Home > Privacy Policy

Privacy Policy

Welcome to the website (the “Site”) of Mentalyc. (“Mentalyc,” “we,” “us,” or “our”). Mentalyc provides a transcription and note-generation service for therapists. These services and the Site are collectively referred to as the “Service” in this Privacy Policy.

This Privacy Policy explains what Personal Data (defined below) we collect, how we use and share that data, and your choices concerning our data practices.

Before using the Service or submitting any Personal Data to Mentalyc, please review this Privacy Policy carefully and contact us if you have any questions. By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not access the Site or otherwise use the Service.

Compliance with Regulations

Mentalyc is compliant with the following data privacy regulations in addition to HIPAA Laws:

PIPEDA (Canada): Personal Information Protection and Electronic Documents Act
PHIA (Canada): Personal Health Information Act
PHIPA (Canada): Personal Health Information Protection Act
POPIA (South Africa): Protection of Personal Information Act
New Zealand Privacy Act
Protection of Personal Data (PPD) (UAE)
Protecting Personal Data Privacy Law (PPDP) (Qatar)
Personal Data Protection Law (Bahrain)

1. PERSONAL DATA WE COLLECT ‍ The section concerns solely therapist data who is a user of our platform. When it comes to therapists, we collect information that alone or in combination with other information in our possession could be used to identify you (“Personal Data”) as follows: Categories of Personal Information Disclosed for Business Purposes:

- Contact Information: This includes your name, email address, phone number, and address.

- Account Information:

Information related to your account, such as your username, password, and any other details provided during the registration process.

- Profile Information:

Information provided to create a Mentalyc profile, which may include profile pictures, gender, links to promotional content, content entered by the user regarding mental wellbeing challenges, and a personal description.

- Communication Information:

Any messages and requests for customer support sent through the Service.

- Log Data:

Information automatically sent by your browser, such as your IP address, browser type, and settings, dates and times of Site access, and interactions with the Site.

- Device Information:

Information about the device you are using, including device name or type, device ID, operating system, and browser information.

- Usage Information:

Information about how you use our Site, including types of content viewed or engaged with, features used, actions taken, interactions with other users, and the time, frequency, and duration of activities.

- Cookies:

Information collected through the use of cookies, as explained in the "Cookies" section below.

- Analytics Data:

Information obtained through Google Analytics, including data on how users interact with the Site.

- Categories of Personal Information Sold: As of November 2023, Mentalyc does not sell personal information.

- Categories of Sources: The sources from which we collect Personal Data include: Information You Provide: Personal Data is collected when you register for and use the Service, contact us with inquiries, or otherwise communicate with us. Social Media Pages: Personal Data is collected when you interact with our Social Media Pages, and information provided by the companies hosting these pages. Automated Collection: Personal Data is collected automatically when you visit, use, and interact with the Service, including log data, cookies, device information, and usage information.

Cookies: We use cookies to operate and administer our Site, gather usage data on our Site, and improve your experience on it. A “cookie” is a piece of information sent to your browser by a website you visit. Cookies can be stored on your computer for different periods of time. Some cookies expire after a certain amount of time, or upon logging out (session cookies), others survive after your browser is closed until a defined expiration date is set in the cookie (as determined by the third party placing it), and help recognize your computer when you open your browser and browse the Internet again (persistent cookies). For more details on cookies, please visit the All About Cookies website.

Analytics: We use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to help us analyze how users use the Site and enhance your experience when you use the Site. For more information on how Google uses this data, go to www.google.com/policies/privacy/partners/.

Online Tracking and Do Not Track Signals: We and our third-party service providers may use cookies or other tracking technologies to collect information about your browsing activities over time and across different websites following your use of the Site. Our Site currently does not respond to “Do Not Track” (“DNT”) signals and operates as described in this Privacy Policy whether or not a DNT signal is received. If we do respond to DNT signals in the future, we will update this Privacy Policy to describe how we do so.

Your Choices. On most web browsers, you will find a “help” section on the toolbar. Please refer to this section for information on how to receive a notification when you are receiving a new cookie and how to turn cookies off. Please see the links below for guidance on how to modify your web browser’s settings on the most popular browsers:

‍Internet Explorer ‍Mozilla Firefox ‍Google Chrome ‍Apple Safari

Please note that if you limit the ability of websites to set cookies, you may be unable to access certain parts of the Site and you may not be able to benefit from the full functionality of the Site.

Advertising networks may use cookies to collect Personal Data. Most advertising networks offer you a way to opt out of targeted advertising. If you would like to find out more information, please visit the Network Advertising Initiative’s online resources at http://www.networkadvertising.org and follow the opt-out instructions there.

If you access the Site on your mobile device, you may not be able to control tracking technologies through the settings.

Anonymity and Pseudonymity: At Mentalyc, we respect your privacy preferences. While our services are designed to provide a personalized experience, we acknowledge the importance of choice in how you interact with us. You have the option to engage with Mentalyc either anonymously or using a pseudonym, unless providing identifiable information is required by law or is necessary for the specific purposes of our service. If you choose not to disclose your identity, please be aware that certain features or functionalities may be limited.

Quality of Personal Information: To ensure the accuracy, completeness, and currency of your personal information, we take reasonable steps to maintain data quality. We encourage you to update your information promptly if there are any changes. If you believe that the personal information we hold about you is inaccurate, incomplete, or outdated, please contact us, and we will promptly take appropriate measures to correct it.

Lawful Basis for Data Collection: We collect your personal data only when we have a lawful basis to do so. Here are the main lawful bases we rely on:

Consent: In some cases, you (the therapist) will be asked to expressly consent to the collection of your personal data. By using Mentalyc's services, you consent to the collection and use of your personal data as described in this Privacy Policy.
Contractual Necessity: In order to fulfill our contractual obligations of providing the transcription and note-generation service, we need to collect certain data about you. This includes your contact information for customer support, account details for service access, and potentially profile information to personalize your experience.

We will specify the lawful basis used for collecting each category of data below for your reference: • Category of Personal Data - Lawful Basis

• Contact Information - Contractual Necessity

• Account Information - Contractual Necessity

• Profile Information - Consent

• Communication Information - Contractual Necessity

• Log Data - Consent

• Device Information - Consent

• Usage Information - Consent

• Cookies and Analytics Data - Consent

Data Retention:

We will retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Here are some examples of how long we may retain your data:

Account Information: As long as your account is active.
Communication Information: For a reasonable period to resolve inquiries and disputes.
Usage Information: For a reasonable period to analyze trends and improve our services.

You can also request data deletion at any time by contacting Mentalyc.

Cross-Border Data Transfers (New Zealand)

Mentalyc is committed to protecting the privacy of our users, including those located in New Zealand. When we transfer personal information outside of New Zealand, we take steps to ensure that the information receives a level of protection that is comparable to that provided under the New Zealand Privacy Act.

Currently, we do not rely on standard contractual clauses approved by the Privacy Commissioner as a safeguard for cross-border data transfers. However, we are committed to implementing appropriate safeguards in the future to comply with the New Zealand Privacy Act.

Here are some of the factors we consider when assessing the adequacy of protection for personal information transferred overseas:

The laws of the country receiving the information: We will consider whether the country has laws and regulations in place that provide a level of protection for personal information that is similar to the New Zealand Privacy Act.

The security measures of the recipient organization: We will assess the security measures that the recipient organization has in place to protect personal information.

Any other relevant factors: We will consider any other relevant factors that may affect the level of protection for personal information, such as the nature of the personal information and the purpose for which it is being transferred.

We will not transfer your personal information to a country without taking steps to ensure that your privacy rights are protected.

For more information about our cross-border data transfer practices, please contact us as described in the Contact Us section of this Privacy Policy.

2. HOW WE USE PERSONAL DATA ‍ We may use Personal Data for the following purposes:

To provide customer service and respond to your inquiries, comments, feedback or questions;
To help resolve disputes;
To send you service or support messages, updates, security alerts, and account notifications;
To administer referral programs, rewards, surveys, sweepstakes, contests, or other promotional activities or events sponsored or managed by Mentalyc or its third-party partners;
To research and analyze how you interact with our Service;
To maintain and improve the content and functionality of the Service;
To develop new products and services;
To prevent fraud, criminal activity, or misuse of our Service, and to ensure the security of our IT systems, architecture, and networks; and
To comply with legal obligations and legal processes and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.
In accordance with Law 25's requirements for transparency and individual rights, if we engage in profiling activities, we will provide clear information about the types of profiling conducted and how individuals can exercise their right to object to profiling.
We do not currently engage in automated decision-making based on personal data. However, if such practices are implemented in the future, they will adhere to Law 25's specific requirements for transparency and individual rights.

Additionally:

Aggregated Information: We may aggregate anonymized Personal Data and use the aggregated information to analyze the effectiveness of our Service, to improve and add features to our Service, and for other similar purposes. In addition, from time to time, we may analyze the general behavior and characteristics of users of our Services and share aggregated information like general user statistics with prospective business partners. We may collect aggregated information through the Service, through cookies, and through other means described in this Privacy Policy.

Marketing: We may use your Personal Data to contact you to tell you about products or services we believe may be of interest to you. For instance, if you elect to provide your email or telephone number, we may use that information to send you special offers. You may opt out of receiving emails by following the instructions contained in each promotional email we send you. In addition, if at any time you do not wish to receive future marketing communications, you may contact us. If you unsubscribe from our marketing lists, you will no longer receive marketing communications but we will continue to contact you regarding the management of your account, and other administrative matters, and to respond to your requests.

De-identified Data for Research: Mentalyc may use de-identified data, which meets HIPAA privacy standards, for research purposes. This data cannot be used to identify any individual user. The research helps us improve Mentalyc's platform and services to better serve our users.

3. PERSONAL HEALTH INFORMATION (PHI) COMPLIANCE

This section outlines Mentalyc's commitment to protecting Personal Health Information (PHI) entrusted to us by therapists in accordance with the Nova Scotia Personal Health Information Act (PHIA). We recognize the sensitive nature of PHI and implement strict measures to safeguard its confidentiality, integrity, and security.

Obtaining Consent:

Therapists using Mentalyc's services must obtain clear, written consent from their patients before collecting, using, or disclosing any PHI through our platform.
Mentalyc recommends therapists provide patients with a copy of their consent form for their records.
We will only collect, use, or disclose PHI within the parameters authorized by the patient's consent.

Safeguarding PHI:

Mentalyc implements robust security measures to protect PHI, including:
- Secure storage of data using industry-standard encryption methods.
- Access controls to restrict access to authorized personnel only.
- Regular security audits and penetration testing to identify and address vulnerabilities.
- Employee training on PHIA compliance and data security best practices.

Patient Access and Correction:

Patients have the right to access and correct their PHI under PHIA. Therapists using Mentalyc's platform can:
- Access a patient's PHI upon request through secure channels provided by Mentalyc.
- Facilitate patient requests to review and correct their PHI within Mentalyc's system according to PHIA guidelines.

Accountability:

Mentalyc is committed to supporting therapists in complying with PHIA. We provide resources and guidance to therapists regarding their obligations under PHIA when using our services.
We maintain a process for addressing any potential PHI breaches promptly and effectively.

Disclosure of PHI:

Mentalyc will only disclose PHI under limited circumstances permitted by PHIA, such as:
- With the patient's explicit consent.
- As required by law or legal process.
- To public health authorities for reporting purposes.
- In emergency situations to protect the health or safety of an individual.

4. SHARING AND DISCLOSURE OF PERSONAL DATA

In certain circumstances, we may share your Personal Data with third parties without further notice to you unless required by the law, as set forth below:

Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may share Personal Data with vendors and service providers, including providers of hosting services, email communication software and email newsletter services, advertising and marketing services, payment processors, customer relationship management and customer support services, and web analytics services. Pursuant to our instructions, these parties will access, process, or store Personal Data in the course of performing their duties to us. Business Transfers: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of all or a portion of our assets, or transition of service to another provider, your Personal Data and other information may be shared in the diligence process with counterparties and others assisting with the transaction and transferred to a successor or affiliate as part of that transaction along with other assets. Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability.

5. UPDATE YOUR INFORMATION ‍ Please log in to your account or contact us if you need to change or correct your Personal Data. ‍ 6. LINKS TO OTHER WEBSITES ‍ The Service may contain links to other websites not operated or controlled by Mentalyc, including social media services (“Third Party Sites”). The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third-Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed Third-Party. Please contact the Third-Party Sites directly for information on their privacy practices and policies. ‍ 7. SECURITY ‍ You use the Service at your own risk. We implement commercially reasonable technical, administrative, and organizational measures to protect Personal Data both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or e-mail transmission is ever fully secure or error-free. In particular, e-mails sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Service or e-mail. Please keep this in mind when disclosing any Personal Data to Mentalyc via the Internet. In addition, we are not responsible for the circumvention of any privacy settings or security measures contained on the Service, or third-party websites. ‍ 8. INTERNATIONAL USERS ‍ By using our Service, you understand and acknowledge that your Personal Data will be transferred from your location to the facilities and servers of our hosting providers and third-party service providers.

Compliance with Quebec Privacy Laws: To ensure compliance with Law 25's requirements for cross-border transfers, we implement appropriate safeguards, such as standard contractual clauses or data processing agreements, when transferring personal data to servers located outside of Quebec. These safeguards ensure that personal data receives a level of protection consistent with Quebec's privacy laws.

9. YOUR CHOICES ‍ In certain circumstances providing Personal Data is optional. However, if you choose not to provide Personal Data that is needed to use some features of our Services, you may be unable to use those features. You can also contact us to ask us to update or correct your Personal Data.

In compliance with Law 25's requirement for data retention limits, we retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

10. CALIFORNIA CONSUMER PRIVACY ACT (CCPA) RIGHTS

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your Personal Data. This section outlines those rights and provides information on how to exercise them.

Right to Know About Personal Information Collected, Disclosed, or Sold: You have the right to request that Mentalyc disclose certain information to you about our collection and use of your Personal Data over the past 12 months. Upon receiving a verifiable request, we will provide details about the categories and specific pieces of Personal Data we have collected, the sources from which we collected the information, the purposes for which we used the information, and whether we disclosed or sold the information to third parties.

How to Submit a Request to Know: To exercise your right to know, please submit a verifiable request by contacting us. Right to Request Deletion of Personal Information: You have the right to request the deletion of your Personal Data collected or maintained by Mentalyc. Upon receiving a verifiable request, we will delete your Personal Data from our records, subject to certain exceptions.

How to Submit a Request to Delete: To exercise your right to delete, please submit a verifiable request by contacting us.Verification Process: Before responding to your request, we may need to verify your identity. To do so, we may request additional information to confirm your identity and ensure the security of your Personal Data. We will only use the information provided in connection with your request.

Authorized Agents: You may designate an authorized agent to make a request on your behalf. If you use an authorized agent, we will require them to provide proof of your written authorization and verify their own identity.

Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. This means we will not deny you goods or services, charge you different prices or rates, or provide you with a different level or quality of services.

Contact Information: If you have any questions or concerns about our CCPA-related practices or this section of the Privacy Policy, please contact us.

Effective Date: This CCPA section is effective as of October 1, 2023, and it is subject to change in accordance with updates to CCPA regulations or changes in our data practices. Please refer to this section regularly for the most current information on your CCPA rights and how to exercise them.

11. YOUR RIGHTS UNDER THE NEW ZEALAND PRIVACY ACT

AIf you are a user located in New Zealand, you have certain rights under the Privacy Act 2020 in relation to your personal information. These rights include:

Right to Access and Correct Your Personal Information: You have the right to request a copy of the personal information we hold about you and to correct any inaccuracies in that information. You can exercise this right by contacting us as described in the Contact Us section of this Privacy Policy.

Right to Object to Processing: You have the right to object to us processing your personal information for certain purposes, such as direct marketing. You can object to processing by contacting us as described in the Contact Us section of this Privacy Policy.

Right to Complain to the Privacy Commissioner: If you have any concerns about our handling of your personal information, you can make a complaint to the Privacy Commissioner. You can find more information about the Privacy Commissioner and how to make a complaint on their website https://www.privacy.org.nz/.

Please note: These rights are not absolute and may be subject to certain limitations and exceptions under the New Zealand Privacy Act.

12. ACCESSING AND OBTAINING YOUR PERSONAL INFORMATION

Right to Access Personal Information: As a consumer, you have the right to request and obtain a copy of the specific pieces of personal information that Mentalyc has collected about you. This includes information collected over the past 12 months.

How to Submit a Request for Access: To exercise your right to access your personal information, please submit a verifiable request by sending an email to [email protected] with the subject line "Request for Access to Personal Information" or by contacting us through the designated channels provided on our Site.

Verification Process: Before responding to your request, we will need to verify your identity to ensure the security of your personal information. This verification process may require additional information.

Response to Requests: Upon receiving a verifiable request, we will provide you with a copy of the specific pieces of personal information that we have collected about you, subject to any legal exceptions.

No Discrimination: We will not discriminate against you for exercising your right to access your personal information. This means we will not deny you goods or services, charge you different prices or rates, or provide you with a different level or quality of services.

13. CHANGES TO THE PRIVACY POLICY ‍ The Service and our business may change from time to time. As a result, we may change this Privacy Policy at any time. When we do, we will post an updated version on this page, unless another type of notice is required by the applicable law. By continuing to use our Service or providing us with Personal Data after we have posted an updated Privacy Policy, or notified you by other means if applicable, you consent to the revised Privacy Policy and practices described in it. ‍ 14. CONTACT US ‍ If you have any questions about our Privacy Policy or information practices, please feel free to contact us.