Privacy Policy

Effective 1 September 2026. Last updated 19 October 2026.

1. Who we are

MendAI AS (organisation number 937 548 079), Terrasseveien 44B, 1363 Høvik, Bærum, Norway, is the controller of the personal data described in this policy. "MendAI", "we" and "us" mean MendAI AS. Contact us about anything in this policy at hello@mendai.tech.

2. What this policy covers

This policy covers the mendai.tech website (the "Site") and the MendAI Diary app for Android and iOS ("Diary"), including what happens when you link Diary to a therapist or facility. Therapists and facilities that use MendAI Companion or MendAI Platform have a data processing agreement with us; see Data protection.

3. MendAI Diary

Your account

To use Diary you create an account with your email address, or sign in with Apple or Google. We store your name, your email address (or the private relay address Apple gives us, if you choose to hide your email) and an account identifier. If you sign in with Apple or Google, they know that you signed in to Diary, under their own privacy policies; we receive nothing else from them. Legal basis: performing our agreement with you (GDPR art. 6(1)(b)).

What you write

Your entries, goals and check-ins that you have set aside are stored on your account so that they are there when you come back. What you write in a diary can reveal health information, so we process it on your explicit consent, which you give when you sign up (art. 6(1)(a) and art. 9(2)(a)).

If you dictate an entry, your phone's own speech recognition (Apple's on iOS, Google's on Android) turns your voice into text under their terms. We receive and save only the text.

Diary's AI

Diary's AI is not a person. Before anything you write is sent to it for the first time, the app tells you what will be sent and who receives it, and asks your permission. Nothing is sent until you agree.

When the AI responds, we send the entry or message it is responding to, together with the goals and recent context it needs to reply, to Amazon Bedrock, an AI service run by Amazon Web Services (AWS) in the EU. If you have connected a health source, that context includes daily summaries of your health data, such as last night's sleep, your steps or your workouts, so the AI can refer to them in its reply. Bedrock runs large language models from several model makers, including Anthropic's Claude models. AWS processes this text only on our behalf. Under AWS's terms, Bedrock does not store your text or the AI's reply, does not share them with the model makers, and does not use them to train any model. We do not use what you write to train or fine-tune AI models either.

Legal basis: your explicit consent (art. 6(1)(a), and art. 9(2)(a) for anything you choose to write that reveals sensitive information). You can withdraw consent at any time in the app's settings. The AI then stops and nothing more is sent. Withdrawing does not affect what was sent before.

Health data

If you choose, Diary reads sleep, steps, active energy, workouts, mindful minutes, resting heart rate and heart rate variability from Apple Health (on iOS) or Health Connect (on Android), and shows them alongside your days. Diary only reads: it never writes, changes or deletes anything in Apple Health or Health Connect. Diary asks for each source separately, and you can disconnect a source at any time in your phone's settings (on iPhone, Settings > Health > Data Access & Devices; on Android, in Health Connect). Health data is shown as the source recorded it. It is never scored, labelled normal or abnormal, used to diagnose anything, or used to trigger a notification. Diary's AI may mention it when reflecting on your day with you, as described above. It is never used for advertising or marketing, and Apple Health data is never stored in iCloud. Legal basis: your explicit consent (art. 9(2)(a)).

Limited use. Diary uses data from Health Connect and Apple Health only to provide the features you see in the app: showing your health data day by day, letting Diary's AI reflect on it with you, and sharing daily summaries with a therapist or facility if you choose to. We never sell it, use it for advertising, give it to data brokers or information resellers, or use it to decide on credit, insurance, employment or lending. We transfer it only to the service providers listed in section 6, who process it for us, to a therapist or facility you choose to link, or when the law requires it. Use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

Linking to a therapist or facility

You can link Diary to a therapist or counsellor who uses MendAI Companion, or to a facility that uses MendAI Platform, with a code they give you. Linking is always your choice and never a condition of care. You choose what is shared in Diary's permissions, one category at a time, and can stop at any time.

If you choose, this can include your entries, your conversations with the AI and daily summaries of your health data. Your therapist or facility is notified when something serious is wrong, such as you asking for contact or no check-ins for a while. Health data is never used to trigger these notifications. You can see every rule in the app.

For the view you share, your therapist or facility is the controller and we process it for them under a data processing agreement. Your Diary itself stays under our control. Legal basis for each link: your explicit consent (art. 9(2)(a)).

What Diary does not do

• It shows no advertising, and we never sell your data.
• It does not track you across apps and websites owned by other companies.
• It does not access your photos, location or contacts.
• It shares nothing with anyone unless you link to a therapist or facility, and then only the categories you choose.
• It never diagnoses, assesses or predicts any condition, and never builds a profile of you from what you write.

Technical data

When the app talks to our servers, our systems log standard technical information: IP address, app version, device type and timestamps. We use it to keep the service secure and working. If you have chosen in your phone's settings to share analytics with app developers, Apple or Google also gives us crash reports and aggregated usage statistics. Legal basis: our legitimate interest in running a secure, reliable service (art. 6(1)(f)).

Deleting your account

You can delete your account from inside the app, in its settings. This deletes your account, everything you wrote and the health data Diary has read, and ends any link to a therapist or facility. Data is removed from our live systems within 30 days, and from backups within 35 days as they are overwritten. If you can no longer open the app, email hello@mendai.tech from the address on your account and we will delete it for you.

4. The website

Contact form

If you use the contact form, we receive your name, email address, the option you pick and your message. We use them to reply and, if you asked for early access, to contact you about it. Please do not include health information in your message; if you do, we use it only to reply to you. Legal basis: taking steps you ask for before an agreement (art. 6(1)(b)) and our legitimate interest in answering enquiries (art. 6(1)(f)). We send marketing only if you have agreed to it (art. 6(1)(a)).

Our own analytics

Our first-party analytics records the page path, the referring page, a coarse screen size (small, medium or large), any utm_ campaign tags in the link you followed, and a random session id that lives only in your browser tab's memory. It sets no cookies, stores nothing on your device and cannot recognise you when you return. It is switched off if your browser sends a Global Privacy Control or Do Not Track signal. Legal basis: our legitimate interest in understanding how the Site is used (art. 6(1)(f)).

Google Analytics (only with your consent)

If you accept cookies, we use Google Analytics to measure visits, pages viewed, how you arrived, approximate location (country or city, derived from your IP address, which Google Analytics does not store), device and browser type. Google Analytics sets cookies to tell visits apart. We have turned off Google signals and advertising features, so this data is not used for advertising. Legal basis: your consent (art. 6(1)(a)).

Error monitoring (Sentry)

We use Sentry to find and fix errors and slow pages. When something goes wrong, Sentry receives technical details: the page, the error, browser and device type, and your IP address in transit. We have configured it not to collect user details or the content of forms. Legal basis: our legitimate interest in a working, secure Site (art. 6(1)(f)).

If you accept cookies, Sentry may also record a replay of a session, mainly when an error occurs, so we can see what went wrong. All text and form fields are masked and images are blocked in the recording. Legal basis: your consent (art. 6(1)(a)).

Server logs

Our hosting (AWS) logs standard technical information: IP address, browser, time and the address requested. We use it for security, preventing abuse and delivering the Site. Legal basis: legitimate interest (art. 6(1)(f)).

5. Cookies and similar technologies

The Site uses the following. Diary uses none of them.

• Your cookie choice (browser local storage, mendai.consent.v1): remembers whether you accepted or declined. It is strictly necessary and kept until you clear your browser data.
• Google Analytics cookies (_ga, _ga_*): only if you accept. They last up to 2 years unless you decline later or clear them.
• Sentry session replay (browser session storage): only if you accept. It is cleared when you close the tab.

Nothing optional loads until you choose. If your browser sends a Global Privacy Control signal, we treat it as declining. You can change your choice at any time with Cookie settings at the bottom of every page. If you withdraw, we stop Google Analytics and session replay and delete the Google Analytics cookies.

6. Who receives your data

We do not sell personal data and do not share it for advertising. We use these service providers, who process data only on our instructions under data processing agreements:

• Amazon Web Services EMEA SARL (AWS): hosting, databases, email, contact records and Diary's AI (Amazon Bedrock).
• Google Ireland Limited: Google Analytics on the Site, only with your consent.
• Functional Software, Inc. (Sentry): error monitoring for the Site, stored in Sentry's EU data region in Germany.

If you link Diary to a therapist or facility, they receive the categories you chose to share, as described in section 3.

Each provider is contractually required to protect personal data to the same standard as this policy, or better, and to use it for no purpose of its own. If you sign in to Diary with Apple or Google, they act under their own privacy policies. We disclose personal data to authorities only when the law requires it.

7. Where your data is stored

Your Diary account, everything you write, the health data Diary reads, and contact form submissions are stored in the AWS Europe (Stockholm) region in Sweden, inside the EU/EEA. Diary's AI runs on Amazon Bedrock in the EU. Google and Sentry are headquartered in the United States and may access data from there. For those transfers we rely on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

If you are in South Africa, storing your data in Sweden is a transfer outside South Africa. We rely on section 72 of the Protection of Personal Information Act (POPIA): your data is protected there by the GDPR, which gives protection substantially similar to POPIA's.

8. How long we keep data

• Diary account, everything you write and health data Diary has read: while your account exists. After you delete it, 30 days from live systems and 35 days from backups.
• Contact form messages: 12 months after our last contact with you, or sooner if you ask.
• First-party analytics events: 13 months.
• Google Analytics data: 2 months.
• Sentry error reports and replays: 90 days.
• Server and app logs: 30 days.

9. Security

Data is encrypted in transit (TLS) and at rest using AWS-managed encryption, following AWS security best practice. Access is limited to the people who need it to run the service. If a personal data breach occurs, we notify Datatilsynet within 72 hours where the law requires, and we tell you without undue delay if it puts you at high risk.

10. Your rights

Under the GDPR you can ask to see the personal data we hold about you, correct it, delete it, restrict how we use it, receive a copy in a portable format, and object to processing based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time: in the Diary app's settings for the AI and links, in your phone's settings for health sources, and with Cookie settings on the Site.

You can delete your Diary account yourself in the app. For anything else, email hello@mendai.tech. We reply within one month, free of charge, and may ask you to confirm your identity first. You can also complain to Datatilsynet (the Norwegian Data Protection Authority) or the data protection authority where you live.

If you are in South Africa, you have the same rights under POPIA. Our information officer can be reached at hello@mendai.tech, and you can complain to the Information Regulator.

11. Age

The Site and Diary are for people aged 18 or older. We do not knowingly collect data from anyone younger. If we learn that someone under 18 has an account or has contacted us, we delete their data.

12. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how Diary uses your data, we tell you in the app or by email before it takes effect, and we ask for your consent again where the law requires it.

13. Contact

MendAI AS, Terrasseveien 44B, 1363 Høvik, Bærum, Norway. Email: hello@mendai.tech. See also our Terms of Use.