Mindset Health, Inc. ("we", "us", "Mindset Health" or "Mindset") is committed to protecting and respecting your privacy. We offer a mobile app and website that help users ("Users") assess their suitability for, and access, the Nerva program, a gut-brain therapy program that supports the self-management of symptoms of irritable bowel syndrome (IBS) and other disorders of gut-brain interaction (DGBI, commonly known as gut-brain disorders).
This Privacy Policy describes how we handle the personal information we collect in connection with the Nerva website, app and related services (collectively, the "Services"), and applies to users in the United States. This Policy covers Nerva only; other Mindset Health products and the general mindsethealth.com website are covered by the Mindset Health privacy policy. Unless specified below, "you" refers to Users, website visitors and anyone else who uses our Services.
We may receive limited personal and health information about you from your healthcare provider or clinic when they refer you to the Nerva program. This typically includes your name and email address, and may optionally include your date of birth, phone number, your primary condition, and any other clinical information your provider chooses to include (for example, in a referral form or letter). Your referring provider is responsible for obtaining your consent before sharing this information. We use it solely to facilitate your enrollment in the Nerva program and to contact you with onboarding instructions, and we require referring partners to confirm they have obtained appropriate patient consent before submitting a referral.
We and our service providers may automatically collect information about you, your device and your interactions over time, such as: operating system, device manufacturer and model, browser type, IP address, app-generated device identifiers and advertising identifiers, language settings, mobile carrier and general location derived from your IP address (such as city or state); and usage data such as pages or screens viewed, time on page and access times. We do not collect hardware identifiers such as IMEI or UDID. We collect this information using cookies and similar technologies (see the Cookies, analytics and advertising section below).
To provide the Services, including creating and administering accounts, hosting and operating the Services, communicating with you and responding to inquiries, and analyzing use of the Services to evaluate and improve them.
Coverage and reimbursement. We may use your information to verify eligibility or coverage, seek payment or reimbursement, prepare and submit coverage-related requests, communicate with you about the outcome and, at your request, advocate for your coverage with your health plan or employer's benefits-plan administrator. We may also use aggregated, anonymized or de-identified information to demonstrate interest in Nerva and advocate for broader coverage with health plans and employers without identifying you.
Artificial intelligence and personalization. We use artificial intelligence ("AI") to personalize the educational and coaching content you receive within Nerva. We may process your symptom data, preferences and program interactions through third-party AI services to tailor content, recommendations and coaching to you. Our AI service providers (currently OpenAI and Google Gemini) each operate under a Business Associate Agreement and applicable data protection terms requiring them to protect the confidentiality and security of your information, and your data is not used by these providers to train or improve their general-purpose AI models. We may also use other AI tools to support our internal operations, but we do not send your personal or health information to any AI provider unless it is bound by a Business Associate Agreement or an equivalent data protection contract. AI-generated content supports your self-management and wellbeing and does not constitute medical advice, diagnosis or treatment.
Research, development and improvement. We may use personal information to analyze and improve the Services, identify trends and operate our business, and to create aggregated, anonymized or de-identified statistics for lawful business purposes.
Marketing and advertising. We may send you direct marketing communications and use analytics and advertising services to promote the Services. See the Cookies, analytics and advertising and Your privacy choices sections below for your options.
For compliance and protection, including to enforce our terms, comply with legal obligations, defend against legal claims, protect the security and integrity of our Services, and identify and investigate fraudulent, harmful or illegal activity.
Clinicians. We may share a User's personal information with the User's designated clinician at the User's direction, so the clinician can provide appropriate assistance. A User can stop sharing at any time by removing that clinician in the app.
Coverage and reimbursement recipients. At your request or as otherwise permitted by law, we may disclose the minimum information necessary to insurers, health plans, third-party administrators, healthcare clearinghouses, billing providers, healthcare providers, and employer benefits personnel acting in connection with a group health plan, to determine eligibility or coverage and obtain payment or reimbursement. We do not disclose your health information to your manager or for employment-related decisions. We may share aggregated, anonymized or de-identified information with health plans and employers to demonstrate interest in Nerva and advocate for broader coverage without identifying you.
Service providers. We share personal information with companies that provide services on our behalf (such as hosting, communications, security, billing and payment processing, fraud prevention, analytics, and customer relationship management), under contracts requiring them to protect it.
Advertising and analytics partners. We may share limited information collected on our website and app with analytics and advertising partners as described in the Cookies, analytics and advertising section below. We do not sell your personal information, and we do not use your health information for advertising.
Professional advisors. We share personal information with advisors such as lawyers, auditors, bankers and insurers where necessary for their services to us.
Law enforcement and legal requirements. We disclose personal information to law enforcement or government authorities only where we are legally required to do so, for example in response to a valid court order or subpoena. We do not provide voluntary or bulk access to any authority, and we have no relationship with immigration agencies (such as ICE) or similar bodies. Any disclosure is limited to the minimum the law requires.
Business transferees. We may share personal information with acquirers and other participants in a corporate transaction (such as a merger, acquisition, reorganization, sale or bankruptcy) involving our business or assets.
We and our service providers use cookies, software development kits (SDKs) and similar technologies to operate the Services, remember your preferences, understand how the Services are used, and to support our marketing. This includes analytics and product-measurement tools (such as Google Analytics and Amplitude) and advertising tools provided by our third-party advertising partners, which may change from time to time. We do not sell your personal information, and we do not use your health information for advertising.
Your choices. You can manage cookies and tracking through our consent banner and through your browser and device settings, and we honor Global Privacy Control (GPC) signals. You can also limit interest-based advertising using the platform and industry tools described in the Your privacy choices section below. Some parts of the Services may not work without essential cookies.
We take reasonable steps to protect the personal information we hold. Our security program is independently audited, including under the SOC 2 Type II framework, and our controls are assessed against HIPAA requirements. Health information is our most restricted category of data; access to it is role-based and granted on a least-privilege, need-to-know basis, and is logged and regularly reviewed. We encrypt personal information in transit and at rest, enforce encryption-key rotation, and carry out regular risk assessments, vulnerability scanning and external penetration testing. No security measures are completely secure, and we cannot guarantee the absolute security of your personal information.
We keep personal information only for as long as it is needed for the purposes described in this Policy, to meet our legal and contractual obligations, and to comply with applicable records-retention requirements. When personal information is no longer needed, we take reasonable steps to delete or de-identify it. We may retain de-identified or aggregated data for longer where reasonably required to deliver or improve our Services.
Unsubscribe from direct marketing. Follow the unsubscribe instructions in any marketing communication. You may continue to receive service-related messages.
Opt out of push notifications. Deactivate push notifications in your device settings, in the app's notification settings, or by deleting the app.
Opt out of interest-based advertising. You can limit online tracking by blocking cookies in your browser, limiting your mobile advertising identifier in your device settings, and using industry opt-out tools such as the Digital Advertising Alliance (optout.aboutads.info) and the Network Advertising Initiative (optout.networkadvertising.org). Because these opt-outs are device and browser specific, you will need to opt out on each browser and device you use.
Do Not Track and Global Privacy Control. We honor Global Privacy Control (GPC) signals where required. We do not currently respond to "Do Not Track" browser signals.
Delete your account. You can delete your account and its associated data at any time using the 'Delete account' option in the app, which is the quickest way to do this. You can also request deletion using the details in the Contact Us section.
Depending on the US state you live in (for example California, Virginia, Colorado and other states with comprehensive privacy laws), you may have the right to: confirm whether we process your personal information and access it; correct inaccuracies; delete your personal information; obtain a portable copy; and opt out of targeted advertising, the "sale" or "sharing" of personal information, and certain profiling. We do not sell personal information for money, and we do not knowingly sell or share the personal information of anyone under 16. Where these rights apply, you may exercise them free from discrimination.
California residents (CCPA/CPRA). In addition to the rights above, you have the right to limit the use and disclosure of sensitive personal information. You may use an authorized agent to submit a request, and you may appeal a denied request by contacting us.
How to exercise your rights. Submit a request using the details in the Contact Us section. We will verify your identity before responding and will respond within the timeframes required by applicable law. Your rights may be limited where an exception applies, including for health information governed by HIPAA.
We use automated systems, including AI, to personalize the educational and coaching content you receive within Nerva. This processing does not produce legal or similarly significant effects on you; it is used only to customize educational and coaching content. AI personalization is a core part of how the Nerva program is delivered, so we are not currently able to provide the program with AI-personalized content switched off. If you do not wish to receive AI-personalized content, you may stop using the program and cancel your subscription at any time. You may request human review of an AI-personalized recommendation, express your point of view, and contest the outcome, by contacting privacy@mindsethealth.com.
We may engage in clinical research and trials that use only aggregated and de-identified data. If you would prefer your information not be used in our studies, contact us at hello@mindsethealth.com.
This Notice of Privacy Practices applies to Mindset Health, Inc. as a HIPAA Covered Entity. It describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
Who this covers. Where Mindset Health, Inc. acts as a HIPAA Covered Entity, this notice governs the protected health information ("PHI") we hold about you. Mindset Health Pty Ltd acts as our Business Associate under a Business Associate Agreement and handles PHI only as that agreement and the law permit.
How we may use and disclose your PHI without your authorization. We may use and disclose your PHI for treatment, payment and health care operations. For payment, this includes checking coverage and obtaining payment or reimbursement. For example, at your request, we may contact your insurer, health plan or employer's benefits-plan administrator to determine or request coverage for your use of Nerva. We may also use or disclose PHI where the HIPAA Privacy Rule permits or requires it, including: to you; as required by law; for public health activities; for health oversight; for judicial and law-enforcement requests that meet the rule's conditions; to avert a serious threat to health or safety; and the other limited purposes set out in 45 CFR 164.512. We apply the "minimum necessary" standard, using or disclosing only the least PHI needed for the purpose.
Uses and disclosures that need your authorization. We obtain your written authorization before using or disclosing PHI for marketing, before any disclosure that is a sale of PHI, and for psychotherapy notes, except where the rule allows otherwise. You may revoke an authorization in writing at any time, except to the extent we have already acted on it. We do not sell PHI.
Reproductive health care. We do not use or disclose PHI to investigate or impose liability on any person for seeking, obtaining, providing or facilitating lawful reproductive health care, and we require a valid attestation before certain disclosures potentially related to reproductive health care.
Your rights. You have the right to: access and obtain a copy of your PHI in a designated record set; request that we amend your PHI; receive an accounting of certain disclosures; request restrictions on uses and disclosures; request to receive confidential communications by alternative means or at an alternative location; obtain a paper or electronic copy of this notice; and complain about our privacy practices. To exercise these rights, contact our HIPAA Privacy Officer at compliance@mindsethealth.com.
Our duties. We are required to maintain the privacy of your PHI, give you this notice of our legal duties and privacy practices, notify you following a breach of unsecured PHI, and abide by the terms of the notice currently in effect. We may change this notice; any change will apply to the PHI we already hold as well as information we receive in future, and the current version will be posted with this policy.
Complaints. If you believe your privacy rights have been violated, you may complain to us at compliance@mindsethealth.com and to the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for making a complaint or exercising your rights.
Effective date. July 31, 2026
Nerva is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. If you are under 18, we recommend that you use Nerva with the involvement and guidance of a parent or guardian. If we learn we have collected personal information from a child under 13 without the consent required by law, we will delete it. If you believe a child under 13 has provided us with personal information, contact us at privacy@mindsethealth.com.
We may modify this Privacy Policy at any time. If we make material changes, we will notify you by updating the date above, and may also notify you in another way reasonably likely to reach you, such as by email.
Attention: Simon Raik-Allen, Chief Technology Officer and Compliance Officer
Address: 2261 Market Street, STE 4117, San Francisco, CA 94114, USA
Email: privacy@mindsethealth.com
Mindset Health Pty Ltd (ABN 11 617 368 957) ("we", "us", "Mindset Health" or "Mindset") is committed to protecting and respecting your privacy. We offer a mobile app and website that help users ("Users") assess their suitability for, and access, the Nerva program, a gut-brain therapy program for irritable bowel syndrome (IBS) and other disorders of gut-brain interaction (DGBI, commonly known as gut-brain disorders). The program combines cognitive-behavioural-based education, gut-directed hypnotherapy, symptom tracking and breathing techniques.
This Privacy Policy sets out how we handle the personal information we collect in connection with the Nerva website, app and related services (the "Services" or "System"). We handle personal information in accordance with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs"). Unless stated otherwise, "you" refers to Users, website visitors and anyone else who uses our Services.
Mindset Health provides you (the "User") with the Nerva program, including the Nerva website and web assessment (at nervaibs.com and nervahealth.com and their associated subdomains) (the "Website") and the Nerva mobile application (the "App"), together the "System". This Policy covers Nerva only; other Mindset Health products and the general mindsethealth.com website are covered by the Mindset Health privacy policy.
This Policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. The Australian Privacy Principles form the baseline of protection we apply to all users, wherever they are located. If you are outside Australia, see "Users in other countries" in section 3 for how your local privacy laws apply.
We collect and process your information to provide, personalise, support and improve the Nerva program (our gut-brain therapy program for IBS and other DGBI).
Where it is lawful and practicable, you have the option of dealing with us without identifying yourself, or by using a pseudonym. Some Services cannot be provided if we are not able to identify you.
Health information is "sensitive information" under the Privacy Act. We collect it only with your consent and use it only for the purposes described in this Policy. You may withdraw your consent at any time by contacting us (see section 5), although this may mean we can no longer provide part or all of the program. You can delete your account and its associated data at any time using the 'Delete account' option in the App, which is the quickest way to do this. You can also request deletion by emailing hello@mindsethealth.com from the email address associated with the data.
We may receive limited personal and health information about you from your healthcare provider or clinic when they refer you to our program. This typically includes your name and email address, and may optionally include your date of birth, phone number, your primary condition, and any other clinical information your provider chooses to include (for example, in a referral form or letter). Your referring provider is responsible for obtaining your consent before sharing this information with us, and for making all required disclosures under the Privacy Act. We use this information solely to facilitate your enrolment in the Nerva program and to contact you with onboarding instructions.
We may receive materials from third parties such as our partner clinics to improve the quality of our Services. We require our partners to de-identify such material before providing it to us, and to obtain all required consents and make all required disclosures under the Privacy Act. If we inadvertently receive personal or health information from a partner, we will handle it in accordance with this Policy and applicable law, including taking reasonable steps to protect it and to de-identify or destroy it where appropriate.
We and our service providers may collect information about the devices you use to access the System, such as operating system, device manufacturer and model, browser type, IP address, app-generated device identifiers and advertising identifiers, language settings, mobile carrier and general location derived from your IP address (such as city, state or country), as well as usage data such as the pages or screens you view and access times. We use this to provide support, for system administration, to tailor your experience, to report aggregate information internally, and to assist communication (for example push notifications). We do not collect hardware identifiers such as IMEI or UDID.
We and our service providers use cookies, software development kits (SDKs) and similar technologies to operate the System, remember your preferences, understand how the System is used, and to support our marketing. This includes analytics and product-measurement tools (such as Google Analytics and Amplitude) and attribution and advertising tools provided by our third-party advertising partners, which may change from time to time.
We do not sell your personal information, and we do not use your health information for advertising.
Your choices about cookies and tracking. You can manage cookies and tracking through our consent banner and through your browser and device settings, and we honour Global Privacy Control (GPC) signals. Depending on your location, some non-essential cookies and tags require your consent before they are used, and some parts of the System may not work without essential cookies.
We may include your data in aggregated, de-identified datasets shared with our research partners. In these datasets your data is not personally identifiable and is used only to support generalised statements (for example, trends across age groups). We may also link data with other datasets (such as health insurance claims) for research, using privacy-preserving methods and under agreements that prohibit re-identification. Only aggregated, de-identified results are shared or published.
We take reasonable steps to protect the personal information we hold. Our security program is independently audited, including under the SOC 2 Type II framework, and our controls are assessed against HIPAA requirements. Health information is our most restricted category of data; access to it is role-based and granted on a least-privilege, need-to-know basis, and is logged and regularly reviewed. We encrypt personal information in transit and at rest, enforce encryption-key rotation, and carry out regular risk assessments, vulnerability scanning and external penetration testing. We may store personal information with trusted third-party providers such as Google Cloud Platform (GCP) under written agreements requiring them to protect it. No security measures are completely secure, and we cannot guarantee the absolute security of your personal information.
We keep your personal information only for as long as it is needed for the purposes described in this Policy, to meet our legal and contractual obligations, and to comply with any applicable health-records retention requirements. In line with APP 11.2, when personal information is no longer needed we take reasonable steps to destroy or de-identify it. We may retain de-identified or aggregated data for longer where reasonably required to deliver or improve our Services.
Notifiable data breaches. If a data breach involving your personal information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.
Nerva is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. If you are under 18, we recommend that you use Nerva with the involvement and guidance of a parent or guardian. If we become aware that we have collected personal information from a child under 13 without the consent required by law, we will take reasonable steps to delete it. If you believe a child under 13 has provided us with personal information, contact us at privacy@mindsethealth.com.
We understand that your personal and health information is private, and we are dedicated to maintaining its confidentiality and integrity. We will never sell or rent it. We follow a least-privilege access approach, so any disclosure of your personal information is kept to the minimum necessary. We do not disclose personal information to third parties for any purpose materially different from the purpose for which it was collected. The categories below describe how we use and, where necessary, disclose your information.
Disclosure at your request. We may disclose information relating to your use of the System when you ask us to. This may require your written authorisation.
Payment. We do not store card or customer payment details other than with trusted suppliers who help us deliver the Services, and we require those suppliers to meet our security and data protection standards. We may use and disclose your personal information to obtain payment for the Services.
Services and operations. We may use and disclose your personal information to provide the Services and for our internal operations, including administration, planning, analytics and activities that assess and improve the quality of the Services (for example satisfaction surveys). We may use de-identified information to improve customer service and for internal training.
Artificial intelligence and personalisation. We use artificial intelligence ("AI") to personalise the educational and coaching content you receive within Nerva. These automated systems analyse the information you provide, including your symptom data, preferences and program interactions, to tailor content, recommendations and coaching to you. Our AI service providers (currently OpenAI and Google Gemini) each operate under Business Associate Agreements and applicable data protection terms requiring them to protect the confidentiality and security of your information, and your data is not used by these providers to train or improve their general-purpose AI models. We may also use other AI tools to support our internal operations, but we do not send your personal or health information to any AI provider unless it is bound by a Business Associate Agreement or an equivalent data protection contract. This personalisation does not produce legal or similarly significant effects on you; it is used only to customise educational and wellbeing content. AI-generated content supports your self-management and wellbeing and does not constitute medical advice, diagnosis or treatment. AI personalisation is a core part of how the Nerva program is delivered, so we are not currently able to provide the program with AI-personalised content switched off. If you do not wish to receive AI-personalised content, you may stop using the program and cancel your subscription at any time (see section 5 for contact details). You may also contact us at any time to request human review of an AI-personalised recommendation, to express your point of view, or to contest an outcome.
Emails and other communications. We may use your personal information to send you communications by email or SMS about our products and services, in accordance with the Privacy Act, the Spam Act 2003 (Cth) and other applicable laws. You can opt out of marketing communications at any time by following the unsubscribe instructions. You may continue to receive service-related messages.
Reminders and notifications. We may contact you to remind you to interact with, or complete tasks relating to, your use of the System. You can change or cancel these in the App or in your device notification settings.
Third-party service providers. We use third-party service providers (for example hosting, email delivery, analytics, accounting and other business partners) to help us operate. We disclose personal information to them only so they can perform their services for us, and we require appropriate contracts or written agreements to safeguard your personal information.
Third-party medical professionals. With your explicit permission, we may share your personal information with third-party medical professionals nominated by you. You can stop sharing at any time.
Serious threats to life, health or safety. We may use and disclose your personal information where necessary to lessen or prevent a serious threat to your life, health or safety, or that of the public or another person, consistent with the APPs. Any disclosure would only be to someone able to help address the threat.
Law enforcement and legal requirements. We disclose personal information to law enforcement or government authorities only where we are legally required to do so, for example in response to a valid court order or subpoena. We do not provide voluntary or bulk access to any authority, and we have no relationship with immigration agencies (such as ICE) or similar bodies. Any disclosure is limited to the minimum the law requires.
People responsible for your care. We may disclose your personal information to a person responsible for you (such as a family member or carer) where you are unable to give consent, for example in an emergency, and disclosure is consistent with the APPs and appropriate in the circumstances.
Research and publicity. We may use aggregated, de-identified information for internal and external research and publicity, for example publishing generalised trends in the context of public health information and academic research.
Transfer of business assets. If we sell or buy a business or assets, or if Mindset Health or substantially all of its assets are acquired, personal information may be among the transferred assets. We will ensure any such transfer is handled consistently with the Privacy Act and this Policy.
Overseas disclosures. We may disclose your personal information to service providers and other recipients located overseas, primarily in the United States. Before we disclose your personal information to an overseas recipient, we enter into a written contract requiring them to handle it consistently with the Australian Privacy Principles, unless the disclosure is required or authorised by law or you have consented to it. We take reasonable steps to ensure overseas recipients do not breach the APPs, and we remain accountable under APP 8.
Nerva is available to users outside Australia. Unless the law of your country requires otherwise, we apply the protections set out in this Policy, based on the Privacy Act 1988 (Cth) and the Australian Privacy Principles, to all users regardless of location.
Where your local law gives you additional rights or imposes additional obligations on us, we comply with those requirements. In particular:
To exercise any of these rights, contact us at privacy@mindsethealth.com.
Access and correction. You may access the personal information we hold about you and ask us to update or correct it, subject to certain exceptions under the APPs. Please contact us in writing at the details in section 5. We will endeavour to respond within 30 days. If we cannot provide access or make a correction within that time, we will give you written reasons and suggest alternatives. We do not charge for an access request but may charge a reasonable administrative fee for providing a copy. We may require identification before providing the information.
If you have any queries or complaints about this Policy, please contact:
Attention: Simon Raik-Allen, Chief Technology Officer and Compliance Officer, Mindset Health Pty Ltd
Address: Level 2, 620 Church Street, Cremorne VIC 3121
Email: privacy@mindsethealth.com
We will acknowledge your complaint within 7 days and endeavour to resolve it within 30 days, unless we notify you otherwise in writing. We may ask for additional details and will handle complaints confidentially to the extent lawful and practicable. If you are dissatisfied with the outcome, you may refer the complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.