Mentwell

Privacy Policy

Version 2026-10-07

Draft. Details in [square brackets] still need to be filled in by Mentwell, and this document should be checked by a legal adviser before it is relied on.

The short version

We never ask for your name, email address or phone number in the app, unless you choose to send a help request.
We ask for your age group, your gender and the first part of your postcode (like B12).
Your check-ins (how you feel, where you feel it in your body, and your notes) are saved on your phone and sent to Mentwell without your name. Help requests are different: see "Keeping you safe".
Mentwell staff use them to understand how young people are feeling across schools and programmes, and to make support better. We hide small groups so nobody can be picked out.
We don't show your check-ins to your school, your parents or anyone else, except to keep you safe (see "Keeping you safe" below).
Nobody watches the app all the time, so it is not an emergency service. Your notes are checked for some words that might mean you are not safe, and Mentwell's safeguarding team may then contact your school. If you are worried about yourself or someone else, talk to a trusted adult or contact Childline (0800 1111, free, 24 hours) or text SHOUT to 85258. In an emergency, call 999.
If you are under 13, a parent or carer needs to say it is OK for you to use the app.
You can make an account if you want to (you do not have to). It uses a username you choose, not your name. You can delete one check-in, or everything, at any time in "About this app" (safeguarding records are the exception: Mentwell deletes those).
No adverts, no tracking, and we never sell your information.

Who we are

Mentwell is run by Mentwell CIC, a community interest company registered in England and Wales (company number [COMPANY NUMBER]), at Office 1, Izabella House, Birmingham B1 3NJ. We are the "controller" of the personal information described in this policy, which means we decide how it is used and we are responsible for looking after it.

We are registered with the Information Commissioner's Office (ICO), registration number [ICO REGISTRATION NUMBER]. If you have any question about this policy or your information, email [email protected].

What this policy covers

This policy covers the Mentwell website (where you can read about our work, contact us or book a session) and the 5 Minute Feelings app (an emotion check-in and journal for young people, which does not ask for your name, unless you choose to send a help request). It explains what we collect, why, who can see it, how long we keep it and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).

What the app collects

When you set up the app and do a check-in, we collect:

A random code made by your phone the first time you open the app, and a secret key that proves later messages come from the same phone. It is not linked to your name or phone number. If you choose to make an account, it is linked to that account.
Your age group (for example 13 to 14), your gender (and, if you choose to, a description in your own words) and the first part of your postcode (for example B12). We never ask for your full postcode.
A code for your school or programme, if you opened the app from a link they gave you.
Each check-in: the feelings you picked, how strong they were, where you felt them in your body and anything you wrote about that, where you were, who you were with, any note you wrote, and the date and time.
That you agreed to this policy and our Terms of Use, which version, and when. If you are under 13, that you confirmed a parent or carer has said it is OK.
If you make an optional account (see "Optional account" below): the username you chose, a password if you set one, a public key if you use Face ID, a fingerprint or your phone's unlock, and a code we make for you, kept only in a scrambled form.
If you choose to send a help request: the message, the name and way to reach you that you type in, and your school code and age group, which we add. If a note of yours is flagged (see "Keeping you safe"), a copy of that note.
Technical information our servers need to work and stay secure, such as your IP address, which is used for a short time to stop the app being misused and is not stored with your check-ins.

Optional account

You do not need an account to use the app. If you want to get your check-ins back on a new phone, you can make one. We still never ask for your name, email address or phone number (unless you choose to send a help request). This is what an account is made of:

A username you choose. Please do not use your real name.
A password, if you want one.
Face ID, a fingerprint or your phone's unlock, if you want to use it. We only store a public key, never any part of your face or fingerprint. Your face or fingerprint never leaves your phone.
A personal code that we make for you. It is the way back into your account if you lose your phone or forget your password.
Your password and your personal code are never stored as you typed them. We keep them only in a form that cannot be turned back into the original, so nobody at Mentwell can read them or tell you what they are.
The personal code is also kept on the phone that made it, so you can look at it again. That copy is removed when you sign out.
Signing out removes this phone's copy. Your account stays with us, so you can sign in again later.
If you delete all your data in "About this app", your account is deleted too.
If you ask for help with your account, Mentwell's admin can look it up by its username (a username is not a name) to give you a temporary password, pause it or delete it. Nobody at Mentwell can see a list of usernames.

What the app does not collect

Please don't write anyone's full name, or details that could identify someone, in your notes. If you do, that information becomes part of your check-in.

Your name, email address, phone number or full postcode, unless you choose to send a help request.
Your exact location, contacts, photos or anything else on your phone.
Anything for advertising, and no tracking or analytics tools.

Health information

How you feel, and where you feel it in your body, is information about your health. The law calls this "special category" information and gives it extra protection. We only collect it because you choose to share it in a check-in, after agreeing to this policy, and we only use it in the ways described here.

Voice typing

You can speak instead of typing in a check-in by tapping the microphone. This is optional. Your phone or browser turns your speech into text using its own speech service, for example Google's in Chrome and on Android, or Apple's in Safari on iPhone. That company receives the recording to do this, under its own privacy policy, and may process it outside the UK.

We never receive or keep the recording. We only receive the text that appears in the box, and only if you save the check-in. If you would rather not, type instead.

What the website collects

If you send us a message through the contact form: your name, organisation, email address, phone number (if you give it), what you are interested in and your message.
If you book a session: your name, email address, phone number (if you give it), any notes, and the session you chose.
If you are a member of Mentwell staff: your login details, and the IP address and browser of each login, to keep the admin area secure.
Your IP address, for a short time, to protect the website from misuse (for example, limiting how often a form can be sent).

How we use information, and our legal reasons

What	Why	Legal reason (UK GDPR)
App profile and check-ins	To show you your journal and patterns, and to understand wellbeing across the schools and programmes we work with so we can improve support.	Your consent (Article 6(1)(a)), and for health information your explicit consent (Article 9(2)(a)). If you are under 13, your parent or carer's consent. You can withdraw it at any time by deleting your data in the app.
Summary figures	Overall numbers (for example, how many young people felt anxious this month) to share with schools and organisations we work with. Groups smaller than 5 people are always hidden.	The same consent as above.
Contact form and bookings	To reply to you and to arrange and run the sessions you ask for.	Taking steps you have asked for before a contract, or our contract with you (Article 6(1)(b)), and our legitimate interest in running our services (Article 6(1)(f)).
Keeping children safe (help requests and flagged notes)	To look after a young person who may not be safe, and to contact their school if needed.	Our legitimate interest in keeping children safe (Article 6(1)(f)). For health or other special category information, the UK Data Protection Act 2018 Schedule 1 condition "safeguarding of children and of individuals at risk". [LEGAL CHECK OF SAFEGUARDING BASIS]
Security	To keep the website and app safe and stop misuse.	Our legitimate interest in keeping our services secure (Article 6(1)(f)).

Who can see your check-ins

Anyone who can use your phone or browser can open the app and see your journal. Keep your phone locked if this worries you.
Only authorised Mentwell staff can see the information sent from the app, in a secure admin area. They see check-ins without your name, and small groups are hidden in reports. A help request is different: it has the name and contact you choose to give.
We do not give your individual check-ins to your school, your parents or anyone else, except to keep you safe (see "Keeping you safe"). We may share overall summary figures that cannot identify anyone.
We would only share more if the law requires us to (for example, a court order).
Safeguarding items (see "Keeping you safe") are not hidden when a group is small, because they are about keeping one person safe.

Keeping you safe

Nobody watches the app all the time, so it is not an emergency service and we cannot promise to see or answer anything straight away. The app shows you where to get help when you need it. If you are worried about yourself or someone else, talk to a trusted adult or contact Childline (0800 1111, free, 24 hours) or text SHOUT to 85258. In an emergency, call 999.

Notes you write are checked for words that might mean you are not safe. If one is found, Mentwell's safeguarding team sees that note with your school code, age group, gender and postcode area (not your name) and may contact your school. You can also choose to send a help request to the safeguarding team with a name and a way to reach you. It holds what you choose to share, plus your school code and age group, which the app adds.

Companies that help us

We use a small number of service providers. They only use information to provide their service to us, under contracts that require them to protect it:

OVHcloud: hosts our website, app and database on servers in the United Kingdom, and stores our encrypted backups on servers in Germany.
Cloudflare: protects the website and app from attacks and delivers them quickly. Requests pass through its network, which sees your IP address.

Information outside the UK

Our encrypted backups are stored in Germany. The UK recognises the European Union as giving an adequate level of protection, so no extra steps are needed. Cloudflare may process technical information such as IP addresses outside the UK; where it does, it is covered by the safeguards the law requires, such as the UK International Data Transfer Addendum.

How long we keep information

On your phone: until you delete it in the app, clear your browser data, or uninstall the app.
On our servers: app information is kept for 2 years after your last check-in, then deleted. If you delete your data in the app, it is deleted from our servers straight away, except safeguarding records (see below).
Contact form messages and booking details: kept for 2 years after we last speak to you, then deleted.
Safeguarding records (help requests and flagged notes) are kept until Mentwell deletes them, once they are no longer needed. Deleting your data in the app does not delete a safeguarding record already made.
Backups: deleted information can remain in our encrypted backups for up to 7 days, until those backups are replaced.

How we keep information safe

Everything sent between your phone and us is encrypted (HTTPS).
The app only accepts messages from your phone when they carry its secret key, which we store in a scrambled (hashed) form.
Backups are encrypted. Access to the admin area is limited to authorised staff and protected by a password.
Reports hide any group smaller than 5 people, so nobody can be picked out.

Your rights

You have the right to see the information we hold about you, to have it corrected, to have it deleted, to limit how we use it, to object to how we use it, to get a copy of it, and to withdraw your consent at any time. Withdrawing consent does not affect what we did before.

In the app, you can change your details on the setup screen, delete any check-in from your journal, and delete everything using "Delete all my data" in "About this app" (safeguarding records are the exception: Mentwell deletes those). Because the app does not know who you are, this is the surest way to use your rights: we can only find your app information through your phone. For anything else, email [email protected]. We will reply within one month.

If you are under 13, a parent or carer can help you use these rights.

Children

The app is for young people aged 8 and over. If you are under 13, a parent or carer must say it is OK for you to use the app before you start, and the app asks you to confirm this. We have written the short version at the top of this policy so it is easier to read.

Complaints

If you are unhappy with how we have used your information, please tell us first at [email protected]. You can also complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.

Changes to this policy

This is version 2026-10-07. If we change it in a way that matters, we will update this page and the app will ask you to read and agree to the new version.