Privacy Policy

Last updated: July 30, 2026

This Privacy Policy explains how CertaMind, Inc. ("CertaMind," "we," or "us") collects, uses, and shares information when you use our websites, applications, cognitive assessments, and related services (the "Service"). The Service is currently offered to users in the United States.

CertaMind is a general-wellness product. We are not currently operated as a covered entity or business associate under HIPAA, and this policy is not a HIPAA Notice of Privacy Practices. We nevertheless use safeguards designed to protect the confidentiality of information.

1. Information We Collect

Account and authentication information

• Email address, name, account identifier, sign-in codes, account timestamps, and information received from an authentication provider such as Google or Apple;
• Profile information, including date of birth, sex assigned at birth, education, language, and general geographic information;
• Subscription and transaction information. Stripe processes payment-card details; CertaMind does not store your full card number.

Health-intake and assessment information

• Before taking assessments, you must submit the health-intake form. You may select "Decline to answer" for individual questions;
• If provided, health-intake answers may include diagnoses, medications, family history, substance use, sleep, exercise, smoking, stress, lifestyle, education, language, and free-text health information;
• Voice recordings, transcriptions, assessment responses, response times, scores, and derived acoustic, linguistic, cognitive, or other measurements.

Support and technical information

• Support communications, attachments, and associated account and contact information;
• Device, browser, application, session, usage, diagnostic, and security-log information, including essential cookies and similar local storage needed to authenticate you and operate the Service.

2. How We Use Information

• Provide, operate, personalize, transcribe, analyze, and score assessments;
• Create and authenticate accounts, process subscriptions, and provide support;
• Maintain security, prevent abuse, troubleshoot, and improve the Service;
• Communicate about your account, requests, transactions, and material Service changes;
• Comply with law and enforce our agreements.

We may use de-identified or aggregated assessment and usage data for product analytics, validation, and research. We do not currently use identifiable health-intake answers for research. If we introduce that use, we will provide additional notice and obtain separate consent where promised or required. We do not use personal information for third-party advertising.

3. Voice, Transcription, and AI Processing

We currently use Deepgram to perform speech-to-text processing for spoken assessments. We may enable additional transcription or AI-analysis providers, such as AssemblyAI or OpenAI, for specified product, research, or quality-assurance functions. We will update this policy before materially expanding that processing. Provider use of content is governed by our applicable account settings and agreements.

4. How We Share Information

We do not sell personal information or consumer health data. We share information only as described below:

• Supabase — database hosting, authentication, and file storage for account information, assessment results, health-intake information, recordings, and related identifiers;
• Deepgram — speech-to-text processing of voice recordings;
• AssemblyAI and OpenAI — optional or future transcription and AI-assisted analysis described above when enabled;
• Stripe — subscription, payment, fraud-prevention, and transaction processing;
• Intercom — customer-support messaging, which may receive account identifiers, name, email, account timestamps, support content, and attachments;
• Google and Apple — optional account authentication when you choose the corresponding sign-in method;
• Render — application hosting and associated operational data.

We may also disclose information when required by law or legal process; to protect users, CertaMind, or the public; in connection with a merger, acquisition, financing, reorganization, or sale of assets; or at your direction, such as when you export results to share with a clinician.

5. Data Retention

We retain account and profile information, assessment results, and submitted versions of health-intake information while your account is active and as reasonably needed to provide longitudinal results. Raw recordings, transcripts, support conversations, security logs, billing records, backups, and provider copies may follow different operational or legal retention periods. After a verified deletion request, we delete or de-identify personal information within a reasonable period, except where retention is necessary for legal, security, fraud-prevention, backup, dispute-resolution, or agreement-enforcement purposes.

6. Your Choices and Requests

You may request access to, correction of, or deletion of personal information by emailing privacy@certamind.com. Account settings allow updates to certain profile information and may provide a limited report of recent assessment results; that report is not a complete export of all personal information we maintain. We may verify requests using your account and may deny or limit a request where permitted by law.

7. Consumer Health Data Notice

Depending on where you live, information about cognitive performance, voice, diagnoses, medications, family history, substance use, sleep, lifestyle, and related inferences may be considered consumer health data. We collect this information from you and from your interactions with assessments to provide and improve the Service, generate results, maintain security, and perform the uses described above.

We share consumer health data only with processors needed for those purposes, with your direction, or as legally required. We do not sell consumer health data. Where applicable law provides rights to access, delete, correct, withdraw consent, or appeal a decision about consumer health data, submit a request to privacy@certamind.com. If we deny an appeal, you may have the right to contact your state attorney general.

8. California Privacy Rights

If the California Consumer Privacy Act (CCPA) applies to our processing—or if we elect to honor the same request voluntarily—you may have rights to know, access, delete, or correct personal information and to receive equal service after exercising those rights.

We collect or may collect identifiers; customer and transaction records; characteristics such as age and sex assigned at birth; education information; internet or network activity; audio information; health and consumer-health information; and inferences such as assessment scores. Sources, uses, and recipient categories are described in Sections 1–4. We do not sell or share personal information for cross-context behavioral advertising, and we use sensitive personal information only for the Service and other permitted purposes.

Submit requests to privacy@certamind.com from the email associated with your account. An authorized agent may submit a request on your behalf, subject to verification.

9. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided personal information, contact privacy@certamind.com so we can investigate and delete it where appropriate.

10. Data Security

We use administrative, technical, and organizational safeguards designed to protect information, including encryption in transit and access controls. No transmission or storage method is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this policy. If we make material changes, we will provide notice before they take effect, such as by email or an in-app notice.

12. Contact Us

CertaMind, Inc.
533 Airport Blvd
Burlingame, CA 94010
privacy@certamind.com