mobile app
• Expo and Apple deliver push notifications for the mobile app, and Apple distributes the app through the App Store

I do not share client information with referral partners. When a client is referred to an outside provider such as Spirit Pharmacist for a medication consultation, the client books and communicates with that provider independently. The client may, at their sole discretion, choose to share a recording or summary of an outside consultation with me, but no information flows from me to outside providers without the client's direct action.

I may disclose information without consent only when required by law, such as in response to a valid court order or subpoena, or when disclosure is necessary to prevent imminent harm to the client or others.

4. How Information Is Protected

I take reasonable measures to protect information against unauthorized access, disclosure, alteration, or destruction. Specific protections include:

• The website transmits all data over encrypted HTTPS connections
• The DocuSign account where intake documents are stored is secured with two-factor authentication and accessible only by me
• The Google Workspace account used for client communication is secured with two-factor authentication
• The laptop where electronic practitioner notes are stored is secured with biometric login and full-disk encryption
• The mobile phone used for client communication is secured with biometric login
• Handwritten practitioner notes are kept in my sole possession
• Mobile app information is stored with Supabase and transmitted over encrypted HTTPS connections, and the app uses database row-level security so that each client's private content — including journal entries, intentions, and motto — is readable only by their own account and is not accessible to me or to any other client
• I am the only person with access to any account, device, or location where client information is stored, other than each client's own access to their own app account

No method of electronic transmission or storage is perfectly secure. While I take reasonable precautions, I cannot guarantee absolute security of any information transmitted to or stored by me or by the third-party providers listed in Section 3.

5. How Long Information Is Kept

Different categories of information are retained for different periods.

Website analytics data is retained by Vercel according to its own retention practices, typically a rolling window of recent traffic.

Contact form submissionsare retained in the mackenzie@pliablepathways.com inbox and on Formspree's servers. Submissions that do not lead to engagement are retained for up to two years and then deleted.

Calendly booking information is retained in the Calendly platform for the duration of the account.

Client intake documents and practitioner notes are retained for seven years following the final session with the client. This retention period aligns with record-keeping standards in the counseling profession and supports continuity of care should a client return for additional services. After seven years, records are deleted from DocuSign and from any electronic notes on the practitioner laptop. Handwritten notebooks containing notes are destroyed once their contents have been transferred to electronic records.

Client communication records including emails and text messages are retained for the duration of the working relationship and for up to two years following the final session, after which they are deleted.

Mobile app information— including account details, schedule information, journal content, daily check-ins, and any research information — is retained for as long as the client uses the app. A client may permanently delete their account and all associated app data at any time from within the app's settings; this deletion is immediate and cannot be undone. If a client turns off research participation without deleting their account, no further research information is shared and their previously collected research information is excluded from research results.

A client may request earlier deletion of their records at any time. See Section 6.

6. Your Rights Under Colorado Law

The Colorado Privacy Act provides Colorado residents with the following rights regarding personal information:

• Right of access. You may request confirmation of whether I process your personal information and request a copy of the information I hold about you.
• Right of correction. You may request correction of inaccurate personal information.
• Right of deletion. You may request deletion of your personal information, subject to limited exceptions where retention is required by law.
• Right to data portability. You may request a copy of your personal information in a portable, machine-readable format where technically feasible.
• Right to opt out. You may opt out of the processing of your personal information for the purposes of targeted advertising, the sale of personal information, or profiling that produces legal or similarly significant effects. I do not engage in any of these activities, so this right applies only as a matter of disclosure.

To exercise any of these rights, contact me at mackenzie@pliablepathways.com. I will respond to verifiable requests within forty-five days, with a possible extension of an additional forty-five days where necessary and where you have been notified of the extension.

If I deny a request, you have the right to appeal. To appeal a denial, reply to my response with the word “Appeal” and the basis for the appeal. I will respond to appeals within forty-five days. If your appeal is denied, you may contact the Colorado Attorney General at coag.gov to submit a complaint.

I will not discriminate against you for exercising any of these rights.

7. How to Exercise Your Rights

To exercise any of the rights described in Section 6, send a written request to mackenzie@pliablepathways.com with the subject line “Privacy Request.” Include the following in your request:

• Your full name and the email address or phone number associated with your interaction with Pliable Pathways
• A description of the right you are exercising and the information your request concerns
• Sufficient information for me to verify your identity, which may include responding to follow-up questions confirming details only you would know

I will acknowledge receipt of your request within ten business days and respond substantively within forty-five days. If I require additional time, I will notify you of the extension within the initial forty-five-day period.

There is no fee for exercising your rights, except where requests are manifestly unfounded, excessive, or repetitive, in which case I may charge a reasonable fee or decline to act on the request.

8. Children's Privacy

Pliable Pathways services are available only to adults aged 21 and older, in accordance with Colorado's Natural Medicine Health Act. The website displays an age verification gate that requires confirmation of age before content can be accessed. Visitors who indicate they are under 21 are redirected away from the site.

I do not knowingly collect information from anyone under the age of 21. If you believe a person under 21 has provided information through the website or otherwise, contact me at mackenzie@pliablepathways.com and I will delete the information.

9. Changes to This Policy

I may update this policy from time to time to reflect changes in my practices, services, or applicable law. The effective date at the top of this policy will be updated when changes are made.

For material changes that affect how I collect, use, or share information, I will provide notice through the website and, where I have an active relationship with you, by direct communication.

Continued use of the website or services after changes take effect constitutes acceptance of the updated policy.

10. Contact

If you have questions, concerns, or requests regarding this privacy policy or how your information is handled, contact: