Data protection at MendAI

Where you share data with us

This website. A contact form you choose to fill in, our own cookie-free analytics, and error monitoring. Google Analytics and session replay run only if you accept them, and you can change that at any time with Cookie settings at the bottom of every page.

MendAI Diary. Your account, what you write, and any health data you choose to connect from Apple Health or Health Connect. Diary's AI receives your writing only after you agree in the app. If you link to a therapist or facility, they see only the categories you choose, which can include your entries and AI conversations. You can delete your account and everything in it from inside the app.

MendAI Companion and MendAI Platform. For the view a client shares, the therapist (Companion) or the facility (Platform) is the controller, and MendAI AS is their processor under a data processing agreement. The client's Diary itself stays under our control. Every link rests on the client's explicit consent, and linking is always their free choice. Configuration changes workflows and views; it never widens what a client consented to. Platform reports enforce a minimum group size and never identify an individual below it, and a data protection impact assessment is done for each Platform project before go-live.

The full detail, including every provider, retention period and legal basis, is in the Privacy Policy.

GDPR

MendAI AS is a Norwegian company, and the GDPR is our default for everyone, not an add-on for European visitors. In practice:

• Data minimisation. We collect what a purpose needs and nothing more. Our own website analytics cannot even recognise a returning visitor.
• EU hosting. Our systems run in the AWS Europe (Stockholm) region in Sweden, and Diary's AI runs on Amazon Bedrock in the EU.
• Explicit consent for health data. What you write, each health source, sending your writing to an AI model and each link to a therapist or facility rest on your explicit consent (GDPR art. 9(2)(a)), and each can be withdrawn. Analytics cookies and session replay also wait for a clear yes.
• Your rights, handled directly. Access, correction, deletion, portability and objection requests go to hello@mendai.tech, and we answer within one month. Our supervisory authority is Datatilsynet (the Norwegian Data Protection Authority).

South Africa (POPIA)

MendAI Companion is offered in South Africa. Under the Protection of Personal Information Act, health information, including mental health, is special personal information, and we process it on consent. Storing data in the AWS Europe (Stockholm) region in Sweden is a transfer outside South Africa, made under section 72 of POPIA. Questions go to our information officer at hello@mendai.tech, and you can complain to the Information Regulator.

Security

Data is encrypted in transit and at rest, following AWS security best practice, and access is limited to the people who need it to run the service. If a breach occurs, we notify the authority and affected people as the GDPR requires.

HIPAA

HIPAA, the US health privacy law, applies to health plans, healthcare clearinghouses and healthcare providers who bill electronically, and to their business associates. MendAI is not offered in the United States, and HIPAA does not apply to it.

When we describe our safeguards as "HIPAA-aligned", we mean that we design them to the standard of the HIPAA Security Rule, not that we claim a compliance status. A business associate agreement would be signed only through a US healthcare partner, and we would say so plainly.

What we will not do

• Sell personal data.
• Show advertising in our apps, or track you across other companies' apps.
• Share Diary entries or AI conversations with anyone you have not chosen to share them with.
• Use what you write to train AI models.

Questions

Ask us anything at hello@mendai.tech. If you are a clinician or partner with a due-diligence questionnaire, we are happy to complete it.