Skip to content
Legal

Privacy Policy

Last updated on September 25, 2026

Purpose and Scope

In its everyday business operations Mindgram makes use of a variety of personal data, including data about:

  • Current, past and prospective employees
  • Customers
  • Users of and visitors to its websites
  • Subscribers

In collecting and using this data, the organization is subject to a variety of legislation controlling how such activities may be carried out and the safeguards that must be put in place to protect it.

The purpose of this policy is to set out the relevant legislation and to describe the steps Mindgram is taking to ensure that it complies with it. This control applies to all systems, people and processes that constitute the organization’s information systems, including board members, directors, employees, suppliers and other third parties who have access to Mindgram systems.

Privacy and data protection policy

Key Definitions

  • Personal Data (or Personal Information): Any information relating to an identified or identifiable natural person (i.e., data subject).
  • Client Data: Any data, documents, content, or other information (which may or may not include Personal Data) that you upload, submit, or otherwise make available to Mindgram in connection with your use of the Platform.
  • Controller: The entity that determines the purposes and means of processing Personal Data.
  • Processor: The entity that processes Personal Data on behalf of the Controller.

Data Collection and Use

  1. Minimal Personal Data Collection
    Mindgram does not store or maintain personally identifiable information (PII) on its own servers, with the exception of what is necessary to provide and secure our services. Authentication on the Platform is handled by a trusted third-party provider, Auth0, which stores limited Personal Data such as names and email addresses for login and identity management purposes.
  2. Client Data
    • Mindgram provides tools and infrastructure for storing, processing, and analyzing data relevant to the biopharma industry.
    • Ownership: You retain all rights to the Client Data you upload or otherwise provide.
    • Data Usage: Mindgram processes Client Data solely to provide, maintain, and improve our services, or otherwise as instructed by you and in accordance with applicable laws.
  3. Business-to-Business Context
    Because Mindgram is a B2B tool, the primary data we handle is related to our corporate clients and their users’ professional information. Any Personal Data is typically limited to business contact details (e.g., name, business email) used for account creation, user support, and client communications.

Data Governance Policies

  1. Data Retention
    • Retention Period: Mindgram assists clients in meeting GDPR and other data protection regulations by facilitating timely deletion of customer data upon request.
    • Post-Contract Access: For twenty (20) days after the end of the contract term, Mindgram will make your data available to you through the Platform unless you instruct us to delete such data sooner.
    • Deletion of Data: After the 20-day period, Mindgram will discontinue all use of your data and destroy all copies of your data in its possession, unless otherwise required by law or expressly agreed upon with you.
  2. Data Access
    • Mindgram Engineers: Access to customer data by Mindgram engineers is granted strictly for service delivery purposes, under rigorous managerial oversight, and only when expressly authorized by you.
    • Client Access: As a client, you have access to your data on the Platform and can export data out of the Platform at any time.
    • Restricted Access: Only authorized subscribers with valid login credentials (username and password) can access the Platform.
  3. Auth0 Authentication
    • Mindgram uses Auth0, a third-party identity and access management service, to handle user authentication.
    • Auth0 stores basic information such as names and email addresses to create secure, unique user accounts for the Platform.
    • Mindgram does not store any additional personal data beyond what is necessary for client account administration and support.

Data Security

Mindgram employs industry-standard security measures to protect against unauthorized access, alteration, disclosure, or destruction of your data. These measures include, but are not limited to:

  • Secure data centers with robust physical and network security controls.
  • Encryption of data in transit (e.g., via TLS/SSL) and, where applicable, at rest.
  • Strict access controls and internal policies restricting access to systems and data to authorized personnel only.
  • Regular security audits and vulnerability assessments.
  • Incident response procedures designed to swiftly address any security breach.

Sharing and Disclosure of Data

  1. Service Providers (Processors)
    We may engage third-party service providers to process data on our behalf (e.g., hosting providers, authentication providers, analytics providers). These processors are contractually required to protect data and may only process data in accordance with our instructions.
  2. Legal Requirements
    We may disclose your data if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
  3. Business Transfers
    In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of such a transaction, subject to confidentiality and data protection obligations.

Rights of the individual

The personal data principal also has rights with regard to their personal data. These will generally consist of:

  1. The right to be informed
  2. The right of access
  3. The right to rectification
  4. The right to erasure
  5. The right to restrict processing
  6. The right to data portability
  7. The right to object
  8. Rights in relation to automated decision making and profiling.

To exercise these rights, please contact us using the information in the “Contact Us” section below. We may request additional information from you to verify your identity before completing your request.

Lawfulness of processing

Depending on the legislation involved, there may be a number of alternative ways in which the lawfulness of a specific case of processing of personal data may be established. It is Mindgram policy to identify the appropriate basis for processing and to document it, in accordance with the applicable legislation. The main options are described in brief in the following sections.

Consent

Where appropriate, Mindgram will obtain consent from a personal data principal to collect and process their data. In cases of children being below the age specified in applicable legislation, parental consent will be obtained. Transparent information about our usage of their personal data will be provided to personal data principals at the time that consent is obtained and their rights regarding their data explained, such as the right to withdraw consent. This information will be provided in an accessible form, written in clear language and free of charge.

If the personal data is not obtained directly from the personal data principal, then this information will be provided to the personal data principal within a reasonable period after the data is obtained and definitely within one month.

Performance of a contract

Where the personal data collected and processed is required to fulfill a contract with the personal data principal, consent is not required. This will often be the case where the contract cannot be completed without the personal data in question, for example, a delivery cannot be made without a name and email address.

Legal obligation

If the personal data is required to be collected and processed in order to comply with applicable law, then consent is not required. This may be the case for some data related to employment and taxation for example, and for many areas addressed by the public sector. For example, processing of personal data relating to criminal convictions and offenses or related security measures.

International transfers of personal data

Transfers of personal data between countries will be carefully reviewed prior to the transfer taking place to ensure that they fall within the limits imposed by the applicable legislation. This depends partly on the relevant authority’s judgment (for example in the case of the GDPR, the European Commission) as to the adequacy of the safeguards for personal data applicable in the receiving country and this may change over time.

Where an adequacy decision (or similar statement) does not exist for a destination country, an appropriate safeguard such as standard contractual clauses will be used, or a relevant exception identified as permitted under the applicable legislation.

Breach notification

It is Mindgram’s policy to be fair and proportionate when considering the actions to be taken to inform affected parties regarding breaches of personal data. In line with the applicable legislation, where a breach is known to have occurred which is likely to result in a risk to the rights and freedoms of individuals, where required the relevant supervisory authority will be informed within the specified timeframe (for example, for the GDPR within 72 hours). If acting as a data processor, Mindgram shall notify the data controller of the data breach security incident. This will be managed in accordance with our Security Incident Response Policy which sets out the overall process of handling information security incidents.

Enforcement

Any violation of this policy or any other Mindgram policy or procedure may result in disciplinary action, up to and including termination of employment. Mindgram reserves the right to notify the appropriate law enforcement authorities of any unlawful activity and to cooperate in any investigation of such activity. Mindgram does not consider conduct in violation of this policy to be within an employee’s or contractor’s course and scope of work.

Any personnel who is requested to undertake an activity that he or she believes is in violation of this policy must provide a written or verbal complaint to his or her manager or any other manager of Mindgram as soon as possible.

The disciplinary process should also be used as a deterrent to prevent employees and contractors from violating organizational security policies and procedures, and any other security breaches.

Updates to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we do, we will revise the “Last Updated” date at the top of this document. The consents we rely on are reviewed at least annually, together with this Policy, to confirm that they still cover the purposes for which personal data is used. Where a change to this Policy or to our processing materially affects how personal data is used, we notify the affected individuals by email before the change takes effect and, where consent is the lawful basis for the processing, obtain their consent again. We encourage you to review this Policy periodically to stay informed about our data protection practices.

Contact Us

If you have any questions, concerns, or requests regarding this Policy or our data protection practices, please contact us at:

Mindgram Technologies, Inc.
admin@mindgram.ai