Effective October 15, 2026
This policy covers the Mendly app used without a therapist. If a therapist invited you to Mendly, different rules apply — see the section on therapist accounts below.
The health-specific disclosures required by Washington's My Health My Data Act and Nevada SB 370 are in our Consumer Health Data Privacy Policy, which those laws require to be a separate document.
HIPAA applies to health care providers and the companies handling data for them. When you use Mendly on your own, there is no provider involved, so HIPAA does not apply to your information.
That does not mean it is unprotected. Your information is covered by the FTC Health Breach Notification Rule, by state consumer health data laws including Washington's My Health My Data Act and Nevada SB 370, and by the commitments in this policy.
We say this plainly because health apps are often assumed to be HIPAA-covered when they are not, and we would rather you know exactly which rules apply.
You give us: your email address, your name, your check-in responses and notes, your preferences, and your confirmation that you are 18 or older. The answers you give during setup are used on your phone to choose what you start tracking. We do not keep them.
Your consent records: when you agree to these documents, to the Consumer Health Data Privacy Policy, to the weekly read, or to importing health figures, we record which version you agreed to and when, so we can show what you agreed to and stop when you withdraw.
If you sign in with Apple or Google: we receive the email address and name that service passes to us, and nothing else. We never tell Apple or Google what you use Mendly for.
Your device gives us: a notification token if you allow notifications, your time zone, and your app version and device type for troubleshooting. The token lets us tell you a weekly report is ready. Your daily reminder is scheduled on your phone and does not use it.
When you open the app: a sign-in record with the time, your IP address, and the device and app details your phone sends with each request (its user agent). We keep at most one record every 12 hours, to secure your account and spot access that is not yours, until you delete your account.
If the app crashes: a short error report with the error message, the place in the code where it happened, the screen, your app version and platform, and your device’s user agent. Tokens, email addresses, and anything resembling a credential are removed first. It is sent without your account details, contains no check-in content, and is deleted after 90 days.
Only if you have Mendly Plus (paid, or free for a limited time) and connect Apple Health or Health Connect: one figure a day for time asleep, steps, exercise minutes, resting heart rate, heart rate variability and mindful minutes. Mendly only reads these, never writes to them, and keeps them apart from what you type. If your Plus access ends, Mendly stops reading new figures. Disconnecting in Settings deletes everything that was imported. Accounts linked to a therapist cannot connect these.
We do not collect precise location, contacts, photos, your address book, advertising identifiers, or anything from other apps beyond the health figures above if you choose to connect them.
We do not use advertising, attribution, or session-recording tools. There is no advertising SDK and no general-purpose analytics SDK in the Mendly app. The one third-party SDK we do include is RevenueCat, which handles subscription purchases — it is used only on personal accounts, never on accounts linked to a therapist.
We do not sell your information, share it with advertisers, or use it to train AI models.
Only service providers, under contract, acting on our instructions:
Each of these providers is bound to protect your information at least as well as this policy does, and to use it only to provide its service to Mendly.
We may disclose information if legally required, or where necessary to prevent imminent harm. If Mendly is ever acquired, your information may transfer as part of that — we will notify you first and you will be able to delete your account before any transfer.
Mendly Plus writes a weekly read from your check-ins and notes using a large language model running on Amazon Bedrock within Mendly's AWS environment. Your information is not used to train any model. Reads are stored against your account and visible only to you. If you don't have Mendly Plus (paid, or free for a limited time), or don't give permission, no AI processing happens.
We ask your permission before any of this happens, and nothing is sent until you give it. The request names what is sent — your ratings, the questions you track, any notes you wrote, and, only if you separately turn health figures on for your read, your daily figures from Apple Health or Health Connect — and who it goes to. You can withdraw it at any time under Settings › Your data › Writing your weekly read. Withdrawing stops any further read being written and sends nothing more; reads you already have stay in your account and in your data export, and the rest of Mendly is unaffected.
Every time you save a check-in, Mendly checks your note and any written answers for language suggesting suicidal ideation or self-harm. This happens for everyone, with or without Plus. If it finds explicit language, the app shows you the 988 Suicide and Crisis Lifeline straight away. When a weekly read is due, the same check runs over that week’s writing first. If it finds explicit language, or repeated signs of hopelessness or distress, that week’s read is replaced by a short fixed message of support with the 988 Lifeline at the top, and nothing from that week is sent to the model.
The weekly read stores whether this check was raised and a short reason code (for example, explicit self-harm language), so the stronger crisis card shows again whenever you reopen that read. It is a language check, not a diagnosis or a risk score, it is never shared with anyone, it is included in your data export, and it is deleted with your account. We do not contact anyone on your behalf. Our protocol is published at mendly.me/legal/crisis-protocol.
Your full rights, and how to exercise them, are set out under Your rights, and how to use them below.
Set out the way state privacy laws ask for it. Everything below comes from you, or from Apple or Google if you sign in or subscribe through them. We do not buy information about you, obtain it from data brokers, or take it from other apps on your device.
We disclose these categories only to the service providers named under Who we share it with, under contract, and only to run Mendly. We keep each category until you delete your account, then remove it immediately and from our backups within 35 days. Error reports are deleted after 90 days. After a deletion we keep a short record that it happened, with counts only and none of your content.
We have never sold personal information, and we do not share it for cross-context behavioural advertising. There is no advertising in Mendly, no advertising identifier, no tracking pixel, and no general-purpose analytics service. No third party collects information about your activity over time and across other apps or websites through Mendly.
Because we do not sell or share it, there is nothing for you to opt out of — but if that ever changes we will say so here and ask you first. We also do not use your sensitive information for anything beyond providing Mendly to you, so the right to limit its use has nothing to restrict.
Depending on where you live — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana — you have some or all of these rights. We extend them to everyone rather than checking where you are.
To make a request, use Settings in the app, start a deletion at mendly.me/delete-account, or email support@mendly.me. We answer within 45 days and may take another 45 if a request is complex, in which case we will tell you why before the first period ends. We verify a request by the email address on the account; for a deletion we may ask you to confirm from that address before we act, because a deletion cannot be undone.
You may use an authorised agent by having them email us with your written permission. We will still verify the request with you directly. In California an agent may instead act under a lawful power of attorney.
Appeals. If we refuse all or part of a request, you can appeal by replying to our decision or by emailing support@mendly.me with "Appeal" in the subject line. We will answer your appeal in writing within 45 days, explaining what we decided and why. If we deny your appeal, you can complain to your state attorney general: Washington, Nevada, Connecticut, or the attorney general where you live. Californians may also contact the California Privacy Protection Agency.
Mendly is not for anyone under 18. We do not knowingly collect information from children under 13, and we do not knowingly collect or sell the personal information of anyone under 16. If we learn that we have, we delete it. If you believe a child has given us information, email support@mendly.me.
Your check-ins are part of your therapist's clinical record and are protected health information under HIPAA. Mendly handles that information as your therapist's business associate under a written agreement, and their notice of privacy practices governs it. Those records are stored separately from personal-use data and are never combined.
Deleting your Mendly login does not delete your clinical record. Your therapist is legally required to keep those records for a period set by law and their professional obligations. Deleting your account removes your access and stops new entries; it does not erase what your therapist already has.
Encryption in transit and at rest. Access to production data is limited to the people who operate Mendly and need it, and access through Mendly’s own admin tools is logged. On your device, credentials are stored in the system keychain and the app can lock itself after you have been away from it.
No system is perfectly secure. If a breach affects your health information we will notify you and the FTC as the Health Breach Notification Rule requires — without unreasonable delay and no later than 60 days after discovering it.
We keep your information until you delete it. Deleting your account removes it from Mendly immediately, and from our backups within 35 days. That includes your check-ins, notes, weekly reads, imported health figures, tracked items, notification tokens, sign-in records, and error reports linked to your account; email records keep only a masked address. Information is held in the United States on AWS infrastructure, and Mendly is intended for use in the United States only.
We will post changes here and, if material, show you the new version in the app and ask you to accept it before it takes effect.
Mendly LLC · support@mendly.me