Privacy Policy

1 Information We Collect

To provide the Service, we collect:

• Identity & account: name, email address, and password (stored as a salted hash, never in plain text).
• Health & wellness data: mood scores, emotions, sleep/stress/energy levels, and journal notes you choose to log.
• Appointment data: therapist bookings, session times, session type, and ratings you leave.
• Communications: messages exchanged with your therapist, and conversations with the in-app AI companion.
• Usage & device data: app interactions, device type, and OS version, used for reliability and security purposes.

2 How We Use Your Information

• To provide core features: therapist matching and booking, mood tracking and insights, secure messaging, and the AI companion.
• To detect and respond to safety and crisis situations (for example, surfacing crisis-line resources when our systems detect signs of risk in an AI chat).
• To send you appointment, message, and account notifications.
• To maintain the security, integrity, and reliability of the Service.

We do not use your health data for advertising, and we do not sell your personal information.

3 How We Share Information

We share information only as needed to operate the Service:

• Your therapist: appointment details and messages you send are visible to the therapist you are booked with.
• AI service provider: messages you send to the AI companion are processed by our own AI Integration service (not a third-party AI brand) to generate a response. Messages are screened for crisis risk before a response is generated.
• Push, email & SMS providers: we use Firebase Cloud Messaging (push notifications), Resend (email), and Africa's Talking (SMS) to deliver notifications — each receives only the contact information (device token, email, or phone number) needed to deliver that notification.
• Legal & safety: where required by law, or to protect someone's immediate safety.

We never sell your data to third parties or advertisers.

4 Data Security

All data in transit is encrypted via TLS/HTTPS. Direct messages between you and your therapist, and anonymous community content, are additionally encrypted at rest (AES-256-GCM). Access to your data is limited to what each part of our system needs to function.

5 Data Retention

We retain your account and health data for as long as your account is active, so you can see your history and progress over time. If you delete your account, we delete or anonymize your personal data within 30 days, except where we're required to retain it for legal or safety reasons.

6 Your Rights & Choices

You can access or correct your profile at any time from within the app. You can request a full export or deletion of your data by visiting our Delete Account page or emailing us at the address below.

7 Children's Privacy

Mindora is not directed at, and is not intended for use by, children under the age of 16. We do not knowingly collect personal information from children under this age. If you believe a child has provided us with personal information, please contact us so we can remove it.

8 International Users

Mindora is operated from Rwanda and handled in accordance with Rwanda's Law N°058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy, as well as other applicable data protection laws.

9 Changes to This Policy

We may update this policy from time to time. We'll notify you of material changes in the app or by email before they take effect.

10 Contact Us

For any privacy questions or requests, reach us at privacy@mindora.app.