Privacy
The Mindset Operating System Ltd ("MindsetOS", "we", "our", or "us") provides digital and AI tools that help individuals and teams build psychological awareness, develop healthier performance habits, and strengthen their mindset at work and in life.
Company details:
We are the Data Controller for the personal data of individual users, whether they access MindsetOS directly or through their employer. Where access is provided through an organisation, that organisation is a separate, independent controller only for the limited data it determines, such as the employee list it provides and the aggregated, de-identified insights it receives.
We collect only the data necessary to provide, personalise, and improve the MindsetOS experience.
MindsetOS does not collect or process health records, medical information, or any data intended for clinical or diagnostic use. All data shared within the app relates to mindset, habits, and personal growth, not to medical or therapeutic evaluation.
Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases to process personal data:
| Purpose | Type of data | Lawful basis | GDPR article |
|---|---|---|---|
| Account creation and delivery of services | Account and contact data | Necessary for performance of a contract (to deliver app functionality). | Art. 6(1)(b) |
| User reflections, assessments, and AI coaching interactions | Self-reported mindset and behavioural information (non-clinical) | Consent: users choose to share this data to receive personalised insights. | Art. 6(1)(a) |
| Platform improvement and analytics | Technical and aggregated usage data | Legitimate interests in maintaining and improving the service (balanced against user rights). | Art. 6(1)(f) |
| Marketing communications (optional) | Contact data (email) | Consent (users can withdraw at any time). | Art. 6(1)(a) |
Important: MindsetOS does not collect or process medical, clinical, or therapeutic information. The data you provide through assessments or reflections relates to personal development and mindset awareness, not to health status or diagnosis. Our tools are designed for self-awareness and behavioural insight, not for medical or psychological evaluation.
We use data to:
We do not sell or rent your personal data.
When MindsetOS provides services through an employer or organisation:
Data is securely hosted and processed using GDPR-compliant partners, including:
All personal data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is limited to authorised personnel and protected by authentication controls. MindsetOS is Cyber Essentials certified, meeting UK government-backed standards for cyber security. MindsetOS remains responsible for ensuring lawful and secure processing by all partners.
Where third parties (such as Convex, OpenAI, or Kit) process data outside the UK/EU, Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) ensure equivalent safeguards and compliance with UK GDPR.
Under UK GDPR, you have the right to access, correct, delete, restrict, or object to processing; withdraw consent; and request data portability.
To exercise your rights, contact admin@themindsetos.com.
If you are unsatisfied with our response, you can lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
MindsetOS uses local storage and session tokens to maintain secure sessions, save progress, and enable offline functionality.
Product analytics (provided by PostHog) are used to understand general usage patterns and improve the platform. Analytics are disabled by default and only activated with user consent. Analytics data is anonymised or aggregated and is never used for advertising or cross-app tracking.
You can delete local data at any time by logging out or deleting your account within the app.
We may update this policy periodically. The latest version will always be available within the app and on our website.
For organisations using MindsetOS under a business agreement, data protection terms are set out in our standard Data Protection Agreement (available on request).