Privacy

This page is a translation. The English version is the authoritative one; where they differ, the English text governs.

Last updated 9 September 2026

Who we are

Mindalva is operated by Mindalva Lda, Rua Barão de Sabrosa 60, 1900-093 Lisboa, Portugal. We are the data controller for the processing described here. You can reach us at hello@mindalva.com.

The short version

Your answers stay in your browser. Everything you type or say during an assessment is held in your own browser and is sent to our servers only at the moment you ask for a report — and even then we do not keep it. We store no assessments, no reports, and no accounts. The one exception is dictation: in browsers that cannot transcribe speech themselves, the recording is sent to be written down and is discarded as soon as it has been. The exception is an assessment started with a review code: those are kept in full so they can be read afterwards, and the consent screen says so before you answer a question.

What we actually hold

None of the rows we store on a server contains an answer, a report, or anything clinical. The usage row records that some browser began an assessment of a condition, which questions it reached and when it stopped — never what was answered; on a paid assessment it also carries the email address you gave at checkout. The refund and dispute rows hold Stripe's own identifiers and amounts, so that money going back is recorded somewhere we control. The link identifier is a random string recording that a resume link was used. The language cookie sits in your browser and holds nothing but a language code.

Health data

What you tell an assessment is special-category data under Article 9 of the GDPR. Our lawful basis for processing it is your explicit consent, given when you begin an assessment. You may withdraw that consent at any time by closing the tab and clearing your browser data, which erases everything, because your browser is the only place it was.

Speaking your answers

If you use the microphone rather than typing, how your speech becomes text depends on the browser you are using. In Google Chrome and Microsoft Edge this means your recorded audio is sent to Google’s servers for speech recognition, under Google’s own terms. In Safari it is handled by Apple. In those browsers we never receive the audio, only the text that appears in the box. Where the browser cannot transcribe — Firefox, and every browser on iOS except Safari — the recording is sent to us instead and transcribed by Cloudflare Workers AI on our behalf. It is used for that one request and is never written to a database or a log. Either way the audio leaves your device, and given what you may be describing, you should know that before you use it.

If that is not acceptable to you, type your answers instead. Typed answers never leave your browser until you request a report, and are never sent to Google or Apple or transcribed anywhere.

When your data does leave your browser

• When you ask for a report. Your answers are sent to our server, scored, and returned. On the paid tier, the parts you wrote in your own words are also sent to a language model provider so they can be read against the diagnostic criteria. Nothing is written to disk at either step. The provider is asked to route only to models that do not collect or train on what is sent. OpenRouter does not train on it either way; its own documentation is clear that this preference deprioritises providers that would rather than excluding them outright, so we state it as the request we make, not as a promise we can keep on their behalf.
• When you ask us to email your report. The report is passed to our email provider to deliver. It then sits in your inbox until you delete it. We keep no copy — that email is the only one.
• While you answer. We record that an assessment was started, which questions it reached, and when it finished, so we can see where people stop. The question is recorded, never the answer — not the rating, not anything you wrote, not the result. On a free screening it is tied to a random number and to nothing else. On a paid assessment we also store the email address you gave at checkout, so that we can recognise your purchase, support it and refund it; that means a paid record does identify you.

Who processes data for us

Transfers to the United States rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses. We do not sell your data, we do not advertise, and we run no analytics or tracking of any kind.

Cookies

We set two cookies. One records that you are entitled to the assessment you paid for — set after payment or after you redeem an access code, signed so it cannot be altered, and expiring after 30 days. The other remembers the language you chose, for 12 months, and holds nothing but a language code. Both are strictly necessary for the service to work, so we do not ask for consent to set them. We use no analytics, advertising, or tracking cookies.

Your rights

You have the right to access, correct, erase, restrict, and port your data, and to object to processing. In practice most of these are immediate and in your hands: your assessment lives in your browser, and clearing your browser data erases it completely.

For anything we do hold — your email address at Stripe, or the opaque link identifier — write to hello@mindalva.com and we will act within one month. You may also complain to the Portuguese supervisory authority, the Comissão Nacional de Protecção de Dados (cnpd.pt), or to the authority where you live.

Children

Mindalva is for adults. The instruments it uses are validated in adults, and it is not suitable for anyone under 18.

Changes

If we change how we handle your data we will update this page and the date at the top. Material changes affecting data we already hold will be notified by email where we have one.