Privacy Policy
REVIEW REQUIRED — draft, not legally approved. Version draft-2026-10-11.
Who is responsible
The data controller's legal name, address and privacy contact will be added here before launch. Until then, contact the MindFocus team through the app.
What we collect
Account details (name, email), the answers you choose to give in onboarding and self-reflection tests, AI coaching conversations, habits, check-ins and progress you record, bookings and purchases. Some of this can reveal information about your wellbeing or mental health, which UK GDPR treats as special category (health) data. Payment card and bank details are handled by Stripe — we only keep Stripe reference IDs, never your card number.
What we don't save
Reflection notes in Mind Skills Studio and Resilient Mind are not saved, and are not sent to us, to AI providers or to analytics. Their progress marks are stored only on your device. The optional Quiet & Contemplation pathway is opt-in, and we don't record or infer your beliefs.
How we use it and why (UK GDPR)
To provide and personalise coaching (contract), process payments (contract and legal obligation), keep the service safe, including safety alerts if a conversation suggests risk of harm (legitimate interests / vital interests), and to communicate about your account (contract). Health-related information is processed with your explicit consent, which you can withdraw. These legal bases are awaiting legal review. We don't sell your data and we don't use advertising pixels.
Service providers
Hosting and database (Lovable Cloud), payments (Stripe), and AI models you select (OpenAI GPT, Google Gemini or Anthropic Claude) via our AI gateway to generate coaching replies. Some providers may process data outside the UK.
Who can see it
Your private data is protected by access rules so other users can't see it. Coaches you book can see booking details and may keep private session notes. Community posts are visible to paid members only. Authorised administrators can access data where needed to run and secure the service.
How long we keep it
Retention periods are awaiting admin confirmation and will be listed here before launch.
Your rights
You can ask to access, correct, delete or export your data, object to or restrict processing, and withdraw consent. You can complain to the UK Information Commissioner's Office (ico.org.uk).