Privacy Policy

Last updated: August 20, 2026

Who operates Mindar

Mindar is operated by Novaeve Technology Co., Limited ("we," "our," or "us"). You can contact us at support@medrixai.com.

Registered office: Rm 903D, 9/F, CAMERON COML CTR, 458-468 HENNESSY RD, Causeway Bay, Hong Kong.

Information we collect

Depending on how you use the product, we may collect the following categories of information:

Account information. Name, email address, authentication credentials, workspace membership, and support messages when you create an account or contact us.

User content. Notes, audio recordings, transcripts, uploaded documents, prompts, generated summaries, decisions, tags, and related workspace metadata that you create or upload.

Technical and diagnostic data. Device type, device model, operating system and version, app version, IP-derived region, crash logs, performance diagnostics, and usage events. On mobile devices, if you opt in to crash reporting, we may also collect stack traces, device state (memory, storage), and the timestamp of the event. Crash reporting is off by default and requires your explicit consent.

Cookies and similar technologies. See the Cookies and Analytics section below.

We do not collect biometric data, health data, or precise geolocation unless you explicitly provide it as part of user content.

Legal basis for processing (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Performance of a contract — to provide the service, manage your account, and fulfill your requests.
• Legitimate interests — to maintain security, prevent fraud, improve reliability, and conduct analytics (balanced against your rights and freedoms).
• Consent — for optional analytics cookies, session replay, and detailed mobile crash reporting. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation — to comply with applicable laws, regulations, or legal proceedings.

How we use information

We use information to:

• Provide, maintain, and improve the service
• Generate AI-assisted summaries and answers
• Manage user accounts and synchronize content across devices
• Respond to support requests
• Prevent abuse, fraud, and security incidents
• Meet legal obligations

We do not sell personal information. We do not use workspace content for advertising.

AI processing

Mindar may send prompts, files, notes, transcripts, and related context to trusted AI and infrastructure providers so the product can generate summaries, evidence packs, recommendations, and answers. We limit this processing to what is needed to provide the requested product experience. These providers are bound by contractual obligations to process data only on our instructions and to maintain appropriate security measures.

AI output may be inaccurate or incomplete. Users should review generated content before relying on it for business, research, legal, medical, financial, or other important decisions.

Mobile crash reporting

On mobile applications, we offer optional crash reporting to help diagnose and fix stability issues. When enabled, crash reports may include stack traces, device model, operating system version, app version, available memory and storage, and the time of the crash. Raw audio and user content are never included.

Crash reporting is off by default. You can enable or disable it at any time in Settings > Privacy. If you use a third-party crash analytics SDK, that provider processes crash data under its own privacy policy and our data processing agreement.

Cookies and analytics

On www.mindar.ai and web.mindar.ai, we use Google Analytics 4 to understand page usage only after you allow analytics cookies. Analytics storage is denied by default. Advertising storage, advertising user data, and advertising personalization remain denied even when analytics is allowed.

Analytics data is limited to sanitized page navigation information. We do not intentionally send names, email addresses, phone numbers, prompts, chat messages, knowledge-base text, file contents, or workspace content to Google Analytics. Sensitive query parameters and private route identifiers are removed before a page view is sent.

The analytics preference and Google Analytics cookies use the shared mindar.ai domain so your choice and session can continue between www.mindar.ai and web.mindar.ai. You can change or withdraw your choice at any time through the cookie settings control. Withdrawing consent disables analytics storage and removes known Google Analytics cookies from the browser.

Sharing and service providers

We may share information with vendors who help us host, secure, analyze, support, and operate Mindar. These providers are authorized to process information only for the purposes described in this policy and under appropriate confidentiality and security terms.

We may disclose information if required by law, to protect rights and safety, or as part of a corporate transaction such as a merger, acquisition, or financing.

International data transfers

If you access the service from outside Hong Kong, your information may be transferred to and processed in other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by transfer impact assessments where required. We implement additional technical safeguards including encryption in transit and at rest.

You may request a copy of the SCCs or further information about our transfer safeguards by contacting support@medrixai.com.

Your rights

All users

Regardless of where you are located, you may:

• Access, correct, or delete your account and associated data
• Export your workspace content
• Opt out of optional analytics and crash reporting
• Contact us with privacy questions or concerns

EEA, UK, and Switzerland

If you are located in the EEA, UK, or Switzerland, you additionally have the right to:

• Access — obtain confirmation of processing and a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion under Article 17 GDPR
• Restriction — limit processing in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — at any time, without affecting prior lawful processing
• Lodge a complaint — with your local supervisory authority

To exercise these rights, contact support@medrixai.com. We will respond within one month.

California (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of personal information
• Opt out of the sale or sharing of personal information (we do not sell personal information)
• Non-discrimination for exercising your rights

To submit a request, email support@medrixai.com with "California Privacy Rights" in the subject line.

Hong Kong (PDPO)

If you are located in Hong Kong, you have the right under the Personal Data (Privacy) Ordinance to:

• Request access to your personal data
• Request correction of inaccurate personal data
• Opt out of direct marketing use of your data

To exercise these rights, contact support@medrixai.com.

Retention and deletion

We retain account and workspace content while your account is active or as needed to provide the service. You can request deletion through the account deletion page or by contacting support.

Some records may be retained for a limited period where required for security, fraud prevention, tax, accounting, dispute resolution, or other legal obligations. Crash reports and diagnostic data are automatically deleted after 30 days unless a longer retention is necessary for an active investigation.

Security

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, or alteration. Data is encrypted in transit (TLS) and at rest. No online service can guarantee absolute security.

Children

Mindar is not intended for children under 13, or under 16 in the EEA, UK, or Switzerland. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete the information.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the product or by email. The "Last updated" date at the top indicates when this policy was last revised. Continued use of the service after changes constitutes acceptance of the updated policy.

Contact

For privacy questions, data access requests, correction requests, deletion requests, or complaints, contact support@medrixai.com.

Registered office: Rm 903D, 9/F, CAMERON COML CTR, 458-468 HENNESSY RD, Causeway Bay, Hong Kong.