Privacy Policy

Effective date: 1 June 2026

Privacy Policy

1. INTRODUCTION

Cleared Mind (Pty) Ltd, registration number 2020/187373/07 ("Cleared Mind," "we," "us," or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, store, and protect your information when you use our mental wellness platform, website, and mobile applications (collectively, the "Services"). By using ClearedMind's Services, you agree to the collection and use of information in accordance with this Privacy Policy and South Africa's Protection of Personal Information Act (POPIA).

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

Account Information:

Full name
Email address
Phone number (optional)
Date of birth
Password (encrypted)
Profile photo (optional)
Language preference Mental Health Information:
Mental health screening responses (PHQ-9, GAD-7, PSS-10, and other assessments)
Mood tracking entries
Journal entries
Progress notes
Goals and preferences
Therapy session notes (if applicable) Payment Information:
Payment information is processed through PayFast, a PCI-DSS compliant payment processor
We do NOT store credit card numbers, CVV codes, or banking passwords
We retain transaction records (amount, date, subscription type) for billing purposes Communication Data:
Support requests and correspondence
Feedback and survey responses
Messages with therapists (encrypted)
Testimonials (with explicit consent) Therapist Booking Information (if applicable):
Preferred therapist specialties
Booking preferences
Session attendance records

2.2 Information Collected Automatically

Usage Data:

Pages visited and features used
Time spent on platform
Click patterns and navigation paths
Assessment completion rates
Login frequency and times Device Information:
Device type (phone, tablet, computer)
Operating system and version
Browser type and version
IP address
Device identifiers (anonymized)
Screen resolution
Time zone and language settings Location Data:
General location (city/province level) based on IP address
We do NOT collect precise GPS location unless you explicitly grant permission for specific features Cookies and Tracking Technologies:
Session cookies (essential for platform functionality)
Analytics cookies (Google Analytics, Firebase)
Marketing cookies (with your consent)
See Section 11 for detailed Cookie Policy

2.3 Information from Third Parties

Social Media (if you choose to connect):

Profile information from Facebook, Google, or Apple sign-in
Only basic profile data (name, email, profile photo) with your permission Payment Processors:
Transaction confirmation from PayFast
Payment status updates Therapists (with your consent):
Session notes shared by your therapist (if you authorize sharing)
Treatment recommendations

3. HOW WE USE YOUR INFORMATION

3.1 Lawful Basis for Processing

Under POPIA, we process your personal information based on:

Consent: You explicitly agree to us processing your mental health data for wellness tracking
Contract Performance: To provide the services you've subscribed to
Legitimate Interest: To improve our services, ensure security, and prevent fraud
Legal Obligation: To comply with South African laws and regulations

3.2 Specific Uses

To Provide Core Services:

Create and manage your account
Administer mental health assessments
Track your mood and progress over time
Provide personalized wellness recommendations
Facilitate therapist bookings and sessions
Send assessment results and progress reports
Enable community forum participation To Process Payments:
Process subscription payments via PayFast
Manage billing and invoicing
Handle refunds and cancellations
Prevent payment fraud To Communicate with You:
Send account notifications (password resets, subscription changes)
Deliver assessment results and progress updates
Provide customer support
Send educational mental health content (with your consent)
Notify you of new features or updates
Respond to your inquiries To Improve Our Services:
Analyze usage patterns to improve user experience
Conduct research on platform effectiveness (anonymized data only)
Develop new features based on user needs
Test and optimize platform performance
Identify and fix technical issues To Ensure Safety and Security:
Detect and prevent fraud, abuse, and security threats
Verify user identity
Enforce our Terms of Service
Comply with legal obligations
Respond to crisis situations (only when necessary for user safety) Marketing (with explicit consent):
Send newsletters with mental health tips
Promote new features or services
Share relevant mental health resources
Invite you to surveys or research studies You can opt out of marketing communications at any time via the unsubscribe link in emails or in your account settings.

4. HOW WE SHARE YOUR INFORMATION

We do NOT sell your personal information to third parties. We only share your data in the following limited circumstances:

4.1 With Your Consent

Therapists:

If you book a therapy session, we share your name, contact information, and intake questionnaire with your chosen therapist
Therapists are bound by HPCSA confidentiality requirements and cannot share your information without your consent
You can choose to share assessment results and progress reports with your therapist Healthcare Providers:
You can export and share your Cleared Mind data with your doctor, psychiatrist, or other healthcare providers

4.2 Service Providers

We work with trusted third-party service providers who help us operate our platform: Payment Processing:

PayFast (payment gateway) - receives payment information to process transactions
PCI-DSS compliant; does not share your payment details with us Cloud Hosting:
Amazon Web Services (AWS) - South African data centers
Data encrypted in transit and at rest Analytics:
Google Analytics / Firebase Analytics - anonymous usage data only
Helps us understand how users interact with our platform Customer Relationship Management:
Zoho CRM - manages customer support tickets and communications
Only staff with legitimate need can access your data Email Services:
Zoho Campaigns - sends service emails and newsletters (if you opt in) All service providers:
Are contractually required to protect your data
Can only use your data for the specific purposes we authorize
Must comply with POPIA and data protection standards

4.3 Legal Requirements

We may disclose your information when required by law:

Court orders or legal process
To comply with South African laws and regulations
To protect ClearedMind's legal rights
To prevent fraud or security threats
In emergencies where disclosure is necessary to protect someone's life or safety

4.4 Business Transfers

If Cleared Mind is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email and/or prominent notice on our platform before your data is transferred and becomes subject to a different privacy policy.

4.5 Aggregate & Anonymous Data

We may share aggregated, anonymized data that cannot identify you personally:

Research publications on mental health trends
Platform effectiveness studies
Industry reports and statistics
Marketing materials showcasing platform impact Example: "43% of Cleared Mind users report mood improvement within 30 days" (no individual identification)

5. DATA SECURITY

We implement robust security measures to protect your personal information:

5.1 Technical Security

Encryption:

All data transmitted between your device and our servers uses 256-bit SSL/TLS encryption (bank-level security)
All stored mental health data is encrypted at rest
Passwords are hashed using industry-standard algorithms (never stored in plain text) Access Controls:
Multi-factor authentication for staff access
Role-based access (staff can only access data necessary for their role)
Regular access audits and reviews Infrastructure Security:
Servers hosted in secure South African data centers
Regular security patches and updates
Firewall protection and intrusion detection systems
Daily encrypted backups Platform Security:
Secure video conferencing for therapy sessions (end-to-end encrypted)
Automatic session timeouts after inactivity
Protection against common vulnerabilities (SQL injection, XSS, CSRF)

5.2 Organizational Security

Staff Training:

All staff sign confidentiality agreements
Regular training on POPIA compliance and data protection
Background checks for employees with data access Policies & Procedures:
Data breach response plan
Incident reporting protocols
Regular security audits by independent experts Therapist Security:
HPCSA-registered therapists bound by professional confidentiality
Therapists maintain their own secure clinical notes (not stored on our platform)
Professional indemnity insurance requirements

5.3 Your Responsibility

You play an important role in keeping your data secure:

Choose a strong, unique password
Never share your password with anyone
Log out when using shared devices
Report suspicious activity immediately to security@clearedmind.com
Keep your device and apps updated

6. DATA RETENTION

6.1 Active Accounts

While your account is active, we retain your data to provide ongoing services:

Account information: Retained while account is active
Mental health assessments: Stored to track progress over time
Mood entries: Maintained for historical tracking
Communication records: Kept for support purposes

6.2 Inactive Accounts

If you don't log in for 24 consecutive months:

We'll send reminder emails before taking action
Your data will be anonymized (personal identifiers removed)
Anonymized data may be used for research purposes only

6.3 Deleted Accounts

When you delete your account:

Personal identifiers deleted within 30 days
Assessment responses anonymized within 30 days
Payment records retained for 7 years (tax and legal requirements)
Backup copies securely deleted within 90 days
Therapist clinical notes (if applicable) are maintained by therapists per HPCSA requirements (7 years minimum)

6.4 Legal Retention

Some data must be retained longer due to legal obligations:

Financial records: 7 years (SARS requirements)
User agreements: 5 years after termination
Legal correspondence: Duration of matter + 5 years

7. YOUR RIGHTS UNDER POPIA

As a South African resident, you have the following rights regarding your personal information:

7.1 Right to Access

You can request a copy of all personal information we hold about you. How to exercise: Email privacy@clearedmind.com with "Data Access Request" in the subject line. We'll respond within 30 days with a downloadable file of your data.

7.2 Right to Correction

You can request correction of inaccurate or incomplete information. How to exercise: Update information directly in your Account Settings, or email privacy@clearedmind.com for assistance.

7.3 Right to Deletion ("Right to be Forgotten")

You can request deletion of your personal information, subject to legal retention requirements. How to exercise: Go to Account Settings > Delete Account, or email privacy@clearedmind.com. We'll confirm deletion within 30 days. Exceptions: We may retain data when required by law (e.g., financial records) or to resolve disputes.

7.4 Right to Object

You can object to processing of your data for direct marketing purposes. How to exercise: Click "unsubscribe" in marketing emails, or adjust preferences in Account Settings > Communication Preferences.

7.5 Right to Restriction

You can request that we limit how we use your data while a dispute is resolved. How to exercise: Email privacy@clearedmind.com explaining your concern.

7.6 Right to Data Portability

You can receive your data in a machine-readable format to transfer to another service. How to exercise: Request data export via Account Settings > Download My Data, or email privacy@clearedmind.com. We'll provide data in CSV or JSON format.

7.7 Right to Withdraw Consent

You can withdraw consent for data processing at any time (this may limit service availability). How to exercise: Adjust consent preferences in Account Settings, or email privacy@clearedmind.com.

7.8 Right to Lodge a Complaint

If you're unsatisfied with how we handle your data, you can file a complaint with: Information Regulator (South Africa) 33 Hoofd Street, Forum III, 3rd Floor Braampark, Braamfontein Johannesburg, 2001 Email: inforeg@justice.gov.za Phone: 012 406 4818 Website: www.justice.gov.za/inforeg

8. CHILDREN'S PRIVACY

8.1 Age Requirements

Users must be 16 years or older to create a Cleared Mind account
Users aged 16-17 require parental/guardian consent
We do NOT knowingly collect information from children under 13

8.2 Parental Consent Process

For users aged 16-17:

Parent/guardian must provide email consent before account activation
Parent/guardian can access the minor's data upon request
Parent/guardian can request account deletion at any time

8.3 If We Discover Underage Use

If we learn that a user under 16 has created an account without parental consent, or a user under 13 has accessed our services, we will:

Immediately suspend the account
Delete all personal information within 30 days
Notify the email address associated with the account

9. INTERNATIONAL DATA TRANSFERS

9.1 Primary Data Storage

Your data is primarily stored on servers located in South Africa.

9.2 International Transfers

Some service providers (e.g., Google Analytics, AWS backups) may process data outside South Africa. When this occurs:

We ensure adequate protection mechanisms (Standard Contractual Clauses)
We comply with POPIA Section 72 requirements
We obtain your explicit consent where required
Data is encrypted in transit and at rest

10. THERAPIST DATA PRACTICES

10.1 Therapist Access

Cleared Mind therapists:

Can only access data for their assigned clients
Are bound by HPCSA confidentiality requirements
Maintain their own clinical notes separately (not on Cleared Mind platform)
Must obtain explicit consent before sharing client information

10.2 What Cleared Mind Can See

Cleared Mind platform administrators can access:

Booking and scheduling data
Payment/billing information
General session metadata (date, time, duration, attendance) Cleared Mind platform administrators CANNOT access:
Session recordings or content
Therapist clinical notes
Diagnosis or treatment plans
Confidential therapeutic communications

10.3 Therapist Independence

Therapists are independent contractors, not Cleared Mind employees. They maintain professional responsibility for:

Clinical decision-making
Record-keeping per HPCSA standards
Client confidentiality
Professional liability

11. COOKIES POLICY

11.1 What Are Cookies?

Cookies are small text files stored on your device that help websites function and improve user experience.

11.2 Types of Cookies We Use

Essential Cookies (Always Active):

Login authentication
Session management
Security features
Cannot be disabled without losing functionality Analytics Cookies (With Consent):
Google Analytics: tracks anonymous usage patterns
Firebase Analytics: measures app performance
Helps us improve user experience Marketing Cookies (With Consent):
Meta Pixel (Facebook/Instagram): tracks conversions from ads
TikTok Pixel: measures ad performance
Used only if you consent via our cookie banner

11.3 Managing Cookies

Via Our Platform:

Adjust cookie preferences in Account Settings > Privacy > Cookie Preferences Via Your Browser:
Chrome: Settings > Privacy > Cookies
Firefox: Options > Privacy > Cookies
Safari: Preferences > Privacy > Cookies
Edge: Settings > Privacy > Cookies Note: Disabling essential cookies will prevent you from using ClearedMind's services.

11.4 Do Not Track

Our platform respects "Do Not Track" browser signals. When enabled, we disable non-essential tracking cookies.

12. CHANGES TO THIS PRIVACY POLICY

12.1 Notification of Changes

We may update this Privacy Policy from time to time. When we make material changes:

We'll notify you via email (to your registered email address)
We'll display a prominent notice on our platform
We'll provide 30 days' notice before changes take effect

12.2 Your Acceptance

Continued use of Cleared Mind after the effective date of changes constitutes acceptance of the updated Privacy Policy.

12.3 Version History

Previous versions of this Privacy Policy are available upon request. Email privacy@clearedmind.com to access archived versions.

13. CONTACT US

13.1 Information Officer

For all privacy-related questions, requests, or concerns: Name: [Your Information Officer Name] Email: privacy@clearedmind.com Phone: [Your Contact Number] Address: [Your Registered Business Address] Response Time: We aim to respond within 5 business days for inquiries and within 30 days for formal data access requests.

13.2 Data Protection Officer

Email: dpo@clearedmind.com

13.3 General Inquiries

For non-privacy questions:

General: info@clearedmind.com
Support: support@clearedmind.com
Security Issues: security@clearedmind.com

14. SPECIFIC SCENARIOS

14.1 Crisis Situations

If you indicate suicidal thoughts or imminent danger:

We may contact emergency services or crisis lines
We may notify emergency contacts you've designated
This overrides normal confidentiality to protect your safety
We'll inform you of actions taken as soon as safely possible

14.2 Research Participation

If you consent to participate in Cleared Mind research studies:

Your data will be anonymized before use in research
You can withdraw consent at any time
Research findings may be published, but never with identifying information
Separate consent forms will be provided for each study

14.3 Employment Screening

Cleared Mind data should NEVER be used for employment decisions:

We do not share data with employers without your explicit written consent
We recommend NOT sharing detailed mental health assessments with employers
Employers cannot compel you to provide Cleared Mind access

15. SOUTH AFRICAN LEGAL FRAMEWORK

This Privacy Policy complies with:

Protection of Personal Information Act (POPIA), Act 4 of 2013
Promotion of Access to Information Act (PAIA), Act 2 of 2000
Electronic Communications and Transactions Act (ECTA), Act 25 of 2002
Consumer Protection Act (CPA), Act 68 of 2008
Health Professions Council of South Africa (HPCSA) ethical guidelines

16. GLOSSARY

Personal Information: Information that identifies or can be used to identify you as an individual. Processing: Any operation performed on personal information, including collection, storage, use, or disclosure. Anonymization: Removing all identifying information so data cannot be linked back to you. Encryption: Converting data into code to prevent unauthorized access. POPIA: Protection of Personal Information Act, South Africa's data protection law.

ACCEPTANCE By using ClearedMind's services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.