Effective October 15, 2026
This policy applies to people who use the Mendly app for themselves, without a therapist.
It does not apply if a therapist invited you to Mendly. In that case your information is protected health information handled on your therapist’s behalf under HIPAA, and their notice of privacy practices governs it. See the final section below.
We collect what you enter, and, only if you choose to connect it, a few daily figures from Apple Health or Health Connect. We do not buy health data from anyone. The only things we derive from what you enter are your patterns, your weekly read, and the crisis-language check described below.
We do not collect precise location, biometric identifiers, contacts, photos, or any information about reproductive or gender-affirming care, and nothing from Apple Health or Health Connect beyond the figures listed above. The answers you give during setup are used on your phone to choose what you start tracking. We do not keep them.
We ask for your consent to collect and use your consumer health data separately from our Terms and Privacy Policy, with its own checkbox next to a link to this policy. It is not implied by signing up or by using the app. When you tick it, our servers record the time and the version of this policy you agreed to. If you have not given consent to the current version, including if you signed up before we asked this way, the app asks you before you can save anything new, and Mendly does not save check-ins, import health figures, or write weekly reads for you until you agree.
You can withdraw it at any time in the app under Settings › Privacy › Withdraw health-data consent, or by emailing support@mendly.me. Withdrawing stops all further collection and use straight away: check-ins can’t be saved, no health figures are imported, and no weekly read is written, because withdrawing also withdraws your permission for the weekly read. What you already saved stays in your account until you delete it, and you can export or delete it from the same screen. To have everything removed, delete your account under Settings or at mendly.me/delete-account.
Every category above comes directly from you: entered in the app, or read from Apple Health or Health Connect on your phone if you connect it. We have no other sources of consumer health data.
We do not use your consumer health data for advertising, and we do not use it to train any machine learning model.
We do not sell your consumer health data. We have never sold it and we do not have a process for doing so.
We share it only with service providers (processors) who process it on our behalf, under contract, and only as needed to run Mendly. Each is bound to protect it at least as well as this policy does:
We have not shared consumer health data with any third party or affiliate. The providers above are not third parties under Washington and Nevada law, because they process data only for us. No third party collects information about you over time and across other apps or websites through Mendly.
Notifications we send never contain health information. They say Mendly is ready for you and nothing more, so the services that deliver them never see anything about your check-ins. Your daily reminder never leaves your phone at all — it is scheduled on the device itself.
We may also disclose information if legally compelled, or where necessary to protect someone from imminent harm.
If you have Mendly Plus (paid, or free for a limited time) and give permission, your check-in responses and notes — and your daily health figures, only if you separately turn those on for your read — are processed by a large language model to write your weekly read. The model runs on Amazon Bedrock inside Mendly's own AWS environment. Your data is not used to train or improve any model. The read is stored against your account and shown only to you.
This happens only with your explicit permission, which we ask for in the app before anything is sent, naming exactly what is sent and where it goes. You can withdraw it at any time under Settings › Your data › Writing your weekly read, after which no further read is written and nothing further is sent. Withdrawing your health-data consent withdraws this permission too.
Every time you save a check-in, Mendly checks your note and any written answers for language suggesting suicidal ideation or self-harm. This runs for everyone who uses the app on their own, with or without Plus. If it finds explicit language, the app shows you the 988 Suicide and Crisis Lifeline straight away, with a link to findahelpline.com for people outside the US. Nothing about that check-in’s result is stored against you.
When a weekly read is due, the same check runs over that week’s writing first. If it finds explicit language, or repeated signs of hopelessness or distress, that week’s read is replaced by a short fixed message of support with the 988 Lifeline at the top, and nothing from that week is sent to the model. The read stores whether the check was raised and a short reason code (explicit self-harm language, sustained distress language, or distress language alongside low ratings), so the stronger crisis card appears again whenever you reopen it. That flag is not a risk score or a diagnosis, is never shared with anyone, is included in your data export, and is deleted with your account.
We do not contact anyone on your behalf — not emergency services, not family, not a therapist. We do not restrict your account or use the flag for anything except showing you that card. Separately, we keep a daily count of how many times crisis resources were shown, which carries no identifier and cannot be traced back to you.
This is a check on language, not a diagnosis or a clinical judgement, and it is never presented as one. Our full protocol is published at mendly.me/legal/crisis-protocol.
You may, at any time:
To exercise any of these, use Settings in the app, start a deletion at mendly.me/delete-account, or email support@mendly.me. We respond within 45 days, and may take another 45 if a request is complex, in which case we will tell you why before the first period ends. These requests are free.
If we refuse a request, you can appeal by replying to our decision or by emailing support@mendly.me with "Appeal" in the subject line. We will answer your appeal in writing within 45 days, explaining what we decided and why. If we deny your appeal, you can complain to the attorney general: Washington, Nevada, Connecticut, or your own state’s attorney general.
Data is encrypted in transit and at rest. Access is limited to the people who operate Mendly and need it, and access through Mendly’s own admin tools is logged. On your phone, your credentials are held in the device keychain and the app can lock itself after you have been away from it.
We keep your data until you delete it. Deleting your account removes it from Mendly immediately, and from our backups within 35 days. We also ask RevenueCat to delete its record of you and, if you signed in with Apple, ask Apple to revoke Mendly’s access. Afterwards we keep only a short record that the deletion happened, with counts and none of your content.
If a breach affects your consumer health data, we will notify you and the FTC as the Health Breach Notification Rule requires — without unreasonable delay and no later than 60 days after discovering it.
If a therapist invited you, your check-ins are part of their clinical record. That information is protected health information under HIPAA, Mendly handles it as their business associate, and this policy does not apply to it. Those records are kept separate from consumer data in our systems and are never combined.
A therapist-linked account and a personal account are separate. Nothing moves from one to the other: your therapist’s record is not copied into a personal account, and Mendly never gives a therapist access to a personal account. Anything you choose to show a clinician yourself, such as a session summary, is up to you.
If we change this policy we will post the new version here. If the change is material, the app shows you the new version and asks for your consent again before Mendly collects or uses anything more. We will not apply a material change to data already collected without asking you first.
Mendly LLC · support@mendly.me