Privacy Notice for 7Mind's Online Services

Valid from September 2026

Your data, your choice.

Data protection is very important to 7Mind GmbH (“7Mind”). We place great importance to handling your personal data responsibly and transparently. It is important to us that you always know when we store which data and what we use it for.

In this Privacy Notice, we explain which personal data we process, why we do so and which rights you have. To keep this Privacy Notice clear and easy to understand, we have summarised further information on individual providers mentioned below – including their role and possible transfers of data to third countries – in a table at the end of this Privacy Notice.

You can access the latest version at any time in our 7Mind app (“App” includes: 7Mind mobile app – iOS/Android) and on our 7Mind website (“Website”). This Privacy Notice will be updated where necessary.

I. Controller and data protection officer

The controller responsible for the processing of personal data described in this Privacy Notice is:

7Mind GmbH
Ritterstraße 12
10969 Berlin
Germany

Email: [email protected]

You can contact our data protection officer at: [email protected]

When carrying out the processing activities described below, we are partly supported by companies within our corporate group (“7NXT Group”), where this is necessary for internal administrative purposes, data analysis, financial administration or joint marketing activities. These companies include, in particular, 7NXT and Gymondo.

For this purpose, we have concluded an intercompany agreement covering any data transfers within our group. Further information on these 7NXT companies can be found in the provider list in the appendix.

II. Registration and login

If you create a user account via the App or Website, we collect personal data, namely your email address, username, password, gender and date of birth and, optionally, your first and last name. We also assign a user ID in order to technically manage your account and document account-related processes. We process this data to set up your user account and to verify your identity in connection with support requests.

You can also optionally log in via Amazon, Google, Apple or Facebook. In this case, we receive the data required for login and allocation of your user account, in particular name, email address and authentication information, and, where applicable, your profile picture if you release it as part of the relevant login process. We process this data to authenticate you and provide you with access to your user account. Use of these login methods is voluntary.

Where we offer login to, or use of, our services via cooperation partners, personal data may be processed depending on the cooperation and technical setup. This may include, in particular, authentication data, pseudonymous identifiers, name, contact details, contract or entitlement status or, for certain prevention program partnerships, your health insurance number and, where applicable, further information required for the relevant cooperation. We process this data to verify your entitlement to use our service, provide you with access and implement the cooperation. Where the relevant cooperation partner processes personal data under its own responsibility, its privacy notice also applies. You can find further information there about which data the cooperation partner processes and for which purposes.

The legal basis for registration and login is the performance of a contract with you regarding use of the account pursuant to Art. 6(1)(b) GDPR. Where processing is based on your consent, it is carried out on the basis of Art. 6(1)(a) GDPR. Legally required documentation is carried out on the basis of Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. The data is stored for as long as your user account exists and is deleted after the account is deleted, unless statutory retention obligations prevent deletion.

III. Contract processing and payment

If you use paid services or subscriptions, we process the personal data required to establish, perform, manage and bill the contract, in particular username, email address, IP address, user ID, registration data, contract and order data, and billing and payment data.

For order and payment processing, we use external service providers, primarily Chargebee and, in certain cases depending on your chosen payment method, also PayPal or Adyen. If you have an older subscription with us, your data will be processed by FastSpring. In all cases, we only transmit the data required for processing.

The processing is carried out to perform the contract with you on the basis of Art. 6(1)(b) GDPR. Where we process data to comply with statutory retention and documentation obligations, this is carried out on the basis of Art. 6(1)(c) GDPR.

If a contract is concluded in the context of a cooperation, we may also disclose certain personal data to the relevant cooperation partner or intermediary of the cooperation, for example to verify your membership or contractual status with the cooperation partner or for billing purposes in connection with the cooperation. Depending on the cooperation, the legal basis is Art. 6(1)(a) or (b) GDPR.

IV. Use of basic membership functions

After registration, we process personal data required to provide you with the basic functions of our App and platform. This includes, in particular, data on the courses, exercises and content you use, search and filter settings, favourites and downloads, reminder, language and display settings, as well as information on your usage history and progress, such as completed sessions, usage duration, streaks and accessed content.

This processing is carried out to provide the services contractually agreed with you. The legal basis is Art. 6(1)(b) GDPR. Any further evaluation or processing, in particular in connection with health data or individualised recommendations, is carried out only where there is a separate legal basis, in particular consent given by you, as described in the following sections.

V. Customer service

If you contact us, for example by chat, email, post or contact form, we process the contact details you provide and the content of your enquiries in order to handle your request.

To enable you to contact us and to process your enquiries efficiently, we use Zendesk as a customer relationship management (“CRM”) and support service. To support our customer service, particularly first-level support, we also use automations and AI-supported functions, for example via n8n, Langdock, or functions integrated directly into Zendesk. These help us structure, forward, prepare or answer enquiries more quickly. They are used only to handle your request and improve our customer service.

If you have given your consent in the contact form (Art. 6(1)(a) GDPR), you will subsequently receive a review request with a link to a review page on Trustpilot. For verification purposes, we transmit your name, email address and a reference number to Trustpilot to ensure that you have used our services. To submit a review, you need to open a customer account with Trustpilot. To preserve the neutrality and objectivity of reviews, we have no direct influence on the reviews and cannot delete them ourselves. We therefore ask you to contact Trustpilot directly in this regard.

We also use Dovetail to evaluate user feedback. Dovetail helps us systematically analyse feedback and continuously improve our customer service. Only anonymised and aggregated data is processed for statistical evaluations and trend identification.

For individual contact forms provided on our Website, in particular for enquiries from prospects, business customers and partners, we use external technical service providers, particularly Mailchimp. In this context, we process the contact details you enter and the content of your enquiry to handle your request.

Unless stated otherwise, the legal basis for the processing activities mentioned above is our pre-contractual or contractual obligations pursuant to Art. 6(1)(b) GDPR and, otherwise, Art. 6(1)(f) GDPR based on our legitimate interest in answering customer enquiries efficiently and measuring the satisfaction of our potential and existing customers with customer service.

VI. Technical infrastructure

For hosting and technical provision of our online services, we use the external service provider Amazon Web Services and platform-specific providers such as Apple and Google for website- and app-related services. In this context, personal data generated when our services are used is processed, in particular technical connection data, usage data and, depending on the specific use, contract and contact data as well as enquiry content. Processing is carried out on the basis of Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

To ensure that our App and Website load quickly, stably and securely, we use the content delivery network services AWS CloudFront and Cloudflare. Technical connection and usage data may be processed in this context, in particular IP address, access times, requested content and technical information about the device, browser or app used. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

We use the content management service Storyblok to manage and provide editorial content and media files on our website. When accessing content provided via Storyblok, the following data may be processed: the IP address, the time and type of access, the content requested, and technical information about the device and browser used. This processing is based on Article 6(1)(b) of the GDPR, to the extent that the content is necessary for the provision of our contractual or pre-contractual services, as well as on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the efficient management and the fast, stable, and user-friendly delivery of our website content.

For the technical preparation and structuring of data in our internal systems, we use dbt Labs. Personal data may also be processed where it forms part of the data sets we process. The service does not permanently store the data. Processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in a secure, powerful and efficiently manageable data infrastructure.

Within our corporate group (7NXT Group), Gymondo GmbH supports us in particular with backend hosting, technical operations, maintenance and technical development of our systems. Processing is carried out in separate technical environments to ensure a clear separation from other data sets and systems. Depending on the service concerned, processing is carried out on the basis of Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. We use appropriate technical and organisational measures to ensure a high level of information security. Gymondo is also certified according to ISO/IEC 27001.

VII. Security and monitoring

To monitor the stability and security of our online services and to detect, analyse and remedy technical errors, we use Firebase Crashlytics and Firebase Performance Monitoring, New Relic, AWS and Sentry. Depending on the affected system, this may involve processing IP addresses, device and usage data, technical log data, crash and performance data, unique technical identifiers and, in individual cases, personal data contained in error messages or affected system requests. The data collected for this purpose is stored for a maximum of one month and then automatically deleted.

Where processing is necessary to provide our contractual services, it is carried out on the basis of Art. 6(1)(b) GDPR. Otherwise, it is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, monitored and error-free operation of our online services and internal systems.

VIII. Service and marketing communication

Newsletter

If you subscribe to our newsletter, we process your email address in order to send you the newsletter. To verify your registration, we use the double opt-in procedure; in this process, we also process the IP address and the date and time of registration and confirmation. Processing for newsletter dispatch is based on your consent pursuant to Art. 6(1)(a) GDPR; processing to document your consent is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. We use Braze to send and manage the newsletter. If you have consented, we also evaluate the newsletter, in particular opens and clicks, to optimise our content and communication. You can withdraw your consent at any time with effect for the future using the unsubscribe link in the newsletter. After you unsubscribe, we store your email address in a suppression list to prevent future mailings. This is carried out on the basis of Art. 6(1)(f) GDPR.

Existing customer advertising

In legally permitted cases, we may use the email address received in connection with the conclusion of a contract to inform you about our own similar products or services. Processing of personal data is carried out on the basis of Article 6(1)(f) of the GDPR in conjunction with Section 7(3) of the “Gesetz gegen den unlauteren Wettbewerb” (“UWG”). You may object to this use of your email address at any time without incurring costs other than transmission costs according to the basic tariffs.

Mandatory communication in connection with prevention programmes

If you reside in Germany, you can participate in prevention courses subsidised by your health insurance provider. In this case we regularly send you important information and participant documents for the relevant course to your email address as part of the contract, on the basis of Art. 6(1)(b) GDPR. As we are also obliged to carry out evaluation measures for continuous quality assurance and improvement, you may, with your consent, occasionally receive emails with related surveys. The legal basis for data processing is Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR.

Push and email notifications

In the App, you can voluntarily activate reminders for certain content or functions, for example by push notification or email. For this purpose, we process the reminder settings, content, times and activation status of the respective reminder selected by you. We use Braze to manage and send these messages.

For push notifications, we also process the technical information required for delivery, in particular the APNS token for iOS or the FCM token for Android. Delivery is carried out via the push services of your respective operating system provider; email reminders are delivered via the email provider you use. These providers may process personal data in connection with delivery under their own responsibility; we can influence their data processing only within the scope of our own integration.

Our processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You can deactivate voluntary reminders at any time in the App settings. You can also deactivate push notifications in your device settings; email reminders can also be unsubscribed via the unsubscribe link in the relevant email.

Events

If you register for an event offered by us via our Website or App, we process the personal data required for registration, organisation and performance of the event, in particular name, email address and, where applicable, further information requested in the registration form. Processing is carried out to handle registration and participation in the relevant event on the basis of Art. 6(1)(b) GDPR. Where you voluntarily provide us with further information, processing is carried out on the basis of Art. 6(1)(a) GDPR.

For paid events, we also process the data required for billing and payment processing. Further information on the service providers used can be found under Contract processing and payment.

Surveys

Occasionally, we invite you to participate in voluntary surveys via our App, by email or by other means. If you participate, we process the information you provide for evaluation, quality assurance and further development of our services. The survey providers Typeform and SurveyMonkey are used to conduct the surveys.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. Where possible, your information is processed pseudonymously and aggregated or anonymised for evaluations. Publications are made exclusively in anonymised form.

Intra-group marketing support

For planning, carrying out, evaluating and optimising our own marketing measures, we also use companies belonging to the 7NXT Group as internal service providers. Where these companies process personal data for us, this is done exclusively to support our own marketing communication and only within the scope of the legal basis applicable to the relevant measure, in particular on the basis of your consent pursuant to Art. 6(1)(a) GDPR or, where legally permitted, on the basis of Art. 6(1)(f) GDPR. Personal data is used for marketing purposes of other companies of the 7NXT Group only where there is a separate legal basis, in particular your consent.

IX. Cookies and analytics

Website

When our Website is accessed, access data is stored in server log files for technical reasons. This may include, in particular, IP address, browser information, operating system, host name, date and time of access, referrer URL, access status and volume of data transferred. Processing is carried out to ensure the security, stability and functionality of our Website, for error analysis and for detecting and preventing misuse on the basis of Art. 6(1)(f) GDPR. Log files are generally stored for a maximum of 90 days.

We also use technically necessary cookies and similar technologies to provide our Website, ensure its security and stability, and store your cookie settings in your browser. This may include services from Cloudflare and ConfigCat as well as our own technically necessary cookies. The legal basis for processing personal data is Art. 6(1)(f) GDPR. Where information is stored on or accessed from your device without consent, we rely on the applicable statutory exception under the national ePrivacy rules applicable in your jurisdiction, including Section 25(2) of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (“TDDDG”) in Germany. In addition, we use CookieFirst to process your consent status. The legal basis for processing personal data for this purpose is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR..

Where you have consented, we use optional cookies and similar technologies on the basis of Art. 6(1)(a) GDPR and, for storage of or access to information on your device, your consent under the national ePrivacy rules applicable in your jurisdiction, including Section 25(1) TDDDG in Germany, unless a specific statutory exception applies:

For optional functions and embedded content, we use, in particular, Amplitude, SoundCloud, YouTube and Zendesk. These services may be used to provide external media content or support functions. The respective providers may process information about the use of the embedded content or functions.

• For statistical evaluation and optimisation of our Website, we use, where you have consented, in particular Google Analytics and Hotjar. These services help us understand how our Website is used, which content is relevant and how we can improve our Website.

• For marketing, reach measurement, conversion measurement, retargeting and optimisation of our marketing measures, we use, where you have consented, in particular services from Google, Meta, Microsoft Advertising, Awin, Outbrain, Pinterest, Taboola and Roeye. Information about your use of our Website, interactions with advertising, referrer information and cookie or similar identifiers may be processed and transmitted to the respective providers.

• We use the technologies mentioned above only with your prior consent. Further information can be found in the cookie banner and via the “Cookie settings” link in the footer of our Website. You can withdraw your consent at any time via the cookie settings.

App

Where you have consented, we use analytics and marketing tools such as Adjust and Google Analytics for Firebase in our App in order to analyse use of our App, further develop functions and measure the effectiveness of our marketing measures. We also use Braze to create user segments based on usage analytics and tailor our communications to your needs, provided you have consented into marketing communications. Technical identifiers, device and system information, usage and interaction data as well as event-related data may be processed, for example relating to registration, login, starting a service, purchase activities or receipt of push notifications.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. Where information is stored on or read from your device for the use of the services, we additionally rely on your consent under the national ePrivacy rules applicable in your jurisdiction, including Section 25(1) TDDDG in Germany, unless a statutory exception applies. You can withdraw your consent at any time with effect for the future in the relevant App settings.

Internal data analysis and reporting

The processing described below is independent of the use of cookies and similar technologies and serves the internal evaluation and optimisation of our services.

To better understand our users and their needs and to further develop our products, we use BigQuery (Google) and Tableau to analyse and visualise data. Data from BigQuery is transferred to Tableau to create reports and visualisations. In addition, we use Looker (Google) as an analytics and reporting tool and Amplitude to evaluate user behaviour and optimise products. Where possible, this processing is carried out without personal reference or in aggregated form. In individual cases, in particular in connection with cooperations with health insurance providers, pseudonymised data may also be processed where this is necessary for the relevant evaluation purposes. Processing is carried out on the basis of Art. 6(1)(f) GDPR. In carrying out this processing, we are supported by our parent company, 7NXT GmbH, which provides internal services in the area of data transformation and analysis.

X. AI-supported functions

If you reside in Germany, we might offer you our AI chat “Seven” in the App on a trial basis, which you can use after giving active consent. The legal basis is Art. 6(1)(a) GDPR. To provide this function, we process the personal data required for this purpose and share it with the provider Aury. Details on the data processed, Aury and the security measures we have taken can be found in the separate Privacy Notice: AI Companion Privacy Notice.

Note: Please share in the chat only information that you actually wish to disclose. You can withdraw your consent at any time with effect for the future by deactivating the AI Companion or declaring your withdrawal using the function provided for this purpose in the 7Mind App.

XI. External content and social media

Our Website contains links to our profiles on social networks. These are designed as external links. Merely accessing our Website does not transmit any data to the respective providers. Only when you click such a link will you be redirected to the relevant platform. Where you share content via social networks, further processing is carried out by the respective network operator under its own responsibility.

Where you have consented, we embed external content on our Website, in particular the audio player from Podigee and, in individual cases, SoundCloud and YouTube, to provide you with audio/video content such as podcasts. When the player is activated, a connection to the servers of the respective provider may be established; in particular, IP address, device and browser information and usage data may be processed. The legal basis is Art. 6(1)(a) GDPR and, for any storage of or access to information on your device, the national ePrivacy rules applicable in your jurisdiction, including Section 25(1) TDDDG in Germany. You can withdraw your consent at any time via the cookie settings.

XII. Retention period

We store your personal data only for as long as we need it for the respective purposes. Once these purposes no longer apply, we generally delete the data. In certain cases, however, we may or must retain your data for longer. This applies, for example, if we still need it as evidence for potential legal claims or if statutory retention obligations exist.

To address potential legal claims, we generally retain contract data for up to three years after the end of the year in which our business relationship with you ends. In addition, we are legally required to retain certain data for longer periods for tax and accounting purposes. Depending on the type of data, these retention periods range from two to ten years.

XIII. Datenübermittlung in Drittländer

Where personal data is transferred to recipients in countries outside the European Economic Area (“EEA”), we comply with the transfer rules applicable to the relevant processing. In the absence of an adequacy decision by the European Commission, we ensure an adequate level of data protection through appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses; for eligible transfers to the United States, the EU-U.S. Data Privacy Framework may also apply. However, it cannot be entirely ruled out that authorities in these countries may gain access to personal data under certain circumstances.

Further information on the individual recipients, the respective transfers and the safeguards used can be found in the provider overview in the appendix.

XIV. Your right to object

Where personal data is processed for the performance of tasks carried out in the public interest (Art. 6(1)(e) GDPR) or for the purposes of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time, with effect for the future, to the processing of personal data concerning you. If you object, we must stop any further processing of your data for the purposes mentioned above, unless:

there are compelling legitimate grounds for processing which override your interests, rights and freedoms; or

• processing is necessary for the establishment, exercise or defence of legal claims.

• Under the conditions of Art. 21(1) GDPR, data processing may be objected to on grounds relating to the particular situation of the data subject.

If you wish to exercise your right of withdrawal or objection, you can notify us using the contact details below.

XV. Your other rights

Access: You have the right to request information from us at any time about the data stored about you (Art. 15 GDPR). This also concerns the recipients or categories of recipients to whom this data is disclosed, the purpose and the duration of storage.

Rectification, erasure, restriction of processing: You also have the right, under the conditions of Art. 16 GDPR, to request rectification, under the conditions of Art. 17 GDPR, to request erasure and, under the conditions of Art. 18 GDPR, to request restriction of processing.

Data portability: You may also request data transmission in a machine-readable format at any time under the conditions of Art. 20 GDPR.

How you can exercise your rights: To exercise your rights, you can contact us at any time, for example by email or post at:

7Mind GmbH
Ritterstraße 12
10969 Berlin
Germany

Email: [email protected]

Our data protection officer can be contacted at: [email protected]

Irrespective of other legal remedies, you have the right to lodge a complaint with the competent data protection authority. If you reside in the EU, you may in particular contact the supervisory authority of your habitual residence, place of work or the place of the alleged infringement, or the supervisory authority responsible for our registered office. The supervisory authority responsible for 7Mind in Germany is:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59-61
10555 Berlin
Germany

Appendix - Provider overview

Abbreviations / legend

Role

• DP = data processor

• IC = (predominantly) independent controllership

• JC = joint controllership

Privacy notice

• de = only available in German

Third-country transfer safeguards

• – = no third-country transfer

• DPF = EU-U.S. Data Privacy Framework

• SCC = European Commission Standard Contractual Clauses

• BCR = Binding Corporate Rules

• ADQ = EU adequacy decision for the relevant recipient country

*****