Privacy and Data Processing Policy

1. Data controller

The controller of your data is SanaMente IA, located in Medellín, Colombia. For anything about your data, write to privacidad@dm-ia.com.

We process your data in accordance with Colombia's Law 1581 of 2012 and its regulatory decree, Decree 1377 of 2013 (now compiled in Single Regulatory Decree 1074 of 2015).

This policy explains what data the SanaMente app collects, what it is used for, who it is shared with, where it is stored and how long it is kept.

2. Data we collect

👤 Account data

💚 Wellbeing data (sensitive data)

Data about your emotional state is sensitive data. Providing it is voluntary: you can use the app without writing in the journal or talking to the companion.

📱 Technical and purchase data

We keep monthly usage counters (how many messages and reflections you used) to apply your plan limits, and the subscription data Apple sends us. Our server technically logs the IP address of each connection. We do not collect location or contacts, and we do not access other apps.

3. What we use your data for

• To provide the service: talk with you, remember the context you share and show you your history.
• Safety: detect risk expressions so we can show you support routes. We use fixed rules and, in the chat, an automated review with artificial intelligence that can only add notices, never remove them. Neither diagnoses or assesses your health, and we do not store the text that triggered them.
• Account and payments: sign in, recover your password and validate your subscription.

We never use your data for advertising, we do not sell it and we do not build commercial profiles.

4. Artificial intelligence

SanaMente uses third party artificial intelligence models. SanaMente's AI is not a mental health professional: it does not diagnose, prescribe or replace therapy.

• Anthropic (Claude) is the artificial intelligence provider. It generates chat replies, suggested replies, the «Regularme» guided reflection and conversation summaries. The journal prompt comes from a fixed bank of questions and does not use artificial intelligence. If the provider is unavailable because of a technical failure, or declines to answer for safety reasons, we do not use any other provider: the app shows you a fixed message so you can try again or, depending on the case, the support routes.

What we send them: for each chat message we send your name, a summary of your recent mood, recent journal excerpts, summaries of previous conversations and the history of the current conversation, so the companion can reply with context. For the guided reflection we send only the thought you wrote. Everything travels encrypted (HTTPS).

Training: Anthropic states that, by default, it does not use inputs or outputs from its commercial API to train its models (Anthropic Privacy Center). Anthropic may keep data for a limited period under its own policies.

Authorization: before your first message in the chat and before your first guided reflection in «Regularme», the app shows you a screen that explains what data we send, to which providers and where your conversations are stored. To continue you must check the box «I authorize my messages to be processed by these providers, outside Colombia» and tap «Accept and continue». The authorization is requested only once and covers both features; it is not requested at sign up. If you choose «Not now», you will not be able to use the chat or the guided reflection and we do not send your data to the providers. The rest of the app works the same.

5. Who we share data with

We will only disclose data to anyone else if a competent authority requires it by law, or if there is an imminent risk to someone's life.

6. Transfers outside Colombia

Your data leaves Colombia. It is stored on a server located in the United States, and the providers in section 5 process it in the United States or other countries depending on their infrastructure. By authorizing the use of artificial intelligence in the app, you authorize this international transfer.

7. Where data is stored and how it is protected

• All communication between the app and the server is encrypted (HTTPS).
• Passwords are stored with an irreversible hash (bcrypt) and the Safety Plan backup is stored encrypted.
• What you write or upload is stored encrypted at rest in our database: chat messages, the titles and summaries of your conversations, journal entries and their photos, and mood check-in notes. The encryption key is stored separately from the database.
• What you pick from a list in the mood check-in (level, emotion, intensity and need) is stored without additional encryption, because the support rules and your progress work with it.
• Server access is restricted to the person responsible.
• We make daily backups of the database and the journal photos, and keep those from the last 7 days. In backups, what you write or upload is also encrypted, and the key is not stored in them.

8. How long we keep your data

• Conversations with the companion: deleted automatically after 12 months without using the app. While you use it, they are kept.
• Everything else: kept while your account exists. If you delete a journal entry in the app, it is no longer shown and is permanently deleted when you delete your account.
• When you delete your account (Profile, Delete my account, or at sanamenteia.com/eliminar-cuenta): your account, conversations, journal with its photos, mood check-ins, exercises, Safety Plan, usage counters and subscription data are deleted immediately. Backups that still contain them expire on their own within 7 days at most. We only keep a record without content that the account was deleted (an irreversible code of the email and the date).

9. Your rights

You can access, update and correct your data; request proof of your authorization; revoke it; ask us to delete your data; and know how we use it. If you are in Colombia, you can also file a complaint with the Superintendencia de Industria y Comercio after first making your request to us.

To exercise your rights, write to privacidad@dm-ia.com. We answer inquiries within 10 business days and claims within 15 business days.

10. Minors

SanaMente is intended exclusively for people 18 years of age or older. We do not knowingly collect data from minors. If we learn that someone under 18 created an account, we will delete the account and its data.

11. Changes to this policy

If we change anything important we will let you know in the app. The date of the last update appears at the top.