Mente360 ("we," "us," or "our") is committed to protecting the privacy of our users. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our mental health practice management platform and related services (collectively, the "Services").

1. Information We Collect

Account Information: When you register for an account, we collect your name, email address, phone number, professional credentials, and practice information.

Practice Data: Information you enter into the platform related to your practice operations, including scheduling, billing, and administrative data.

Protected Health Information (PHI): If you use our platform to manage client records, we may process PHI on your behalf as a Business Associate under HIPAA. Our handling of PHI is governed by our Business Associate Agreement.

Mobile Phone Numbers: We collect mobile phone numbers when you opt in to receive SMS notifications, appointment reminders, or other text message communications from our platform.

Usage Data: We automatically collect information about how you interact with our Services, including IP addresses, browser type, pages visited, and access times.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Services
Send transactional communications including appointment reminders and account notifications via email or SMS
Process payments and billing
Respond to your inquiries and provide customer support
Ensure compliance with legal obligations
Protect against fraudulent or unauthorized activity

3. SMS/Text Messaging

When you provide your mobile phone number and opt in to receive text messages from Mente360, you consent to receive SMS communications related to your account, including appointment reminders, scheduling confirmations, and service notifications.

Mobile Information Protection: We do not share, sell, rent, or otherwise disclose mobile phone numbers or SMS opt-in data to any third parties or affiliates for marketing or promotional purposes.

Mobile information may only be shared with service providers who assist us in delivering SMS messages (such as our telecommunications provider), and such providers are contractually prohibited from using this information for any purpose other than providing the messaging service.

Message frequency varies based on your account activity and preferences. Message and data rates may apply depending on your mobile carrier plan.

You may opt out of SMS communications at any time by replying STOP to any message or by updating your notification preferences in your account settings. Reply HELP for assistance.

4. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

Service Providers: We engage third-party companies to perform services on our behalf, such as payment processing, data hosting, and customer support. These providers are contractually obligated to protect your information and use it only for the purposes we specify.

Legal Requirements: We may disclose your information if required by law, legal process, or government request, or to protect the rights, property, or safety of Mente360, our users, or others.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

6. HIPAA Compliance

For healthcare providers subject to HIPAA, Mente360 acts as a Business Associate. We will enter into a Business Associate Agreement (BAA) with covered entities as required by HIPAA. Our handling of Protected Health Information is governed by the terms of that agreement and applicable law.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide you with our Services. We may also retain certain information as required by law or for legitimate business purposes, such as resolving disputes or enforcing our agreements.

8. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

The right to access, correct, or delete your data
Object to or restrict certain processing
Data portability

To exercise these rights, please contact us using the information below.

You may update your account information at any time by logging into your account settings. You may also opt out of promotional communications by following the unsubscribe instructions in those messages.

9. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

10. Third-Party Calendar Integrations

Mente360 offers an optional Calendar Sync feature that connects a provider's Mente360 schedule with an external calendar account, including Google Calendar, Microsoft Outlook, and Apple Calendar. This feature is off by default. It is enabled only when an individual provider chooses to connect an account, and it can be disconnected at any time.

10.1 Information We Access From Your Google Account

When a provider connects a Google Calendar account, Mente360 requests only the permissions required to operate the feature:

Your email address (openid, email) - used solely to display which account is connected, so a provider can confirm they linked the intended calendar.
View and edit events on your calendars (calendar.events) - used to create, update, and remove Mente360 appointment entries on your calendar, and to read existing events so Mente360 can avoid double-booking you.
See the list of calendars you are subscribed to (calendar.calendarlist.readonly) - used only to present a list of your calendars so you can choose which one to sync.

Mente360 does not request permission to share your calendars, to change their sharing settings, or to delete calendars.

10.2 What We Send To Your Calendar

You control how much detail Mente360 writes to your external calendar:

Busy Only (the default) - the calendar entry is titled "Busy" and contains only the appointment's date, time, and duration. No client information of any kind leaves Mente360.
Type Only - the entry additionally includes the appointment type.
Full Details - the entry additionally includes the client's name.

Type Only and Full Details place protected health information on a third-party calendar. Mente360 therefore requires an explicit, separately recorded acknowledgement before either can be enabled, and records the date and time of that acknowledgement. We recommend that practices have a Business Associate Agreement in place with their calendar provider before selecting these levels.

Clinical notes, assessment results, diagnoses, billing information, and message content are never sent to an external calendar at any detail level.

10.3 What We Store

To keep your calendar in sync without repeatedly contacting your provider, Mente360 stores:

OAuth access and refresh tokens for the connected account
The email address of the connected account and the identifier of the selected calendar
For events on your calendar within a limited window around the present date: the event's start time, end time, and title

Event titles from a personal calendar can contain sensitive personal information. Mente360 therefore stores them encrypted at rest, as it does the access tokens, the account email address, and the calendar identifier. This information is stored in your practice's isolated tenant database and is not combined with data from any other practice.

Mente360 reads your calendar only within a bounded window around the present date. It does not retrieve or retain your full calendar history.

10.4 How We Use It, And What We Never Do

Information obtained from Google is used only to operate the Calendar Sync feature for the provider who connected the account.

Mente360 does not:

sell, rent, or transfer Google user data to third parties
use Google user data for advertising, marketing, or profiling
use Google user data to train, develop, or improve any artificial intelligence or machine learning model
permit humans to read Google user data, except where required to resolve a specific support issue with the user's knowledge, where required by law, or where necessary to investigate a security incident or a violation of our terms

Mente360's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10.5 Revoking Access And Deletion

You can disconnect a calendar at any time from Settings → Calendar Sync in Mente360. On disconnection, Mente360 stops all synchronisation and ceases accessing your Google account.

You can independently revoke Mente360's access from your Google Account at https://myaccount.google.com/permissions. Revoking access there stops all further access immediately, whether or not the connection is also removed inside Mente360.

Appointment entries that Mente360 has already written to your calendar remain on your calendar after disconnection, so that your schedule is not altered unexpectedly. You may delete them yourself in your calendar application.

Stored tokens and cached event information are deleted in accordance with Section 7 (Data Retention). Records of the connection itself are retained where required for the audit trail obligations described in Section 6.

10.6 Microsoft and Apple Calendars

The same detail-level controls, encryption, storage limits, and use restrictions described above apply to Outlook and Apple Calendar connections. Apple Calendar connections use an app-specific password rather than OAuth; that password is stored encrypted and is used only to synchronise your calendar.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on our website and updating the effective date. Your continued use of our Services after any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Mente360
Email: privacy@mente360.com
Website: https://www.mente360.com