Consumer Health Data Privacy Policy

Last updated: 16 August 2026

This policy is in effect. It is also under continuing legal review, and we will post any revision here with a new date.

This policy is for residents of Washington State and of other U.S. states with a dedicated consumer health data law, including Nevada and Connecticut. It is a separate document from our general Privacy Policy because those laws require it to be, and it describes the same practices from the angle those laws care about. Where the two overlap, they say the same thing; if you ever find that they do not, tell us and we will fix it.

Mindima is operated by Noah Kanyo, 5005 Dalhousie Dr NW, Unit 175 #1332, Calgary, AB T3A 5R8, Canada. Contact: support@mindima.com.

Mindima is not a healthcare service

Mindima is a mental performance app for general wellbeing and cognitive practice. It is not a medical device, it does not diagnose, treat, cure or prevent anything, and we are not a healthcare provider. We are not covered by HIPAA and nothing here should be read as suggesting we are. We nonetheless treat the categories below as consumer health data, because information about how somebody feels and how their mind is working deserves that treatment whether or not a regulator has told us so.

What we treat as consumer health data

These are the categories in Mindima that can reveal something about your mental or physical state:

• Mood check-ins, before and after sessions, and the notes you attach to them.
• Felt states you select in a check-in, for example that you feel wired, flat, stuck or unfocused.
• Reflections and journal entries, including voice notes.
• Survey and assessment answers, including partly completed ones, and the setup questions about focus, stress, memory, mood and sleep.
• Derived scores and profiles. The trait profile built from your survey answers, your cognitive ability estimates, your composite index and brain-age estimate, and the patterns we calculate from your record such as mood by day of week or your best time of day. We treat these as health data even though you never typed them, because an inference about your state is still information about your state.
• Practice and habit logs where they record how a practice went or how you felt about it, including any photo you attach.

Where it goes, which is mostly nowhere

By default, none of it reaches us. All of the above is written to a database inside the app on your device and stays there. There is no server-side copy and we cannot see it. That is the ordinary state of the product, not a setting you have to find.

Two optional features change that, and only if you switch them on:

• Encrypted backup. Your record is encrypted on your device with a key derived from your recovery code, and only then uploaded. We hold ciphertext. We do not hold the key and cannot read the contents.
• The progress dashboard. This uploads a fixed set of aggregate numbers that we can read: your normalized metric scores and their daily trend deltas, level, streak days, session counts, games played and badges. Because those numbers describe cognitive performance over time, we treat them as consumer health data too. They never include your mood values, reflections, journal text, voice notes or raw survey answers, and the allowed list is enforced in code on both sides so that a future change cannot quietly widen it.

Voice notes and practice photos are never uploaded at all, by any feature.

How we collect it, and why

We collect it because you enter it, or because the app calculates it from what you entered. We use it for exactly one thing: to give you the product. Showing you your own record, drawing your stats and trends, picking what to suggest next, and, if you have switched them on, powering your dashboard and the weekly summary email drawn from it.

We do not use it for advertising, we do not use it to build profiles for anyone else, and we do not use it to train models on other people’s behalf.

Your consent

We ask for your permission to record this category separately, with its own control, and separately again from the age confirmation and from acceptance of our Terms. Nothing about it is bundled, and there are no pre-ticked boxes anywhere in Mindima.

You can say no and keep using Mindima. The games, tools, puzzles and your performance stats all work. The features that would record mood, reflection or survey content simply do not record it, and they say so on screen rather than failing silently.

Encrypted backup and the progress dashboard each require their own separate permission on top of that one, because sending data somewhere is a different decision from recording it.

We keep a record of what you agreed to, when, in what language, and which version of the policy and Terms was in force at the time. You can ask us for it.

We do not sell consumer health data

We have never sold consumer health data and we do not intend to. We do not exchange it for money or for anything else of value. Washington law requires a separate, signed authorization before any such sale, on a prescribed form. We have no such authorization from anyone, because we have never asked for one, because we do not do this. If that ever changed we would have to ask you, on that form, and you would be free to refuse.

Who else can see it

We do not share consumer health data with third parties for their own purposes. The only third parties that come near it are the service providers who host the systems it sits in, under written terms that limit them to acting on our instructions:

• Cloudflare, which hosts our servers and storage. It holds your encrypted backup as ciphertext, and holds the dashboard aggregates in the same readable form we do.

Apple, Google and Stripe handle payments and never receive any of the categories above. Expo receives only an update check. No advertising network, data broker or analytics company receives any of it, because we use none.

We would disclose it if we were legally compelled to. If that happens we will tell you unless we are forbidden from doing so, and for your record itself the honest answer is that we could hand over only ciphertext we cannot read.

How long we keep it

On your device, until you delete it. Mindima gives you targeted delete controls under Settings, so you can clear survey entries, tool history or everything, without deleting the app.

On our servers, your encrypted backup is kept while backup is switched on and your account exists, and superseded versions are removed when a newer backup replaces them. Dashboard aggregates are deleted when you switch the dashboard off, and when you delete your account. Nothing in this category is retained after account deletion.

Your rights

Under Washington law, and comparable laws elsewhere, you have the right to:

• Know whether we collect, share or sell your consumer health data, and to access it. This whole page is that disclosure, and you can download the data itself: the in-app export gives you your complete on-device record as a single file, and your account page gives you everything we hold on our servers.
• Withdraw your consent to collection and to sharing, at any time, in the same place you gave it.
• Have it deleted, including from our archived and backup systems. Delete your account in the app or at mindima.com/delete-account, or email us. We will confirm deletion, and we will pass the request to our service providers where it applies to them.
• Appeal a refusal. If we decline a request we will tell you why, in writing, within the time the law allows, and explain how to appeal. If we then decline your appeal we will give you a way to complain to your Attorney General.
• Not be discriminated against for exercising any of this. No feature is withheld, no price changes, and nothing is degraded.

To exercise any of these, email support@mindima.com from the address on your account, or use the controls in the app. We respond within the time applicable law requires, and in any case within 45 days. We will ask you to verify the request came from you, because handing someone else your record would be the exact harm these laws exist to prevent. Anyone you authorize may act on your behalf with evidence of that authority.

Employees, contractors and access

Mindima is operated by one person. Access to production systems is limited to that operator and used only to run and repair the service. There is no analytics team, no growth team and no third-party contractor with a login. If that changes, this section changes with it.

If you are in Washington State

This policy is the disclosure required by RCW 19.373. If you believe we have not honored a right described here, you can contact us at support@mindima.com, and you may also contact the Washington State Attorney General’s Office. We would rather you gave us the chance to put it right first, but you are not required to.

Changes

If we change this policy we will post it here with a new date, and where the change affects what you agreed to, we will ask you again rather than assume the old answer still holds.

Contact

support@mindima.com, or write to Noah Kanyo, 5005 Dalhousie Dr NW, Unit 175 #1332, Calgary, AB T3A 5R8, Canada.