Privacy Policy

How Mindwell collects, uses and protects your personal information.

1. Who we are

Mindwell is an online counselling and therapy service operated by Mindwell, Kampala Ntinda, in Uganda. We are responsible for the personal data you share with us, under the Data Protection and Privacy Act, 2019.

2. What we collect

• Account details: your name, email, phone number, date of birth, gender (optional) and password (stored encrypted).
• Health information you share: your answers to screening questions (such as PHQ-9 and GAD-7), check-ins, mood entries, journal entries, messages with your therapist, and the notes your therapist writes about your sessions. This is sensitive personal data and we treat it with extra care.
• Payments: the amount, date, payment method and a masked phone number. Mobile Money payments are processed by Flutterwave; we never see your PIN.
• Technical information: basic logs (such as when you logged in) needed to keep the service secure.

3. Why we use it

• To provide counselling: matching you with a therapist, booking and running sessions, and keeping clinical records.
• To keep you safe: if your answers suggest you may be at risk of harm, our care team is alerted so someone can follow up.
• To send reminders, receipts and important account messages by email and SMS (you can turn reminders off in Settings).
• To take payments and meet our legal and accounting obligations.
• To improve the service, using anonymous or summarised information where possible.

We use your sensitive health information only with your consent, which you give when you create your account, and only for your care.

4. Who can see it

• Your therapist sees your screening and check-in results, session notes, and anything you choose to share (journal entries and your mood chart are private unless you share them).
• Authorised Mindwell staff see what they need to route bookings, handle safety alerts, payments and support. Access to clinical information is recorded in an audit log.
• Service providers who help us run Mindwell, under agreements to protect your data: hosting, email delivery, SMS (Pandora Networks), payments (Flutterwave) and video calls (LiveKit). Some of these process data outside Uganda; we only use providers that protect it to a standard comparable to Ugandan law.
• We do not sell your data or use it for advertising.

Video sessions are not recorded.

5. When we may share without your permission

Only where the law requires it, or where there is a serious and immediate risk to your life or someone else's — for example, contacting emergency services. Your therapist will explain these limits of confidentiality.

6. How long we keep it

We keep clinical records for as long as required for professional and legal purposes, and other information for as long as your account is active or the law requires. [Retention periods to be confirmed by Dr. Ntabade.]

7. Your rights

Under the Data Protection and Privacy Act you can ask to see the personal data we hold about you, ask us to correct it, object to certain uses, and ask us to delete it where we are not required to keep it. You can withdraw your consent at any time — this may mean we can no longer provide counselling. To make a request, contact us at care@mindwell.com. You can also complain to the Personal Data Protection Office.

8. Security

We use encrypted connections (HTTPS), encrypted passwords, access controls and audit logs. No system is perfectly secure; if a breach affects your data we will tell you and the regulator as the law requires.

9. Age

Mindwell accounts are for adults aged 18 and over.

10. Changes

If we change this policy we will update the version below and ask you to review and accept it the next time you log in.

Version 2026-10-draft · Questions: care@mindwell.com