Privacy Policy
Last updated: April 23, 2025
Owner and Data Controller
Cambridge Mind Technologies Ltd
75 Kinnerton Street
London
SW1X 8ED
United Kingdom
Company Number: 11691319
Owner contact email:info@cambridgemindtechnologies.com
Types of Data Collected
Cambridge Mind Technologies collects the following personal data from users of our Cami chatbot service:
User identifiers (usernames, unique IDs)
Chat conversations and user inputs
Timestamps of conversations
Age group (for appropriate content delivery)
Special categories of data: Mental health information that may be shared during conversations with the chatbot
Mode and Place of Processing the Data
Methods of Processing
Cambridge Mind Technologies takes appropriate security measures to prevent unauthorised access, disclosure, modification, or unauthorised destruction of the Data. The Data processing is carried out using computers and/or IT enabled tools, following organisational procedures and modes strictly related to the purposes indicated.
In addition to Cambridge Mind Technologies, in some cases, the Data may be accessible to certain types of persons involved with the operation of this Application (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies) appointed, if necessary, as Data Processors.
Place
The Data is processed at Cambridge Mind Technologies' operating offices and in any other places where the parties involved in the processing are located.
Depending on the User's location, data transfers may involve transferring the User's Data to a country other than their own. Users can find out more about the place of processing of such transferred Data in the section containing details about the processing of Personal Data.
Cambridge Mind Technologies transfers data to the following countries outside the UK:
United States (Pinecone, Langsmith, OpenAI, OpenRouter, Twilio SendGrid)
Germany (PostHog)
All international transfers are conducted with appropriate safeguards in accordance with UK data protection regulations.
Retention Time
Personal Data shall be processed and stored for as long as required by the purpose for which it has been collected.
The Purposes of Processing
The Data concerning the User is collected to allow Cambridge Mind Technologies to:
Provide psychological first aid and mental health support through the Cami chatbot
Enable safeguarding alerts to appropriate school staff when warranted
Improve the chatbot's responses through analysis of anonymized data
Comply with legal obligations
Protect rights and interests of users or third parties
Detect and prevent malicious or fraudulent activity
Sub-processors and Technical Infrastructure
Cambridge Mind Technologies uses the following sub-processors to deliver the Cami service:
Google Cloud Platform (UK)
Purpose: Hosting of application and secure storage of data
Location: United Kingdom
Microsoft Corporation (UK)
Purpose: Anonymisation software
Location: United Kingdom
Pinecone (US)
Purpose: Storage and retrieval of chat data to enable contextual conversations
Location: United States (US-East-1 region)
Security measures: End-to-end encryption, access controls, regular security audits
Langsmith (US)
Purpose: Observability tool for monitoring and improving chat interactions
Location: United States
Data handling: Receives only anonymised conversation data
OpenAI (US)
Purpose: Provides embedding model to convert text into vector representations
Location: United States
Data handling: Processes text for vector conversion but does not store conversation data
OpenRouter (US)
Purpose: Access to Llama language models for generating chatbot responses
Location: United States
Security measures: Encrypted data transmission, no persistent storage of conversation data
Supabase (UK)
Purpose: Authentication services and database management
Location: United Kingdom (EU-West-2, London)
Security measures: Encrypted data storage, role-based access controls
Twilio SendGrid (US)
Purpose: Sending alert and digest emails to designated school staff
Location: United States (Eastern US)
Data handling: Access to email addresses of school staff and alert content only
PostHog (Germany)
Purpose: Analytics services for monitoring system performance and usage patterns
Location: Germany (Frankfurt)
Data handling: Receives anonymised usage data only
Security Measures
Cambridge Mind Technologies implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
End-to-end encryption for data transmission
Access controls and role-based permissions
Regular security audits
Encrypted data storage
Secure authentication mechanisms
Data minimization practices
Staff training on data protection
The Rights of Users Based on the General Data Protection Regulation (GDPR)
Users may exercise certain rights regarding their Data processed by Cambridge Mind Technologies.
In particular, Users have the right to do the following, to the extent permitted by law:
Withdraw their consent at any time: Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
Object to processing of their Data: Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent.
Access their Data: Users have the right to learn if Data is being processed by Cambridge Mind Technologies, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Data undergoing processing.
Verify and seek rectification: Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
Restrict the processing of their Data: Users have the right to restrict the processing of their Data. In this case, Cambridge Mind Technologies will not process their Data for any purpose other than storing it.
Have their Personal Data deleted or otherwise removed: Users have the right to obtain the erasure of their Data from Cambridge Mind Technologies.
Receive their Data and have it transferred to another controller: Users have the right to receive their Data in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to another controller without any hindrance.
Lodge a complaint: Users have the right to bring a claim before their competent data protection authority.
How to Exercise These Rights
Any requests to exercise User rights can be directed to Cambridge Mind Technologies through the contact details provided in this document. Such requests are free of charge and will be answered as early as possible and always within one month.
Safeguarding and Risk Assessment
Cambridge Mind Technologies employs an automated risk assessment system to identify potential mental health concerns in conversations. This system categorizes conversations into:
Low Risk (Green): General concerns where the chatbot provides empathetic support and coping strategies.
Medium Risk (Amber): Emerging mental health concerns that trigger alerts to designated school staff.
High Risk (Red): Safeguarding issues (e.g., self-harm, abuse, suicidal ideation) that trigger immediate escalation to designated safeguarding leads.
In cases of medium and high risk, the system will generate appropriate alerts to designated school staff while maintaining user privacy to the extent possible while fulfilling safeguarding obligations.
Changes to This Privacy Policy
Cambridge Mind Technologies reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within the Application and/or - as far as technically and legally feasible - sending a notice to Users via any contact information available to Cambridge Mind Technologies.
It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.
Contact Us
If you have any questions about this Privacy Policy, please contact us using the details below.