1. Who is responsible for your information
Mindara, a unit of eMedify, Sangrur, Punjab 148001, India, is responsible for the information described here. Depending on the service, an independent healthcare professional or a sponsoring organisation may also be responsible for limited information they process for their own purposes. Contact [email protected] for privacy questions.
Grievance Officer: Dr Devanshu (Grievance Officer), Mindara, a unit of eMedify, Sangrur, Punjab 148001, India. Email [email protected]. We acknowledge every complaint within 48 hours and aim to resolve it within one month.
2. Information we collect
- Account and identity: name, email, telephone, age or guardian details where needed, authentication and security events.
- Profile and preferences: location, language, accessibility choices, care goals, provider preferences, saved content, and consent choices.
- Care information: bookings, intake answers, messages, assessments, care plans, prescriptions, clinical documents, and information a provider records in delivering care.
- Mira (AI companion) and self-help: your conversations with Mira, short notes Mira keeps to personalise later conversations, mood check-ins and their notes, journal reflections, and answers and scores from screening questionnaires such as PHQ-9 or GAD-7.
- Care-history sharing: when you choose to share selected history with a provider, what was shared, with whom, and when.
- Session operations: room provider, connection and attendance times, participant role, support events, and recording or in-room chat metadata where the service policy and required consent permit capture.
- Payments: transaction references, amount, currency, status, refund and invoice details. Payment-card credentials are handled by the payment provider, not stored as ordinary Mindara profile data.
- Device and use: IP address, browser, device, logs, security signals, referral data, cookie preferences, browser notification subscriptions, and analytics as described in section 11.
- Messages we send you: the emails, notifications and WhatsApp messages we send, and whether an email was opened or a link in it was clicked, so we can check delivery and improve our messages.
- Provider and careers data: qualifications, registrations, service jurisdictions, availability, work history, application answers, CV documents, and consented CV-extraction results. For providers, we also measure active time on the provider dashboard (only while a page is open and in use) for service quality and support.
- Professionals we invite: if you are a mental-health or wellness professional, we may use contact details you have published in professional directories, or that were shared with us, to invite you to join Mindara. Every invitation lets you unsubscribe.
3. Why and on what basis we use it
We process information to create and secure accounts; arrange and document care; enable communications; take payment; operate programmes; provide support; prevent abuse; meet legal and professional duties; and improve the service. Depending on local law, the basis may be performance of a contract, informed or explicit consent, compliance with law, protection of vital interests, provision or management of healthcare, or a legitimate interest balanced against your rights. Marketing and optional analytics use separate choices where required.
4. Health and other sensitive information
Health information receives additional protection. Access is limited by role and care relationship. We do not use clinical conversations or CVs for advertising. We do not sell personal information. Where local law treats health, biometric, professional, or identity data as sensitive or special-category information, we apply the additional lawful condition and consent or notice required there.
5. AI-assisted processing
Some companion, matching, summarisation, or CV-extraction features use AI services: currently Anthropic (Claude), Google (Gemini) and OpenAI-compatible services, as configured by Mindara. When you talk with Mira, the content of the conversation is sent to the AI service so it can reply; your name is replaced with a placeholder first. These services process the information to provide the feature to us, under their business terms. The purpose is to assist organisation or human review, not to make a final clinical or employment decision. Career CV extraction requires an explicit application choice; if extraction is unavailable, a person reviews the original file. We do not automatically reject an applicant or publish a provider profile from a CV. Applicants can review and correct a generated provider draft before submitting it for verification. No data received through Google Workspace APIs or Google Sign-In is ever passed to, processed by, or used to train any AI models.
6. Google User Data and Workspace APIs
Mindara provides optional features that integrate with Google services, including "Sign in with Google" and video consultation room hosting via Google Meet. When you choose to use these features, our application accesses, processes, and stores specific Google user data in strict accordance with the following disclosures:
- Google Sign-In: We access basic profile information (your Google user identifier, email address, and name) solely to authenticate your identity, create or link your Mindara account, and protect account security.
- Google Calendar and Meet: For providers connecting Google Meet or when company-assisted Google Meet session hosting is used, we request Calendar access (
https://www.googleapis.com/auth/calendar.events.owned) and the applicable Meet permission:https://www.googleapis.com/auth/meetings.space.createdfor company-created meeting spaces, orhttps://www.googleapis.com/auth/meetings.space.readonlyfor provider-hosted attendance. These permissions are used to schedule consultations, generate conference links, attach meeting details to appointments, and reconcile participant attendance and duration for booked sessions.
Data Sharing, Transfer, and Disclosure: Mindara does not sell, trade, transfer, or disclose Google user data to third parties, external advertisers, data brokers, or third-party AI services. Google user data is used solely to facilitate the requested user-facing features (account authentication and appointment video scheduling) between the client and healthcare provider, and is never shared beyond what is strictly necessary to conduct the care session.
Google Limited Use Policy Compliance: Mindara's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Prohibition on AI/ML Model Training: Google user data is never used to create, train, fine-tune, or improve foundational, generalized, or custom AI/ML models. No Google user data or Google Workspace data is ever transferred to or processed by any third-party AI service provider (including Google Gemini, OpenAI, or Anthropic).
7. Who receives information
Information may be available to the professional delivering care, authorised Mindara teams, and service providers needed for hosting, email, payments, video rooms, security, support, analytics, or AI processing. Each receives only what is reasonably needed and is subject to contractual or legal controls. As stated in Section 6, Google user data is never shared with third-party advertisers, data brokers, or AI model providers. Employers and programme sponsors receive eligibility administration and carefully aggregated reporting, not individual therapy content, unless you direct us or law requires disclosure.
The main service providers we use are: payments — PayU, Cashfree and PayPal; video sessions — Zoom, Jitsi and Google Meet; email — Brevo and our own mail server; WhatsApp messages — Meta (WhatsApp Business); website security and delivery — Cloudflare; product analytics — Google Analytics; reading text from uploaded CVs — OCR.space; AI features — the AI services listed in section 5; browser notifications — your browser’s push service. You can ask us for the full list of parties your information has been shared with.
8. International transfers
Mindara and its providers may process information outside your country. We assess destination restrictions and use appropriate contractual, organisational, and technical safeguards. Where required, we rely on an adequacy decision, approved transfer clauses, consent for a specific transfer, or another lawful mechanism. Location-specific care restrictions remain separate from data-transfer rules.
9. Retention
We keep your account information, care records and Mira history while your account is open. Our team deletes them when you ask us to or when you close your account, except records we must keep for clinical record duties, tax, payment, fraud prevention, disputes or other legal reasons; those are kept only for as long as that duty lasts. Database backups are overwritten on a rolling basis, normally within 35 days. A few things are removed automatically: unsuccessful career CVs after the recruitment retention period, normally 180 days (unless the applicant agrees to a talent-pool period or law requires longer), AI service logs after 30 days, and product-analytics records after about 400 days.
10. Security
Safeguards include encrypted transport, access controls, role separation, audit logs, private document storage, session expiry, backups, monitoring, and incident-response procedures. No system is risk-free. Tell us promptly if credentials or a private link may have been exposed. If a personal-data breach affects you, we will tell you, and the Data Protection Board of India, as the law requires.
11. Cookies and analytics
Essential storage keeps you signed in, protects forms, remembers privacy choices, and supports payment or care flows. Product analytics is on by default to help us understand which pages are useful. It uses our own measurement and Google Analytics, with IP anonymisation and without advertising features, and it never includes care messages, session notes, CVs, or payment details. We also remember for up to 90 days which page or campaign first brought you to Mindara. You can turn product analytics off at any time from this page, which stops it in your browser, including Google Analytics; a minimal record of key service events, such as a completed booking, is still kept to run the service. Browser controls can also remove stored cookies.
12. Your choices and rights
Depending on where you live, you may ask for access, correction, erasure, restriction, portability, objection, withdrawal of consent, information about sharing, or review of a significant automated decision. You may also complain to the relevant authority. Use the controls above or email [email protected]. We may verify identity and explain when a lawful exception applies. Withdrawing consent does not undo processing already lawfully completed.
In India, you can also ask for a summary of the personal information we hold about you and the parties we have shared it with, and you can nominate another person to exercise your rights if you die or become unable to. We reply to data requests within 30 days. If you are not satisfied with how we handle a grievance, you can complain to the Data Protection Board of India.
13. Children and guardians
Mindara accounts are for adults (18 or older). A child under 18 does not get an account of their own. Instead, a parent or legal guardian adds a child profile under “Family members you manage”, gives us the child’s name and date of birth, and records their permission for us to store the child’s details for their care. The child profile has no login, no email of its own, and every message or update about the child goes to the parent or guardian.
Before any session can be booked for a child, the parent or guardian must confirm they are the parent or guardian by uploading an identity document (or, when available, through DigiLocker). Our team checks it, and we keep a record of the confirmation and the permission given. Until then the child profile is browse-only. Confirmation ends automatically on the child’s 18th birthday, and a parent or guardian can remove a child profile at any time.
Some features are off for under-18s: there is no marketing, no AI personalisation, no community posting and no paid-placement advertising on a child profile, and we never use a child’s information for behavioural monitoring or targeted advertising. When a doctor (for example a psychiatrist or neurologist) consults a child online, a parent or guardian must be present for the whole consultation and the doctor records that they checked who that adult is. Providers choose whether they see under-18s, and some session types are for adults only. We limit what we collect about a child to what their care needs.
14. Regional information
India
India users may exercise rights and grievance routes under the Digital Personal Data Protection Act, 2023 and applicable DPDP Rules. Mental-health records also engage confidentiality and access protections under the Mental Healthcare Act, 2017.
EEA and United Kingdom
Users may have the rights described by the European Commission, including access, rectification, erasure, restriction, portability, objection, and safeguards around solely automated decisions. Health information is special-category data; the UK ICO guidance explains the additional protection.
California
California residents may have rights to know, correct, delete, limit certain uses of sensitive personal information, and opt out of sale or sharing under the California Consumer Privacy Act. Mindara does not sell personal information or share it for cross-context behavioural advertising.
Canada, Australia, Singapore, and the UAE
We respond to applicable rights and principles under Canada’s PIPEDA fair information principles, Australia’s Australian Privacy Principles, Singapore’s PDPA obligations, and the UAE’s personal-data protection law. Provincial, state, health-sector, or free-zone rules may also apply.
15. Updates and contact
We date material revisions and provide additional notice or renewed consent where required. Questions: [email protected]. Grievances: Dr Devanshu (Grievance Officer), Mindara, a unit of eMedify, Sangrur, Punjab 148001, India. Email [email protected]. We acknowledge every complaint within 48 hours and aim to resolve it within one month.