Privacy Policy

Privacy Policy

Mind Friend Inc. · Version 3.2 · Last updated 23 October 2026

This Policy explains how Mind Friend Inc. handles personal data when you use the MindFriend platform, including Olive Friend, or visit www.mindfriend.com.

1. Who we are and what this covers

Mind Friend Inc. ("MindFriend", "we", "us") operates the MindFriend platform. Mind Friend Inc. is a corporation registered in the State of Delaware, United States (Delaware File No. 10723358). Registered office: 251 Little Falls Drive, Wilmington, New Castle County, DE 19808, USA. Registered agent: Corporation Service Company. General enquiries: talk@mindfriend.com. Legal enquiries: legal@mindfriend.com. Website: www.mindfriend.com.

For users in the United Kingdom, UK data-protection law (UK GDPR and the Data Protection Act 2018) applies. For users in the United States, this Policy and the additional information in Sections 16 and 17 apply. Privacy questions and requests: legal@mindfriend.com.

2. Who is responsible for what

Responsibility follows the activity, not the organisation:

Mind Friend Inc. is responsible for the personal data the Platform processes: your account and profile; searches and filters; bookings and payment records; support requests; security and audit logs; first-party usage analytics; the transmission and 14-day storage of messages and in-session chat between Clients and Professionals; video and audio technical metadata; Olive Friend conversations; and Professionals' account, credential and profile data.

Each Professional is separately responsible for the clinical use of what a Client shares with them and for the clinical records, notes, diagnoses, treatment decisions, consents and safeguarding records they create. Professionals handle that information under their own privacy notice and professional obligations. MindFriend does not create, hold or access clinical notes.

Stripe is responsible for the card and bank details you give it directly when paying or receiving payouts, under Stripe's own privacy policy.

Where a Professional is subject to specific US health-privacy law for the services they provide, MindFriend supports the arrangements that law requires; contact legal@mindfriend.com for details.

3. The data we collect

Account data: name, email, password (stored as a hash), country and, for US users, state; for Professionals, title, qualifications, registration or licence details, insurance details, states or countries served, fees, availability and profile content including any Promotional Video.

Booking and payment data: the Professional booked, date, time, format, price, cancellation policy accepted, status, refunds; payment status and the last four digits of a card, but not the card number, which Stripe holds.

Communications: messages and in-session chat between Clients and Professionals, held for 14 days; support emails.

Olive Friend: the text you enter, Olive's responses, timestamps, and safety signals (for example that a crisis prompt was shown).

Olive Friend guest use: if you use Olive without an account, a temporary session identifier, your IP address and device details, your confirmation that you are 18 or over and your consent, and the conversation for the duration of the session only.

Health-related information you choose to share when you search or filter, message a Professional, or use Olive. We treat this as sensitive data.

Technical data: IP address, device and browser information, security and audit logs, and first-party usage analytics.

Acceptance records: the version of each agreement you accepted and when, with IP address and device.

4. Why we use it and our legal basis

Purpose	Data	Legal basis (UK)
Creating and running your account; providing search, booking and communication tools	Account, booking, communications, technical	Contract (Art. 6(1)(b))
Processing payments and refunds and preventing fraud	Booking and payment, technical	Contract; legal obligation; legitimate interests (fraud prevention)
Transmitting and storing for 14 days your messages and in-session chat, including any health-related information you include	Communications	Contract, and your explicit consent for health-related content (Art. 9(2)(a)), given the first time you send a message; withdrawable at any time
Providing Olive Friend and keeping it safe	Olive Friend data	Your explicit consent (Arts. 6(1)(a) and 9(2)(a)), given when you first use Olive; withdrawable by stopping use or deleting your history; legitimate interests for technical security logs
Administrative credential checks of Professionals	Professional account data	Legitimate interests (platform integrity); legal obligation where applicable
Security, abuse prevention, audit	Technical, acceptance records	Legitimate interests; legal obligation
Support and complaints	Support communications	Contract; legitimate interests
Legal claims and regulatory requests	Any relevant data	Legal obligation; legitimate interests; Art. 9(2)(f) where health data is involved
Service emails (confirmations, reminders, receipts, notices)	Account, booking	Contract
Marketing emails	Account (email)	Consent, withdrawable at any time

We do not use health or booking data for advertising, do not sell personal data, and do not share personal data with advertising networks.

5. Our data-minimisation commitments

We do not record Sessions.

We do not create, hold or access clinical notes.

We do not use artificial intelligence on messages or in-session chat between a Client and a Professional.

Olive Friend conversations are used only to generate responses and keep the feature safe; our AI service provider, OpenAI, operates under zero data retention, and conversations are not used to train AI models and are not shared with Professionals.

We keep messages and in-session chat for 14 days only, then delete them automatically.

First-party analytics are pseudonymised: usage is measured against a random identifier, not your name or email, and health-related content is excluded from analytics.

We do not use third-party analytics or advertising tags (see Section 18).

6. Who we share data with

We share personal data only with the service providers we need to run the Platform, each under a contract that restricts them to acting on our instructions: hosting and storage (Amazon Web Services), video and audio infrastructure (Stream), transactional email (Mailjet), chat-media storage (Cloudinary), bot protection on forms (Google reCAPTCHA), optional sign-in (Google Sign-In, under Google's terms), payment processing (Stripe), and, for Olive Friend, OpenAI, which generates Olive's responses on our instructions under a data-processing agreement with zero data retention: OpenAI does not store your conversations after generating the response and is contractually prohibited from using them to train its models. The current list is in Section 19 of this Policy.

We share your messages and booking details with the Professional you choose, because that is the service you asked for. If your access is paid for by an Organisation, the Organisation receives only aggregated, de-identified usage reporting and never your individual data. We disclose data to authorities or others where the law requires it, or where necessary to protect someone from serious harm, and we will tell you where we lawfully can.

7. International transfers

Our providers process data in the United Kingdom, the European Economic Area and the United States. Where personal data of UK users is transferred outside the United Kingdom, we rely on a UK adequacy regulation or on appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with a transfer risk assessment and any supplementary measures required. Details of the safeguard for a particular provider are available from legal@mindfriend.com.

8. How long we keep it

Data	Retention
Messages and in-session chat	14 days, then deleted automatically
Olive Friend conversations	Until you delete them, or 30 days after your account closes
Olive Friend guest conversations (no account)	Deleted when the session ends; the confirmation record is kept 6 years
Olive safety-signal records	12 months
Account and profile	While your account is open, then 30 days
Booking and payment records	6 years after the transaction (accounting and legal requirements)
Acceptance records	6 years after the agreement ends
Support communications	2 years
Security and audit logs	12 months
Professional credential-check records	While listed, then 6 years

9. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to receive a portable copy, and to withdraw consent where consent is the basis. Contact legal@mindfriend.com; we respond within one month (extendable by two months for complex requests, with notice). For clinical records, contact your Professional. UK users may complain to the Information Commissioner's Office at ico.org.uk. Withdrawing consent to messaging or Olive means those features will no longer be available to you; it does not affect processing before withdrawal.

10. Automated decision-making and profiling

Search results are ordered by relevance to your criteria and filters as described in the Terms and Conditions for Professionals. Olive Friend generates conversational responses and, if a safety signal is raised, shows crisis resources. Neither makes decisions with legal or similarly significant effects about you, and no decision about whether you may use the Platform is made solely by automated means.

11. Security

We protect personal data with technical and organisational measures appropriate to its sensitivity, including the automatic 14-day deletion of communications. No system is completely secure; we will notify you and the relevant authority of a personal-data breach where the law requires it.

12. Cookies

See Section 18 of this Policy. The Platform uses only cookies that are strictly necessary to run it; there are no advertising or third-party analytics cookies.

13. Children

The Platform, including Olive Friend and its guest mode, is for adults aged 18 and over; guests confirm their age before their first message. We do not knowingly collect data from anyone under 18, and we delete such data if we become aware of it.

14. If you are a Professional

We process your account, credential, insurance, profile and payout data to list you, to carry out administrative credential checks, to pay you and to meet our legal obligations. Your profile is public to registered Clients. If you provide a Promotional Video and consent to its promotional use, we process your image, voice and name on the basis of that consent, which you can withdraw as described in the Terms and Conditions for Professionals.

15. Olive Friend

When you use Olive we process what you type, Olive's responses, timestamps and safety signals. Anything you tell Olive about your health or feelings is health-related data and is protected as such. Your conversation text is sent to OpenAI only to generate responses. OpenAI acts on our instructions under a data-processing agreement with zero data retention: it does not store your conversations after generating the response, and it may not use them to train its models. We do not routinely read Olive conversations; a small number of trained staff may review a conversation where an automated safety signal is raised, where you ask us to, or to investigate misuse, and each such access is logged. Olive conversations are not shared with Professionals and are not linked to your messages with a Professional. You can delete your Olive history at any time from your account.

Using Olive without an account. You can use Olive as a guest. Before your first message we ask you to confirm that you are 18 or over and to consent to our handling of what you share, including anything about your health; this consent is the legal basis for guest use, and you withdraw it simply by ending the session. We hold a temporary session identifier, your IP address and device details so that the session works and so that we can keep a record of your confirmation. Guest conversations are not saved to any account: they are used to generate Olive's responses during the session and are deleted when the session ends, so there is no history to retrieve, review or delete afterwards. The record of your confirmation (session identifier, timestamp, IP address, device, and the version of the notice you confirmed) is kept for six years, as for other acceptance records, and never contains the content of your conversation. Safety-signal records are kept as described in Section 8. Guests cannot book or message Professionals.

16. Additional information for users in the United States

This Section applies if you are a resident of a US state whose privacy law gives you the rights below. What we collect: identifiers, account credentials, commercial information (bookings and payments), internet activity (logs), state-level location, and health-related information you provide. We do not sell personal information and do not share it for cross-context behavioural advertising; we honour Global Privacy Control signals. Sensitive personal information (health-related content) is used only to provide the services you request. Your rights: to know and access, to delete, to correct, to obtain a portable copy, to limit the use of sensitive personal information, and not to be discriminated against for exercising your rights. How to exercise them: email legal@mindfriend.com or use your account controls; we verify requests using your account email and may ask for further confirmation; you may use an authorised agent; we respond within 45 days, extendable once by 45 days with notice. Notice at collection is given at account creation and where you enter health-related information.

17. Consumer health data (Washington, Nevada, Connecticut and similar laws)

Consumer health data we collect: health-related information you enter when searching for or messaging a Professional or using Olive Friend; safety signals; and booking records that show you sought mental-health support. Sources: you. Why: to provide the services you request and keep them safe. Who receives it: the Professional you choose (for messages and bookings) and the providers listed in Section 6 for hosting, video, email, chat media and, for Olive, AI responses; never advertisers. We do not sell consumer health data. Consent: where your state's law requires it, we ask for your opt-in consent before collecting consumer health data, at the point you first message a Professional or use Olive. Your rights: to access, to withdraw consent, to have data deleted (including from our providers), and to appeal a refusal by emailing legal@mindfriend.com with "Appeal" in the subject line; we respond within 45 days. Geofencing: we do not use geofencing around health facilities.

18. Cookies

18.1 Our approach

We use only cookies that are strictly necessary to run the Platform. We do not use advertising cookies, third-party analytics cookies, or any tracking that follows you to other websites. Because every cookie we set is strictly necessary, we do not show a cookie banner; UK law (the Privacy and Electronic Communications Regulations) does not require consent for strictly necessary cookies. We do not sell or share personal data collected through cookies, and we honour Global Privacy Control signals from US users.

18.2 The cookies we use

Cookie	Purpose	Duration
Session cookie	Keeps you signed in and protects your session against forgery	Until you sign out or close the browser
Security cookie	Protects forms and login against automated abuse (Google reCAPTCHA)	Session
Preferences cookie	Remembers your language and display settings	12 months

18.3 Analytics

Our usage analytics are first-party and are produced from server-side records against a random identifier that is not linked to your name or email; they set no cookie and exclude health-related content.

18.4 Third parties

Google reCAPTCHA sets a cookie to distinguish people from automated traffic on our forms; Google's privacy policy governs Google's use of that data. If you sign in with Google, Google's own cookies and terms apply to the sign-in. No other third party sets cookies on the Platform.

18.5 Managing cookies

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent you from signing in or booking. If we add any cookie that is not strictly necessary, we will ask for your consent before setting it and update this Policy.

19. Service providers

Provider	What it does for the Platform
Stripe	Payment processing, Professional payout onboarding and payouts; holds card and bank details under its own privacy policy
Amazon Web Services (AWS)	Platform hosting and data storage
Stream	Video and audio infrastructure for Sessions; MindFriend does not record Sessions
Mailjet	Transactional email (confirmations, reminders, receipts, notices)
Cloudinary	Storage of media shared in chat, subject to the 14-day chat retention
Google reCAPTCHA	Bot and abuse protection on forms
Google Sign-In	Optional account sign-in, under Google's own terms
OpenAI (Olive Friend)	Generates Olive Friend responses on our instructions under a data-processing agreement with zero data retention; does not store conversations after generating the response; contractually prohibited from using them to train its models
First-party analytics	Operated by MindFriend; no third-party analytics provider
Credential checks	Administrative checks carried out by MindFriend staff; no third-party verification service

19.1 Changes

We update this page when a provider is added or replaced. Material changes affecting your data are also notified as described in the Privacy Policy. Questions: legal@mindfriend.com.

20. Changes and contact

We may update this Policy. Material changes are notified by email and by a notice on the Platform before they take effect; the version and date appear at the top. Contact: legal@mindfriend.com · Mind Friend Inc., 251 Little Falls Drive, Wilmington, New Castle County, DE 19808, USA.