How Mendly protects client data

Your clients trust you with how they are really doing. Here is exactly what we do to protect that information.

HIPAA has no official certification, so we don’t claim one. Instead, this page lists the specific safeguards and agreements we have in place.

A Business Associate Agreement with every practice

You sign our Business Associate Agreement before you invite your first client, on every plan, including free.
If we ever learn of a breach or security incident involving your clients’ information, we tell you without unreasonable delay and within 30 days.
Client information is stored only with Amazon Web Services, in the United States, under AWS’s own Business Associate Agreement with us.
No other company receives client information. Stripe handles your billing and sees only your email address.

Every connection to Mendly uses HTTPS (TLS 1.2 or higher), and browsers are told never to connect without it.
Client data and its backups are encrypted at rest, with keys managed by AWS.
The Mendly app keeps sign-ins and unsent check-ins in the phone’s encrypted secure storage.

You see only your own clients, and each client sees only their own check-ins. Our server checks this on every request, and our automated tests try to break it.
Two-factor sign-in is required for every therapist account, with an authenticator app or an emailed code. Exporting client data requires it too.
You are signed out after 30 minutes without activity.
Repeated failed sign-ins lock sign-in for a few minutes and alert us.
Mendly’s own admin screens show totals only, never client names or email addresses.

Each time a client’s record is viewed or changed, the audit log records which account did it and when.
The app can add to the audit log but cannot edit or delete it.
We are alerted right away if the audit log ever fails to write.
Automated threat detection watches our cloud account around the clock and alerts us to unusual activity.

No advertising, and no tracking or analytics code from other companies.
We never sell client information or use it for marketing.
Client check-ins are never sent to an AI service.
Reminders and emails never say what a client tracks, how they answered, or a score.

Client data is backed up continuously and can be restored to any point in the last 35 days. We test a full restore every year.
You can export your clients’ data at any time.
When you delete a client, their information is removed right away and is gone from backups within 35 days.

Read our Business Associate Agreement, or email us for our completed security questionnaire.