Privacy policy

1. Who is responsible

The controller is Humanity in Business Solutions (HIBS), the company that operates Synapse Cura. Contact for anything about your data, including this policy and your rights: info@humanityinbusiness.com. Until a data protection officer is appointed, the same address reaches the person responsible for data protection.

Clinicians who use Synapse Cura are separately responsible, as controllers, for their own professional documentation, which they keep outside the service as their profession and national law require. Synapse Cura holds the shared record under your control.

2. What we collect

• Account: email address, a hash of your password (never the password), second-factor secret for professionals and administrators, sign-in times, your country, your time zone, and, if you give it, your date of birth (needed only for under-18s).
• Your record, written by you: your story, diagnoses you report, medication and reactions, check-ins and hard moments, sleep and daily functioning, questionnaires, key facts and life context, safety plan, advance choices, emergency contacts, goals and wishes. This is health data (a special category under Article 9 GDPR).
• Care coordination, written by your clinicians with your agreement: record entries, session summaries, assessments, diagnoses with their basis, decisions, care plan, messages, referrals, handovers, between-visit reviews and prescribed practices. Also health data.
• Clinicians: name, profession, licence and register details, verification notes, clinic membership and roles, and the terms you set for reviews.
• Guardians and loved ones: the name the person gave, the level of involvement the person chose, verification by a clinician (no documents are stored), and the dates.
• Audit and security: who opened which part of a record and when; administrator actions; counts of unusual access patterns and sign-in anomalies, without any content.
• Notifications: that something is waiting for you, and your email preference. Emails never contain personal or clinical details.
• Requests and feedback: data-rights requests and their outcome; pilot feedback you choose to give.
• Technical: the IP address and browser details that any web server receives, kept briefly in hosting logs; the result of a bot check at sign-up and sign-in. We use no analytics, advertising or tracking cookies. The browser stores only what is needed to keep you signed in and your preferences (language, theme, time zone).

3. Why, and on what legal basis

• To run your account and the service you asked for (Article 6(1)(b), performance of a contract): account, record, care coordination, notifications, export.
• To process health data at all: your explicit consent (Article 9(2)(a)), given when you create your account and renewed when a document changes. You can withdraw it at any time by closing your account; earlier processing stays lawful. For a clinician's own entries, their professional documentation duty (Article 9(2)(h)) may also apply, which is why those entries stay in your history after a clinician leaves.
• Safety: the crisis information you set up is shown to your team under your consent; in a situation of danger to life we may rely on vital interests (Article 6(1)(d), 9(2)(c)).
• Security, audit and accountability (Article 6(1)(f), legitimate interest, and Article 32): the access log, administrator log and security signals. You can object; we will explain why the log must stay for your protection.
• Legal obligations (Article 6(1)(c)): clinician registration checks, guardianship rules per country, answering your data-rights requests and keeping proof that we did.
• Anonymous statistics about mental health over time: only if you opt in, only over groups of at least ten people, never with row-level data leaving the database, and switched off during the pilot (Article 6(1)(a), 9(2)(a)). You can change your choice on the Me page.
• No automated decision-making or profiling takes place. Nothing in the service scores, ranks or interprets you.

4. Who sees what

• You see everything of your own, including who opened your record.
• Clinicians you added to your team see only the parts you switched on for each of them. Clinicians on the same team can coordinate with each other in a space you agreed to and can see is in use. A clinician who leaves keeps authorship of their entries, not access.
• Loved ones and guardians see only the level you chose (emergency profile, guide, alerts), never your notes, diary or scores.
• Administrators verify clinicians, answer data-rights requests and review security signals and safety reports. They do not read records as a matter of course; any opening by an administrator is logged and visible to you, and every administrator action is logged.
• Nobody else. No employer, insurer, pharmaceutical company, advertiser or researcher has access to any record or workspace. Clinic administrators see counts about their clinic's clinicians, never patient content.
• We disclose data to authorities only when the law compels us, and we tell you unless the law forbids it.

5. Our processors and where data lives

Data is stored in the European Union. These companies process data on our behalf under data processing agreements:

• Supabase: the database, authentication and backups, in Frankfurt, Germany. Everything the service stores.
• Vercel: hosting and the one server function that sends notifications, in Frankfurt; its global edge network serves only static files with no personal data.
• Resend: transactional email. It receives your email address and a generic sentence with a link, never health content.
• Cloudflare Turnstile: a bot check on the sign-up and sign-in page only. It sees the browser and network signals of that page, never your email, password or record.
• Google: only if you choose to sign in with Google. Google receives the fact of the sign-in; we receive your email address.

No health data is transferred outside the European Economic Area. Where a processor's support staff could in principle reach data from elsewhere, the agreement includes the European Commission's standard contractual clauses. The full list, including what each party sees, is kept in our sub-processor register and updated before any new party is used.

6. How long we keep data

• Your account and record: for as long as you have an account. Clinical records are never deleted by a timer; they are a history.
• The access log: five years, so that you can check who opened your record long after the fact. Notifications: one year. Security signals: until acknowledged plus one year.
• When you ask for deletion, your account and your data are removed from every table of the service by one procedure that is tested on every change to the code. Kept, with your name blanked: the fact that a request was fulfilled, administrator logs, and clinicians' entries in their own professional documentation, which they must keep under their national rules outside the service. We tell you exactly what was removed and what was kept.
• Hosting and email logs are kept by the processors for a short technical period under their agreements.

7. Your rights

You have the right to access your data, to have it corrected (in a history, a correction is a new entry that points to the old one), to have it erased, to restrict or object to processing, to receive it in a portable form, to withdraw consent at any time, and not to be subject to automated decisions. Most of these you can do yourself:

• Access and portability: download your whole record from the export page in the app, at any time.
• Sharing, objection and restriction: change what each clinician sees, pause or remove anyone, and change your statistics choice on the Me page.
• Erasure and anything else: send a request from the Me page or write to info@humanityinbusiness.com. We answer within one month; if a request is complex we tell you within that month how much longer we need, up to two further months.
• Complaint: you can complain to the data protection authority in the country where you live or work, or where you think a breach happened. We would rather hear from you first, but you do not have to.

8. How we protect data

• Every connection is encrypted in transit. Data is encrypted at rest by our hosting provider.
• Who may see what is enforced inside the database itself, row by row, for every table; it is not merely hidden in the interface. Reads of sensitive data go through logged functions, which is what makes your access log complete.
• Clinicians and administrators must use a second factor; passwords are at least twelve characters and checked against known breaches; sessions end after inactivity.
• Clinical records are append-only and server-dated. Administrator actions are logged. Unusual access patterns raise an alert that contains counts, never content. Security headers and a content security policy apply to every page. Dependencies and the code are scanned for known vulnerabilities and for secrets on every change.
• Plainly, what is not yet in place: an independent security test, a formal data protection impact assessment and signed processor agreements are scheduled before the first real patient and are tracked publicly on our privacy and security page. We do not hold any certification and do not claim one.
• If a breach ever puts your rights at risk, we notify the supervisory authority within 72 hours and tell you without undue delay, saying what happened, what it means for you and what we are doing.

9. Children

Synapse Cura is for adults. A person under 18 may take part only where national rules allow it and a guardian has been verified by a clinician; the guardian's authority follows the person's age under the rules of their country. We do not knowingly create accounts for children otherwise; tell us if you believe one exists and we will remove it.

10. Changes to this policy

When this policy changes in a way that matters to you, we show the new version in the app and ask you to accept it before you continue; the version you accepted is recorded with its date. Smaller corrections are published here with a new date. The current version is at the top of this page.