Privacy Policy

This policy applies to three things: the public MindLotus website, the MindLotus therapy platform, and the emails and notifications we send. It explains what we collect, why, who else sees it, how long we keep it and what you can require of us.

It covers everyone whose data we handle: visitors to our website, people who receive therapy as individual clients, employees whose therapy is funded by their employer, psychologists who deliver care through the platform, administrators at partner organisations, people who are invited to the platform but never register, and newsletter subscribers.

It does not cover websites we link to but do not operate, or what your employer does with information you give it directly, outside MindLotus.

• Controller: MindLotus B.V.
• Chamber of Commerce (KVK): 42026262
• Registered office: Meerzand 36, 5658 LJ Eindhoven, the Netherlands
• Privacy contact: privacy@mindlotus.nl
• Data Protection Officer: dpo@mindlotus.nl
• Security reports: security@mindlotus.nl

We are established in the Netherlands and our lead supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

Which obligations we owe you depends on the data, so we set the split out plainly rather than claiming one role for everything.

Where we are the controller

We decide why and how we process your account and identity data, your billing data, the technical and security data our systems generate, our website analytics, our marketing communications, and the data we use to verify psychologists. For that data, we are the controller and this policy is our privacy notice to you.

Where we are the processor

Your clinical record — your intake responses, session notes, transcripts saved to your file, therapy plans and the clinical content of your messages — belongs to the treatment relationship between you and your psychologist. Under the WGBO, your treating psychologist is responsible for that record. We process it on their documented instructions, as their processor, under a written data processing agreement. We do not use it for our own purposes, and we do not use it to train any model.

In practice this means requests about the content of your clinical record are decided by your psychologist. We will always help you reach them, and we will act on their instruction. Requests about your account, your billing or your website data are decided by us.

Where your employer is involved

If your employer funds your therapy, your employer is a separate controller for the employment data it holds about you and for the aggregate reporting it receives. It is never a controller of your clinical record and has no route to it. See section 9.

We collect only what the service needs. What we actually hold about you depends on which parts of the platform you use — a visitor who reads our homepage and leaves is in the last category only.

Data we deliberately do not collect

• We do not collect or store card numbers, expiry dates or security codes. Card details are entered on Stripe's own payment pages and never reach our servers.
• We do not store your bank account details for psychologist payouts. Stripe collects and holds them.
• We do not record video or audio of sessions. Transcription, when it is used, produces text — see section 7.
• We do not use advertising cookies, cross-site tracking pixels, social network widgets, or session-replay tools anywhere on our website or platform.
• We do not buy personal data from data brokers, and we do not sell or rent your personal data to anyone.

Health data

Almost everything you tell us about why you are seeking therapy is data concerning health, which Art. 9 GDPR treats as a special category and protects more strictly. That includes your intake answers, your mood and journal entries, your session notes, your transcripts, and the simple fact that you have booked a session at all.

We rely on two grounds, and we rely on them for different things:

1. Provision of health care — Art. 9(2)(h) GDPR. Your care, your clinical record and the safety follow-up described in section 8 are necessary for the provision of health care and are handled by or under the responsibility of professionals bound by professional secrecy. This ground does not depend on your consent, and withdrawing consent does not remove the record-keeping duty the law places on your psychologist.
2. Your explicit consent — Art. 9(2)(a) GDPR. For anything optional — transcription and AI-drafted summaries, sharing information with a new psychologist when you switch, letting your check-ins and session ratings count towards your employer's anonymous weekly figures (section 9), taking part in research — we ask you separately and you can say no without losing access to therapy. You can withdraw that consent at any time. Withdrawal stops future processing; it does not undo processing that already lawfully happened.

Criminal-offence data

Where we require a psychologist to provide a Verklaring Omtrent het Gedrag (VOG), that document is data relating to criminal convictions and offences under Art. 10 GDPR. We process it because we are assessing the reliability of someone who will work with vulnerable people, which Art. 33(2) of the Dutch UAVG permits. Only the small number of staff who run verification can see it, we record the outcome and the date of the check rather than keeping the certificate indefinitely, and we never disclose it to clients or employers.

What we never do with it

• We do not use your health data to target advertising, and we run no advertising technology on the platform.
• We do not use your health data, your transcripts or your messages to train artificial-intelligence models, and our agreements with our providers prohibit them from doing so.
• We do not disclose your health data to your employer, in any form that could identify you.
• We do not sell it, and we do not share it with insurers, credit reference agencies or marketing partners.

Each purpose we have for processing personal data, the data it involves and the legal ground we rely on. Where we rely on legitimate interests, we have carried out a balancing assessment and you can request a summary of it.

Therapy sessions run over an encrypted real-time video connection provided by Daily.co. Audio and video are relayed between you and your psychologist. We do not record them, and neither we nor Daily.co keep a copy of the audio or video after the session ends.

What happens to a transcript

1. Speech is converted to text in near real time and shown to your psychologist during the session.
2. When the session ends, the transcript is stored against the session, with speaker labels, timestamps, word count and duration.
3. Optionally, the transcript text is sent to OpenAI, which returns a short structured summary. The instruction we give it is to avoid identifying details beyond the roles 'therapist' and 'client', but a transcript of a conversation can still contain names and other details.
4. The summary is saved as a draft note for your psychologist to read, correct and, if they choose, adopt into your record. It is a draft, not a clinical decision, and no treatment decision is made by the system.
5. Your psychologist can edit the transcript and save a reviewed version to your file.

Instant calls

The platform also supports short calls initiated outside a scheduled session. We record who called whom, when, whether the call was accepted, declined or cancelled, and how long it lasted. The content of the call is not recorded.

We use three kinds of automated processing. None of them makes a decision about you that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR: a human is always in the loop, and you always keep the final choice.

Matching

We compare your stated therapy goals, languages, cultural background and preferences against psychologists' specialisations, languages and availability, and suggest who might fit. The suggestion is a ranked list, not an allocation. You choose your psychologist, and you can browse the whole network and ignore our suggestions entirely.

Wellbeing scoring

From your intake answers we calculate indicative scores for mood, anxiety and stress, an overall wellbeing score, and a risk level of low, moderate, high or severe. This is a fixed set of rules applied to answers you gave, not a diagnosis and not a prediction. It is shown to your psychologist as context for a clinical conversation. It never determines whether you can use the service, what you pay, or who you are matched with.

Safety flags

If you indicate in your intake questionnaire that you have experienced thoughts of self-harm or suicide, we set a safety flag on your profile so that a qualified person can follow up. That flag, your answer and any details you added are visible to your psychologist and to the small number of MindLotus staff responsible for clinical safety. We consider this necessary to provide care safely, and in an immediate risk to life we may also act to protect vital interests. Answering "never" or "prefer not to say" does not raise a flag.

You have the right to obtain human intervention, to express your point of view and to contest the result of any of this processing. Write to privacy@mindlotus.nl.

If your employer funds your therapy, it pays for a pool of sessions. It does not buy access to your care, and the platform gives it none.

Joining is your choice

Your employer can invite you, but you only join its programme by accepting the invitation yourself, signed in with the email address it was sent to. Until you accept, your employer sees only the status of the invitation it sent; if you decline, it sees that the invitation was not accepted.

Your employer can see

• That you were invited and what became of the invitation (accepted, not accepted or expired), whether your membership is active or paused, and your work email address, because it administers the benefit.
• How many sessions the organisation has bought, used and has remaining, in total.
• Only if enough employees choose to share (see below): weekly averages of their check-in wellbeing scores and of their ratings of sessions the organisation paid for, with the number of people who shared given only as a range, such as 10–19.

Your employer cannot see

• Anything you told us in your intake questionnaire.
• Whether you have booked, attended or cancelled any particular session.
• Who your psychologist is.
• Your session notes, transcripts, messages, mood entries, journal entries, goals or feedback.
• Your individual check-ins, wellbeing score, session ratings, risk level or safety flag.

Weekly figures only with your consent

Your check-ins and your ratings of sessions your employer paid for count towards its weekly figures only if you switch on sharing in your settings. It is off unless you switch it on, and it is a separate choice from joining. Because the figures are derived from health data, we rely on your explicit consent — Art. 6(1)(a) and Art. 9(2)(a) GDPR.

You can withdraw your consent at any time by switching sharing off. From then on you are left out of every week that has not yet been published. Weeks already published are not changed: they are anonymous averages that are stored with no link to you or anyone else. If your employer pauses your membership, sharing is switched off, and it stays off until you switch it on again.

How we stop the figures from identifying you

Averages leak when the group is small or keeps changing. These rules are enforced in the database that produces the figures, not merely promised here:

• Figures are weekly. Each finished week (Monday to Sunday, UTC) is computed once, after it ends, and then frozen: it is never recomputed, so changing who belongs to the organisation afterwards cannot change what a week showed.
• You count for a week only if you had switched on sharing before the week started, were still sharing when it was computed, and were an active member for the whole week.
• A week is published only if at least 5 employees contributed to it and the organisation had at least 10 members who were active for that whole week, whether they shared or not. Otherwise the week is stored without any figure, and your employer sees only that there was not enough data.
• A published week shows an average and a range for how many people shared. The exact number never leaves our servers, no individual check-in or rating is ever shown, and we never tell your employer who switched sharing on or off.

Your employer does know how many active members it has. Next to that number, the range can show that most or all of them shared in a given week; it never shows who.

Your employer cannot lower these thresholds or see the data behind the averages. The anonymous weekly figures are kept as anonymous statistics for as long as your employer's organisation account exists, and are deleted with it.

We do not sell personal data and we do not share it for anyone else's marketing. We disclose it only to:

• Your treating psychologist, and — if you switch and agree to it — a new psychologist.
• Other users only where you address them: the recipients of your messages.
• Your employer: your invitation and membership status, and — only if you choose to share — the anonymous weekly averages described in section 9.
• Service providers who process data on our instructions, listed below.
• Our professional advisers — lawyers, accountants, auditors and insurers — under confidentiality, where strictly necessary.
• Public authorities, courts and regulators where we are legally required to disclose, or where disclosure is necessary to establish or defend a legal claim. We assess every request, refuse those without a lawful basis, and tell you unless we are prohibited from doing so.
• An acquirer or successor if our business is merged, acquired or reorganised, subject to equivalent protection and, where required, your consent for health data.

Sub-processor register

These are the providers who process personal data on our behalf. Each is bound by a written agreement meeting Art. 28 GDPR, is assessed before we engage it, and may not use your data for its own purposes.

We give at least 30 days' notice through this page before adding a sub-processor that will process health data. If you object, tell us — for platform users we will explain the alternatives, which may include ending your contract without penalty.

Our primary systems — the database, authentication, file storage and the transcription region we request — are in the European Union.

Two transfers leave the EEA and matter enough to name individually:

• OpenAI (United States). When your psychologist requests an AI-drafted summary, the transcript text is sent to OpenAI. This is a transfer of health data. It happens only with your explicit consent to transcription and AI summarisation, and it is covered by a data processing agreement and the European Commission's 2021 Standard Contractual Clauses.
• Resend (United States). Notification and transactional email is delivered through Resend. We write these emails so that they reference sessions without describing their content, but the fact that you use a mental health service is itself sensitive. Covered by Standard Contractual Clauses.

Daily.co and Vercel are US-incorporated but serve our traffic from EU infrastructure; their contracts also include Standard Contractual Clauses. For every transfer outside the EEA we rely on an adequacy decision or on the 2021 Standard Contractual Clauses, together with a transfer impact assessment and supplementary measures such as encryption in transit and at rest, data minimisation and short retention. You can request a copy of the safeguards for any specific transfer from privacy@mindlotus.nl.

We keep personal data no longer than we need it, except where the law requires us to keep it longer. The medical-record period is the main example, and it is the reason we cannot always delete everything on request.

At the end of a retention period we delete the data from production systems and from backups as they rotate, or we irreversibly anonymise it so it can no longer be linked to you. Backups are encrypted and expire on a rolling schedule; deletion from live systems is immediate, and backup expiry completes within 12 months.

We apply technical and organisational measures appropriate to the risk of processing health data, including:

• Encryption in transit (TLS 1.2 or higher) and encryption at rest for the database and file storage.
• Row-level security enforced in the database itself, so that authorisation is checked on every query rather than only in application code. A psychologist can reach only their own clients' records; a client can reach only their own.
• Role-based access control, least-privilege service credentials, and separation between the keys used by the browser and those used by trusted server code.
• Multi-factor authentication and individual named accounts for staff with administrative access.
• Signed webhooks and verified callbacks for payment and email events.
• Logging, monitoring and alerting on production systems, with audit records for security-relevant actions.
• Encrypted, regularly tested backups.
• Dependency and vulnerability scanning, and a documented change and release process.
• Confidentiality undertakings, background screening where appropriate, and privacy and security training for everyone with access to personal data.
• Assessment of every sub-processor before engagement, and a written data processing agreement with each.

If something goes wrong

No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours as Art. 33 GDPR requires. If it is likely to result in a high risk to you, we will tell you directly and without undue delay, and explain what happened, what it means for you and what we are doing about it.

If you believe you have found a vulnerability, please report it to security@mindlotus.nl. We will not pursue legal action against researchers who investigate and report in good faith, who do not access or modify other people's data, and who give us reasonable time to fix the issue before disclosing it.

Subject to the conditions and limits the GDPR sets, you have the following rights. They apply to all of your personal data, whether we hold it as controller or as your psychologist's processor — though for clinical records we act on your psychologist's instruction.

• Access. Confirmation of whether we process data about you, a copy of it, and the information in this policy applied to your case.
• Rectification. Correction of inaccurate data and completion of incomplete data. For a clinical record, you cannot require a professional to change their clinical opinion, but you can require correction of factual errors and you can add your own statement to the file.
• Erasure. Deletion of your data, except where we must keep it — most importantly the medical record under the WGBO, and financial records under tax law.
• Restriction. To have us pause processing while a dispute about accuracy or lawfulness is resolved.
• Portability. A structured, commonly used, machine-readable copy of the data you provided to us under consent or contract, and transmission to another provider where technically feasible.
• Objection. To object to processing based on our legitimate interests, on grounds relating to your particular situation. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdraw consent. At any time, where we rely on consent — for transcription, AI summaries, analytics or marketing. Withdrawal does not affect the lawfulness of processing before it.
• Human intervention. To obtain human review of, to express your view on and to contest any automated processing described in section 8.
• Complain. To lodge a complaint with a supervisory authority — see section 20.

You can delete your account yourself, in the app or on the website: see Deleting your account.

How to exercise them

Email privacy@mindlotus.nl. We may ask for proof of identity where we have reasonable doubt about who is asking — we will ask for the minimum necessary, and we will not ask you to send a full copy of an identity document by email. We respond within one month of a complete request, extendable by up to two further months for complex requests, in which case we tell you within the first month. There is no fee unless a request is manifestly unfounded or excessive.

Dutch healthcare law gives you rights over your medical record that sit alongside the GDPR, and in some respects go further.

• You have the right to inspect your record and to receive a copy of it, free of charge.
• You have the right to add your own statement to the record, which your psychologist must keep with it.
• You have the right to request destruction of the record. Your psychologist must comply unless the law requires retention, or unless keeping it is of substantial interest to someone other than you. A request for destruction is decided by your psychologist, not by us.
• Otherwise the record is kept for 20 years from the end of treatment, or longer where good care requires it.
• Your psychologist is bound by professional secrecy. They may break it only in narrow circumstances recognised by law — for example, a serious and immediate danger to you or to someone else that cannot be averted otherwise.

To exercise these rights, contact your psychologist through the platform. If you cannot reach them — for example, because they have left the network — write to privacy@mindlotus.nl and we will arrange it.

We use a small number of strictly necessary cookies, which do not require consent because the service cannot work without them, and one optional analytics technology on the marketing site, which is loaded only after you accept it.

Our analytics runs on Mixpanel's EU infrastructure, stores its identifier in your browser's local storage rather than in a cookie — which still requires your consent under Art. 11.7a Telecommunicatiewet — and honours your browser's Do Not Track setting. If you decline, nothing is loaded and no events are sent. You can change your choice at any time through Cookie settings in the footer of any page.

When you move from the marketing site to the platform, we may pass a pseudonymous analytics identifier in the link so that a sign-up can be attributed to the campaign that brought you. That identifier is not used inside the platform, and no analytics tooling runs on the platform at all.

We use no advertising cookies, no cross-site tracking pixels, no social-network buttons that profile you, and no session-replay tools.

MindLotus is intended for adults. You must be at least 18 to create an account and receive therapy through the platform. We do not knowingly collect data from anyone under 16, which is the age of digital consent in the Netherlands.

If you believe someone under age has given us personal data, contact privacy@mindlotus.nl and we will delete it promptly, subject to any record we must keep about the deletion itself.

Access to personal data by MindLotus staff is restricted to what a role genuinely requires, and it is logged.

• Support and engineering staff can access account, billing and technical data to resolve problems you report.
• A small clinical safety team can see self-harm flags and the intake answer that raised them, in order to arrange follow-up.
• A small verification team can see psychologists' credentials, identity documents and VOG.
• Administrators can sign in to the platform as another user in order to reproduce a fault. This is restricted to administrator accounts, is recorded, and is used only where it is necessary to resolve a specific issue. It is not used to read clinical records, and access to clinical content by anyone other than your treating psychologist is a disciplinary matter.

Everyone with access is bound by a confidentiality undertaking that survives the end of their engagement with us.

We update this policy when our services, our providers or the law change. The version number and the "last updated" date at the top always tell you which text you are reading.

For material changes — a new purpose, a new category of data, a new recipient of health data, or a change that reduces your protection — we will tell you by email or in the platform at least 30 days before the change takes effect, so that you have time to object, withdraw consent or close your account.

Please come to us first. Most concerns are resolved quickly, and we would rather hear about a problem than have you discover it in a supervisory authority's file.

If you are not satisfied with our response, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) or with the supervisory authority in the EU country where you live, work, or where the issue arose. You also have the right to an effective judicial remedy.

Complaints about the care itself, rather than about data, follow our complaints procedure — write to klachten@mindlotus.nl.

See also our Terms and Conditions, which govern your use of MindLotus.