Privacy Policy
Last updated: September 16, 2026
How Malu Journey collects, uses, and protects your information, and what choices you have about it. This applies to our website and to this members' platform.
1. Introduction and Scope
Malu Journey, LLC ("Company", "Malu Journey", "we" or "us") respects your privacy, and we are committed to protecting it through our compliance with this policy.
This policy describes the types of information we may collect from you, or that you may provide, when you visit our website at www.malujourney.com (the "Website") or use our members' platform at app.malujourney.com (the "Platform"), and our practices for collecting, using, processing, maintaining, protecting and disclosing that information.
The Platform provides access to group workshops ("Workshops"), a directory of preferred partners ("Preferred Partner Directory"), a self-guided assessment, a guided matching tool, a self-paced program, downloadable toolkits, and other resources (collectively, "Community Resources", and together with the Workshops, the "Services").
Some of our Services are free and require no paid membership. Where you use one of those, we may create an account for you from the information you give us. See Accounts Created From an Email Address below.
This policy applies to information we collect
On the Website and on the Platform.
In email, text and other electronic messages between you and us.
Through any mobile or desktop application we may offer.
When you interact with our advertising or applications on third-party services, if those include a link to this policy.
When you send us a request for information or for our Services.
It does not apply to information collected
Offline, or by any other means, including anything you choose to share during a Workshop.
By a Workshop Facilitator or a Preferred Partner who provides services to you outside the Platform.
By any third party, including through content or advertising that links to or is reachable from the Website.
For clarity, neither Malu Journey nor any information collected through the Services is subject to HIPAA (the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191) or the Health Information Technology for Economic and Clinical Health ("HITECH") Act (Public Law 111-5).
Please read this policy carefully. If you do not agree with our policies and practices, your choice is not to use the Website or the Platform. By accessing or using either, you agree to this privacy policy. This policy may change from time to time (see Changes to This Policy). Your continued use after we make changes is deemed acceptance of those changes.
YOU AGREE THAT YOUR VISIT OR USE, AND ANY DISPUTE OVER OUR ONLINE PRIVACY PRACTICES, IS GOVERNED BY THIS PRIVACY POLICY AND OUR TERMS AND CONDITIONS, OF WHICH THIS POLICY FORMS A PART, unless federal, state or local law or our ethical obligations require a higher level of protection for your personal data, in which case they take precedence over this policy.
2. Children Under the Age of 16
The Website and the Platform are not intended for children under 16 years of age. No one under 16 may provide any personal information to or on them. We do not knowingly collect personal information from children under 16. If you are under 16, do not use or provide any information on the Website or the Platform, do not register, do not make any purchase, do not use any interactive or public comment feature, and do not provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use.
If we learn that we have collected or received personal information from a child under 16 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 16, please contact us at admin@malujourney.com.
Residents of certain states under 13, 16 or 18 years of age may have additional rights regarding the collection and sale of their personal information. Please see Your State Privacy Rights below.
3. Information You Provide to Us
Some of this information may be considered "personally identifiable information", "personal data" or "personal information", meaning it reasonably identifies you or your device, or could reasonably be linked or associated with you.
Information you provide by filling in forms, such as your name, address, email address and telephone number. This includes information provided when you register, subscribe to any of our Services, or request further services.
Your user ID, if you create an account with us.
Records and copies of your correspondence with us, including email addresses.
Your responses to surveys we may ask you to complete for research purposes, and any communications with our team.
Details of transactions you carry out, including Workshop scheduling and the fulfillment of your orders. If you make a payment, your card information is passed directly to our payment processor and is never stored on our systems. We may store your billing address to calculate sales tax due in the United States, to maintain records that may be used to investigate potentially fraudulent transactions, and to print on your invoices. We may also collect commercial information such as your purchase history.
Any feedback you provide about the Services, including ratings and reviews.
If you apply to be a Preferred Partner or a Workshop Facilitator: your application information, credentials, tax information, bank account information, areas of expertise, job history, the number of workshops you have facilitated, and anything you choose to include on your resume.
If you register for a Workshop: the information you provide in your intake survey, which we use to assign you to a Cohort, including emergency contact details, your goals for the Workshop, your interest in specific topics, and any past, present or anticipated mental health concerns or treatment ("Medical Information").
What you create on the Platform
The Platform saves what you do in it, so that it is there when you come back:
Deep Sea Alignment. Your answers to our self-guided assessment, and the reading it produces. The assessment asks about how clearly you are able to think under load, your sense of why you do your work, how separate you feel from your role, your readiness for change, and who supports you. Some of those answers describe your state of mind, your working conditions and your home life. Your answers and your reading are saved to your Malu Journey account.
Care Navigator. What you type about what you are looking for, the answers you select, which partners we matched you with, and the explanation we generated for each match.
Journal entries. Anything you write in the Platform's journal, including your responses to our weekly prompts. Your journal is private to you, and a reflection becomes visible to us only if you choose to submit it for possible sharing with the community.
Program progress. Which lessons of the self-paced program you have completed, and anything you enter into an in-lesson exercise or tool.
Community contributions. Posts, replies and reactions you make in a cohort space or in the partner hub.
Experiences you asked to be told about, when they were not yet scheduled.
Toolkits you download, and which link you followed to get to them.
A record of which version of this policy, our Terms and Conditions, and any Workshop consent you accepted, and when.
User contributions are seen by others
You may provide information to be published or displayed ("posted") in shared areas of the Platform, or transmitted to other users or third parties (collectively, "User Contributions"). Your User Contributions are posted and transmitted at your own risk. No security measures are perfect or impenetrable, and we cannot control the actions of other users with whom you choose to share. We therefore cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.
4. Important Notes About Medical Information
This policy does not apply to information collected offline or by any other means, including any Medical Information or other information you choose to share during a Workshop, whether with us or with your Workshop Facilitator. We or your Workshop Facilitator may take notes in order to create a general summary of the discussion (without attributing comments to specific individuals unless otherwise consented to). Your participation in Workshops, and the sharing of any personal information during a Workshop, are subject to your separate consent and are governed by our Workshop Consent Form and Confidentiality Agreement rather than by this policy.
Malu Journey, LLC is not a healthcare provider, does not provide healthcare services, and is not a "covered entity" under HIPAA. Any Medical Information you share with us is therefore not protected health information ("PHI"), and HIPAA and the applicable provisions of the HITECH Act do not apply to our collection, retention, processing or use of it. The provisions of this policy apply instead.
Where a Workshop Facilitator is itself a "covered entity" subject to HIPAA and HITECH, that Facilitator is responsible for complying with them and may provide you with HIPAA-specific disclosures. We require Workshop Facilitators to refrain from sharing your PHI with us, with other Facilitators, or with other participants except in accordance with HIPAA and HITECH, and in a manner that will not cause us, other Facilitators or other participants to be considered "business associates" under HIPAA.
This is no longer only about Workshop intake
The Deep Sea Alignment assessment and the Care Navigator both invite you to tell us about your state of mind, your working conditions and your personal life, and both are available without registering for a Workshop. Because that information is collected through the Website and the Platform, it is governed by this policy.
We treat it as the most sensitive information we hold. Specifically:
Your assessment answers and your reading are stored against your account and can be read by Malu Journey staff, who use them to understand what our members need and to point you toward the right kind of support. That is what the assessment is for.
Your Care Navigator session, including anything you typed into it, is private to you. Our systems do not permit staff to read it.
Your journal entries are private to you.
If you write something to the Care Navigator that indicates you may be in crisis, we show you crisis resources immediately and we do not keep what you wrote. Our database refuses to store it. Nobody at Malu Journey monitors for this, and you should not rely on the Platform to summon help. If you are in danger, call your local emergency number.
Neither the assessment nor anything else on the Platform is a clinical assessment, a diagnosis, or a substitute for care from a qualified professional, and none of it may be used for employment, selection or promotion decisions.
5. Accounts Created From an Email Address
Some things we offer for free -- downloading a toolkit, registering for a public event, or taking the Deep Sea Alignment assessment -- create a Malu Journey account for you from the name and email address you give us, so that what you asked for has somewhere to live. We tell you this at the point of collection, and we email you a link to finish setting the account up if you want to.
You do not have to finish setting it up, you are not charged anything, and you can ask us to delete it at any time by emailing admin@malujourney.com. Until you set a password, the account holds only what you gave us and what you produced, such as your assessment reading.
Where you give us an email address in exchange for something free, we will also send you occasional resources and updates from Malu Journey. Every one of those emails has an unsubscribe link, and unsubscribing does not affect your account or anything saved in it.
6. Information Collected Automatically
As you navigate and interact with the Website and the Platform, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions and patterns:
Cookies. Small data files stored on your device. We use them to keep you signed in and to remember your preferences. If you block them, you will not be able to sign in.
Web beacons. Small graphic images embedded in web pages or emails that help us understand how you interact with our content.
Log files. Records of activity including your IP address, browser type, internet service provider, referring and exit pages, operating system, date and time stamp, and clickstream data.
The information we collect automatically does not itself include personal information, but we may maintain it or associate it with personal information collected in other ways. It helps us improve the Website and deliver a better and more personalized service: estimating audience size and usage patterns, storing your preferences, speeding up your searches, and recognizing you when you return.
Our Website may include social media features and widgets. These may collect your IP address and which page you are visiting, and may set a cookie to function. Your interactions with them are governed by the privacy policy of the company providing them.
If you arrive by clicking through from another website, certain information you provided to that website, such as the terms you searched on, may be transmitted to us and we may use it. You should review the privacy policy of any website from which you reached us.
7. Service Providers We Use
We operate our own Platform rather than a third-party community platform. We use a small number of service providers to run it, including providers of cloud hosting and database services, payment processing, transactional email delivery, and the language model behind the Care Navigator described under Automated Processing and Artificial Intelligence below.
Each of these providers processes only the information it needs for its function, under contract, and none of them is permitted to use your information for its own purposes or to train its own products. Payment card details are transmitted to our payment processor directly and are never stored on our systems.
Our own access to member information is limited to those people who need it to do their job. Administrative access requires both an administrator role and a second authentication factor.
These providers operate under their own privacy policies and we do not control their data security practices. As with any transmission over the internet, we cannot guarantee the security of information in transit. We will tell you the identity of any of our service providers on request, at admin@malujourney.com.
8. How We Use Your Information
We use information we collect about you, or that you provide to us, including any personal information:
To present the Website and the Platform and their contents to you.
To provide the information, products and Services you request.
To provide our programs, including connecting you with your Workshop Facilitator and providing tools to both of you.
To point you toward the kind of support your answers suggest would help, which is the purpose of the Deep Sea Alignment assessment and the Care Navigator.
To monitor and improve the quality of our Workshops and of the Platform.
To carry out our obligations and enforce our rights under any contract between you and us, including billing and collection.
To notify you about changes to the Website, the Platform, or any product or service we offer.
To complete your purchases and otherwise facilitate transactions and payments.
To respond to trust and safety issues, prevent fraud, and keep the Platform and your data secure.
To understand, in aggregate, what our members need, so that we can decide what to build and which practitioners to work with. Analysis of this kind is done across members together, and the conclusions we draw from it do not identify you.
For Workshop Facilitators and Preferred Partners: to assist in recruitment and vetting, to onboard you, to run permitted background checks and screenings required for credentialing, to pay you and comply with tax law, and to provide you with quality statistics and feedback. If you request it, we may also use this information to create your listing in the Preferred Partner Directory.
To allow you to participate in interactive features.
In any other way we describe when you provide the information, and for any other purpose with your consent.
We may also use your information to contact you about our own goods and services that may be of interest to you. If you would rather we did not, adjust your preferences in your account profile or email admin@malujourney.com. See Your Choices below.
9. Automated Processing and Artificial Intelligence
One feature of the Platform uses artificial intelligence, and we want to be precise about which.
The Care Navigator. When you describe what you are looking for, we send that text to a third-party language model provider to produce a short reflection back to you and to suggest which areas of practice it relates to. That provider processes it on our behalf as a service provider, is not permitted to use it for its own purposes, and operates under its own terms. We do not send your name, your email address, or anything else that identifies you. Before any of your text is sent, it passes through a check of our own, written as fixed rules rather than as a model, that looks for indications of crisis. If that check fires, we show you crisis resources and the text is neither sent nor stored.
What is not automated. The Deep Sea Alignment assessment is scored by fixed arithmetic. Identical answers always produce an identical reading, no artificial intelligence is involved, and your answers are not sent outside our own systems in order to score them.
What these features do not do. Nothing on the Platform makes an automated decision about you that produces legal or similarly significant effects. A suggestion from the Care Navigator is a starting point for your own consideration, not a referral, a triage decision, or a judgment about your condition. You choose whether to contact anyone, and we do not contact a partner on your behalf without asking you.
We do not use your information to train artificial intelligence models, and we do not permit our service providers to use it to train theirs.
Separately, we may use an AI-assisted notetaker in Workshops held over video, solely to prepare a written summary of the discussion for participants and Facilitators, and only where that is disclosed for the Workshop. Your consent to that limited use is governed by the Workshop Consent Form and Confidentiality Agreement.
10. Disclosure of Your Information
We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.
We may disclose personal information that we collect, or that you provide:
To our subsidiaries, partners, affiliates, and the applicable Workshop Facilitator.
To contractors, service providers and other third parties we use to support our business, who are bound by contractual obligations to keep personal information confidential and to use it only for the purposes for which we disclose it to them.
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company's assets, whether as a going concern or as part of bankruptcy, liquidation or a similar proceeding, where personal information we hold is among the assets transferred.
To fulfill the purpose for which you provided it, for any other purpose we disclose when you provide it, and with your consent.
WE DO NOT SELL YOUR PERSONAL DATA TO THIRD PARTIES.
We may also disclose your personal information:
To comply with any court order, law or legal process, including to respond to any government or regulatory request.
To enforce or apply our Terms and Conditions and other agreements, including for billing and collection.
Where we believe disclosure is necessary or appropriate to protect the rights, property or safety of the Company, our members, or others. This includes exchanging information with other companies and organizations for fraud protection and credit risk reduction. Our legal advisers may review correspondence for a specific account where we have reason to believe there is a security, legal or fraud issue on that account.
11. Who at Malu Journey Can See What
The Platform is built so that you can read only your own records, and so that our own staff's access is limited by what a feature is for rather than by our discretion. These limits are enforced by our database, not only by our application.
Visible to Malu Journey staff: your profile, your membership and payment status, your registrations, your Deep Sea Alignment answers and reading, any reflection you submitted for sharing, your posts in a cohort or partner space, and your correspondence with us.
Not visible to Malu Journey staff: your journal entries, and your Care Navigator sessions including anything you typed into them.
Visible to a Workshop Facilitator: what you share in that Cohort's space, and what you disclose during a session, subject to the Workshop Consent Form and Confidentiality Agreement.
Visible to other members: your Community directory listing — your name, and the photo, title, location, short bio and link you choose to add. New accounts are listed by default so that members can find one another; the listing is shown only to signed-in members, never on the public web, and you can switch it off at any time from your profile. Nothing else you do on the Platform appears there.
Administrative access requires both an administrator role and a second authentication factor, and administrative sessions end automatically after a period of inactivity. We review these arrangements as we add features, and we will update this section when they change.
12. Your Choices
Cookies. You can set your browser to refuse all or some cookies, or to alert you when cookies are being sent. If you disable or refuse them, parts of the Website and Platform may become inaccessible or stop working, including signing in.
Email. We may send you emails about our products and Services. To stop those, use the unsubscribe link at the bottom of any of them and we will remove you from the relevant list as soon as reasonably possible. Even if you opt out of promotional email, you will continue to receive administrative email, such as a receipt or a password reset.
Direct marketing. If you would rather receive none at all, email admin@malujourney.com.
Interest-based advertising. We do not control third parties' collection or use of your information to serve interest-based advertising. Those third parties may offer you ways to opt out. You can opt out of targeted ads from members of the Network Advertising Initiative on the NAI's website.
Residents of certain states, such as California, may have additional rights and choices. See Your State Privacy Rights below.
13. Accessing and Correcting Your Information
You can review and change your personal information at any time by signing in and visiting your profile.
You may also email us at admin@malujourney.com to request access to, or correction of, any personal information you have provided. We may decline to make a change where we believe it would violate a legal requirement, or would cause the information to become inaccurate.
Content you posted in a shared space may remain visible in another member's copy of it, in an email notification already sent, or in a cached or archived page, and may have been copied by others. We cannot retrieve those.
14. Deleting Your Account, and What Happens When You Do
You can delete your account at any time, for any reason, and you do not have to tell us why. Use the delete option in your profile: we ask you to confirm, and then it happens immediately rather than being queued for review. You can also email admin@malujourney.com from the address on your account and we will do it for you, within 30 days at the outside and normally the same week.
What is deleted
Deleting your account deletes the account itself and the information attached to it, including:
Your profile, your name, your email address, your photo, and your sign-in credentials.
Your Deep Sea Alignment answers and readings.
Your journal entries and your prompt responses.
Your Care Navigator sessions, including anything you typed into them.
Your progress through the self-paced program and anything you entered into its exercises and tools.
Your saved items, your event registrations, and your place on any waitlist.
Your posts, replies and reactions in cohort and partner spaces.
Your record of accepting our agreements, except where we are required to keep it.
What happens to your membership
If you have an active paid membership, we cancel it at the same time so that you are not charged again. Deletion does not itself entitle you to a refund of fees already paid; our refund terms are in the Terms and Conditions.
What we keep, and why
Transaction and tax records. We keep a record of payments you made, including amount, date and the last four digits of the payment method, for as long as tax, accounting and anti-fraud law requires. These are kept in our payment processor's systems as well as our own.
Records we are legally required to retain, or that we need to establish, exercise or defend a legal claim, for as long as that obligation or claim lasts.
Aggregated and de-identified information. Where we have already counted your answers into an aggregate figure -- for example, how many members' assessments pointed toward a particular kind of support -- that figure remains, because it no longer identifies you and cannot be traced back to you. We do not reconstruct individual records from it.
Backups. Deleted information persists in our encrypted backups for up to 30 days before those backups are rotated out. We do not restore a deleted account from a backup.
Anything already sent. An email we have already delivered to you, and a report you already downloaded, are yours and are outside our systems. A report exported by our staff before your deletion request is not automatically recalled, though we will delete any copy we still hold on request.
What we cannot delete
Content you shared with other people. A post in a cohort space that other members have already read, a reflection you submitted and we published, or anything you said aloud in a Workshop, cannot be unseen. Where a post can be removed we remove it; where it has been quoted, screenshotted or copied by someone else, we have no way to reach that copy.
Information held by a Preferred Partner or a Workshop Facilitator you engaged directly. They are independent of us and hold their own records under their own policies. Ask them directly.
If you are a Preferred Partner
Your directory listing is removed by us as a separate step rather than automatically, so that it does not disappear from the Directory without notice to members who were relying on it. Tell us when you want the listing taken down and we will remove it.
You can also ask for less than deletion
If you want to stop hearing from us but keep your account, unsubscribe from our emails. If you want a specific thing removed rather than everything -- a single journal entry, one assessment reading, a post -- delete it in the Platform where you can, or ask us, and we will remove just that.
15. Your State Privacy Rights
State consumer privacy laws may provide their residents with additional rights regarding our use of their personal information.
California: Shine the Light
California law entitles residents to ask for a notice describing what categories of personal information we share with third parties for those third parties' own direct marketing purposes. Unless you ask us to or opt in, we do not share any personal information with third parties for their own direct marketing purposes.
California: CCPA and CPRA
If you are a California resident you have certain rights under the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA):
Right to know. You may request that we disclose information about our collection and use of your personal information over the past 12 months, including the categories collected, the categories of sources, our business or commercial purpose, the categories of third parties with whom we share it, and the specific pieces we have disclosed. The first five of those are described in this policy. We do not sell personal information as defined by the CCPA.
Right to delete. You may request that we delete personal information we collected from you and retained, subject to certain exceptions. See Deleting Your Account above for exactly what that means here.
Right to correct. You may request that we correct inaccurate personal information we maintain about you.
Right to opt out of sale or sharing. You may opt out of the sale or sharing of your personal information.
Right to limit use of sensitive personal information. You may limit our use and disclosure of your sensitive personal information.
Right to non-discrimination. We will not deny you goods or services, charge you a different price, or provide a different level of quality because you exercised any of these rights.
To make a request under the CCPA, email info@malujourney.com. To verify that you are the person about whom we have collected information, you will need to provide certain information when you submit your request, which we will then attempt to match against information we already hold.
Other states
Other states, including Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah and Virginia, provide (now or in the future) their residents with rights to:
Confirm whether we process their personal information.
Access and delete certain personal information.
Correct inaccuracies in their personal information, taking into account its nature and the purpose of processing (excluding Iowa and Utah).
Data portability.
Opt out of processing for targeted advertising (excluding Iowa), for sales, or for profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
Either limit, or require consent for, the processing of sensitive personal data.
The exact scope of these rights varies by state. To exercise any of them, email info@malujourney.com.
Nevada provides its residents with a limited right to opt out of certain personal information sales. Residents who wish to exercise it may email info@malujourney.com, though we do not currently sell data triggering that statute's opt-out requirements.
16. Do Not Track
Some browsers have "do not track" features that let you tell a website not to track you. These features are not uniform. Where available, you may choose to enable a tool that automatically communicates your universal opt-out preferences, such as the Global Privacy Control. You may need a specific browser or an extension that supports these signals. We do not currently take action in response to Do Not Track signals, because no uniform technological standard has been established. We continue to review new technologies and may adopt a standard once one exists.
17. Third-Party Links
The Website and the Platform may contain links to third-party websites. We are not responsible for the privacy practices or the content of those sites. We encourage you to review the privacy policy of any third-party website you visit.
18. Data Security
The Company is located in the United States. Our Services are hosted in the United States and are intended for visitors located within the United States.
Access to your records is enforced by our database, not only by our application: each member's records are readable only by that member, except where this policy says otherwise. Administrative access requires an administrator role and a second authentication factor, and administrative sessions end automatically after a period of inactivity. Payment card details are transmitted to our payment processor directly and are never stored on our systems. We record which version of each of our agreements you accepted, and when.
Unfortunately, the transmission of information over the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of information transmitted to us. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures.
The safety and security of your information also depends on you. Where you have chosen a password, you are responsible for keeping it confidential. Please do not share it with anyone.
19. Changes to This Policy
It is our policy to post any changes we make to this privacy policy on this page. If we make material changes to how we treat your personal information, we will notify you. The date this policy was last revised appears at the top of the page. You are responsible for ensuring we have an up to date, active and deliverable email address for you, and for visiting this page periodically to check for changes.
20. Contact Us
To ask a question or comment about this policy or our privacy practices, email admin@malujourney.com. For requests under a state privacy law, email info@malujourney.com.