Live capture: Spring wood sky island
You decide about your personal data
Physiological data is highly personal. From the design of the system onward, our first question has been who can see what.
Six commitments on data handling
Consent before any recording
When you first use the service, you sign each consent form individually, and data is uploaded only after you consent.
You decide what is displayed
Showing your real name or avatar on the big screen is off by default and only you can turn it on. If you turn it off, the change takes effect immediately.
Organizations see group summaries
Impact reports show anonymized group summaries only.
Your records belong to you
Personal records belong to the participant alone. Organizations see group summaries only.
You can leave at any time
You can delete your account in the app or on the web. Before deletion, we list clearly what will be deleted and what will be kept.
Data used only for the service
Personal data is used only to provide the Mandala Hub service, and physiological data only for reports and statistical analysis.
Who can see what
| Who | What they can see |
|---|---|
| The participant | All of their own reports and trends |
| Others in the same session | Your code name on the big screen, or the name and avatar you have agreed to display |
| Organization administrators | Anonymized group summaries (one person, one vote), participant counts, data coverage and operational statistics; groups of fewer than 3 people are not shown (Report templates) |
| EAP or mental health partners | The organization's group reports; personal reports the participant has agreed to share (Working with EAP partners) |
| Advanced analysis and research exports | Statistics under pseudonymous IDs, exported by staff with specific permissions, with a log kept of every export |
The physiological figures of the "lead participant" shown live on the big screen at the venue are relayed for live display only.
Pseudonymous IDs
Statistics uploaded to the cloud use a pseudonymous ID as the analysis ID (pseudonymization). The ID is generated with HMAC-SHA256 from the account identifier and a secret key held on the server. The same person always gets the same ID, so changes over time can be calculated, but your organization and other third parties cannot work back from the ID to a person. When you withdraw consent or delete your account, the system can find and delete the corresponding statistics.
Under Taiwan's Personal Data Protection Act, pseudonymized data are still personal data, and we protect them under the same rules.
What data we collect
| Account data | Sign-in identifiers from Google or Apple, email address, display name |
| Basic profile | Month and year of birth, and sex: used only for comparison with reference norms |
| Physiological data | Heartbeat intervals, heart rate, HRV metrics; EEG metrics |
| Participation records | Sessions, times, trophies |
| Optional data | Health Connect records; report content sent when you ask AI to explain a report |
| Website forms | The name, organization, contact details and message you enter in the booking and partnership forms, plus the IP address and browser information at the time of sending: used to reply to you and to prevent abuse |
Rights you can exercise in the app
- View your own data and decide whether to share reports
- Withdraw consent
- Turn off display of your real name and avatar, effective immediately
- Leave an organization
- Delete your account (with two confirmation steps)
- When not signed in, clear the records on this phone
Policy and compliance
- Personal data
- Under Taiwan's Personal Data Protection Act, recorded only with consent
- Data location
- Taiwan, with backups in several locations
- Retention
- Personal data are kept until you delete your account. Organization statistics are kept under pseudonymous IDs; after someone leaves, their past records stay in the historical statistics, and the organization cannot identify them
- Personnel use
- Not used for performance reviews; can be written into the contract
- Anonymity threshold
- Groups of fewer than 3 people are not shown
- Your rights
- Access, withdraw consent, delete your account
- Medical devices
- Not a medical device; no diagnosis or treatment
- Security
- Encryption, access control, audit logs (Procurement and security)
- Public procurement
- Documents for government procurement on request (Fire, police and armed forces)
How we meet the Personal Data Protection Act
| Notice (Art. 8) | Each consent form is shown at first use |
| Collection and use (Arts. 19, 20) | Recorded only with consent, used only to provide the service |
| Your rights (Arts. 3, 10, 11) | Access, withdraw consent, delete your account |
| Security (Art. 27) | Encryption in transit, access control, audit logs, pseudonymous IDs |
If your public agency, hospital or school has specific security requirements, we are glad to discuss them.