MePath

Privacy Policy

Last updated: 20 September 2026

This policy explains what personal data MePath collects, how it is used, and the choices and rights you have. MePath is a professional portfolio and career-evidence app for health and care workers.

In short: your records are yours. We store them so you can use them; we do not sell your data or use it for advertising. You can download or permanently delete everything at any time from the app’s settings.

1. Who is responsible for your data

MePath is operated by Curious Labs Limited, a private company limited by shares registered in Nigeria under company number RC 9837743 (“we”, “us”). Curious Labs Limited is the data controller for the personal data described here. For any privacy question or request, contact us at mepath26@gmail.com.

2. What we collect

Account details — your email address and authentication information.
Profile — the professional details you choose to add, such as your name, profession, registration body, PIN/registration number, organisation and headline.
The records you create — professional moments and reflections, education and CPD, feedback, competencies, incidents and learning records, goals, shifts, memberships, work history, publications, awards, and any files you upload (e.g. photos of certificates).
Technical data — basic information needed to run the service reliably (for example, sign-in timestamps).

3. Sensitive information — your responsibility

Some records (such as reflections or incident learning) can touch on sensitive matters. You must not enter information that identifies a patient, service user, or colleague. Refer to people by role, not name. The app includes an on-device reminder and a check that looks for obvious identifiers, but this is a helper, not a guarantee — you remain responsible for keeping your records anonymous and for complying with your professional code and your employer’s policies.

4. How we use your data

To provide the app: storing your records and generating your portfolio, readiness view and exports.
To operate, secure and improve the service.
To contact you about your account or important service changes.

We do not sell your data, and we do not use it for advertising or profiling.

5. The laws we follow and our legal basis

MePath is operated from Nigeria and used by people in the United Kingdom and other countries, so we aim to meet the data-protection law that applies to you. As a Nigerian company we comply with the Nigeria Data Protection Act 2023 (NDPA); and because we offer MePath to people in the UK, we also comply with the UK GDPR for those users. We process your data to perform our contract with you (providing the app you signed up for), on the basis of your consent where you choose to add optional information, and to meet our legal obligations. Where you enter special-category information (such as health-related reflections), you do so on your own initiative to keep your own professional record.

6. Where your data is stored and who processes it

Your data is hosted on our behalf by trusted infrastructure providers who act as our processors under contract:

Supabase — database, authentication and file storage.
Vercel — hosting of the web application.

MePath is operated from Nigeria, and these providers may store or process data on servers located in other countries. Where your data is transferred across borders, we rely on our providers’ contractual and security safeguards to keep it protected to the standard required by the data-protection laws that apply to you.

These providers only process your data to run the service and under our instructions. We do not enable any AI processing of your records; if that ever changes, we will update this policy first and it will be optional.

7. Sharing

We only share data with the processors above. If a future community feature is switched on, only the specific achievement you choose to share is shown, under a first-name-and-initial display name — never your reflections or clinical details.

8. Keeping your data, and deleting it

We keep your data for as long as you have an account. You can download all of your data as a file, or permanently delete your account and all associated records and files, at any time from Profile & Settings → Your data & account. Deletion is immediate and cannot be undone.

9. Your rights

Under the data-protection laws that apply to you — including the UK GDPR and Nigeria’s NDPA — you have the right to access, correct, export, restrict, object to, and erase your personal data. The app lets you do most of this directly. To exercise any right or raise a concern, contact mepath26@gmail.com. You can also complain to your data-protection regulator — in the UK, the Information Commissioner’s Office (ICO) at ico.org.uk; in Nigeria, the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng; or the equivalent authority in your own country.

10. Security

We use reputable providers and standard measures including encryption of data in transit and per-user access controls so that, by default, only you can see your records. No online service can be guaranteed 100% secure, and we cannot be responsible for information you choose to enter that identifies other people.

11. Children

MePath is intended for working health and care professionals and students, and is not directed at children under 16.

12. Changes

We may update this policy as the app develops. Material changes will be notified in the app or by email, and the “last updated” date above will change.