Mentastic Personal Data Processing and Privacy Settings
Approved and effective from 02.10.2026
This document (hereinafter “Privacy Settings”) describes the principles of personal data processing for users of the Mentastic application and website (hereinafter “Application”) by HeBA Clinic OÜ and its subsidiaries and affiliates (hereinafter “HeBA”).
Currently, HeBA Clinic OÜ is the data controller. The Client Data Processing Principles apply to the processing of your personal data when you use our services, contact us, represent or act as a contact person for one of our partners, or visit our website.
General Principles
- A client, within the meaning of these Privacy Settings, is any person who visits the Mentastic website or uses the Mentastic application and the services provided through it.
- HeBA acts as the data controller of Client’s personal data under the General Data Protection Regulation (hereinafter GDPR) and processes data in accordance with GDPR and Estonian laws, including the Personal Data Protection Act, Health Services Organization Act, and Law of Obligations Act.
- All HeBA employees’ contracts include separate provisions for complying with personal data processing and storage requirements.
- All authorized processors contracted by HeBA under GDPR (mainly companies providing IT services and data hosting) follow applicable laws and these Privacy Settings in their data processing.
- HeBA Clinic OÜ processes personal data for the Mentastic application similarly to other services provided, but additional data related to the use of the application may also be processed, including health and activity data that you choose to connect through Health Connect or supported wearable services. More detailed data processing principles are described below in Section 3.
- When you contact Mentastic (e.g., via email, letter, or phone), we process the personal data you provide (e.g., name, contact information, communication details). We do this based on our legitimate interest in responding to and/or resolving your inquiry, including offering you user support.
- When you visit the Application’s website, we may obtain personal data about you through cookies used on our website. Visitors can find more information about cookies on the website’s Cookie Policy.
Legal Basis and Purposes for Personal Data Processing
- HeBA processes personal data as necessary to fulfill the services, including delivering personalized mental wellbeing support and maintaining app functionality. This processing is essential to perform our contract with the Client.
- For registration purposes, the following data is collected directly from the Client:
- Name
- Email address
- For a personalized experience, the following data is collected directly from the Client:
- Gender
- Date of birth
- Location (country)
- This personal data, provided directly by the Client during registration, is processed to support the personalized functionalities within the app (for example, location specific mental health resources).
- HeBA also processes the following types of data:
- Client activities within the application and on the website, including history, preferences, settings, and behavior patterns. This data is used to provide personalized client experience and technical support.
- In addition to the above HeBA processes certain sensitive data, based on Client’s explicit consent. While using the app, the Client can choose to allow the collection and processing of such data for the purpose of improving your mental wellbeing and tailoring the app’s services to your needs. Sensitive data may include data collected with various wearables, in which case you can opt in to connect your health and activity data to Mentastic either directly through Health Connect or through supported wearable and health-data services integrated via Thryve. You decide which available types of data Mentastic may access, and you can change or withdraw these permissions at any time. Depending on the data available on your device and the permissions you provide, this may include:
- Physical activity and fitness data, for example steps, distance, calories burned, exercise sessions, speed, elevation or floors climbed, and measures of exercise intensity such as power or VO2 max;
- Sleep and recovery data, for example sleep duration, sleep stages and resting heart rate;
- Physical state and vital signs, for example heart rate and heart-rate variability, respiratory rate, oxygen saturation, body temperature, weight and body composition;
- Nutrition and intake data, for example calorie, protein and water intake.
- Mentastic uses these data together with your own wellbeing information to provide personalised wellbeing reflections, reports and other features that help you understand multi-dimensional associations between physical activity, recovery, sleep, physiological measures and mental wellbeing. Individual health parameters are not used on their own to diagnose a medical or mental-health condition.
- Sharing health data is optional. You can continue to use Mentastic features that do not require connected health data even if you choose not to provide these permissions.
- If you allow background access to health data, Mentastic may periodically synchronise only the health-data types you have already permitted while the application is not actively open. This helps maintain continuous data timelines and prepare relevant reports without requiring you to open the application for each synchronisation. Background access does not give Mentastic access to additional types of health data.
- If you separately participate in a registered research or clinical study, the health and wellbeing data covered by your study-specific informed consent may also be processed for the research purposes described in the study information and consent. This may include studying associations between different health, activity, sleep, physiological and self-reported wellbeing parameters. Participation in a study is separate from ordinary use of Mentastic and is subject to its own study information and consent.
- Health data are not used for marketing or advertising purposes and are not shared with third parties unless this is necessary for providing the service or conducting a study you have consented to, required by law, or separately authorised by you.
- Analytics: Our Application may collect some anonymized usage data to understand users needs, and to improve our services. These usage data are for example app launches, taps, screen visits, session duration and other information about how users interact with the Application. The Application may also collect crashes and performance reports so we can improve the stability and performance of our Application. The anonymised usage analytics described above do not include the content of your conversations, questionnaire answers, reports or other information you provide to Mentastic. Such content may be processed within Mentastic where it is necessary to provide the features you use, but it is not included in these usage analytics.
- Additional Legal Basis for Processing:
- To provide HeBA services (including personal data such as name, email address, and other necessary information for delivering services through the Application);
- To identify and authenticate users via the Application, including data processed through Apple ID and Google login services if the user opts to use these for logging in;
- To comply with legal obligations, including ensuring user rights under GDPR;
- Based on the user’s consent (including various data, depending on the specific case to which the user has given consent);
- For statistical analysis of website and app usage (all categories of personal data). Processing is necessary for improving our services;
- To make product related offers based on user consent, using any or all personal data categories, for personalized communications..
Transfer of Personal Data
- HeBA keeps confidential any data regarding the Client’s personal information disclosed during the provision of services. This confidentiality obligation may be reasonably waived only in cases specified by law.
- HeBA does not disclose personal data to third parties, except in cases required by law or with the Client’s consent.
- When using the Mentastic application, HeBA may share data with service providers offering technical solutions and infrastructure necessary for the application to function (e.g., Google), provided that data sharing is essential for the application’s features. All third parties are required to comply with applicable laws, including GDPR requirements.
Retention of Personal Data
- HeBA documents and retains personal and health data collected during service provision according to applicable legal requirements for the duration necessary to achieve the processing purpose and as long as required by law. Data processed as part of a registered research or clinical study are retained according to the retention period described in the relevant study information and informed consent and in accordance with applicable research and data-protection requirements.
- Client feedback collected to assess customer satisfaction is retained for 5 years from the date of receipt.
- Accounting documents are retained for 7 years in accordance with the Accounting Act.
- Data collected via Apple ID and Google is retained according to the rules for data processing provided by these services and the client’s rights.
- Data collected according to Client consent during beta versions of the application will be deleted at no later than 3 months after the data has been collected.
Protection of Personal Data
- Personal data is stored in a secure private cloud (Microsoft Azure) that meets the security requirements for processing highly sensitive data and is in compliance with GDPR, with appropriate security settings and monitoring in place.
- The identification and authentication of all Clients are carried out according to the Client’s chosen option. Secure industry-standard software is used to verify and manage Clients’ identity and access control.
- Confidentiality obligations are included in the contracts of all HeBA employees and partners.
- Access to personal data is restricted based on the need to provide services. HeBA employees must identify themselves to process personal data. All personal data usage logs are retained.
Client Rights Regarding Personal Data
- Clients have all the rights of a data subject under applicable law regarding the processing of personal data.
- Clients have the following rights regarding the processing of personal data, among others:
- Right of access: The right to ask at any time whether HeBA holds personal data about the client and to receive information on which personal data HeBA processes about them;
- Right to rectification: The right to request HeBA to correct or update personal data if it is inadequate, incomplete, or incorrect;
- Right to object: The right to object to the processing of personal data by HeBA;
- Right to erasure: The right to request the deletion of personal data, such as when processing is based on the client’s consent and the client has withdrawn their consent;
- Right to restrict processing: The right to request HeBA to restrict the processing of personal data, for instance, if HeBA no longer needs the data for processing purposes, or if the client has objected to the processing;
- Right to withdraw consent: The right to withdraw consent for personal data processing at any time;
- Right to data portability: The right to receive personal data provided by the client and processed based on consent or a contract in a structured, commonly used format.
- Right to lodge a complaint: If the client believes their personal data rights have been violated, they have the right to file a complaint with the Data Protection Inspectorate or a court.
- In certain cases, the rights of other data subjects or HeBA’s legal obligations may limit the client’s rights.
- HeBA may refuse to delete data if it is necessary for:
- Complying with obligations arising from European Union or Member State law or for public interest tasks, particularly related to documenting and retaining health service provision;
- Public interest reasons in the field of public health;
- Archiving in the public interest, scientific or statistical purposes; or
- Preparing, filing, or defending legal claims.
- If the data controller for the Mentastic Application changes in the future, we will inform all Clients of such changes in advance and ensure that personal data processing continues in compliance with applicable laws. This Privacy Settings will also be updated in such cases.
Contact
- HeBA’s contact details for data protection inquiries: Evelyn Aaviksoo.
- Business Name: HeBA Clinic OÜ
- Address: Veerenni 38, 10138 Tallinn
- Data Protection Officer: Evelyn Aaviksoo
- Phone: +372 58 87 01 31
- Email: heba@heba.ee