Privacy Policy

1. Introduction

Welcome to Maunda. Your privacy is important to us, and we are committed to safeguarding your personal information with transparency, integrity, and care. This Privacy Policy explains how Maunda ("we," "us," or "our") collects, uses, stores, shares, and protects your information when you interact with our Services.

Our Services include, but are not limited to:

• The Maunda mobile application ("App")
• Our websites and associated digital platforms
• Integrated wellness tools (e.g., affirmations, journaling, meditation)
• Community-based features (e.g., Uplift feed, messaging, supporter system)
• Counseling and coaching services accessed through our integration with GetHealthie
• Any content, communication, or data you voluntarily provide while using the platform

This Privacy Policy applies to all users, including clients, providers, instructors, guests, and administrators who engage with Maunda.

2. What Information We Collect

Maunda collects a variety of information to provide a personalized, secure, and compliant experience for all users. The type and amount of data we collect depends on how you interact with the platform, your account type, and the features you use.

2.1 Personal Information

Information that can directly identify you, including:

• Full name
• Email address
• Phone number
• Date of birth
• Username or display name
• Profile photo and bio
• Device ID and IP address
• Location data (if enabled)

2.2 Health and Clinical Information

When you access counseling, coaching, or wellness services, we may collect health-related data ("Protected Health Information" or PHI), including:

• Intake forms and assessments
• Session notes and treatment plans
• Insurance information and billing data
• Communication with providers
• Appointment history and provider preferences
• Mental health status, goals, and progress indicators

This information is stored and managed through our HIPAA-compliant partner platform, GetHealthie.

2.3 Wellness and Engagement Data

To support personalized wellness experiences, we may collect:

• Mood entries and check-ins
• Journal entries and reflection responses
• Goal tracking and habit progress
• Daily affirmation responses
• Engagement with meditations, articles, or prompts
• Feedback or survey responses

3. How We Collect Information

Maunda collects information from you in multiple ways—some directly, some automatically through your use of the platform, and some via third-party integrations.

3.1 Information You Provide Directly

We collect information when you:

• Create or update your Maunda account
• Fill out your profile, intake forms, or assessments
• Schedule or attend a session with a provider
• Submit journal entries, mood check-ins, or wellness goals
• Request support or contact us directly

3.2 Information Collected Automatically

We automatically collect technical and usage information such as:

• Device type, operating system, and IP address
• App version, screen views, and button clicks
• Crash logs, error reports, and session durations
• Location data (if permissions are granted)

4. How We Use Your Information

Maunda uses the information we collect to deliver safe, personalized, and effective wellness and mental health services.

4.1 To Provide and Maintain the Services

• Create and manage your account
• Facilitate access to wellness tools and community features
• Schedule, deliver, and document therapy or coaching sessions
• Maintain clinical records in compliance with HIPAA

4.2 To Improve the Platform and User Experience

• Understand feature engagement and user behavior
• Identify technical issues and monitor system performance
• Conduct internal audits and quality assurance reviews

4.3 For Security, Safety, and Fraud Prevention

• Detect, investigate, and prevent fraudulent activity
• Protect user data and prevent account compromise
• Respond to reports of harmful content or threats

5. Legal Grounds and Regulatory Compliance

Maunda processes your personal information only when we have a valid legal basis to do so, in accordance with applicable data protection and healthcare privacy laws including HIPAA, GDPR, CCPA, and similar frameworks.

5.1 HIPAA Compliance (U.S. Users)

If you use Maunda to access counseling or coaching services:

• Your health information is protected under HIPAA
• Data is stored through HIPAA-compliant systems
• Only authorized clinicians can access your clinical data
• You may request access to your clinical records

5.2 CCPA Compliance (California Residents)

California residents have additional rights including:

• Right to know what personal information we collect
• Right to request a copy of your data
• Right to request deletion of your data
• Right to opt out of data sharing

6. How We Share Information

Maunda respects your privacy and shares your information only when necessary to operate our Services, fulfill legal obligations, or with your explicit consent. We do not sell your personal information.

6.1 Sharing with Licensed Providers

If you engage in counseling or coaching, we share relevant information with your assigned therapist, licensed supervisors, and clinical operations team as necessary for treatment.

6.2 Sharing with Third-Party Service Providers

We work with trusted partners including:

• GetHealthie – clinical documentation and telehealth
• Stripe – secure payment processing
• Firebase – performance monitoring and analytics

7. Your Rights and Choices

You have control over your personal information. Depending on your location and applicable laws, you may have the following rights:

8. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes outlined in this Privacy Policy and comply with legal obligations.

8.1 General Retention Periods

• Account Data: Retained while active and up to 3 years after deactivation
• Wellness Data: Up to 2 years from last activity
• Technical Data: 12-18 months for diagnostics and security

8.2 Clinical Record Retention (HIPAA)

Protected Health Information is retained for a minimum of 7 years after the last session, in compliance with HIPAA and state regulations.

9. Data Security

Maunda implements industry-standard security measures to protect your information through administrative, technical, and physical safeguards.

Security Measures

• HIPAA-compliant infrastructure through GetHealthie
• End-to-end encryption using TLS 1.2+ and AES-256
• Role-based access controls
• Regular security testing and vulnerability assessments
• Automated monitoring and alerts for suspicious activity
• Encrypted secure data backups

10. Children's Privacy

Our Services are intended for users at least 13 years old. Users under 18 must have parental or guardian consent. We comply with COPPA and similar international regulations protecting children's privacy.

11. Cookies and Analytics

We use cookies and similar technologies to enhance user experience, analyze platform usage, and improve performance. You can manage cookie preferences through your browser or device settings.

12. AI Use and Automated Processing

Maunda uses AI to enhance wellness features, provide personalized content, and improve platform efficiency. No AI tool provides medical diagnoses or therapeutic advice. All critical decisions involve human oversight.

13. International Users and Data Transfers

Maunda is based in the United States. If you access our Services from outside the U.S., your information may be transferred to and processed in the United States, where data protection laws may differ from your home country.

14. Third-Party Services and Links

Our platform may contain links to third-party websites or integrate with external services. We are not responsible for their privacy practices and encourage you to review their policies.

15. Updates to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, technologies, or legal obligations. Material changes will be communicated through in-app notifications or email.

16. Contact Us

17. Biometric and Sensitive Data

As of this policy's effective date, Maunda does not collect or store biometric information. If future features introduce biometric capabilities, we will obtain written informed consent and comply with all applicable laws.

18. Data Breach Notification Policy

In the event of a data breach, we will notify affected individuals and regulatory bodies as required by law (within 72 hours under GDPR, 60 days under HIPAA). Notifications will include the nature of the breach, affected data, our response, and recommended actions.