Privacy Policy (UK)

Pocket Mentor AI Pty Ltd ACN (688 328 163) (Pocket Mentor, we, us or our) is committed to protecting your personal information.

This Privacy Policy explains how we manage personal information and how to contact us if you have any further queries about how we do this. This Policy does not apply to how we handle personal information about our employees.

Background

We provide a platform (Platform) for our clients (Clients) via the Pocket Mentor mobile application (App) or our website. A Client is a person who signs up to or joins our Platform through a registration process via the App or via our website. The Platform gives our Clients empowering values-based guidance that fosters personal growth, emotional clarity, and self-leadership (Services).

In undertaking our functions and activities we may handle personal information about Clients and other individuals (together, you). We comply with the Data Protection Act 2018 (DPA 2018) and the UK GDPR except where the Law does not require this. The Laws regulate how to handle personal information throughout its life cycle, from collection to use and disclosure, storage, accessibility and disposal.

Personal information is information or an opinion, in any form and whether true or not, about an identified individual or an individual who is reasonably identifiable. Special rules apply for collecting personal information which is sensitive information (Special Category Information). This includes health information and information about a person's race, ethnic origin, political opinions, membership of political, professional or trade associations, religious or philosophical beliefs, sexual orientation or practices and criminal history.

The kind of personal information we collect and hold

If you are not a Client, the personal information we collect and hold will depend on why we are dealing with you.

If you are a Client, we will generally collect one or more of the following items of personal information:

• Personal Identifiers: your name and contact details including postal and email address and telephone number.
• Coaching Inputs: information you share with the Platform (e.g., journal entries, reflections, goals).
• Survey or Feedback Data: if you voluntarily participate in surveys or provide feedback.
• Your position.

If you access our website, we will collect usage data that may or may not constitute personal information. That data includes device type, browser, IP address, pages visited, and actions taken on the site.

How we collect and hold personal information

To the extent required by the Law:

• we will not collect personal information about you unless that information is reasonably necessary for one or more of our functions or activities; and
• we will collect personal information only by lawful and fair means.

When we collect personal information directly from you, we will take reasonable steps at or before the time of collection to ensure that you are aware of certain key matters, such as the purposes for which we are collecting the information, the organisations (or types of organisations) to which we would normally disclose information of that kind, the fact that you are able to access the information and how to contact us.

The purposes for which we handle personal information

General

In general, if we use or disclose your personal information for a purpose (the "secondary purpose") other than the main reason for which it was originally collected (the "primary purpose"), to the extent required by the Law, we will ensure that:

• the secondary purpose is related to the primary purpose of collection (and directly related in the case of sensitive information), and you would reasonably expect that we would use or disclose your information in that way;
• you have consented to the use or disclosure of your personal information for the secondary purpose;
• the use or disclosure is required or authorised by or under law; or
• the use or disclosure is otherwise permitted by the Law (for example, as a necessary part of an investigation of suspected unlawful activity or if it is unreasonable or impracticable to obtain your consent and the use or disclosure is necessary to lessen or prevent a serious threat to life, health or safety).

The purpose for which we use your personal information depends on why we have collected your personal information.

If you are Client, we will use your personal information to give you access to the Platform and provide the Services. This includes:

• providing and personalising coaching insights and Platform interactions;
• improving our Services based on user engagement and feedback;
• communicate with you regarding updates, new features, or support; and
• maintaining the security and integrity of our systems.

Use of Generative AI and other automated decision-making

Generative AI

We use generative artificial intelligence technology (AI) to deliver certain aspects of our Services, including facilitating Platform interactions. The AI functionality that we use is provided by our service providers, including by OpenAI, L.L.C., (OpenAI) which provides us with OpenAI's ChatGPT Enterprise service for businesses (ChatGPT Enterprise).

When you interact with our Platform, including through written messages, voice conversations or video conversations, the applicable data (Input) will be handled by OpenAI and its contractors to generate responses and insights tailored to your needs (Output). Under our agreement with OpenAI as of 1 December 2025, OpenAI states that it will only use Input and Output as necessary to provide us (and you as our end user) with its services that we in turn use to provide you with the Services, comply with applicable law, enforce OpenAI policies, and prevent abuse.

OpenAI has indicates that it handles your personal information for the purpose of providing and supporting the services that it provides to us (which in turn enables us to provide Services), in a manner that provides no less than the level of privacy protection required of it under applicable data privacy and data protection laws.

However, ChatGPT Enterprise's data handling practices are subject to change from time to time. While we will monitor these changes, please note that we may be required to accept updated terms in order to continue providing the Services to you. In this event, we will update our privacy policy.

Automated decision-making

This section of the policy applies if:

• we have arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and
• the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
• personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.

At present, the Platform does not include automated decision-making.

If the Platform is developed to includeany automated decision-making, we will update this policy to include information about:

• the kinds of personal information used in the operation of such computer programs; and
• the kinds of such decisions made solely by the operation of such computer programs; and
• the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.

Marketing

We may use your personal data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services and offers may be relevant for you (we call this marketing).

• You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing.
• We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

Opting Out of Marketing: to unsubscribe from marketing emails at any time, please click on the unsubscribe link at the bottom of any marketing email. You may also contact us or the third party directly if you do not wish to receive any marketing materials from us or them.

Sharing your personal data

Depending on how and why you provide us with your personal data we may share it in the following ways:

• we may share your personal data with any member of our company group, which means our subsidiaries, our ultimate holding company and its subsidiaries;
• with selected third parties to which we sub-contract to provide various services and/or aspects of the Platform's functionality, including the providers expressly discussed in this policy; and
• with analytics and search engine providers that assist us in the improvement and optimisation of this Platform.

We may also disclose your personal data to third parties in the following events:

• if we were to sell or buy any business or assets, in which case we might disclose your personal data to the prospective seller or buyer of such business or assets as part of that transaction;
• if Pocket Mentor or substantially all of its assets are acquired by a third party, in which case personal data held by us about our customers and contacts will be one of the transferred assets;
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or if we are asked to provide your details to a lawful authority in order to aid in the investigation of crime or disorder; and/or
• in order to enforce or apply the Platform's terms of use or terms and conditions of sale; or to protect the rights, property, or safety of our company, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Other service providers

We may disclose your personal information to other service providers over and above OpenAI (for example, MailChimp) to facilitate our provision of the Services or otherwise in connection with our functions and activities.

MailChimp's privacy policy (available at https://www.intuit.com/privacy/statement/) explains more about how it handles personal information that is obtains in the course of providing services to us.

Our legal obligations

We shall:

• make sure that the personal information that we collect, use and disclose is accurate, complete, and up to date;
• take technical and organisational measures that are reasonable in the circumstances to protect the personal information that we hold from misuse, interference and loss and from unauthorised access, modification or disclosure;
• destroy or permanently anonymise personal information that is no longer needed for any purpose; and

Transfer of personal information overseas

We do not presently transfer your personal information to overseas recipients (although our service provider MailChimp may do so). If we transfer personal information to overseas recipients, we will update this policy to include further information and we will take steps to ensure that your rights are no less protected by any overseas recipient with which we share your personal information.

Access and correction of your personal information

Please contact us at [email protected] if you would like to access or correct the personal information that we hold about you.

We will take steps to amend any personal information that you advise us is incorrect.

Questions or complaints

Please contact our Privacy Officer if you have any questions or complaints about the personal information that we hold about you or the way we handle that personal information. We will acknowledge your question or complaint as soon as possible and will seek to address any question or complaint within 14 days after that.

Notifiable data breaches

If there is a loss, or unauthorised access or disclosure of your personal information, we will investigate and shall notify you if it is likely to result in serious harm to you.

Changes

We may change this Privacy Policy from time to time. You can find our up-to-date Privacy Policy posted on our website from time to time.

Website

When you use our website, we can identify your web browser but we do not identify you. We may use web browser data for website optimisation purposes.

We use "cookies" on our website. A cookie is a text file placed on your computer, to either improve the functionality of the website or help us analyse how users use our website. We do not link back to your identity from the information generated by the cookie about your use of the website (including your device's IP-address). If you do not wish us to use cookies, you can configure the browser settings of your computer or your devices for that purpose.

Contact us

If you have any queries about our Privacy Policy, or about the way we manage your personal information, you can:

• Write to us at [email protected]; or
• Click Contact Us on our website.