Last updated: 21 October 2026 (version 2)
This page explains what The Mental Gym does with information about you, in plain language. It describes what the platform does.
1. Who is responsible
Cogninova (Chamber of Commerce / KvK 42071261, VAT ID NL869575673B01), trading as The Mental Gym - by Cogninova is the controller of your personal data. Contact: info@cogninova.nl.
2. This includes information about your mental health
Read this section even if you skip the rest.
To coach you we hold things like your intake answers, the notes your coach makes, the homework you submit, and what you post in the community. Under the GDPR this is special category data (Article 9), the most sensitive kind, with the strictest rules. We treat it that way, and we hold it on the basis of your explicit consent.
3. What we hold
| What | Examples |
|---|---|
| Account | Name, email, phone, postal address, date of birth, password (stored hashed, so we never see it) |
| Subscription | Which package you are on, what you paid, invoices and receipts, and any pause you booked |
| Learning | Which lessons you completed and when, quiz answers and scores, what you write in worksheets and practice logs, and the time you chose for a daily practice reminder. The coach working with you can read your worksheets and practice logs |
| Homework | What you submit, including files, and your coach's review |
| Coaching | When sessions were booked and held, whether you attended, and your coach's notes |
| Voice notes | Short recordings your coach makes for you about a session or your homework, up to two minutes each, and whether you have listened |
| Your toolkit | The lesson parts and worksheet answers you saved, the cards you wrote yourself, and whether your coach may see them |
| Live sessions | Which sessions you signed up for and attended |
| Community | Your posts, comments, reactions, group memberships, and any reports you file |
| Free extras | What you requested, receipts you upload, and what was reimbursed |
| Points | A record of every point awarded and why |
| Which notifications we sent you and your preferences | |
| Notifications on your phone | Only if you switch them on: the push address of each device you switched them on for. Switching them off removes it at once. Signing out on that device stops them, and the address is deleted the next time we would have sent one |
| Agreements | Which version of these documents you accepted, when, and the IP address and browser you accepted them from |
| Email list | Only if you signed up for it: your email address, first name and language, when and on which page you signed up, the exact wording you agreed to, and the IP address and browser you used. If you joined through somebody's share link, whose link it was |
| Questions you send us | What you asked on our question page, your first name and email if you gave them, and the IP address and browser it came from |
| Giveaways | Your entries, which share link brought you or whom yours brought, and whether you won |
| Technical | Server logs, including your IP address |
4. Why we hold it, and on what basis
| Why | Basis |
|---|---|
| To give you the service you signed up for | Performance of our contract with you |
| To coach you: intake, notes, homework, community | Your explicit consent (special category data) |
| To take payment and keep accounts | Contract, and our legal obligation to keep records |
| To email you about your account and bookings | Contract |
| To keep the community safe: moderation and reports | Our legitimate interest in protecting members |
| To keep the platform secure and working | Our legitimate interest |
| To email you articles, news and giveaways | Your consent, which you can withdraw at any time with the unsubscribe link in every one of those emails |
| To run a giveaway you entered and contact the winner | Your consent, given when you entered |
| To read and answer questions you send us | Our legitimate interest in answering the people who write to us |
| To stop our public forms being abused (the IP address) | Our legitimate interest |
| To count visits to our public pages (Google Analytics) | Your consent, given in the cookie banner |
| To measure whether our adverts work (Meta) | Your consent, given separately in the cookie banner |
We do not sell your data, and we do not profile you for marketing. We only send you marketing email if you signed up for it. You are on the list as soon as you tick the box, the first email arrives straight away, and every one of those emails has a one-click unsubscribe link that needs no account and no password.
5. Who else sees it
Inside Cogninova: your coach and our staff, to do their jobs. There is one deliberate exception. The notes a coach writes about a session are withheld from you and from anyone else who is not staff, and the database enforces that, not a setting.
Your toolkit is private. Your coach can see it only if you switch that on in the toolkit, and you can switch it off again at any time.
Other members see very little. When you appear in the community or on the leaderboard, they see your first name, your score and your rank. Your email address, phone number and postal address are held in tables that the community pages cannot read. You can hide yourself from the leaderboard, or from the community entirely, in your profile.
Outside Cogninova, these companies process data on our behalf:
| Company | What for | What they get |
|---|---|---|
| Supabase | Database, sign-in, and file storage | Everything in your account: profile, progress, homework, coaching records, community activity, receipts |
| Stripe | Payments, subscriptions and refunds | Your email, what you bought and what you paid. Card details go to Stripe directly and never reach us |
| Resend | Sending email | Your name, your email address, and the content of the message |
| Calendly | Booking an introduction call | Whatever you type into the booking form, only if you choose to load and use it |
| YouTube (youtube-nocookie.com) | The videos on our home page, in lessons and on the blog | Nothing until you press play. Then your IP address, and no cookies unless you play something |
| Google Analytics | Counting visits to our public pages, never inside your account | Your IP address and which public pages you viewed, and only if you agree to it |
| Meta Platforms Ireland (Facebook, Instagram) | Measuring whether our adverts on Facebook and Instagram bring people to our public pages, never inside your account, and never on our crisis page | Your IP address, your browser, which public pages you viewed, and, if you buy the Community package, the amount paid. Meta can link this to your Facebook or Instagram account. Only if you agree to it, separately from Google Analytics |
| Hostinger | Running the website itself | Standard server logs, including your IP address |
| Your browser’s push service (Google, Apple or Mozilla) | Delivering notifications to your phone, only if you switch them on | Your device’s push address and an encrypted message holding only the subject line, such as “Your coach looked at your homework” |
6. Where it is kept
Your data is stored in the European Union, in Frankfurt, Germany. Some of the companies above are based outside the EU. Where that means data leaves the EU, the transfer is covered by the European Commission's standard contractual clauses.
7. How we protect it
- Every table enforces in the database itself who may read each row, not only in the app. A page cannot show you somebody else's record, even if it tries to.
- Homework files, receipts, community media and voice notes are kept in private storage. The app streams them and checks who you are on every request. We do not use shareable links, because a link, once created, keeps working for anyone who has it.
- Card numbers never reach us. Payment happens on Stripe's own page.
- Supabase Auth stores passwords hashed. Nobody here can read yours.
- Coach notes are withheld at the column level, so even our own admin screens cannot fetch them by accident.
8. How long we keep it
- Community posts: fourteen days, then they are deleted, not hidden.
- Voice notes from your coach: ninety days, then they are deleted. They cannot be played after that day, even before the deletion runs.
- Account and coaching records: for as long as you have an account, and afterwards where we have to keep them.
- Invoices and payment records: seven years, as Dutch tax law requires.
- Email we sent you: kept so we can show you what was sent.
- The email list: until you unsubscribe. We keep the record that you agreed and that you withdrew, so we can show we had your permission.
- Questions you send us: until you ask us to delete them.
- Giveaway entries: with the record of that giveaway.
9. Your rights
You can ask us to:
- show you what we hold about you
- correct anything that is wrong
- delete it, though some records we must keep, such as invoices
- give you a copy you can take elsewhere
- stop a particular use, or withdraw consent where consent is the basis
Write to info@cogninova.nl. We will answer within one month.
If you are not happy with how we handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
10. Cookies
We use two optional tools, on our public pages only: the home page, pricing, the team, the blog and these legal pages. Neither runs on any page inside your account. That is deliberate, because what you read once you are signed in says something about your health, and that does not go to Google or Meta.
- Google Analytics counts which public pages people visit.
- The Meta pixel tells us whether our adverts on Facebook and Instagram bring people here and, if you buy the Community package, that a purchase happened and for how much. It never says what you bought. Meta can link the visit to your Facebook or Instagram account. It never runs on our crisis page, Help now, even if you said yes.
You answer each one separately, and nothing from either is requested until you agree to it: not the tag, not a placeholder, nothing. If you say no, the site behaves the same. You can change your answers at any time from "Cookie choices" in the footer, and saying no later is as easy as saying yes was.
| Where from | What | What it does | Consent needed? |
|---|---|---|---|
| Sign-in (Supabase) | A session cookie | Keeps you logged in. Without it you would sign in again on every page. | Not needed: strictly necessary |
| View as client | dms_preview_tier | Only set for our own staff, to preview what a client sees. | Not needed: strictly necessary |
| Your language | dms_locale | Remembers whether you chose English or Dutch, so the buttons and menus stay in the language you picked. | Not needed: you set it by choosing |
| Stripe | Cookies on Stripe’s own checkout page | Fraud prevention during payment. Set by Stripe on their domain, not ours. | Handled by Stripe during checkout |
| YouTube | No cookie unless you press play | Video is embedded through youtube-nocookie.com, and the player only loads when you press play. Until then nothing is requested from YouTube at all, no IP address and no cookie. | Only if you play the video |
| Calendly | Calendly’s own cookies | The booking calendar. It does not load at all unless you click to load it. | Yes: which is why it is click-to-load |
| Google Analytics | _ga and ga* cookies | Counts visits to our public pages so we know which ones are useful. Only on the public site, never on any page inside your account. | Yes: nothing from Google loads until you agree |
| Meta (Facebook, Instagram) | _fbp | Lets Meta tell us whether an advert on Facebook or Instagram brought you here. Only on the public site, never inside your account, and never on our crisis page. Three months. | Yes: a separate yes from Google Analytics, and nothing from Meta loads until you give it |
| Your cookie choice | dms_consent | Remembers whether you said yes or no, so we stop asking. Six months. | Not needed: it is the record of your answer |
The booking calendar sets Calendly's own cookies, and it does not load until you click to load it.
The video players on our home page, in lessons and on the blog are embedded through youtube-nocookie.com, and each one loads only when you press play. Until then nothing is requested from YouTube: it does not see your IP address and it sets no cookie. Once you press play it sees the request and may set cookies of its own from then on.
11. Children
The Mental Gym is for adults. We do not knowingly hold data about anyone under 18. If you believe we do, tell us and we will delete it.
12. Changes
When this page changes we publish a new version here and ask you to read it the next time you sign in.