Privacy Policy

Overview

Mentia Health operates three products under one shared back office: CarePlay, DevaWorld, and MentiaCompanion. This policy is organized in three parts that build on each other — each part covers only the additional data its product collects, on top of what the previous part already covers.

• Part One — CarePlay covers User data only. CarePlay is a training product; it has no Player, no Care Circle content, and no AI conversation data.
• Part Two — DevaWorld covers everything in Part One, plus the Player data DevaWorld collects: Life Story content, Care Circle details, and virtual-world usage.
• Part Three — MentiaCompanion covers everything in Parts One and Two, plus the AI conversation data unique to MentiaCompanion: audio and video exchanges between the Player and the AI persona.

Provisions that apply identically across all three products — security, storage and retention, your rights, consent and the Designated Person’s authority, children’s data, breach notification, and contact details — are gathered once, in Part Four, rather than repeated three times.

Part One — CarePlay

CarePlay is our training product for Users. It does not involve a Player, a Care Circle’s Life Story content, or any AI-driven interaction — everything in this Part applies only to the person using CarePlay themselves.

Information we collect

• Name, email address, and phone numbers in the future, used to authenticate your account.
• Training progress: which modules and courses you complete, and when.
• Usage logs: IP address, device identifier, and timestamps.

How we use it

• To create and secure your account.
• To track and certify your completion of training content.
• To improve the training content itself.

Who we share it with

• The organization that enrolled you in CarePlay — such as a home care agency, hospital, or assisted-living facility — which can see your training completion and progress. Many of our CarePlay customers are themselves healthcare providers, so this is the normal case, not an exception.
• Service providers who host the application and send authentication emails, under contract to use your data only for that purpose.
• Legal authorities, if required by a court order or subpoena.

We do not use your CarePlay data to train any AI model — that only applies to MentiaCompanion, described in Part Three.

Storage, retention, your rights, and how to contact us are covered once, for all three products, in Part Four.

Part Two — DevaWorld

DevaWorld builds on Part One. In addition to the User data above, it also involves a Player — the person living with dementia — and the Care Circle that supports them.

Additional information we collect

• About the Player: name and date of birth (not mandatory); voluntarily provided “Life Story” content (which may include audio, video, written text, and the names and images of people, places, and objects meaningful to the Player); and the identity of their Care Circle and Designated Person.
• About Care Circle activity: which Users belong to a Care Circle, their roles (Admin, Designated Person, other Users), and invitation history.
• Usage within the virtual world: objects the Player interacts with, session length, and timestamps.

Life Story contributions are voluntary. A User may edit or delete any Life Story content they contributed, at any time, from the Dashboard.

How we use it

• To let the Player’s Care Circle see and contribute to their Life Story, so Users can know the Player better.
• To power the Player’s engagement activities inside the virtual world.
• To improve and personalize the DevaWorld experience.

A note on consent and capacity. Because a Player living with dementia may not be able to give informed consent themselves, DevaWorld relies on the Designated Person to consent to the Player’s participation, and to the collection of their Life Story content, on the Player’s behalf. Part Four explains how we establish who holds that authority, and how a Designated Person can request changes to, or deletion of, the Player’s data.

Who we share it with

• Specialists, hospitals, or other care providers connected to the Player’s care, when a Designated Person requests it, to help coordinate that care.
• The same service providers and legal authorities described in Part One.

DevaWorld does not send Life Story content to AI vendors — that only happens in MentiaCompanion, described in Part Three.

Storage, retention, your rights, and contact details are covered once, for all three products, in Part Four.

Part Three — MentiaCompanion

MentiaCompanion builds on Parts One and Two. In addition to the User and Player data described above, it involves direct AI-driven conversation with the Player.

Additional information we collect

• Conversation data: audio and video recordings of exchanges between the Player and the AI persona, along with the text transcribed from them.
• Derived information: elements our systems extract from those conversations — such as topics, names, or preferences the Player mentions — used to make later conversations more relevant to that Player.

How we use it

• To hold a conversation with the Player and respond to them in real time.
• To extract and store the elements above, so the AI persona can refer back to them in future sessions.
• To improve the quality of the AI persona’s conversation over time.

Who processes it

• Third-party AI vendors provide the underlying speech-to-text, text-to-speech, and conversational AI services.
• We currently use OpenAI’s Whisper (self-hosted on our own servers, so we control where it runs), OpenAI’s ChatGPT API, and ElevenLabs.
• Under OpenAI’s API data policy, our usage is not used to train OpenAI’s models by default.
• These vendors act under contract and may not use conversation data for any purpose other than providing the service to us, unless this section says otherwise.

Cross-border processing. Today, MentiaCompanion’s AI conversation data (audio, video, and derived text) is processed and stored on a North American server for all Players, regardless of which zone they are in — a deliberate, temporary exception to the zone-siloed storage described in Part Four, while we migrate to regional AI processing as OpenAI’s and ElevenLabs’ own regional availability allows.

Storage, retention, your rights, and contact details are covered once, for all three products, in Part Four.

Part Four — Shared Provisions

These provisions apply the same way across CarePlay, DevaWorld, and MentiaCompanion.

Security safeguards

We protect your data with physical, technical, and administrative safeguards, including encryption in transit and at rest for sensitive data, and access limited to staff who need it to do their jobs.

Where your data is stored, and for how long

We operate in three zones: North America (United States and Canada), Europe, and Australasia (Australia and New Zealand). Dashboard, account, and Life Story data is stored on regional servers in Canada (North America), France (Europe and the United Kingdom), and Australia (Australasia), and each region is siloed: this data does not move from one region to another.

AI conversation data from MentiaCompanion is an exception to this: it is currently processed and stored on a North American server for every Player, no matter their zone, with a planned migration to European and Australasian/Singapore processing as our AI vendors make those regions available (see Part Three).

We keep your data while you use our services, and for a reasonable period afterward. After your account is closed, we retain data for at least 10 years in anonymized form, with one exception: phone numbers are kept beyond this schedule, to support functionality planned for future releases.

On request, you may ask us to delete your or your Player’s personal data immediately, rather than waiting for the anonymization period above. A User requests deletion of their own data; a Player’s Designated Person requests it on the Player’s behalf. Send requests to the contact address in Part Four; we verify the requester’s identity and authority before acting. This right extends to phone numbers too: although we otherwise keep them beyond the general anonymization schedule to support future functionality, you may ask us to delete yours specifically, and we will comply unless a legal or safety exception applies — for example, an active legal obligation or dispute, or a fraud or safety investigation. We aim to complete deletion requests within 30 days of verifying your identity and authority. Backup copies that already exist at the time of your request may take up to an additional 90 days to be overwritten in our normal backup cycle.

Your rights

Depending on which of our three zones you’re in — North America, Europe, or Australasia — different laws give you rights over your data:

To exercise any of these rights, contact us using the details below.

Consent, and the Designated Person’s authority

By creating an account, a User declares that they are the Player’s Designated Person, or otherwise authorized to act on the Player’s behalf. For individual and family accounts, we currently rely on that declaration and do not independently verify legal authority, such as power of attorney or guardianship. For institutional customers — home care and assisted-living organizations — consent is instead handled through the organization’s own informed-consent process before a Player is enrolled

Children’s data

We do not allow minors to create accounts. A Player’s Life Story may reference family members who are minors — such as grandchildren, by name or photo — without creating an account or a profile for them; we do not treat this as collecting a minor’s own personal data.

If something goes wrong

If a data breach affects your information, we will notify affected Users and the relevant regulators as required by applicable law in each zone we operate in, including GDPR in Europe, UK GDPR in UK, HIPAA in the United States, and the equivalent breach-notification laws in Canada, Australia, and New Zealand.

Changes to this policy

We will post material changes to this policy on our website, or notify you as otherwise required by law.

Contact us

Questions about this policy, or requests to exercise any of the rights above, can be sent to Mentia’s Data Privacy Officer, Serge Soudoplatoff, at serge@mentia.me.