Privacy policy

1. Data controller

The data controller is MindStim Società a Responsabilità Limitata Semplificata, with registered office at Via Trento 27, 64014 Martinsicuro (TE), Tax ID/VAT number 02223570678.

Contact: certified email (PEC) mindstim@pec.it, email mindstimsrls@gmail.com.

2. Nature of the service and data minimisation

MindStim is designed to not require patient registration and not to load marketing tools on patient session pages. Realtime stimulation state remains in server memory. The optional Record and transcribe feature, when started by the therapist, stores audio, transcripts and draft summaries for the periods below.

On the public pages of the site (marketing, registration, subscription), subject to user consent, Meta Pixel and the Google Ads tag may be active to measure the effectiveness of promotional campaigns - see the dedicated section and the cookie policy.

Professionals, people with relevant experience, students and private individuals may voluntarily create an account, including without a VAT number, to access the Pro plan (advanced features, dedicated link, saved preferences). In that case, email, authentication data and, if subscribed, billing data processed via Stripe are handled as described in the dedicated sections.

The invitation link contains a random session identifier, not permanently associated with a person identified by the Controller.

3. Roles in clinical data processing

For personal data processed in the therapeutic relationship, the professional using MindStim acts as an independent data controller and remains responsible for applicable legal and professional obligations. Recording is optional. Before starting, the therapist must confirm that the patient has been informed and any necessary consent obtained. MindStim processes recorded content to provide the features requested by the professional under the applicable agreements.

MindStim SRLS is instead the data controller for the data described in this notice: technical browsing data, user account data and subscription data.

4. Data processed

In connection with use of the site and service, the following may be processed:

The Controller does not require the patient to create an account. Optional recordings may contain health data. Transcription and draft summaries do not replace the professional’s clinical record.

• Technical browsing and connection data (e.g. IP address, date and time, browser type, system logs) necessary for operation, security and service diagnostics;
• Technical session data (session identifier, stimulation settings transmitted in real time) processed solely for synchronisation between therapist and patient;
• Language preference, stored via a technical cookie (see cookie policy);
• Contact data voluntarily sent by email or certified email (PEC) by the professional or third parties.
• User account data (registered users only): email address, display name, user identifier, dedicated link slug, current active session identifier, non-clinical technical preferences;
• Record of acceptance (user account only): date, time and version of the privacy notice and terms accepted at registration, retained for accountability purposes (Art. 5(2) GDPR);
• Subscription data (Pro plan only): managed by Stripe (subscription status, customer/subscription identifiers, validity period). Payment card data does not pass through MindStim servers.
• Marketing measurement data (subject to consent only): browsing and conversion events (e.g. page view, checkout start, trial start, purchase, registration) sent to Meta via Meta Pixel (browser) and, for subscription conversions, also through Conversions API (server). These may include Meta cookie identifiers (_fbp, _fbc), IP address, user agent and, server-side, hashed email (SHA-256) and a pseudonymized account identifier for advertising matching. The Google Ads tag, limited to public pages, measures verified starts of a 14-day trial and may process ad-click identifiers and Google cookies (_gcl_aw, _gcl_au), IP address, user agent and a pseudonymous conversion identifier to prevent duplicates. No email, account identifiers, checkout identifiers or clinical data is sent to Google. Meta and Google process the data they receive under their respective roles and notices.

5. Purposes and legal basis

The checkbox required at registration documents acknowledgement of this notice and acceptance of the legal notice; it does not constitute additional consent to processing, which is based on the legal grounds indicated above.

• Provision of the service - performance of pre-contractual or contractual measures and technical management of sessions (Art. 6(1)(b) GDPR);
• Security and abuse prevention - legitimate interest of the Controller in protecting infrastructure and users (Art. 6(1)(f) GDPR);
• Legal compliance - legal obligations, requests from the Authority (Art. 6(1)(c) GDPR);
• Service communications - response to requests sent to the contacts indicated (Art. 6(1)(b) or (f) GDPR);
• Marketing communications - informational and promotional emails about MindStim (news, guides, offers), subject to express consent at signup or via account preferences; withdrawable at any time (Art. 6(1)(a) GDPR). Marketing emails may include aggregated measurement of delivery, opens and clicks (technical estimates, without storing IP or user agent) via dedicated infrastructure on a separate subdomain; transactional authentication emails do not include tracking pixels;
• User account and Pro subscription - performance of the contract or pre-contractual measures requested by the user (Art. 6(1)(b) GDPR).

6. Nature of data provision

Simply browsing the site does not require voluntary provision of personal data, except for technical data necessary for operation. To create a user account, a valid email address, a password, confirmation of having read the privacy notice and acceptance of the legal notice are required: without these, registration cannot be completed. Display name is optional. Failure to provide payment data only prevents activation of the Pro plan, not use of free features.

7. Processing methods

Data is processed using IT and electronic means, with logic related to the stated purposes and appropriate security measures (access control, encrypted communications where applicable, minimisation of stored data).

8. Retention

• Optional recordings: audio is available for 7 days from recording or import; original transcripts, revisions and summaries for 30 days. Access is blocked at expiry; automatic retention processes then delete stored copies and object versions;
• An audio recovery copy is also stored in the therapist’s browser. Account-owned copies are removed on the next visit after expiry. Downloaded files remain under the therapist’s control;
• Realtime session data: retained in memory only for the duration of the active connection;
• Server/hosting technical logs: for the time strictly necessary for security and maintenance, within the limits set by the infrastructure provider;
• Language preference cookie: up to 12 months (see cookie policy);
• Email/PEC correspondence: for the time necessary to handle the request and comply with legal obligations;
• User account and subscription data: for the duration of the contractual relationship and, where applicable, for statutory or accounting periods;
• Record of acceptance of privacy notice and terms: for the duration of the account and, after closure, for applicable limitation periods;
• Supabase/Stripe logs and technical data: according to the respective providers' policies and within the limits necessary for the service.

9. Recipients and processors

Recording audio, transcripts, revisions and summaries are processed on AWS. Storage is in eu-central-1; summaries use Amazon Bedrock Nova Micro with an EU inference profile. Clinical content is not sent to Supabase or marketing providers and is not included in application logs. Temporary download links expire after two minutes; anyone receiving a link can use it until expiry.

Data may be processed by authorised personnel of the Controller and by technology providers (e.g. hosting, CDN, network infrastructure) appointed as processors under Art. 28 GDPR, within the limits necessary to provide the service.

For user accounts and profile/subscription databases, the Controller uses Supabase (preferably EU region). For Pro plan payments, it uses Stripe as processor for payment and billing purposes.

There is no sale of personal data or transfer to third parties for marketing purposes.

10. Transfers outside the EU

Where infrastructure components are located outside the European Economic Area, the Controller adopts appropriate safeguards (e.g. adequacy decisions, Standard Contractual Clauses) compatible with the GDPR.

11. Data subject rights

Data subjects may exercise the rights of access, rectification, erasure, restriction, objection, portability (where applicable) and withdrawal of consent (if given) by writing to the Controller at the contacts indicated above.

They also have the right to lodge a complaint with the Italian Data Protection Authority (//www.garanteprivacy.it:www.garanteprivacy.it).

12. Changes

The Controller may update this notice to reflect regulatory or service changes. The date of the last update is shown at the top.