Privacy and safety

Who sees what

MyndfulPal holds sensitive health information. This is where each kind of information goes, and how the system keeps it there. Patients see the same explanation before they start.

Information The patient Their care team Texts, emails and notifications
Check-in answers, mood and weight Yes Yes Never
Blood pressure and wearable readings Yes Yes Never
Medicines and doses taken Yes Yes The dose time only: “It’s time for your 8:00 PM medicines.”
Discharge papers Sends them and sees their status. The app has no download. Yes, only through the portal. Every time someone opens one, it’s logged. Never
Heart-failure episodes and nursing notes Not shown in the app Yes. A signed note can’t be changed. Staff are told “A patient’s check-in needs review,” with a link and no details
Messages with the care team Yes Yes That a message arrived: “Your care team sent you a message.”
Companion conversations Yes A short daily summary only. The database blocks staff from the conversations themselves. Never
A safety concern in the companion or a check-in Shown crisis resources and the clinic’s phone number right away An urgent alert with a short paraphrase of what was said, never the chat Staff are told “An urgent alert needs review,” with no details

In Talk mode, the browser’s own speech recognition (Google’s in Chrome, Apple’s in Safari) turns the patient’s voice into text before it reaches MyndfulPal.

MyndfulPal support can look at a clinic’s portal, read-only, only while one of the clinic’s admins allows it and for a set time. The clinic sees everything support looked at.

How it’s protected

Built in, not added on

  • Locked to each clinic, twice

    The app checks who is asking on every request. Then the database itself returns only that clinic’s rows, or only a patient’s own record. If one layer has a mistake, the other still holds.

  • Sign-in without shared passwords

    Patients sign in with a one-time code sent to their email. Staff use a password and a second factor. Nobody creates their own account: the clinic adds every person.

  • A record of every change

    Every diagnosis change is logged with who made it and when, in a log that can only be added to, and so is every opening of a patient’s document. Each patient has an audit trail the care team can open.

  • Wearable access the patient controls

    The patient approves the connection with their wearable’s own sign-in. The access is stored encrypted, and disconnecting revokes and deletes it.

  • Encrypted, on AWS

    MyndfulPal runs on Amazon Web Services. Data is encrypted in transit and at rest, and backed up.

  • AI, labeled as AI

    The companion, weekly summaries, reading discharge papers and drafting nursing notes use Anthropic’s Claude through Amazon Bedrock. Everything it drafts is marked as AI, and a person checks it: a nurse verifies what it read and signs every note. Alert levels come from fixed, tested rules. The AI’s safety check can only add an urgent alert, never lower or remove one.

  • The right person, before anything shows

    A new patient enters their date of birth before the app shows anything else, and it must match the clinic’s record. After five wrong tries the invitation locks until the clinic resends it.

  • Consent on record, word for word

    Patients agree to monitoring and to AI reading in the app, or by phone with staff reading the same text. Each agreement is stored with a fingerprint of the exact wording shown. Without it, nothing of theirs goes to the AI.

  • Documents kept apart

    Discharge papers are stored encrypted under their own key, and the original is never changed. Staff open them only through the portal. Papers filed for the wrong patient are deleted, along with what the AI read from them.

Safety

If someone might be in danger

MyndfulPal is not an emergency service. It watches for the signs that can’t wait, and points people to 911 or 988 when it sees them.

  • Blood pressure of 180/120 or higher The patient sees a notice to call 911. The lead clinician and on-call staff get an urgent text and email.
  • Crisis language in the companion or a check-in The patient is shown the 988 Suicide & Crisis Lifeline and the clinic’s number. The on-call clinician gets an urgent text and email.
  • Chest discomfort, fainting or breathlessness at rest after discharge The patient is told to call 911 if it’s happening now. The lead clinician and on-call staff get an urgent text and email, sent again if nobody acts.
  • Much more short of breath than usual The patient is asked to call the clinic today, or 911 if they’re breathless at rest or have chest pain. A nurse sees it in Needs review.
  • A heart rate far from usual The patient is asked what’s going on, and reminded to call 911 for chest pain, fainting or trouble breathing.

HIPAA

Not yet. We’re finishing the agreements, policies and reviews needed to sign a Business Associate Agreement and handle real patient data. Until then, MyndfulPal runs with test data only. Ask us for the current status on your demo call.

Questions about privacy? allison@myndfulpal.com