Privacy Policy

Privacy Policy

This explains, plainly, what MentalSynch collects, why, who we share it with, and the choices you have — including for the parts of the platform, like our achievement badges, that live on a public blockchain.

Last updated: July 19, 2026

Who this policy covers

MentalSynch is a product of Elom Labs ("we," "us," or "our"), operating from Nairobi, Kenya. This Privacy Policy applies to everyone who uses MentalSynch — people seeking support, and the therapists, psychiatrists, and physiotherapists who provide it.

By using MentalSynch, you agree to the practices described here. If you don't agree, please don't use the platform — and if you have questions before deciding, contact us using the details at the bottom of this page.

Information We Collect

  • Account information: Name, email address, and password (or your Google account details if you sign in with Google).
  • Profile information: Phone number, date of birth, gender, location, timezone, and bio, where you choose to provide them.
  • Wellbeing information: Personality assessment responses, mood check-ins, journal entries, gratitude entries, breathing/meditation activity, and daily challenge progress.
  • Session and communication information: Booking details, session notes you or your provider add, in-app messages, community posts, and crisis-support conversations (including AI-assisted triage messages).
  • Professional credentials: For therapists, psychiatrists, and physiotherapists: license numbers, qualifications, specializations, and verification documents.
  • Payment information: Billing details needed to process a payment. Card and mobile money details are handled directly by our payment processor, Paystack — we do not store your full card number.
  • On-chain wallet information: If you use our achievement badge feature, we generate a blockchain wallet address for your account and record badge mint transactions on the Avalanche network. See "Blockchain & On-Chain Data" below — this works differently from the rest of your data.
  • Technical information: IP address, browser and device type, and basic usage logs, collected for security and reliability.

How We Use Your Information

  • To operate the platform: match you with professionals, schedule and run sessions, and process payments.
  • To personalize your experience — for example, using your personality assessment to suggest a compatible therapist.
  • To provide crisis support resources and, where necessary, to protect someone's immediate safety.
  • To send you service notifications: booking confirmations, achievement unlocks, and account or security alerts.
  • To maintain the security, integrity, and proper functioning of the platform.
  • To comply with legal obligations, including Kenya's Data Protection Act, 2019.
  • We do not use your health or wellbeing data to train third-party advertising systems, and we do not sell it.

Data Security

  • Passwords are hashed; they are never stored or visible in plain text.
  • Data in transit is encrypted using HTTPS/TLS.
  • Access to sensitive records is limited to the systems and, where a human review is genuinely necessary, personnel who need it to provide the service.
  • Payment card data is handled by Paystack, a PCI-DSS-compliant payment processor — we never see or store full card numbers.
  • No system is 100% secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify affected users and, where required, the Office of the Data Protection Commissioner, without undue delay.

How Information Is Shared

  • Your matched professional: Session details and information you choose to share are visible to the therapist, psychiatrist, or physiotherapist you're working with.
  • Service providers we rely on: Paystack (payments), Daily.co (video sessions), Resend (transactional email), Cloudinary (image hosting), and Printful (marketplace order fulfillment, which requires a shipping address for physical orders). Each processes only what they need to perform their function.
  • Legal and safety exceptions: Where required by Kenyan law, a valid court order, or where we believe in good faith it's necessary to prevent imminent harm to you or someone else.
  • Business changes: If MentalSynch is involved in a merger, acquisition, or asset sale, user information may transfer as part of that transaction, subject to the same protections described here.
  • We do not sell your personal information, and we do not share your health or wellbeing data with advertisers.

Blockchain & On-Chain Data

  • If you use MentalSynch's achievement badge feature, we generate a wallet address for your account automatically. You are never shown or asked to manage a seed phrase — this is handled for you.
  • Achievement badges are minted as soulbound (non-transferable) tokens on the Avalanche blockchain, currently on Avalanche's public Fuji test network.
  • Important: transactions on a public blockchain are, by design, permanent and visible to anyone — this is different from every other part of our platform, where we control deletion. Your wallet address and badge mint transactions cannot be deleted or altered once recorded on-chain, even if you delete your MentalSynch account.
  • Your wallet address alone does not reveal your name or other personal details to anyone viewing the blockchain, but it is a unique, public identifier.
  • This feature does not currently involve real cryptocurrency, monetary value, or mainnet deployment. If that changes in the future, we will update this section and notify users before any such change takes effect.

Your Rights

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Ask us to correct inaccurate or incomplete information.
  • Deletion: Request deletion of your account and associated data, subject to the on-chain and legal/financial record-keeping limits described in this policy.
  • Portability: Request your data in a portable, machine-readable format.
  • Objection & restriction: Object to, or ask us to limit, certain processing of your data.
  • Withdraw consent: Withdraw previously given consent at any time, without affecting the lawfulness of processing before that withdrawal.
  • Complain: Lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC), or the relevant authority in your country, if you believe we have mishandled your data.

Data Retention

  • Account and profile data: Kept while your account is active, and deleted or anonymized within a reasonable period after you close your account, unless we're required to keep it longer.
  • Session and payment records: Kept for as long as required under Kenyan tax and financial record-keeping obligations, typically several years.
  • Crisis-support conversations: Retained only as long as needed for safety follow-up and quality review, then deleted or anonymized.
  • On-chain wallet data: Cannot be deleted once recorded on the blockchain — see "Blockchain & On-Chain Data" above.
  • Legal holds: We may retain data longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

Children's Privacy

  • MentalSynch is intended for users aged 18 and over.
  • We do not knowingly collect personal information from children, and if we become aware that we have, we will delete it.
  • If you believe a child has created an account or shared information with us, please contact us so we can investigate and remove it.

Where Your Data Is Stored

  • MentalSynch is operated from Kenya. Our database and infrastructure providers may store or process data outside Kenya as part of how modern cloud hosting works.
  • Where we transfer data internationally, we take reasonable steps to ensure it receives a comparable level of protection to what's described in this policy.

Emergency & Medical Disclaimer

This is not a medical record system, and MentalSynch is not a healthcare provider

MentalSynch connects you with independent, licensed professionals and provides self-guided wellness tools. We are not a hospital, clinic, or emergency service, and nothing on this platform is a substitute for professional medical advice, diagnosis, or treatment.

In an emergency, contact emergency services directly

If you or someone else is in immediate danger, call Kenya's national emergency line (999 or 112), or go to your nearest hospital. You can also reach the Kenya Red Cross (1199) or Befrienders Kenya (0722 178 177). MentalSynch's in-app crisis tools are a supplementary resource, not a replacement for emergency services.

Changes to This Policy

If we make a material change to this policy — for example, starting to use analytics or advertising cookies, or moving the on-chain badge feature to a live mainnet — we'll update this page, change the "Last updated" date, and where the change is significant, notify you directly (by email or in-app) before it takes effect.

Contact Us

For privacy questions or to exercise any of the rights above:

Privacy Inquiries

  • mentalsynch@gmail.com
  • +254 706 848263
  • We aim to respond within 5 business days

Elom Labs

  • Riverside Drive, Nairobi, Kenya
  • Operator of MentalSynch

Last Updated: July 19, 2026

This policy describes MentalSynch's current practices as accurately as we can. It is not a substitute for independent legal advice, and it does not limit any rights you have under Kenyan law, including the Data Protection Act, 2019.