Privacy Policy

1. Who We Are

Insightable Mind operates the Insightable Mind platform (the "Service"), a free online tool for psychological and wellbeing assessments. We are the entity responsible for handling your personal information under this policy.

If you have any questions about how we handle your information, you can reach us at: legal@insightablemind.com

2. What Information We Collect

We collect the minimum information necessary to provide the Service. We do not ask for more than we need.

2.1 Health Information (Sensitive)

The assessments you complete generate psychological and wellbeing data, including scores, severity ratings, percentile benchmarks, subscale results, interpretive explanations, identified strengths, and diagnostic or risk indicators. Under the Privacy Act 1988 (Cth), this constitutes health information — a category of sensitive information that attracts heightened protection. We handle it accordingly.

If you do not provide an email address, this information is stored against a random session identifier, not your name. If you provide your email address, we link your results to that address so you can return to them in My Profile. We do not ask for your full name to do this.

2.2 Session Data

When you use the Service, we automatically collect:

• A temporary random identifier for your session, and an identifier for the assessment you're completing.
• An optional display name, if you choose to provide one.
• An optional email address, if you choose to provide one.
• Timestamps recording when your session started and ended.
• Your individual responses: question number, answer index, score, and the time each response was recorded.

2.3 Identity Information

You can complete an assessment entirely anonymously. We do not require your name at any point in the main assessment flow. Identity information is only collected when you actively choose to provide it:

• Email address: if you opt in to receive your results by email. We may also use this address to send occasional updates about Insightable Mind and related products, including the Insightable app. You can unsubscribe at any time.
• Email address: when you finish a self-assessment and choose to provide it, that address creates your profile. You can return later by signing in with the same address. There is no separate sign-up form and no password.
• Email address and your first name: if you join our waitlist.

2.4 Approximate Location

When you provide your email address (either to receive results and occasional updates, or to join the waitlist), we may use a geolocation service (ipinfo.io) to derive your approximate city and country from your IP address. We do not store your full IP address. This approximate location is passed to Mailchimp alongside your email address when we add or update you in our audience, so we can keep audience records meaningful and contextual.

2.5 Analytics Data

We collect usage and navigation data to understand how the Service is being used and to improve it over time. This includes information about pages visited, how you move through the assessment, and which parts of your results you view. We do not send your individual question responses or scores to our analytics provider as separate data points. Product analytics events may include pseudonymous identifiers (such as a session or results identifier) and coarse metadata about optional fields — for example, whether you entered optional free-text context and which length band it fell into — but we do not send the wording of that optional text to PostHog as an analytics property. We have enabled session replay, which means our analytics provider may capture a visual recording of what appears on your screen during your visit – including results content if you're viewing it at the time. If you provide your email address to receive or unlock your results, or when you sign in to My Profile, that address may also be shared with our analytics provider so your activity can be connected to a consistent profile. We do not send your question answers, scores, or the wording of your My Profile summary to PostHog as analytics properties. Session replay may still show that summary if it is on your screen. See Section 6 for more detail.

2.6 Optional free-text context

Before your scored results, you may choose to describe, in your own words, what is happening in your life that feels connected to the assessment. This field is optional and may constitute health information depending on what you write. It is stored with your scored result so it can inform an optional, email-unlocked personalized reflection generated as described in Section 12. You may leave the field blank or skip the step entirely.

2.7 Information We Do Not Collect

We do not collect:

• Your full name (during the main assessment flow).
• Date of birth, gender, or other demographic attributes.
• Payment or financial information. The Service is free.
• The exact wording of your optional free-text context inside PostHog analytics event payloads — only coarse metadata as described in Section 2.5.
• A password. My Profile sign-in uses a one-time link sent to your email.

2.8 My Profile

Your profile is created when you finish a self-assessment and provide your email address. There is no separate sign-up form. If you do not provide an email address, your results are not added to a profile.

When you have a profile, we keep:

• The assessments you have completed, the dates, and links back to those results.
• Profile areas based on which assessments you have completed.
• A written summary of your results, shown after one completed self-assessment and saved against your email. How that summary is generated is described in Section 12.
• Progress over time, once you retake an assessment.

3. How We Collect Your Information

We collect information directly from you when you use the Service — by completing an assessment, entering your email address, signing in to My Profile, or signing up to the waitlist. We also collect limited technical data automatically — session identifiers and analytics / usage events as described in Section 2.5 — as part of operating the platform.

We do not collect personal information from third parties or combine your data with externally sourced datasets. If you use the Insightable App and sign in there with the same email address, we connect your website results to that App account. The App is our own product. What it receives is described in Section 6.9.

When you click a recommended next assessment from your results page, we may pre-fill your email on the next assessment for convenience using temporary browser storage that is cleared as soon as you start the new assessment, refresh the page, or click “Not you? Change email”.

4. Why We Collect Your Information

Under Australian Privacy Principle 3, we collect personal information only where it is reasonably necessary for one or more of our functions or activities. Here is specifically why we collect each type:

4.1 Health and Assessment Data

Collected to generate and display your assessment results. This is the core purpose of the Service. Without this data, results cannot be produced. Where you provide your email address, this data is also used to deliver your results, to show your history in My Profile, and to prepare the assessment names, completion dates, and focus areas the Insightable App uses when you sign in there with the same email (see Section 6.9). We do not delete this data when your results email is sent (see Section 5).

4.2 Email Address

Collected, with your consent, for one or more of the following purposes:

• To send you your assessment results.
• To create your profile when you finish a self-assessment, and to sign you in later with a one-time link.
• To connect your website results with the Insightable App when you use the same email address there.
• To send you occasional updates about Insightable Mind and related products, including the Insightable app. You can unsubscribe at any time.
• To notify you of product news or updates, where you have joined the waitlist.

You may withdraw consent and unsubscribe at any time. See Section 8 for your rights.

4.3 Approximate Location

Collected to enrich audience records in Mailchimp (approximate city and country) when you opt in to results by email (including occasional updates) or join the waitlist. Your results email itself is delivered through Resend (see Section 6).

4.4 Analytics Data

Collected to measure traffic, navigation, and product usage so we can improve the Service, diagnose issues, and understand real journeys through the platform — including through session replay, where on-screen content may be recorded. If you provide your email address to receive or unlock results, or you sign in to My Profile, that address may also be shared with our analytics provider. See Section 6 for more detail.

4.5 De-identified Research

We may use de-identified, aggregated assessment data — data that cannot be traced back to any individual — to inform our understanding of mental wellbeing patterns across communities. This is not personal information. No identifiable data is shared with researchers or third parties for this purpose. If this ever changes, we will update this policy and give you a meaningful choice.

4.6 Optional free-text and AI-assisted personalisation

Optional free-text context is collected only when you choose to provide it, to support a clearer, more relevant experience. If you unlock your full results with your email address, we may use that context together with your scored outputs to generate an optional short personalized reflection using a large language model, as described in Section 12. Automated safety checks may run on the text you provide and on generated output. You may skip the optional field entirely.

4.7 My Profile summary

After you complete one self-assessment and provide your email address, we may generate a short written summary of your results for My Profile. We save it against your email and rewrite it only when you complete another assessment. What we send to the model, and the fact that the summary is not shared with the App, are described in Section 12.

5. How Long We Keep Your Information

We keep your personal information only for as long as is necessary. Our approach:

5.1 Session and Assessment Data

Closing your browser tab ends that visit. It does not delete your answers or results.

We keep your responses, scores, and results so you can view them, and so My Profile can show your history and written summary when you have provided your email address. We do not delete them when we send your results email. Your results link keeps working. We keep this information until you ask us to delete it (see Section 8.6).

If you never provide an email address, we still keep the responses and results for that session, stored against a random session identifier rather than your name. They are not added to a profile. A deletion request by email can only find records linked to that email address.

If you have a profile, we also keep the saved written summary against your email until you ask us to delete it, or until a newer summary replaces it because you completed another assessment.

5.2 Email Address

Transactional email (your results): your email address, your results link, and related message details are processed by Resend for as long as needed to send the email and resolve delivery issues, in line with Resend's retention practices. Audience and ongoing communications: your email address (and, where applicable, your first name and approximate location) is retained in Mailchimp for as long as you remain on our audience and subscribed to communications we send through that platform. You may unsubscribe from marketing-style messages using the link in those emails; you may also contact us directly to request deletion or to discuss what we hold.

5.3 Analytics Data

Our analytics providers retain data according to their own settings, including any session replay recordings. Where your email address has been shared with PostHog, that information is retained under PostHog's policies and our arrangements with them. We treat any replay recordings that include health-related or results content with the same care as all other sensitive information described in this policy.

6. Who We Share Your Information With

We do not sell your personal information, and we do not share it with advertisers. The providers listed below are tools we use to run the Service – each chosen carefully, and each receiving only the information they need to do their job.

6.1 Resend (Transactional Email)

Provider: Resend, Inc. Location: United States.

We use Resend to deliver your results email. When you opt in to receive your results, we share your email address, a link to your results page, and the name of the assessment you completed. Resend acts as a data processor on our behalf. We record Resend delivery, open, click, bounce, and complaint events in PostHog to understand whether results emails arrived and were used. Open and click tracking uses Resend's existing tracking pixel and link wrappers; we ingest those events into analytics and do not send the clicker's IP address to PostHog.

We also use Resend to send your one-time My Profile sign-in link. For that email we share your email address and the link. We do not include your assessment results in the sign-in email.

6.2 Mailchimp (Audience / CRM)

Provider: The Rocket Science Group LLC d/b/a Mailchimp. Location: United States.

We use Mailchimp to manage our email audience and to send occasional updates about Insightable Mind and related products. When you opt in to results by email or join the waitlist, we share your email address and the name of the assessment you completed. We may also share your approximate city and country (see Section 6.5), and your first name if you join the waitlist. Your results email itself is sent through Resend, not Mailchimp. Mailchimp acts as a data processor on our behalf under its Data Processing Addendum.

6.3 PostHog (Analytics)

Provider: PostHog, Inc. Location: United States (us.i.posthog.com).

We use PostHog to understand how people move through the Service, diagnose issues, and improve the experience over time.

Usage data: We collect pageview and page-leave events, including the full URL of pages visited – which on results pages may include a unique identifier in the path. We also collect specific product events, such as when certain results screens are shown, when you move through optional context steps, when optional personalisation is requested or fails, or when you submit your email to unlock insights. Some events include pseudonymous identifiers (such as a session or results identifier) and coarse metadata about optional fields — for example, whether optional free-text was present and a broad length band — but we do not attach the wording of that optional text to PostHog events. We do not send your individual question responses or scores to PostHog as separate event payloads.

Session replay: We have enabled PostHog's session replay feature, which captures a visual recording of your session – including content visible on screen at the time. If you are viewing your results or My Profile when a recording is active, that content may appear in the replay, including your written profile summary if it is on screen. We do not send the wording of that summary, your scores, or your answers as separate analytics properties. PostHog applies standard masking for certain field types such as passwords; other on-screen content depends on what the Service renders and our PostHog project settings.

Identity: If you submit your email address to receive or unlock your results, or you sign in to My Profile, we share that address with PostHog so your activity can be associated with a consistent profile.

PostHog initialises only after your first interaction with the page or a short timeout, and does not run on local development environments. In-app surveys are currently disabled.

6.4 Google Analytics (Optional)

Provider: Google LLC. Location: United States.

Where enabled, we use Google Analytics to collect standard anonymized usage data – page visits and session duration. This complements our PostHog data and does not include personal or assessment information.

6.5 ipinfo.io (Geolocation)

Provider: IPinfo, LLC. Location: United States.

When you provide your email address, we use ipinfo.io to derive your approximate city and country from your IP address. We do not store your IP address – only the approximate location, which is passed to Mailchimp as described in Section 6.2.

6.6 New Relic (Infrastructure Monitoring, Optional)

Provider: New Relic, Inc. Location: United States.

Where enabled, we use New Relic to monitor the reliability and performance of the Service. Only server-side operational data is shared – response times, error rates, and similar metrics. No personal information or assessment data is involved.

6.7 Fly.io (Hosting and Database)

Provider: Fly.io, Inc. Location: Australia (Sydney region).

All Service data is processed and stored on Fly.io infrastructure in Sydney. Fly.io acts as a data processor and has no independent access to your data.

6.8 Langfuse and language model inference

Langfuse: Langfuse GmbH (hosted cloud, typically European or United States regions depending on project configuration). We use Langfuse to version prompts, fetch model settings, and record technical traces of optional narrative generation (for example request metadata and model outputs) so we can monitor quality and safety. Traces may include the optional free-text you provided and related assessment outputs needed to generate the reflection. Langfuse acts as a data processor on our behalf.

Language model inference: Narrative text is produced using enterprise-grade large language model infrastructure. At the time of this policy, that includes Anthropic Claude models invoked via Amazon Web Services (AWS) Bedrock. AWS and Anthropic are located in the United States. They receive only what is necessary to fulfil each generation request and act as processors under their respective terms and data protection commitments.

The same providers are used when we generate your My Profile summary (Section 12). For that summary we send the assessment name, completion date, score, severity label, classification label, and a short portion of the interpretation. We do not send your individual question answers or optional free-text for the profile summary. Langfuse traces for the profile summary may include the generated summary text.

6.9 Insightable App

The Insightable iOS app is our product. It has its own privacy policy (Section 15). When you sign in to the App with the same email address you used on this website, the App receives:

• The names of assessments you have completed on Insightable Mind.
• The dates you completed them.
• Focus areas derived from those assessments, which the App uses to suggest meditations.

The App does not receive your individual question answers, raw scores, severity ratings, optional free-text, or your written My Profile summary. Those stay under this policy.

You can ask us to stop this connection by emailing legal@insightablemind.com from the address you use on Insightable Mind. Stopping the connection does not by itself delete your website results or your App account.

7. Overseas Disclosure of Personal Information

Australian Privacy Principle 8 requires us to be transparent when we disclose personal information to overseas recipients. Several of our third-party providers are located in the United States, as described in Section 6.

We take care in selecting overseas providers and take reasonable steps to ensure they are subject to privacy obligations that reflect the standards of the Australian Privacy Principles – through contractual arrangements, their own binding commitments, or applicable law. A list of these providers and their locations is in Section 6.

When you use the Service, your information may be handled by overseas providers as described in this policy. You should be aware that Australian Privacy Law may not apply to the overseas handling of that information, and you may not be able to seek redress under Australian law in relation to such handling. However, we select providers with strong data protection practices and maintain contractual safeguards wherever possible.

8. Your Privacy Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights in relation to your personal information:

8.1 Right of Access (APP 12)

You have the right to request access to the personal information we hold about you. For this website, that can include your email address, your assessment responses and results, and your saved My Profile summary. Some information may also be held by Mailchimp (if you remain on our audience), Resend (for email delivery), PostHog (including your email address if you submitted it or signed in, and session replay recordings), and Langfuse (technical traces of optional narrative generation and of your profile summary, if those features were used). Contact us at the address below and we will help you understand what we hold and which provider may hold related information.

8.2 Right to Correction (APP 13)

If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request that we correct it. We will respond within a reasonable time and correct the information where we agree it requires correction.

8.3 Right to Unsubscribe

You may withdraw consent to receive marketing or results-related communications from us at any time by using the unsubscribe link in any email we send, or by contacting us directly. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

8.4 Right to Complain (APP 1)

If you believe we have handled your personal information in a way that does not comply with the Privacy Act or the Australian Privacy Principles, you have the right to make a complaint. You should first contact us directly so we can attempt to resolve the issue. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

8.5 Anonymity and Pseudonymity (APP 2)

Where lawful and practicable, you have the option to interact with us anonymously or using a pseudonym. You can complete an assessment without providing your name or email address, and view your results. A profile is created only when you finish a self-assessment and provide your email address.

8.6 Deletion, and how this differs from the App

To delete the assessment data and profile we hold for you on this website, email legal@insightablemind.com from the email address you use on Insightable Mind. We will delete:

• The assessment sessions, answers, scores, and results linked to that email.
• The saved My Profile summary.
• The sign-in record for that email.

We will complete this within 90 days. Some information may remain in backup systems for a limited time, and with providers such as PostHog, Resend, Mailchimp, and Langfuse until they process the request.

Deleting your Insightable App account does not delete these website results. If you sign in again with the same email, we link them to the App again. The Insightable app Privacy Policy explains how to delete the App account, in the App or with the form on that page.

Asking us to delete your website data does not cancel an Apple subscription and does not delete your meditation history in the App. If you want both deleted, say so in the same email.

You can also ask us, at the same address, to stop connecting your website results to the App without deleting them.

9. How We Protect Your Information

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access.

All data is stored in Australia on Fly.io infrastructure in Sydney. Access to our systems is protected by secure authentication. We do not store your IP address.

To return to My Profile, you enter your email address and we send you a one-time sign-in link. The link expires after 15 minutes and works only once. We do not store a password. After you open the link, we keep you signed in on that browser with a secure cookie for about 60 days. Each visit renews that period, so regular visits keep you signed in. Signing out clears the cookie.

No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. If you believe your information has been compromised, please contact us straight away.

10. Cookies and Tracking Technologies

We use a temporary random identifier to manage your assessment session while you're using the Service. This is not a long-lived tracking cookie – it exists only for the duration of your visit.

When you sign in to My Profile, we set a secure sign-in cookie that lasts about 60 days and renews when you visit while signed in. It is used to keep you signed in. It is not used to track you across other websites. We also set a simple flag so the site can show that you are signed in. Signing out clears both.

Our analytics providers – PostHog and, where enabled, Google Analytics – may set their own cookies or use similar technologies to track usage over time. If you submit your email address to receive or unlock results, PostHog may link that identifier to your email address. Session replay recordings are stored by PostHog under its own retention practices. You may be able to manage these through your browser settings.

Access to our platform's backend uses a secure session cookie for administrative purposes only. This does not affect your experience as a user of the Service.

11. Children and Young People

The Service does not have an age-gating mechanism. We do not knowingly collect personal information from children in a manner inconsistent with applicable law.

Because the Service collects health information — a sensitive category — parents or guardians who have concerns about a young person's use of the Service are encouraged to contact us. We will work with you to address those concerns appropriately.

12. Personalization and artificial intelligence

Your structured assessment responses are scored using validated, human-designed instruments and deterministic rules in our systems — not by generative artificial intelligence. Interpretive text shown in your results (such as severity descriptions drawn from the instrument) follows those same non-generative rules unless clearly labelled otherwise on screen.

Separately, if you choose to enter optional free-text context (see Section 2.6) and you unlock your full results with your email address, the Service may offer an optional short personalized reflection generated using a large language model. That step sends your optional text, relevant scored outputs, and safety instructions to authorised model infrastructure so a response can be returned and displayed to you. Automated checks are applied to reduce harmful content, but no automated system is perfect and generated text is informational only — not clinical advice.

We use Langfuse to manage prompts and record technical traces of generation (Section 6.8). Product analytics about whether optional personalisation was shown, requested, or failed may be sent to PostHog as described in Sections 2.5 and 6.3, without sending the wording of your optional free text as an analytics property.

You can avoid the optional reflection by skipping the optional free-text step, or by not requesting a generated reflection on your results, according to what the interface offers at the time.

My Profile summary

This is separate from the optional reflection above.

After you complete one self-assessment and provide your email address, My Profile may show a short written summary of your results. We generate it with a large language model. To write it, we send the assessment name, the date you completed it, your score, the severity and classification labels, and a short portion of the interpretation text. We do not send your individual question answers, and we do not send any optional free-text you typed on the results page.

We save the summary against your email. We rewrite it when you complete another assessment. Opening your profile does not rewrite it. The summary is for you to read on the website. It is not shared with the Insightable App.

We use Langfuse to manage the prompt and record a technical trace of this generation, including the summary text (Section 6.8). The model runs on Amazon Web Services Bedrock using Anthropic Claude, as described in that section. The summary is informational only and is not clinical advice.

You can avoid a profile summary by not providing your email address. If you already have one, you can ask us to delete it (Section 8.6).

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and describe the change in this section. The policy published on this page is the current version.

In our March 2026 update, we enabled PostHog session replay and updated Sections 2.5, 6.3, and 10 to reflect this. Our previous clarifications about Resend, Mailchimp, and PostHog identity also remain in effect.

In our April 2026 update, we corrected Section 12 and related disclosures to describe optional AI-assisted personalisation, added Section 6.8 (Langfuse and language model inference), expanded Sections 2.5–2.7, 4.6, 6.3, and 8.1, and clarified PostHog product analytics for optional context and narrative flows. The effective date at the top of this policy was updated accordingly.

In our September 2026 update, we clarified that when you provide your email address to receive results, we may also send occasional updates about Insightable Mind and related products, including the Insightable app. You can unsubscribe at any time. We updated Sections 2.3, 2.4, 4.2, 4.3, and 6.2 to reflect this. We also added that we record Resend delivery, open, click, bounce, and complaint events in PostHog (Section 6.1). The effective date at the top of this policy was updated accordingly.

In our October 2026 update, we described My Profile. Results are kept after your results email is sent. Your profile is created when you finish a self-assessment and provide your email, and you sign in with a one-time email link. We described the written profile summary, what is shared with the Insightable App, and how to ask for deletion. We updated Sections 2, 3, 4, 5, 6, 8, 9, 10, 12, and 15. We also updated this section to record future changes on this page. The effective date at the top of this policy was updated accordingly.

Your continued use of the Service after any update constitutes acknowledgement of the revised policy. We encourage you to review this policy periodically.

14. Contact Us and How to Make a Complaint

We take privacy seriously and welcome any questions, concerns, or feedback about how we handle your personal information. Please reach out — we will respond thoughtfully and promptly.

Privacy enquiries and complaints:
Insightable Mind
Email: legal@insightablemind.com

If you make a complaint, we will acknowledge it within a reasonable time and aim to resolve it within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):

Office of the Australian Information Commissioner
Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

15. Insightable iOS app

Insightable is our iOS meditation app. It uses self-assessment results from Insightable Mind to recommend meditations matched to your focus areas. The App has its own privacy policy covering account data, Apple In-App Purchases, and third-party services.

Read the Insightable app Privacy Policy, the Insightable app Terms of Use, or visit our app support page.

When you use the App with the same email address, it receives the assessment names, completion dates, and focus areas described in Section 6.9. Deleting your App account does not delete your website results. How to delete website data is in Section 8.6.