Privacy and security
Your trust. Our responsibility.
Mental health information deserves exceptional protection.
At Synapse Cura, privacy and information security are foundational to how we design our platform. We believe connected mental healthcare should strengthen patient autonomy, not compromise it.
Our approach is guided by privacy by design, responsible information governance, appropriate access controls and the principle that sensitive information should be used only for clearly defined and legitimate purposes.
We also believe transparency matters. Below is what is in place today, what must be in place before anyone's real health information is used, and what we don't claim. Our commitment is to earn trust through demonstrable safeguards, not simply ask for it.
We do not ask patients to trade privacy for better care.
In place and tested
Built and checked by our own automated tests. Not yet independently verified — that's part of the work before the pilot.
Access checked by the database itself
Every request is authorised on the server: a professional sees only what the patient has chosen to share with them. Automated checks of these rules run on every change.
Sharing per professional
Patients choose, for each professional and each kind of information, what they see — and can change it at any time.
Every read is visible
When a professional opens a patient's record, it is logged, and the patient can see who looked and when.
Nothing rewritten
Clinical entries can't be edited or deleted after the fact; every entry keeps its author and date.
Private stays private
Personal reflections and journey entries are visible only to the patient, and life context only to the professionals they choose.
No employer or research access
There is no route in the platform for an employer, sponsor or research partner to see a patient's information.
Emails without health details
Notification emails say only that something needs attention, never what.
Encrypted connections
Every connection to Synapse Cura uses HTTPS.
Required before the pilot
Synapse Cura is preparing its first pilot. No one's real health information is used until these are in place.
- Two-factor sign-in required for professionals and administrators
- Database and application hosted in the EU (Frankfurt); email delivery and sign-in providers assessed for any processing outside the EU
- Encryption at rest, provided by our hosting, confirmed in our processor agreements
- A complete process for deleting an account and its data, within legal record-keeping obligations
- Security monitoring and alerting
- An independent security test, with findings fixed and retested
- Backup restoration tested, with recovery objectives defined
- A data protection impact assessment and processor agreements
What we don't claim
Not established today. We'll only say otherwise when there is evidence to show.
- ISO 27001 certification or SOC 2 attestation
- Any “GDPR certification” — we work to the regulation; compliance is shown with evidence, not a badge
- End-to-end encryption — the service processes information so it can share it with the professionals you choose
- Clinical validation, or approval as a medical device
Employers and research
Employer-sponsored access
Employers never receive clinical records, private reflections, therapy content or any identifiable mental health information. Any aggregate reporting will be assessed for privacy risk first, with minimum group sizes and safeguards against re-identification.
Research and life sciences
No identifiable information is disclosed to research or commercial partners without a lawful basis, permission and governance. Research access is purpose-limited, reviewed and kept separate; sponsorship never grants access to patient information; and taking part in research is never a condition of care.
Your rights
You can see and download your record, correct it by adding your own context, and ask for access, correction or deletion from your Me page. Deletion is subject to the record-keeping obligations professionals may have under the law, and we'll explain what applies.