Pilot Privacy Notice

1. Who is responsible

Quantum Co-Creation Pty Ltd (Quantum) develops and operates Bridget as a Rise & Thrive Global product. Quantum determines how Bridget account, coaching, service, security and support information is processed and is the principal privacy controller for the platform.

Your employer or sponsoring organisation separately controls the employment, contact and invitation information it uses for its own purposes. It does not control your coaching conversations through Bridget.

If a separate organisation handles a paid pilot invoice, that organisation is responsible for the billing, invoicing, refund and statutory records it must keep. The Pilot Schedule identifies it. A complimentary pilot involves no participant payment information.

2. Information Bridget handles

Depending on how you use the pilot, Quantum handles:

Account and eligibility information:

• name and email address;
• employer or sponsoring organisation;
• account type, invitation and activation status;
• approved country and regional service setting;
• password credentials in protected hashed form; and
• consent and acknowledgement records.

Coaching information:

• the words you enter in a coaching conversation;
• Bridget's replies;
• private conversation titles you choose;
• conversation dates and status; and
• crisis-detection severity flags, without the matched words being copied into the audit event.

Service and security information:

• IP address and browser or device information;
• sign-in, consent, account and security events;
• request identifiers, timestamps and technical error information;
• organisation membership and seat status; and
• support, privacy, accessibility and incident communications.

Payment information: for a paid organisation pilot, the billing organisation and Stripe handle the payment details needed for the transaction. Bridget stores subscription, invoice and status identifiers needed to administer access. Individual participants are not charged under the controlled corporate pilot.

3. Where information comes from

Quantum receives information:

• directly from you when you register, consent, use Bridget or contact us;
• from the Customer when it supplies invitation and eligibility details;
• automatically from the service and your device;
• from Stripe if a paid organisation pilot is used; and
• from service providers when they report delivery, security or operational events.

4. Why information is used

Quantum uses information to:

• verify eligibility and create your account;
• provide and maintain AI coaching conversations;
• return your conversation history and private titles to you;
• enforce consent, privacy, rate and access controls;
• protect Bridget, participants and organisations from misuse;
• provide support and respond to privacy or accessibility requests;
• administer the pilot and organisation seats;
• calculate organisation-level adoption information without reading content;
• meet applicable accounting, security and legal obligations; and
• establish, exercise or defend legal rights where necessary.

Where a law requires a particular legal basis, Quantum relies on the basis appropriate to the activity. This may include performing the participant terms, your consent, Quantum's legitimate interests in safely operating the pilot, and compliance with legal obligations. Withdrawing an essential consent may mean Bridget can no longer provide coaching access.

5. Artificial-intelligence processing

Bridget is an AI system. To generate each reply, the relevant context of your conversation is sent through an encrypted connection to the configured AI provider, currently Anthropic.

This is automated provider processing, not routine human review. Quantum does not use individual pilot conversations for quality assurance, advertising or model training. Pilot activation is conditional on Quantum verifying the production provider's data-processing terms and training and feedback settings.

6. Who can and cannot see coaching content

Only you can retrieve your coaching conversations through your authenticated Bridget account.

The following people cannot read coaching content through the product:

• your employer;
• your organisation administrator;
• a Bridget Platform Admin; and
• routine support personnel.

Your employer receives only the organisation-level information described in the Organisation Administrator Privacy Guide. It does not receive topics, conversation titles, individual activity or message content.

This is a product-access promise, not a claim that decryption is technically impossible. Quantum's backend holds the encryption key so it can return your content to you and prepare your own export. Access to production infrastructure and secret material is restricted. No routine support or administrative task requires a person to decrypt coaching content.

7. Storage and security

Conversation messages, completed conversation backups and private titles are encrypted at application level using AES-256-GCM before storage. Information is also protected by encrypted network connections, access controls, environment secret storage, logging and monitoring.

For the pilot, the active production encryption key is stored in protected platform secret storage. A separate protected recovery copy is limited to named authorised Quantum or Rise & Thrive Global leaders and is used only for controlled recovery. No security measure can remove every risk, so Quantum also maintains incident and recovery procedures.

8. Service providers and international processing

Quantum uses providers to operate Bridget:

• Anthropic, AI reply generation;
• Render and managed PostgreSQL, backend and database hosting;
• Vercel, frontend hosting;
• Resend, service email; and
• Stripe, organisation billing where applicable.

The confirmed contracting entities and processing locations are completed in the released version of this notice before any participant is granted access.

Quantum is based in Australia. Information may therefore be processed in Australia and in provider locations outside your country. Quantum will use contractual and other safeguards required for the approved participant countries. Where EU, EEA or UK participants are included, the Pilot Schedule must identify the applicable transfer arrangement before access is granted.

9. What the employer can see

After you join, your employer may see:

• the total number of current organisation members and seats;
• how many people have completed activation;
• total conversations across the organisation, counted only after an accepted participant message; and
• aggregate weekly adoption information when the five-joined-member privacy threshold is met.

Your employer cannot see what you discuss, when you use Bridget or whether you personally use Bridget after joining.

10. Retention

The current pilot retention settings are:

• active account information: while the account is active and as needed to close the pilot;
• conversation messages, backups and private titles: two years after the conversation date, unless you delete them earlier or a lawful exception applies;
• audit and security records: three years;
• consent records: three years after account deletion; and
• payment and tax records: for the period required by the billing entity's applicable law.

Retention must be implemented operationally, not stated only in this notice. Quantum will delete or de-identify information when it is no longer needed, subject to security, dispute and legal obligations.

11. Your choices and rights

Depending on the law applying to you, you may ask Quantum to:

• explain whether it holds information about you;
• give you access or a portable export;
• correct inaccurate information;
• delete information;
• restrict or object to particular processing;
• withdraw consent for future processing; and
• explain or review an important automated decision, if Bridget introduces one. Bridget does not currently make employment or eligibility decisions about you.

You can use the available Settings controls or contact the privacy address. Quantum will verify the request and respond within the period required by the applicable law. Your employer is not given your export or request details.

You may complain to Quantum first and may also contact the privacy regulator available in your country. Australia: Office of the Australian Information Commissioner, https://www.oaic.gov.au/. Where another country's regulator applies to you, its details are provided in the released version of this notice.

12. Legal requests and serious safety situations

Quantum may preserve or disclose the minimum information required or authorised by applicable law, a binding court or tribunal order, or a valid emergency disclosure rule. An employer request, workplace investigation or lawyer's letter alone does not provide access to coaching content.

Quantum will verify the authority and scope of a request, minimise any disclosure and notify the affected person where permitted and appropriate. No routine in-product legal-content-access mechanism exists for the pilot.

13. Children

Bridget is for people aged 18 or older. Quantum does not knowingly approve a pilot account for a child. Contact the privacy address if you believe a child has provided information.

14. Changes

Quantum will keep this notice accurate and versioned. A material change to the purposes, provider processing, retention or who can see information will be explained and, where required, presented for fresh consent before coaching continues.

15. Contact

Privacy requests and complaints: support@riseandthriveglobal.com

Postal address: Level 7, World Trade Center Tower 4, 18-22 Siddeley Street, Melbourne VIC 3005, Australia

Security concerns: support@riseandthriveglobal.com

General support: support@riseandthriveglobal.com