Legal
Privacy Policy
This page covers Myndgard Share: the Myndgard app and web portal. Myndgard Discover has its own privacy policy, terms and support page.
Myndgard is a mental-health support service used by universities, colleges and therapy practices ("your care provider"). If your care provider has invited you, you can use the Myndgard app and web portal to complete wellbeing questionnaires, track mood and activity, and stay in touch with your clinician between sessions.
Because Myndgard holds information about your mental health, this policy explains plainly what we collect, why, who can see it, how long we keep it, and what you can do about it.
Who is responsible for your data
The Myndgard app, web portal and the service behind them are operated by Myndgard Limited ("Myndgard", "we", "us"), a company registered in Ireland. Myndgard Limited is the data controller for the personal data described in this policy.
For any question about this policy or your data, contact us at privacy@myndgard.com.
Your care provider's clinicians use Myndgard to deliver your care. Any records your care provider keeps outside Myndgard are covered by their own privacy notice.
What we collect
| Information | Where it comes from | Why |
|---|---|---|
| Name, email address, and optional phone number | Your care provider, when it invites you, and you | To create and run your account, sign you in, and contact you about the service |
| Password | You | To sign you in. It is stored only as a one-way hash and we cannot read it |
| Questionnaire answers and scores (for example PHQ-9, GAD-7, intake and check-in questionnaires) | You | So you and your clinician can follow how you are doing over time |
| Mood check-ins, journal entries, homework and messages with your clinician | You | To support your care between sessions |
| Movement and mindfulness sessions you record in the app | You | So you can see your own progress and your clinician can see it too |
| Steps, workouts and sleep from Apple Health on iPhone (optional, off unless you turn it on) | Your phone, with your permission | So you and your clinician can see how activity and rest relate to your wellbeing |
| Clinical information entered by your clinician (for example reason for referral, clinical notes, treatment plans, risk assessments, waitlist information) | Your care provider | To deliver and record your care |
| Push notification token (optional) | Your phone | To send reminders and alerts if you turn notifications on |
| Consent record | You | To record which version of this policy and the terms you accepted, what you agreed to, and when |
| Security and audit logs (sign-ins and account actions, with time, IP address and device type) | Our systems | To keep the service secure and investigate problems |
| Crash and error reports | Our systems | To find and fix faults. Reports are scrubbed of health information and are not linked to your name |
We do not use advertising, third-party analytics or tracking in the app or portal, we do not sell your data, and we do not use your data for marketing.
We do not use artificial intelligence (AI) or large language models to process your information.
Who can see your information
- You can see the information you have entered and the results of your questionnaires.
- Your assigned clinician(s) at your care provider can see your questionnaire answers and scores, check-ins, journal entries you share, messages, movement, mindfulness and (if you turn it on) health-app data, together with the clinical information they and their colleagues record. Clinician access ends when they are no longer assigned to you.
- Your care provider's administrators can see your account details and the information needed to run the service for their organisation (for example assigning clinicians and managing the waitlist).
- Myndgard staff operate and support the service. Their access is restricted, logged and used only to run and support it.
- Service providers (processors) that run parts of the service on our behalf, under contracts that limit what they may do with your data:
| Provider | What they do | Where |
|---|---|---|
| Amazon Web Services | Hosting, databases and file storage | Ireland (EU) |
| SendGrid (Twilio) | Sending service emails such as invitations and password resets | United States |
| Google Firebase Cloud Messaging and Apple Push Notification service | Delivering push notifications to your phone | United States |
| Sentry | Crash and error reporting (scrubbed of health information) | United States |
Notification and email content is kept generic (for example "You have a new message") so that it does not reveal health information on your lock screen or in your inbox.
We will also disclose information if the law requires it, or where we believe in good faith that it is necessary to protect someone's life or safety.
Automated scoring
Questionnaires are scored automatically using their published scoring rules. Some answers, such as those indicating thoughts of self-harm, automatically alert your clinician so that a person can follow up with you. These alerts support your clinician's judgement; they do not make decisions about you on their own.
Legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and providing the service | Art. 6(1)(b), necessary to provide the service you have signed up for |
| Processing your health information (questionnaires, check-ins, journals, messages, clinical information) and sharing it with your clinicians | Art. 9(2)(a), your explicit consent, together with Art. 6(1)(a) |
| Health-app data (steps, workouts, sleep) | Art. 9(2)(a), your explicit consent, which is optional and off by default |
| Push notifications | Art. 6(1)(a), your consent, which is optional |
| Security and audit logs, and crash reports | Art. 6(1)(f), our legitimate interest in keeping the service secure and working |
| Disclosures needed to protect someone's life | Art. 6(1)(d) and Art. 9(2)(c), vital interests |
| Keeping records we are legally required to keep | Art. 6(1)(c), legal obligation |
You give consent in the app or portal the first time you sign in, purpose by purpose. Processing your health information and sharing it with your clinicians are needed for the service to work, so you cannot use Myndgard without them. Health-app data and push notifications are optional. You can withdraw any consent at any time in Settings → Privacy & consent. Withdrawing consent stops that processing from then on but does not affect processing that already took place.
How we protect your information
All traffic between the app or portal and our servers is encrypted. Clinical content such as questionnaire answers, notes, messages, journal entries and treatment plans is additionally encrypted in our database with keys managed separately from the data. Access is restricted by role and to the clinicians assigned to you, and access to patient information is logged. Health information is excluded from our application logs and crash reports. On your phone, sign-in tokens and health information are kept in the device's secure storage and are not included in cloud backups.
How long we keep it
We keep your information for as long as your account is active.
When you delete your account (see below), it is deactivated immediately and you are signed out everywhere. Thirty days later, all of your personal data is permanently erased, including your questionnaire answers, clinical information, messages and health-app data. During those 30 days you can change your mind by contacting support@myndgard.com. Encrypted backups are overwritten within a further 14 days.
After erasure we keep only a record that consent was given and withdrawn, with your identity removed, because we must be able to show that consent was obtained. Your care provider may keep its own clinical records outside Myndgard under its own obligations.
Security logs are kept for 12 months.
Your rights
You can do these yourself, in the app (Profile) or the portal (Account settings → Privacy):
- Export my data gives you a copy of the information we hold about you in a machine-readable format (Art. 15 and 20).
- Delete my account starts erasure as described above (Art. 17).
- Privacy & consent lets you withdraw or give consent purpose by purpose (Art. 7(3)).
You also have the right to correct inaccurate information (Art. 16), to restrict or object to processing (Art. 18 and 21), and not to be subject to decisions based solely on automated processing (Art. 22). To exercise any right, email privacy@myndgard.com. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Data Protection Commission in Ireland (www.dataprotection.ie) or the data protection authority where you live.
International transfers
Your data is stored in the EU (Ireland). Where a provider listed above processes data in the United States, we rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
Age
Myndgard is for adults. You must be 18 or over to use it. If you believe someone under 18 has an account, contact privacy@myndgard.com and we will remove it.
Changes to this policy
If we make a material change, we will tell you in the app and portal and ask you to review and accept the new version before you continue. The version number and effective date above change whenever this policy does.
If you are in distress
Myndgard is not an emergency service. If you are in danger or need urgent help, call 112 or 999. You can call Samaritans free on 116 123 at any time or text 50808. Your care provider's emergency contacts are also listed in the app.
Myndgard Limited · privacy@myndgard.com