Privacy policy

In short

• MyndfulPal handles patients’ information for their clinic, only to run MyndfulPal, under the clinic’s agreement with it.
• MyndfulPal doesn’t sell information, doesn’t show ads, doesn’t use tracking tools on this site or in the apps, and doesn’t use patients’ information to train AI.
• Phone numbers and text message opt-in data are never sold, and never shared with third parties or affiliates for marketing or promotional purposes.

Who we are

MyndfulPal (“we”) makes a patient app and a care-team portal that clinics use to look after patients between visits, and runs this website.

When a clinic uses MyndfulPal, the clinic is the patient’s health care provider and is responsible for their information under HIPAA, the federal health privacy law. MyndfulPal is the clinic’s “business associate”: a company that handles health information for a provider and must protect it the way the provider would. MyndfulPal may use a patient’s information only as the clinic’s agreement with it allows. Patients’ rights over their health information are explained in their clinic’s Notice of Privacy Practices, and they use them through their clinic.

This website

• No cookies, analytics or tracking. This site sets no cookies, and loads nothing from other companies: no analytics, advertising or social media tools. Since nothing tracks you across websites, the site works the same whether or not your browser sends a “Do Not Track” signal.
• Visit logs. Like most websites, our servers record technical details of each request, such as your IP address, browser type, the page and the time, to keep the site secure and working. These logs are kept for up to 90 days.
• Book a demo. If you request a demo, we get your name, work email, clinic or practice, role, how many patients you’d start with, anything you write in the form, and your browser type. We use them only to reply to you and arrange the demo. They’re stored on Amazon Web Services and emailed to our team, and we don’t add you to a mailing list. Please don’t include health information in the form.

Information in the MyndfulPal apps

What the apps hold

• From the clinic, when it adds a patient: their name, email address, phone number (if given), date of birth, time zone, diagnoses, medicines, care plan and visits, and discharge details for post-discharge monitoring.
• From the patient: check-in answers, mood and notes; readings such as weight and blood pressure; which medicine doses they’ve taken; messages with their care team; chats with the AI companion and coping exercises; discharge papers they upload; their agreements (consents), with the exact words agreed to and when; and their choices, such as reminder times, how reminders reach them, and language and display settings.
• From the care team: alerts and their notes, notes about calls, assessments, summaries and nursing notes.
• About family members a patient invites: their name, email address, phone number (if given), what the patient shares with them, their messages with the care team, and their own agreements.
• About clinic staff: their name, email address, phone number (if given), role, and what they do in the portal.
• From devices, automatically: technical details needed for security, such as IP address, browser type, and the time and address of each request. If someone turns on app notifications, their browser gives MyndfulPal an address for sending them.
• Stored on the device: the apps keep the sign-in session, the email address, and display and language choices in the browser’s storage. They use no advertising or tracking cookies.

How it’s used

MyndfulPal uses this information only to run MyndfulPal for the clinic:

• to show patients their check-ins, medicines, messages and progress;
• to show the care team what patients share, and alert them when answers or readings show certain changes;
• to show family members what the patient chose to share with them;
• to send reminders and notices by app notification, text message or email;
• to run the AI features the patient agreed to;
• to keep MyndfulPal secure, find and fix problems, and keep records the law requires.

MyndfulPal never sells this information or shares it for advertising, never uses analytics, advertising or tracking tools in the apps, and never uses it to train AI models. It doesn’t use it for research or publication, or combine it with other clinics’ information, unless the clinic agrees in writing and the law allows.

Text messages

MyndfulPal texts patients and family members who choose texts, and clinic staff about patients who need urgent attention. Our text message terms explain what the texts say, how often they come, and how to stop them (reply STOP) or get help (reply HELP).

• Your agreement is recorded. When a patient or family member agrees to texts, MyndfulPal records when, the number, and the exact words they saw or were read (and, in the app, the browser used).
• Texts carry no health details. They never name conditions, readings or medicines, because texts aren’t encrypted end to end and phone companies could read them.
• Your number is used only for these texts. Phone numbers, text message opt-in data and consent are never sold, rented or shared with third parties or affiliates for marketing or promotional purposes. The only companies that handle them are those that deliver the texts for us (Amazon Web Services and the phone companies), and only to deliver them.

AI

With the patient’s agreement, MyndfulPal uses AI (Anthropic’s Claude, through Amazon Web Services’ Bedrock service, in the United States) to write the AI companion’s replies, check companion messages for signs the patient may not be safe, summarize companion chats and check-ins for the care team, word daily check-in questions, read discharge papers (a person on the care team checks every detail), and draft nursing notes that a nurse edits and signs.

• The companion is an AI, not a person, and isn’t part of the care team. The app says so.
• Amazon Web Services runs the AI for MyndfulPal under its agreement to protect health information. Anthropic, the company that makes Claude, doesn’t receive patients’ information.
• Patients agree to these uses of AI when they set up the app, and need to agree to start using it. After that, they can withdraw their agreement at any time on the Me screen or by calling their clinic, and nothing of theirs goes to the AI.

Who can see information in the apps

Changes to a patient’s record, who opened it, opening their documents, downloading their information, and support staff’s access are recorded in an audit trail the clinic can review.

Where it’s kept and how it’s protected

• In the United States, on Amazon Web Services: mainly in Oregon, with backup copies in Ohio.
• Encrypted when stored and whenever it travels over the internet. Texts and emails are the exception, which is why they never include health details.
• Kept apart from other clinics’ information at the database level, so one clinic’s staff can’t see another clinic’s patients.
• Protected sign-in: patients and family members sign in with a one-time code sent to their email; staff use a password and an authenticator app.
• Backed up every day, and monitored for security problems.

If MyndfulPal finds that information was accessed or shared in a way it shouldn’t have been, it tells the clinic, which tells the people affected if the law requires.

How long it’s kept

• Patient information is kept as long as the clinic decides, under its agreement with MyndfulPal. When a clinic discharges a patient, their sign-in stops, and their information stays part of the clinic’s record until the clinic deletes it or stops using MyndfulPal.
• When information is deleted, it’s removed from MyndfulPal’s live systems promptly. Some copies remain for a while, protected and unused: encrypted backups for up to 35 days, system logs for up to 1 year, and the audit trail of who opened or changed information for at least 6 years.
• Some clinical records can’t be deleted through the app, such as a nurse’s signed note, so that nobody can quietly change a medical record. The clinic decides what happens to them.
• When a clinic stops using MyndfulPal, MyndfulPal gives the clinic a copy of its records and then deletes its own, with the same backup and log periods.
• Demo requests are kept while we’re in touch about MyndfulPal. Ask us and we’ll delete yours.

Your rights and choices

Patients: under HIPAA, your rights over your health information run through your clinic, and its Notice of Privacy Practices explains them. You can ask your clinic to see or get a copy of your information, correct it, get a list of certain disclosures, limit how it’s used or shared or contact you a different way (for example, no texts), or delete it. HIPAA gives no right to have records deleted, and your clinic may need to keep some records by law, but it will tell you what it can do. If you write to MyndfulPal instead, we’ll pass your request to your clinic within 2 business days. You can also complain to your clinic or to the U.S. Department of Health and Human Services, Office for Civil Rights, and nobody may retaliate against you for complaining.

Family members can change how they’re told (text or email) in their own MyndfulPal view, and the patient can stop sharing with them at any time. Website visitors who requested a demo can ask us to see or delete what they sent.

Depending on where you live, state law may give you other rights. Ask us, or your clinic.

Children

MyndfulPal is for adults 18 and older. Clinics don’t enroll anyone younger, and this site isn’t meant for children.

Changes to this policy

We’ll update this policy when MyndfulPal changes how it handles information. The date at the top shows the current version. If a change is important, we’ll say so in the apps before it takes effect.

Contact

• About your care or your rights as a patient: your clinic.
• About this policy, our texts, or a demo request: allison@myndfulpal.com. Please don’t include health details.