This is a draft. It describes accurately what the platform does with your information, and it has not yet been reviewed by a lawyer. The passages marked needs legal review are the ones we are not willing to state as settled until it has been.
Last updated: 4 September 2026 (version 6)
This explains what The Mental Gym does with information about you, in plain language. It describes what the platform actually does, not what a template says.
1. Who is responsible
Cogninova (Chamber of Commerce / KvK 42071261, VAT ID NL005429495B17), trading as The Mental Gym - by Cogninova is the controller of your personal data. Contact: enrico@cogninova.nl.
2. This includes information about your mental health
Read this bit even if you skip the rest.
To coach you we hold things like your intake answers, notes your coach makes, the homework you submit, and what you post in the community. Under the GDPR that is special category data (Article 9) — the most sensitive kind, with the strictest rules. We treat it that way.
[NEEDS LEGAL REVIEW] — the precise lawful basis for holding it (explicit consent under Article 9(2)(a) is the intended basis), and whether a Data Protection Impact Assessment is required. Both need confirming by somebody qualified.
3. What we hold
| What | Examples |
|---|---|
| Account | Name, email, phone, postal address, date of birth, password (stored hashed — we never see it) |
| Subscription | Which package you are on, what you paid, invoices and receipts |
| Learning | Which lessons you completed and when, quiz answers and scores |
| Homework | What you submit, including files, and your coach's review |
| Coaching | When sessions were booked and held, whether you attended, and your coach's notes |
| Live sessions | Which sessions you signed up for and attended |
| Community | Your posts, comments, reactions, group memberships, and any reports you file |
| Free extras | What you requested, receipts you upload, and what was reimbursed |
| Points | A record of every point awarded and why |
| Which notifications we sent you and your preferences | |
| Agreements | Which version of these documents you accepted, when, and the IP address and browser you accepted them from |
| Technical | Server logs, including your IP address |
4. Why we hold it, and on what basis
| Why | Basis |
|---|---|
| To give you the service you signed up for | Performance of our contract with you |
| To coach you — intake, notes, homework, community | Your explicit consent (special category data) |
| To take payment and keep accounts | Contract, and our legal obligation to keep records |
| To email you about your account and bookings | Contract |
| To keep the community safe — moderation, reports | Our legitimate interest in protecting members |
| To keep the platform secure and working | Our legitimate interest |
We do not sell your data, we do not advertise to you, and we do not profile you for marketing.
5. Who else sees it
Inside Cogninova: your coach and our staff, to do their jobs. One deliberate exception — the notes a coach writes about a session are withheld from you and from anyone else who is not staff. That is enforced by the database, not by a setting.
Other members see very little. When you appear in the community or on the leaderboard, all that is shown is your first name, your score and your rank. Your email address, phone number and postal address are held in tables that community pages physically cannot read. You can hide yourself from the leaderboard, or from the community entirely, in your profile.
Outside Cogninova, these companies process data on our behalf:
| Company | What for | What they get |
|---|---|---|
| Supabase | Database, sign-in, and file storage | Everything in your account: profile, progress, homework, coaching records, community activity, receipts |
| Stripe | Payments, subscriptions and refunds | Your email, what you bought and what you paid. Card details go to Stripe directly and never reach us |
| Resend | Sending email | Your name, your email address, and the content of the message |
| Calendly | Booking an introduction call | Whatever you type into the booking form, only if you choose to load and use it |
| YouTube (youtube-nocookie.com) | The video on our home page | Nothing until you press play. Then your IP address, and no cookies unless you play something |
| Google Analytics | Counting visits to our public pages — never inside your account | Your IP address and which public pages you viewed, and only if you agree to it |
| Hostinger | Running the website itself | Standard server logs, including your IP address |
6. Where it is kept
Your data is stored in the European Union. Some of the companies above are based outside the EU; where that means data leaves the EU, it is covered by the European Commission's standard contractual clauses.
7. How we protect it
Some specifics, because "we take security seriously" means nothing:
- Every table enforces who may read each row in the database itself, not just in the app. A page cannot show you somebody else's record even if it tries to.
- Homework files, receipts and community media are in private storage. They are streamed through the app, which checks who you are on every request. We deliberately do not use shareable links, because a link once created would keep working for anyone who has it.
- Card numbers never reach us. Payment happens on Stripe's own page.
- Passwords are stored hashed by Supabase Auth. Nobody here can read yours.
- Coach notes are withheld at the column level, so even our own admin screens cannot fetch them by accident.
8. How long we keep it
- Community posts: fourteen days, then they are deleted for real — not hidden.
- Account and coaching records: for as long as you have an account, and afterwards where we have to keep them.
- Invoices and payment records: seven years, which Dutch tax law requires.
- Email we sent you: kept so we can show you what was sent.
[NEEDS LEGAL REVIEW] — a stated retention period for coaching notes, homework and intake answers after an account closes. "For as long as you have an account" is honest about today and is not a complete answer.
9. Your rights
You can ask us to:
- show you what we hold about you
- correct anything wrong
- delete it — though some records we must keep, such as invoices
- give you a copy you can take elsewhere
- stop a particular use, or withdraw consent where consent is the basis
Write to enrico@cogninova.nl. We will answer within one month.
If you are not happy with how we handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
10. Cookies
We use Google Analytics on our public pages only — the home page, pricing, the team, and these legal pages. It never runs on any page inside your account, which is deliberate: what you read once you are signed in says something about your health, and that is not going to Google.
Nothing from Google is requested until you agree. Not the tag, not a placeholder, nothing. If you say no, the site behaves identically and we simply do not count your visit. You can change your answer any time from "Cookie choices" in the footer, and saying no later is as easy as saying yes was.
We use no advertising cookies and no cross-site trackers of any kind.
| Where from | What | What it does | Consent needed? |
|---|---|---|---|
| Sign-in (Supabase) | A session cookie | Keeps you logged in. Without it you would sign in again on every page. | Not needed — strictly necessary |
| View as client | dms_preview_tier | Only set for our own staff, to preview what a client sees. | Not needed — strictly necessary |
| Your language | dms_locale | Remembers whether you chose English or Dutch, so the buttons and menus stay in the language you picked. | Not needed — you set it by choosing |
| Stripe | Cookies on Stripe’s own checkout page | Fraud prevention during payment. Set by Stripe on their domain, not ours. | Handled by Stripe during checkout |
| YouTube | No cookie unless you press play | Video is embedded through youtube-nocookie.com, and the player only loads when you press play. Until then nothing is requested from YouTube at all — no IP address and no cookie. | Only if you play the video |
| Calendly | Calendly’s own cookies | The booking calendar. It does not load at all unless you click to load it. | Yes — which is why it is click-to-load |
| Google Analytics | _ga and ga* cookies | Counts visits to our public pages so we know which ones are useful. Only on the public site — never on any page inside your account. | Yes — nothing from Google loads until you agree |
| Your cookie choice | dms_consent | Remembers whether you said yes or no, so we stop asking. Six months. | Not needed — it is the record of your answer |
The booking calendar is the only third-party thing that sets a cookie, and it does not load until you click to load it.
One thing worth being exact about: the video player on our home page is embedded through youtube-nocookie.com, and it only loads when you press play. Until you do, nothing is requested from YouTube — it never sees your IP address, and it sets no cookie. Press play and it sees both the request and, from then on, may set cookies of its own.
[NEEDS LEGAL REVIEW] — Google Analytics involves sending your IP address to Google, a company outside the EU. The lawfulness of that transfer has been contested repeatedly and is a question for a lawyer rather than for us.
11. Children
The Mental Gym is for adults. We do not knowingly hold data about anyone under 18. If you believe we do, tell us and we will delete it.
12. Changes
We will publish a new version here when this changes, and ask you to read it the next time you sign in.