Skip to content

Privacy Policy

Last Updated: October 15, 2026 (Version 7)

1. Introduction

Mendly ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Mendly is operated by Mendly LLC, a Pennsylvania limited liability company.

This Privacy Policy covers the Mendly therapist platform at mendly.me and the client accounts therapists create on it, including when a client uses the Mendly mobile app to complete check-ins for their therapist. Personal (non-therapist) accounts in the Mendly mobile app are covered by the separate App Privacy Policy.

By using Mendly, you agree to the collection and use of information in accordance with this Privacy Policy.

2. HIPAA & Protected Health Information

Mendly serves mental health professionals, and much of the information on the platform is protected health information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA"). Your therapist or practice is the HIPAA covered entity responsible for your health information; Mendly LLC acts as their business associate.

We handle PHI in accordance with HIPAA and the Business Associate Agreement ("BAA") we enter into with each therapist customer, available at mendly.me/legal/baa. To the extent this Privacy Policy conflicts with the BAA with respect to PHI, the BAA controls.

If you are a client and wish to access, amend, or request an accounting of disclosures of your health records, direct your request to your therapist — we support them in fulfilling those requests as required by HIPAA.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

  • Therapist Accounts: Name, email address, password (managed by our authentication provider), organization name (optional), and your multi-factor authentication settings
  • Client Accounts: Name and email address (entered by your therapist when they invite you), password (managed by our authentication provider), your association with your therapist, and your time zone, which the web browser or mobile app reports so reminders and check-in dates line up with your local day

3.2 Usage and Security Data

We automatically collect:

  • Sign-in records (time, IP address, and browser or device type), kept so unusual access can be detected. In the Mendly mobile app, a record is made when the app is opened, at most once every 12 hours. Sign-in records are kept until the account is deleted
  • An audit log of who viewed or changed client records and when, as HIPAA requires. The audit log is append-only: entries cannot be edited or deleted through the Service
  • A log of the emails we send you: the recipient address, subject line, type, time, and delivery status, but not the body of the message. Email log entries are deleted after 90 days
  • Error reports from the website and the mobile app: the error message, where in the code it happened, the page or screen, the app version, and the browser or device type. On the website a report is linked to the signed-in account; mobile app reports are not. Error reports are deleted after 90 days
  • Whether you have completed the in-app tour, and other interface preferences

3.3 Application Data

Depending on how you use the service, we collect:

  • The check-in questions your therapist chooses for you, including any questions they write themselves
  • Your daily check-in responses, overall mood rating, and any notes you write. If you change a check-in you already sent, the earlier version is kept as part of your record
  • Whether the text of a check-in contained language suggesting a risk of self-harm (a flag for your therapist, which records the date and whether your therapist has reviewed it, but no text)
  • Your answers to standardized questionnaires your therapist assigns (such as the PHQ-9, GAD-7, PCL-5, and AUDIT-C), the resulting total score and severity band, and, for the PHQ-9, whether your answer to the self-harm question was anything other than "not at all"
  • Client information entered by your therapist (a birthday, and any notes your therapist adds)
  • Reminder settings: the reminder time your therapist sets, whether email reminders are on, whether and when you unsubscribed from them, and whether the mobile app has a reminder scheduled on your device
  • Trends and insights derived from your own check-ins, such as which tracked factors line up with your mood

3.4 Billing Information

For therapist subscriptions, we collect:

  • Subscription plan, billing interval, and billing status
  • Payment records and invoices
  • Your referral code and, if you were referred, who referred you

Payments are processed by Stripe. Your full payment card details are provided directly to Stripe and are not stored on our servers. Stripe's handling of your information is described in its own privacy policy. Stripe does not receive any client information.

3.5 Phone Number and SMS Data

SMS notifications are not currently offered. If we enable SMS in the future, opting in would involve collecting:

  • Your mobile phone number
  • SMS consent status and timestamp
  • SMS message logs (message type, delivery status, timestamps), deleted after 90 days
  • Opt-in and opt-out records

For complete details, see our SMS Consent & Terms page.

3.6 The Mendly Mobile App

If you use the Mendly mobile app as a therapist-linked client, the app also:

  • Schedules your daily reminder as a notification on your own device. The reminder is generic ("Time for your check-in") and is not sent through any notification service; nothing about your check-in leaves your device for it
  • Can lock itself behind Face ID, Touch ID, or your device passcode. That check happens entirely on your device
  • Sends us a short technical report if the app crashes: the error message, where in the code it happened, the screen, the app version and platform, and your device's user agent. Tokens, email addresses, and anything resembling a credential are removed, no check-in content is included, the report is not linked to your account, and it is deleted after 90 days
  • Checks for app updates with Expo's update service. That request carries your device platform, the app's version, release channel and installed update, and may include a random identifier for this installation of the app; like any internet request it also shows your IP address. It contains no account or health information

The app does not read your health data from Apple Health or Health Connect on accounts linked to a therapist, and it contains no advertising, attribution, or analytics software.

3.7 Cookies and Tracking

We use:

  • Session cookies for authentication
  • CSRF tokens for security
  • Local storage for user preferences
  • Privacy-friendly, cookieless analytics on our public pages to count visits and understand traffic. This uses no cookies and stores no personal information — visits are counted using a rotating daily identifier that cannot be traced back to you.

We do not use third-party advertising or analytics trackers.

4. How We Use Your Information

We use your information to:

  • Provide and maintain the Service
  • Authenticate users and manage accounts
  • Show therapists their clients' check-ins, questionnaire results, and insights
  • Process subscription payments and manage billing
  • Send the emails the Service relies on: client invitations and invitation codes, password resets and sign-in codes, check-in reminders you enable, a weekly summary to therapists that contains counts only (how many clients checked in and how many may need attention, never names or scores), payment receipts, a reminder before an annual plan renews, referral notices, a notice when someone tries to sign up with an email address that already has an account (at most one an hour), replies to account-deletion requests, a notice if we close a therapist account, and security alerts to our own team
  • Show crisis resources to a client when a questionnaire answer or check-in text suggests a risk of self-harm, and flag both a positive PHQ-9 self-harm answer and check-in text with that kind of language to the client's therapist on their dashboard until the therapist marks it reviewed. There is no real-time alert
  • Detect and prevent security threats, fraud, or abuse
  • Comply with legal obligations
  • Improve and develop the Service

No artificial intelligence is used on therapist or client data. Check-ins, questionnaire answers, and other information on the therapist platform are not sent to any AI or machine-learning service and are never used to train any model. Insights are computed with ordinary statistics on each client's own data.

5. Information Sharing and Disclosure

5.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties.

5.2 Your Therapist

If you are a client, everything you enter in a check-in or questionnaire is shared with the therapist who invited you. That is the purpose of the Service. Your therapist can also export their clients' check-ins and questionnaire responses as a file for their own records.

5.3 Third-Party Service Providers

We share data with service providers who help us operate:

  • Amazon Web Services (AWS): Application hosting, database, user authentication, and transactional email delivery. AWS is our primary infrastructure provider, and we have a business associate agreement with AWS covering PHI.
  • Stripe: Subscription payment processing (billing information only — Stripe does not receive client health information)
  • Cloudflare: DNS services
  • Expo: Delivering updates to the Mendly mobile app. When the app checks for an update, Expo receives the device platform, the app's version, release channel and installed update, possibly a random identifier for the installation, and the IP address the request comes from. It receives no account or health information.
  • Apple and Google: Distribution of the Mendly mobile app through the App Store and Google Play. They receive the usual information about app installs and crashes that their platforms collect; they do not receive your account or check-in information from us.

These providers have access to your data only to perform services on our behalf and are obligated to protect it. Providers that handle PHI on our behalf are bound by business associate agreements as required by HIPAA.

5.4 Legal Requirements

We may disclose your information if required by law or to:

  • Comply with legal process (subpoenas, court orders)
  • Protect our rights, property, or safety
  • Prevent fraud or security threats
  • Respond to government requests

5.5 Business Transfers

If Mendly is acquired or merged, your information may be transferred to the new owner, subject to the protections of this Privacy Policy and, for PHI, the BAA and HIPAA.

6. Data Storage and Security

6.1 Where We Store Data

Your data is stored on:

  • Amazon Web Services infrastructure (managed PostgreSQL database and cloud hosting)
  • Servers located in the United States

6.2 Security Measures

We implement security measures including:

  • Managed authentication through AWS Cognito, with multi-factor authentication required for therapist and administrator accounts
  • HTTPS/TLS encryption for data in transit
  • Encryption of data at rest
  • CSRF protection
  • Rate limiting on authentication and sensitive operations
  • Automatic sign-out after 30 minutes of inactivity on the web, enforced by our servers as well as in your browser
  • Security headers (HSTS, CSP, X-Frame-Options)
  • Append-only audit logging of access to client records
  • Mendly's admin tools do not show client records: they show therapist account and billing information and counts, such as how many clients a therapist has, but not who the clients are or what they entered

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6.3 Data Retention

We retain data for as long as your account is active or as needed to provide the Service. You may delete your account or request deletion at any time, as described in Section 7. Deleted data is removed from the Service immediately and from our encrypted backups within 35 days. PHI is returned or destroyed in accordance with the BAA when a therapist's account ends. The record of a therapist's signed BAA is retained after deletion, with the date and reason it ended, as required for compliance.

7. Your Rights and Choices

7.1 Access and Update

Therapists can access and update their account information in Settings. Clients cannot view their past check-ins in the Mendly app or on the website; to see or get a copy of their check-in history and other health records, clients can ask their therapist, as described in Section 2. Therapists can download their clients' check-ins and questionnaire responses from Settings to respond to such a request.

7.2 Data Deletion

To delete your data:

  • Therapists: Delete your account from Settings. Deletion is immediate and permanent, cancels any paid subscription, and removes your account, all of your clients' accounts, every check-in (including earlier versions of edited check-ins), questionnaire response, and safety flag, and your and your clients' sign-in records, notification registrations, and error reports. Client email addresses in our email log are masked. You can also email support@mendly.me; we process emailed requests within 30 days.
  • Clients: Contact your therapist, or email support@mendly.me — because your therapist controls your health records, we will coordinate the request with them. You can also close your login yourself under Settings in the Mendly app, which signs you out and stops your reminders; your check-ins stay with your therapist as part of your clinical record.

7.3 Data Export

Therapists can download all of their clients' check-ins and questionnaire responses as a CSV file from Settings. For other export requests, email support@mendly.me.

7.4 Email Communications

The emails described in Section 4 are part of the Service. Client reminders and the therapist weekly summary can each be turned off: reminders through the unsubscribe link in every reminder email or by asking your therapist, and the weekly summary from the therapist's Settings page or the link in the email. When a client unsubscribes from reminders, their therapist cannot turn reminder emails back on; to restart them, the client can email support@mendly.me.

We may occasionally email therapist customers about Mendly product updates. You can turn these off or back on under Product update emails in Settings, and every such email includes an unsubscribe link. Opting out does not affect the emails the Service relies on. We never send marketing email to clients.

Prospective customers. We may email therapists and practices who do not have a Mendly account about the Service, using business contact details (such as name, practice, work email, phone, website, and location) from public sources such as practice websites and directories. We use these details only for that outreach. Every such email identifies itself as promotional and includes an unsubscribe link; once you unsubscribe, we keep your address on a do-not-contact list so we do not email you again. To have your details removed, email support@mendly.me.

8. Children's Privacy

A therapist may create a client account for a minor (under 18) only with the consent of the minor's parent or legal guardian; the therapist is responsible for obtaining that consent, and the Service does not verify age or record it. The Mendly mobile app is rated for ages 18 and over in the app stores, so clients under 18 should complete check-ins on the website. The parent or legal guardian is responsible for:

  • Providing consent for the minor's account
  • Reviewing this Privacy Policy
  • Managing the minor's account and data

9. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

  • Know what personal information we collect
  • Know if we sell or disclose your personal information (we do not sell)
  • Access your personal information
  • Delete your personal information
  • Opt-out of the sale of personal information (not applicable - we don't sell)
  • Non-discrimination for exercising your rights

Note that PHI governed by HIPAA is generally exempt from the CCPA; rights in your health records are provided under HIPAA through your therapist, as described in Section 2.

To exercise these rights, email support@mendly.me.

10. International Users

Mendly is operated from Pennsylvania, USA. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States where data protection laws may differ from your country.

11. Changes to This Privacy Policy

We may update this Privacy Policy. When we make a material change, we will:

  • Post the updated Privacy Policy on the Service
  • Update the "Last Updated" date and version number
  • Ask you to review and accept the updated Privacy Policy the next time you sign in on the web

Continued use after the updated Privacy Policy takes effect constitutes acceptance.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Email: support@mendly.me
Company: Mendly LLC
Location: Pennsylvania, USA

13. Data Breach Notification

If a breach affects client health information (PHI), we will notify the affected therapist customers as the HIPAA Breach Notification Rule and our BAA require, without unreasonable delay and no later than 30 days after discovering it, with the information they need. Under HIPAA, the therapist decides whether and how clients are notified, and any notice to clients comes from the therapist or from us at the therapist's direction. If a breach affects other information about you, such as a therapist's account or billing information, we will notify affected users by email without unreasonable delay and as applicable state law requires.

By using Mendly, you acknowledge that you have read and understood this Privacy Policy.