Privacy policy

Mindset AI Tasks (“the service”) is a project and task management platform used by organisations to plan and run the mobilisation of care services. It is available at task.mindsetai.co.uk and as a mobile app for Android and iOS. This policy explains what personal data the service handles, why, and the choices you have.

You can create an account in the mobile app, which sets up a workspace for your organisation, or your organisation can invite you. Your organisation decides what information goes into its workspace and is the controller of that content. Mindset operates the service and processes that content on your organisation’s behalf. For your own account details, Mindset is the controller.

What we collect

• Account details: your name, work email address, role, profile picture if you add one, and a securely hashed password. If you turn on two-factor sign-in, an encrypted authenticator secret.
• Work content: the projects, tasks, comments, files, photos and messages you and your colleagues add.
• Usage and security records: sign-in times, an audit history of changes, IP address and browser or device type, used to keep accounts secure and to show who did what.
• Mobile app: a random device identifier created by the app, a push notification token if you allow notifications, and photos you take with the camera to attach to a task. The app only uses the camera when you tap “Take photo”.

We do not use advertising, we do not sell personal data, and we do not track you across other apps or websites.

Why we use it

• To provide the service your organisation has asked for: signing you in, showing and updating your tasks, and storing attachments (contract with your organisation; our legitimate interest in running the service).
• To send emails and notifications about tasks assigned to you, reminders, and account security (legitimate interest; you can turn notifications off on your device).
• To keep the service secure, prevent misuse and investigate problems (legitimate interest; legal obligation where applicable).
• To run optional AI features, such as summaries and the assistant, when someone in your workspace uses them (on your organisation’s instruction).

Who processes data for us

• Hostinger, which hosts the servers that run the service.
• Prisma (Prisma Postgres), which hosts the database.
• Our email provider, used to send account and notification emails.
• Google Firebase Cloud Messaging and Apple Push Notification service, which deliver push notifications to the mobile app.
• OpenAI, Anthropic or OpenRouter, only when an AI feature is used, and only with the content needed for that request. Under their API terms, OpenAI and Anthropic do not train their models on this data.

Some of these providers may process data outside the UK. Where they do, the transfer is protected by the UK International Data Transfer Agreement, Standard Contractual Clauses or an adequacy decision.

How long we keep it

Work content is kept for as long as your organisation keeps its workspace. Notifications and background job history are deleted automatically after a period. Mobile sign-in sessions expire and are revoked when you sign out. When an account is deleted, its personal details are removed or anonymised; audit entries may be kept where your organisation needs them for its records.

Security

Data is encrypted in transit with HTTPS. Passwords are hashed, mobile sign-in tokens are stored in the device’s secure storage, and access to each workspace is limited to its members.

Your rights and deleting your account

In the mobile app you can delete your account yourself: Settings, then Delete account. Workspaces where you are the only member are deleted with it; shared workspaces stay with your team and tasks you owned become unassigned.

You can ask to access, correct, export or delete your personal data, or object to how it is used. To delete your account and its data without the app, email arnold.chiy@mindsetsocialcare.co.uk from the address you sign in with, or ask your organisation’s administrator. We act on requests within 30 days. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk.

Children

The service is for staff of organisations and is not intended for anyone under 18.

Changes and contact

We will update this page when the way we handle data changes, and change the date at the top. Questions: arnold.chiy@mindsetsocialcare.co.uk.