MindBridge privacy notice

Who is responsible

Greyinsights Limited, Nigeria operates MindBridge and is responsible for the patient service. The Android app is published through Xthetic Studio Ltd’s Google Play developer account. Publication through that account does not grant developers routine access to patient assessments.

Correspondence: 5B, Jo-Babs Dare Close, off Adeyeri Close, Opebi, Ikeja 100212, Lagos, Nigeria. Support and privacy: eap@greyinsights.org. General business enquiries: enquiries@greyinsights.org. Busayo Adewale coordinates support and privacy requests.

MindBridge is intended for adults aged 18 and over. Greyinsights currently focuses on Nigeria and Africa. UK app availability supports Nigerian users travelling to the UK and UK-based staff; it does not announce a new UK care service. Support hours are 09:00–17:00 Nigerian time. This is not continuous clinical monitoring or an emergency service.

Information we use

Account information includes email, patient/user identifier, name, phone number, account status and any organisation affiliation. Health information includes assessment answers, scores, completion history and related patient records. Existing appointment information is displayed where available.

We also handle supported privacy preferences, authentication/session and security/audit records, and correspondence you choose to send. Technical information includes requests, timestamps, errors, performance information and network/device information handled by hosting and authentication providers. These providers can process IP addresses and IP-derived approximate location.

The Android app does not request GPS, contacts, SMS, photos, microphone or advertising-ID permissions. It signs existing accounts in and does not create accounts or offer appointment booking, cancellation or rescheduling. Unsubmitted Android answers remain in screen memory and are lost if you leave the assessment or its process ends. Submitted records are held on the service.

Purposes and processing arrangements

We use account information to provide the service you request and manage sign-in, health information for assessment and care, security information to protect accounts and investigate failures, and support correspondence to handle your request. Assessment results are screening information, not a diagnosis. The app does not use them to make automatic employment, insurance or service-eligibility decisions.

Account/service processing supports provision of the requested service. Necessary security and operational processing supports our legitimate interests in maintaining a safe service; legal obligations may require particular records to be retained. Health information is processed for assessment and care under Greyinsights’ supervision and the responsibility of appropriately qualified healthcare professionals bound by professional confidentiality.

Merely reading this notice is not consent to unrelated processing. Optional web analytics and product-email choices are separate from essential service processing and can be managed on the web Privacy & consent page. Essential security and error diagnostics do not stop when optional usage analytics is declined. This Android service does not sell assessment answers or use them for advertising profiles, AI-model training or a new research project under this notice.

Access and service providers

Authorised Greyinsights consultants review assessments, including those from individual patients without an organisation. Admin and super-admin roles also have clinical-review access under the service’s access rules. Organisation-admin status alone does not grant clinical review. Organisation affiliation is not blanket permission for an employer to read answers. Technical access must be limited to a justified task.

Technical suppliers support the service: Supabase for authentication and database services, Vercel for hosting, Sentry for backend/web error diagnostics, Greyinsights’ custom SMTP service for native sign-in emails, and Resend for applicable other transactional service emails. Supabase’s primary project database is in Stockholm, Sweden; the current Vercel backend deployment runs in the US. Authorised staff and suppliers can process information outside Nigeria. Supplier processing and international access must follow applicable data-protection and confidentiality arrangements; no specific localisation or transfer certification is implied.

We may disclose information where required by a lawful obligation or to protect legal rights. We do not give independent third parties unrestricted rights to use patient information through this notice.

Retention

Our normal adult-record schedule is seven years after the later of last clinical contact or assessment for clinical assessment/care records, and two years after closure for support correspondence. The target for configurable application telemetry is 90 days. Technical providers’ own security, diagnostic and backup cycles are separate and may differ; these targets are not a guarantee that every provider copy expires at the same time.

Retention and deletion require a recorded review rather than an instant automatic purge. A documented care or legal hold can justify longer restricted retention. Closing an account is considered separately from erasing a clinical record that legitimately needs to be kept. We explain retained categories, reasons and applicable periods when responding to a request. No unverified automatic deletion or backup-expiry deadline is promised.

Access, correction, account closure and deletion

You can request access, correction, account closure or deletion without installing or signing into MindBridge. Email eap@greyinsights.org with the subject “MindBridge privacy request”. Initially provide only your account email and the type of request. Do not email assessment answers, passwords, sign-in codes, identity documents or clinical history.

We arrange proportionate identity verification before disclosing records or taking account action, and a secure delivery channel where records need to be supplied. Our service targets are to acknowledge requests within two business days and aim to resolve them within 30 calendar days after identity verification, subject to applicable legal deadlines. If more information or time is needed, we explain why and provide an update.

We assess what is eligible for deletion and the relevant supplier-held copies. Where retention is justified, we explain the exception and restrict use appropriately. Disabling an account alone is not represented as complete erasure. You can raise a concern with us or the Nigeria Data Protection Commission at ndpc.gov.ng. Applicable rights depend on the circumstances and jurisdiction; this notice does not remove them.

Security and notice changes

The Android service uses encrypted HTTPS connections. Android sessions use Keystore-backed encrypted storage, and the app disables Android backup of its data. Patient APIs check access to the signed-in patient’s records. No system can guarantee absolute security.

We update this notice when the service or its data practices change. A notice update does not itself activate a new mandatory consent or grant broader access.