Depending on how you use the website and App, we may collect or process:

• identity and account information, such as name, email address and login details;

• waitlist, registration and communications information;

• information you choose to enter into the App, including text, reflections, experiences, habits, emotions, anxiety-related information and other user-generated content;

• usage information, such as interactions with App features, progress, session activity and feature engagement;

• technical information, such as IP address, device type, operating system, browser information, identifiers and security logs;

• support communications and feedback; and

• information generated or inferred by App functionality where necessary to provide features described to you.

Information entered into an anxiety-support app may reveal or relate to a person’s physical or mental health. Where information constitutes special-category personal data under applicable law, Mendreo will process it only where an appropriate lawful basis and additional legal condition apply.

Users should only provide information that is reasonably necessary for using the service and should avoid entering unnecessary identifying information about other people.

We may use personal data to:

• create and manage user accounts;

• provide App functionality and personalised in-product experiences where enabled;

• process user inputs and generate AI-supported responses;

• operate, maintain, secure and troubleshoot the App;

• provide customer support;

• understand product usage and improve usability and performance;

• send service communications and, where permitted, product or marketing communications;

• prevent misuse, fraud and security incidents; and

• comply with legal and regulatory obligations.

Certain App features use artificial intelligence. User inputs may be processed by AI systems in order to generate responses or provide App functionality.

Where external technology providers support AI functionality, Mendreo will assess the relevant data flows and use appropriate contractual, security and data-protection safeguards. The App should clearly inform users where they are interacting with AI.

Mendreo will describe any material automated decision-making or profiling that produces legal or similarly significant effects where such processing applies. This Notice should be updated if the App introduces functionality of that kind.

Depending on the processing activity, Mendreo may rely on one or more lawful bases, including performance of a contract, legitimate interests, legal obligations and consent. Where special-category personal data is processed, an additional condition under applicable data-protection law will also be identified and documented.

The precise lawful basis may vary by feature. Mendreo maintains internal records of processing and will provide more specific notices where appropriate.

We may share personal data with carefully selected service providers that support hosting, cloud infrastructure, authentication, communications, analytics, security, customer support or AI functionality. We may also disclose information where required or permitted by law.

We do not sell personal data.

Some service providers may process personal data outside Ireland or the European Economic Area. Where international transfers occur, Mendreo will use an appropriate transfer mechanism and safeguards where required by law.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the service, maintaining security and records, resolving disputes and meeting legal or regulatory obligations.

Retention periods may differ depending on the type of data and App functionality. More specific retention information may be provided within the App or supporting documentation.

Mendreo uses appropriate technical and organisational measures designed to protect personal data from unauthorised access, loss, alteration, disclosure or misuse. No digital service can guarantee absolute security.

The website may use cookies and similar technologies as described in the Cookie Policy. App analytics and similar technologies will be used in accordance with applicable law and the choices made available to users.

Depending on applicable law and the circumstances, you may have rights including access, correction, erasure, restriction, objection, data portability and withdrawal of consent where processing is based on consent.

You may exercise applicable rights by contacting info@mendreo.com. You may also have the right to complain to the relevant data-protection supervisory authority.

The App should state the minimum age for use and should not knowingly collect children’s personal data in a manner inconsistent with the age limits, parental-consent requirements or other safeguards that apply to the service. This section should be updated once the product’s final age policy is confirmed.

We may update this Privacy Notice to reflect changes in the App, technology, service providers, data practices or legal requirements. Where changes are material, we will provide appropriate notice where required.