Data processing and compliance

Parties and subject matter

The business that subscribes to MINGU is the controller of its customers’, patients’, students’, players’ and team’s data. MINGU is the processor:

Contact

hola@mingu.es

The subject matter is providing the MINGU service described in the terms of service. It lasts as long as the service contract and, afterwards, as long as needed to return or erase the data as set out under end of processing.

Nature, purpose and data processed

MINGU hosts, organises, stores, retrieves, displays, sends and erases data for the sole purpose of providing the service to the business. The data and the people concerned depend on the features the business turns on:

People concerned: the business’s customers, patients, students, players and participants; their parents or legal guardians when they are minors; the business’s team; and contact people at insurers.

MINGU’s obligations

As processor, MINGU undertakes to:

• Process data only on the business’s documented instructions: this agreement and the way the business configures and uses the dashboard. If we believe an instruction breaks the law, we will say so.
• Not use the data for its own purposes or disclose it to third parties, except to authorised sub-processors or where the law requires.
• Ensure that everyone authorised to process the data is bound by confidentiality.
• Apply the Article 32 GDPR security measures described on this page.
• Help the business respond to data subjects’ rights, with the dashboard’s tools and directly where needed. If someone asks us to exercise a right over the business’s data, we will pass it on without delay.
• Help the business with security, breach notification, impact assessments and prior consultation with the authority, as far as the information available to us allows.
• Keep a record of the processing activities we carry out as processor.
• Make available to the business the information needed to show compliance with this agreement and allow audits, as set out below.

Sub-processors

The business gives MINGU general authorisation to use the providers on this list. MINGU binds them by contract to data protection obligations equivalent to those in this agreement and remains responsible for their compliance.

If we add or replace a provider, we will notify businesses by email or in the dashboard at least 15 days in advance. The business may object on reasonable grounds within that time; if we cannot find a solution, it may cancel the service without penalty.

Where a provider processes data outside the European Economic Area, the transfer relies on the European Commission’s standard contractual clauses and, where the provider has certified, on the EU-U.S. Data Privacy Framework.

Security measures

• Encrypted connections across the whole service, and backups encrypted before they leave our systems.
• Separation between businesses in the database itself: every query checks which business the person belongs to and what they may see.
• Roles within each business (owner, manager, team) and specific permissions for clinical history.
• Private files (documents, progress photos, attachments) that only open through temporary links for people with permission.
• One-way encrypted passwords and two-step verification available for the dashboard.
• Activity logs to investigate unauthorised access.
• Daily backups, encrypted and verified, replaced within about 30 days.
• MINGU staff access limited to what support and security strictly need, and logged.

We review these measures whenever the service or the risk changes.

Security breaches

If MINGU detects a breach affecting the business’s data, it will tell the business without undue delay and in any case within 48 hours of becoming aware of it, with the information available: what happened, which data and people may be affected, the likely consequences and the measures taken or proposed. As controller, the business notifies the authority and the people affected where required; MINGU will help it do so.

Health data

Health businesses such as physiotherapy or clinical nutrition can keep clinical history and other health data in MINGU. For this data:

• The legal basis and the duty of secrecy belong to the business and its professionals, usually the provision of health care (Art. 9(2)(h) GDPR).
• Only the business’s staff with clinical permission can see it. MINGU AI has no access to it.
• Informed consents are signed in MINGU and stored with the date, the channel and, for a minor, the guardian who signs.
• Email reminders contain only the business, the date, the time and the visit type.
• Video consultations take place on Jitsi Meet in a room with a unique link; MINGU does not record them.
• The business must keep clinical records for as long as the law requires (in Spain, generally at least five years from each discharge; in Catalonia, fifteen years) and export them before closing its account.

MINGU AI

MINGU AI is optional, and the business can turn off its customers’ assistant in the settings. The dashboard assistant receives only operating data (classes, services, timetables, prices and aggregated figures); it does not receive the customer list, clinical records or messages, and names are removed from reports before they reach the model. No suggested action runs without a person’s confirmation.

Minors

If the business has customers under 14, it must obtain their parents’ or legal guardians’ consent before processing their data. MINGU can record the guardian on signed consents, but does not verify the age or identity of whoever signs: that check is the business’s.

The business’s obligations

• Having a legal basis for each processing activity and informing the people concerned through its own privacy notice.
• Giving lawful instructions and configuring its team’s access carefully.
• Obtaining the consents that apply, such as those for minors and marketing.
• Carrying out an impact assessment where required, for example when processing health data on a large scale.
• Responding to data subjects’ rights and overseeing compliance with this agreement.

End of processing

When the service ends, the business can ask MINGU for a copy of its data in a structured, commonly used format and to close the business. After closure, MINGU erases the data from its live systems, and from backups within their replacement period of about 30 days. MINGU will keep, restricted, only the data a law requires it to retain.

If the subscription ends and the business gives no instruction, we keep the data so it can reactivate the account, and may erase it 90 days after the service ends, telling the business beforehand.

Demonstrating compliance and audits

On written request, MINGU will give the business the information needed to show compliance with this agreement. The business may carry out or commission an audit with reasonable notice, at its own cost, at most once a year unless there has been a breach or an authority requires it, and without access to other businesses’ data.

Contact

For any data protection matter, request for information or audit, write to hola@mingu.es.