Privacy Notice
Effective date: 27 July 2026
Last updated: 27 July 2026
Version: 2.0
Controller: Pink Elephant, Unipessoal Lda (NIPC 519056582)
1. About This Notice
This privacy notice explains how Pink Elephant, Unipessoal Lda (“Pink Elephant”, “States of Mind”, “we”, “us” or “our”) processes personal data in connection with the States of Mind website at statesofmind.com and the associated services described in it, including our articles, podcast and educational content, our self-assessments and screenings, our AI Navigator, our community, our newsletter, and the way we handle support, privacy, legal and editorial correspondence. It is addressed to visitors, registered members, newsletter subscribers, contributors and anyone else whose personal data we process in connection with these services (referred to in this notice as “you”). It is provided in accordance with Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”).
2. Who We Are
The controller responsible for your personal data is Pink Elephant, Unipessoal Lda, a company registered in Portugal under company number (NIPC) 519056582, with its registered address at Edifício Amoreiras Square, Rua Carlos Alberto da Mota Pinto, no. 17, second floor, 1070-313 Lisboa, Portugal. You can contact us about privacy matters at privacy@pink-elephant.co.
Having assessed the criteria in Article 37 GDPR, we have concluded that we are not required to appoint a Data Protection Officer. The contact point above is available to handle any question, concern or request you may have concerning your personal data. Because we are established only in Portugal and the services described in this notice are directed at users across the European Union and beyond, our lead supervisory authority for cross-border processing is the Comissão Nacional de Proteção de Dados (“CNPD”), in accordance with the one-stop-shop mechanism under Article 56 GDPR.
3. What States of Mind Is and Is Not
States of Mind is an educational and informational platform dedicated to psychedelic care. Nothing on the website, including our articles, podcast, self-assessments, screenings and AI Navigator, is intended to provide medical advice, a diagnosis or a treatment recommendation, and none of it is intended to be, or should be relied upon as, a substitute for consultation with a qualified healthcare professional.
None of our services are a crisis or emergency service. If you are in crisis, experiencing thoughts of suicide or self-harm, or facing a medical emergency, please contact your local emergency services number or an appropriate crisis helpline in your country, or go to your nearest emergency department, without delay.
We explain below, in the sections dealing with our self-assessments, screenings and AI Navigator, why this matters for the personal data we process, and we set out the corresponding contractual disclaimers in full in our Terms of Use.
4. The Personal Data We Collect and How We Use It
This section describes each of the activities through which we process personal data, the categories of personal data involved, the legal basis on which we rely, the recipients of that data, whether it is transferred outside the European Economic Area (“EEA”) and on what safeguards, and how long we retain it. In addition to the specific external recipients named in each activity below, our website, backend and infrastructure are supported by Cloudflare, Inc., which provides content delivery, routing, encryption and security services across our domains, and DigitalOcean, LLC, which provides hosting, database and backup services for our backend systems. Both act as our processors and, incidentally to providing that infrastructure, may process the personal data described throughout this section on our behalf.
4.1 Website Analytics and Session Replay
When you visit our website, we and our analytics providers process certain technical and behavioral information to understand how the website is used in the aggregate, improve its functionality and the experience it offers, identify technical issues, and analyze navigation patterns. This may include your IP address (to the extent processed by the relevant provider), device and browser information, an analytics identifier, a session identifier, the pages you view and the URLs you visit, the source that referred you to the website, click, scroll and navigation events, timestamps, coarse location data where this can be derived, your consent status, and, where you have not opted out and the relevant page is not excluded, a masked recording of your session (“Session Replay”).
Session Replay is configured to the most conservative masking level available, meaning that all text and all form fields are hidden from anyone who later views the recording. Session Replay is switched off entirely on pages where sensitive information may be displayed or collected, including login and authentication pages, community pages, assessment and quiz pages, AI Navigator pages, provider-contact and early-access forms, newsletter forms, and any support, legal or editorial form.
We rely on your consent (Article 6(1)(a) GDPR) as the legal basis for this processing, which you give or decline through our cookie and consent banner. You may withdraw your consent at any time with future effect, as described in our Cookie Policy. Internally, access is limited to authorized product and analytics personnel. Externally, this information is processed by Amplitude, Inc., which provides our analytics and Session Replay tooling and is configured with European Union data residency, and by Google Ireland Limited (Google Analytics), which we use as a secondary analytics system.
Processing by these providers may involve the transfer of personal data outside the EEA. Where this occurs, we rely on Data Processing Agreements, Standard Contractual Clauses where applicable, and the relevant provider’s own transfer safeguards. Session Replay recordings are retained for 30 days; event-level analytics data from Amplitude is retained for 14 months; and user- or event-level data held in Google Analytics is retained for 14 months, or the shortest retention setting available that remains consistent with the purpose described above. Genuinely anonymized, aggregated statistics may be retained beyond these periods.
4.2 Newsletter Subscriptions
If you subscribe to our newsletter, we process your email address, your subscription status, the date, time, source and version of the consent you gave, the date of any withdrawal or unsubscribe, and delivery and bounce metadata, in order to send you newsletters and educational updates. This processing is based on your consent (Article 6(1)(a) GDPR) and, in respect of maintaining records sufficient to honor opt-out and unsubscribe requests, on our compliance with applicable legal obligations relating to electronic marketing communications (Article 6(1)(c) GDPR).
Internally, this information is accessible to authorized communications personnel. Externally, newsletter delivery is carried out by Klaviyo (NYSE: KVYO), which hosts subscriber data primarily within the European Union. Where Klaviyo’s own subprocessors are located outside the EEA, appropriate safeguards apply, including Data Processing Agreements, Standard Contractual Clauses where applicable, and other legally recognized transfer mechanisms.
We retain your subscriber data for as long as your subscription remains active. After you unsubscribe, we retain newsletter engagement and delivery records for up to 24 months before deleting or anonymizing them where technically feasible, save that we keep a minimal suppression record for as long as necessary to ensure we do not contact you again and to demonstrate our compliance with your request.
4.3 Community Registration and Authentication
If you register for our community, we process your email address, a user identifier, your login data, the authentication provider you use, and, where you sign in through Google or another external provider, sign-in verification metadata, in order to create and manage your account, authenticate you, and provide access to members-only community features and content, such as live events, expert question-and-answer sessions and interaction with other members. This processing is necessary for the performance of the contract between you and us that arises when you register for community membership (Article 6(1)(b) GDPR).
Community accounts are administered through our community platform provider, Circle.so (CircleCo, Inc.), and, where applicable, Google acts as an external sign-in provider. Personal data may accordingly be transferred outside the EEA. Where this occurs, we rely on Data Processing Agreements, Standard Contractual Clauses where applicable, and Circle.so’s own international transfer mechanisms.
We retain your community account data for as long as your membership remains active. Following confirmed deletion of your account, we delete or anonymize this data within 30 days, save that any security or fraud-prevention log that we retain for a longer period is subject to its own, separately defined retention period and legal basis.
4.4 Community Participation and Moderation
When you participate in our community we process your username or display name, your profile information, your posts, comments, reactions, direct messages and chat messages, your event registrations and participation records, any attachments or images you choose to share, timestamps, and, where relevant, content-reporting and moderation records and related technical metadata.
Some of this information may constitute special categories of personal data within the meaning of Article 9 GDPR. Because our community exists to enable open conversation about psychedelic care, members may voluntarily disclose information about their own health, mental health, treatment history or experience with psychedelic substances in posts, comments, chats, direct messages, live-event discussions or attachments. We ask members not to disclose health information or other identifying information about a third party unless it is genuinely necessary to do so, precisely because such disclosures can affect people who have not themselves chosen to use our community.
Where you choose to include information about your own health, mental health, treatment or psychedelic-related experience in a post, comment, message or other contribution, we treat that choice as your explicit consent to our processing of that special category data for the purpose of operating the community (Article 9(2)(a) GDPR). This consent is tied to that specific content and is separate from your general acceptance of our Terms of Use. You may withdraw it for the future at any time by deleting the content yourself, where the feature allows this, or by asking us to remove it at privacy@pink-elephant.co. The general processing associated with community participation is otherwise based on the performance of our contract with you (Article 6(1)(b) GDPR) and on our legitimate interest in maintaining a safe, trustworthy and well-ordered community (Article 6(1)(f) GDPR).
Internally, access to community content is limited to authorized community administrators and moderators. Within the community itself, your contributions are visible to other members and, where content is shared in a particular event or space, to the relevant event hosts or invited experts. Externally, community participation data is processed by Circle.so (CircleCo, Inc.) as our community-platform provider, which may involve transfers of personal data outside the EEA, safeguarded by Data Processing Agreements, Standard Contractual Clauses where applicable, and Circle.so’s own transfer mechanisms.
We delete or anonymize account-linked community data within 30 days of confirmed account deletion. Private messages and content containing health, other special category, or third-party personal data are deleted on the same timeline unless we need to retain them for an active legal, safety or moderation matter. Posts and comments may continue to exist after that point only where they have been genuinely anonymized, such that neither you nor anyone else can be identified, singled out or linked to the content from what remains. Removing a username alone is not treated as sufficient anonymization where the remaining content is still capable of identifying someone.
4.5 Self-Assessments and Educational Screenings
If you choose to complete one of our self-assessments or educational screenings we process your name and email address (only where necessary to deliver or retrieve your results), your country, your age or age range and sex or gender where these are used by the relevant tool, the time of submission, a record of your consent, the type of assessment and related metadata, your calculated score and result, and, where applicable, metadata about any personalized recommendation generated for you and about the delivery of results by email.
The substance of your answers, together with your calculated score and result and the personalized recommendation generated for you, constitutes special category data under Article 9 GDPR. This includes any mental health indicators, ADHD-, depression- or anxiety-related responses, scores derived from PHQ-9 or comparable tools, indications of interest in psychedelic-assisted therapy, treatment-interest information, other self-reported health information, and, where your chosen assessment includes them, responses relating to severe distress or self-harm.
These tools are optional and are not a crisis or emergency service, and they do not provide a diagnosis, a clinical screening in the medical sense, a treatment recommendation or a decision about your eligibility for treatment. They exist to help you understand general, evidence-based information about yourself and to point you towards relevant educational content. We calculate your score ourselves and store your answers as structured data. We then send a minimized, categorical version of that data, for example, in a form similar to “female, 28 years old, moderate ADHD, Germany” rather than your free-text answers, to OpenAI Ireland Ltd., which generates the personalized recommendation text you see.
We rely on your explicit consent for this processing, including of the special category data involved (Articles 6(1)(a) and 9(2)(a) GDPR). Nothing about this feature is offered or processed without that consent, and you may decline to use it or withdraw consent at any time with future effect. Internally, access to this information is limited to authorized product, support, privacy and security personnel. Externally, it is processed by OpenAI Ireland Ltd. for the purpose of generating your personalized recommendation, by DigitalOcean (or the equivalent backend provider we use) for storage of your responses and results, and, where you ask us to email your results, by Klaviyo (NYSE: KVYO), the same provider we use for newsletter delivery.
This may involve transfers of personal data, including special category data, outside the EEA. Where this occurs, we rely on Data Processing Agreements, Standard Contractual Clauses where applicable, contractual confidentiality commitments, and the relevant provider’s own transfer safeguards. We retain assessment responses, the underlying structured data, generated results and related recommendation data for up to 12 months from the date of your submission, after which they are deleted or irreversibly anonymized. Data sent to and received from OpenAI that is not needed for the ongoing operation of the feature is retained for no longer than 30 days. Genuinely anonymized, aggregated statistics may be retained after that point.
4.6 AI Navigator
If you choose to use our AI Navigator, we process your user or account identifier where you are signed in, or otherwise a session identifier, together with the messages and responses you exchange with the tool, conversation timestamps, session metadata, the content recommendations it produces, a record of your consent, and related technical metadata. Because you are free to ask the AI Navigator about anything, your messages may include mental health symptoms, interests or concerns, treatment interests, interest in psychedelic substances or therapies, other health-related information, or other special category data within the meaning of Article 9 GDPR, whether you enter it directly or it can be inferred from the tool’s response to you.
The AI Navigator exists to help you navigate our content. It does not provide medical advice, a diagnosis, a mental health assessment, a treatment recommendation or any decision about your eligibility for treatment, and you should not rely on it for those purposes. We store your inputs as structured data and send them, together with our own prompt, to OpenAI Ireland Ltd., which generates the response the tool gives you.
We rely on your explicit consent for this processing, including of any special category data involved (Articles 6(1)(a) and 9(2)(a) GDPR), which you give before or while using the feature. You may decline to use the AI Navigator or withdraw your consent at any time with future effect. Internally, access is limited to authorized product, support, privacy and security personnel; externally, your inputs and the resulting outputs are processed by OpenAI Ireland Ltd. for response generation, and by DigitalOcean (or the equivalent backend provider we use) for storage.
This may involve transfers of personal data, including special category data, outside the EEA, safeguarded by Data Processing Agreements, Standard Contractual Clauses where applicable, contractual confidentiality commitments, and the relevant provider’s own transfer mechanisms. We retain AI Navigator messages and related data for your active session and for 12 months thereafter for security and troubleshooting purposes. If we offer you the ability to view your own conversation history, we will separately tell you the exact retention period that applies to that history before you can turn it on. Genuinely anonymized, aggregated usage statistics may be retained beyond these periods.
4.7 Support, Privacy and Legal Requests
If you contact us with a support, privacy, legal or terms-related request, we process your email address and the content of your message, together with any special category data you choose to include in your message or its attachments, in order to receive, review and respond to your request. We rely on our compliance with applicable legal obligations (Article 6(1)(c) GDPR) and our legitimate interest in responding to enquiries and managing our legal position (Article 6(1)(f) GDPR) as the legal basis for this processing. Where your message contains special category data, we process it only to the extent necessary for the establishment, exercise or defense of legal claims (Article 9(2)(f) GDPR).
Internally, this information is accessible to authorized privacy, legal, support and operational personnel. Externally, our email service is provided by Google, acting as our processor, which may involve transfers of personal data outside the EEA, safeguarded by a Data Processing Agreement, Standard Contractual Clauses where applicable, and Google’s own transfer mechanisms. We retain support and legal correspondence for up to 24 months from the closure of your request, unless a longer period is required for legal compliance, dispute handling or recordkeeping. We may keep a minimal record of privacy requests we have fulfilled for longer, where necessary to demonstrate our compliance with the GDPR.
4.8 Editorial Submissions and Contributor Relationships
If you contribute, submit or review editorial content for us, we process your name, email address, professional affiliation, biography, curriculum vitae, portfolio, professional credentials, editorial correspondence, submission materials, and, where applicable, your payment or contact details, in order to manage editorial submissions, correspondence, review and publication workflows, contributor relationships and conflict-of-interest handling. You can reach our editorial team at editorial@statesofmind.com.
This processing is based on the performance of our contract or arrangement with you (Article 6(1)(b) GDPR), our legitimate interest in managing editorial quality, integrity and our relationships with contributors (Article 6(1)(f) GDPR) and, where relevant, our compliance with applicable legal obligations, including in relation to payment and accounting records (Article 6(1)(c) GDPR).
Internally, this information is accessible to authorized editorial, legal, privacy and publication personnel. Externally, it may be shared with Google, for correspondence handled through our email systems, and, where we engage them for a particular submission, editorial workflow or storage tools, contracted editors, expert reviewers or review-board members. This may involve transfers of personal data outside the EEA, safeguarded by Data Processing Agreements, Standard Contractual Clauses where applicable, and the relevant provider’s transfer mechanisms.
We retain editorial submissions and correspondence for up to 24 months after your last substantive interaction with us, unless a longer period is required for publication records, contractual obligations, payment and accounting, or dispute handling. Where your contribution is published, information identifying you as its author may remain associated with that content for as long as it remains publicly available.
5. Special Category Data and Explicit Consent
Several of the activities described above involve special categories of personal data under Article 9 GDPR, in particular, information about health, mental health and psychedelic-related experiences that you or other members choose to share. We only process this information where you have given your explicit consent to that specific processing, which is always separate from, and additional to, any general acceptance of our Terms of Use or this notice. Simply using the website does not amount to explicit consent to any special category processing.
You may withdraw that consent at any time, with effect for the future, by using the controls we provide within the relevant feature, by adjusting your cookie and consent preferences, or by contacting us at privacy@pink-elephant.co. Because our community allows members to discuss their own experiences openly, we also ask every member not to disclose health information or other identifying information about somebody else unless this is genuinely necessary. If you believe another member has shared your personal data without a proper basis for doing so, you may report this to our moderators or contact us directly, and we will consider deletion, restriction or other appropriate action.
6. Automated Processing and Personalized Recommendations
Our self-assessments and screenings calculate a score using a fixed, published methodology associated with the relevant framework (such as the PHQ-9) and then use that score, together with a small number of categorical details you provide, to generate a personalized, written recommendation through a large language model operated by OpenAI. Our AI Navigator uses a similar model to interpret your messages and recommend content on our website.
In both cases, the processing is automated, but it does not amount to a decision described in Article 22 GDPR. It does not produce a decision that has a legal effect on you or that similarly significantly affects you, it does not diagnose a condition, determine your eligibility for any treatment, or make any decision about you that we or a third party then act on without your own judgment. The outputs are provided for general information and educational purposes, are not verified by a clinician before being shown to you, and should not be treated as a substitute for professional advice. If you have questions about how a particular result or recommendation was generated, you may contact us at privacy@pink-elephant.co.
7. Cookies and Similar Technologies
We and our providers use cookies and similar technologies on our website, for example to keep you signed in, to remember your preferences, and, with your consent, to understand how the website is used. Full details of the categories of cookies we use, the providers responsible for them, how long they last, and how you can manage your preferences are set out in our separate Cookie Policy, which forms part of our approach to transparency under this notice.
8. International Data Transfers
Several of the providers we rely on to operate the website, the community, our self-assessments, our AI Navigator, and our email and editorial workflows are located, or process personal data, outside the EEA, principally in the United States. Where this occurs, we do not transfer personal data on that basis alone. We put in place recognized safeguards before doing so, which, depending on the provider, include Standard Contractual Clauses approved by the European Commission, Data Processing Agreements that reflect the requirements of Article 28 GDPR, and additional contractual, technical and organizational measures appropriate to the risk, such as confidentiality commitments and, where offered by the provider, regional data residency.
We keep the transfers we rely on, and the safeguards that apply to them, under periodic review. You can ask us for further information about a specific transfer, or for a copy of the relevant safeguard, by contacting us at privacy@pink-elephant.co.
9. How We Keep Personal Data Secure
We maintain technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse and disclosure. These include restricting internal access to personal data to those who need it to perform their role, requiring strong authentication for access to our production systems, encrypting data in transit and at rest, maintaining regular backups, and logging and reviewing access to sensitive systems. We require the processors we work with to maintain comparable safeguards under written agreements.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you become aware of a security concern affecting your personal data, please contact us at privacy@pink-elephant.co.
10. Your Rights
Subject to the conditions and exceptions set out in the GDPR, you have the right to ask us for access to the personal data we hold about you, to have inaccurate personal data corrected, to have your personal data erased, to restrict our processing of it, to receive a copy of certain personal data you have provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another controller, and to object to processing that is based on our legitimate interests or that is carried out for direct marketing.
Where our processing is based on your consent, you have the right to withdraw that consent at any time, with effect for the future and without affecting the lawfulness of processing carried out before your withdrawal. You also have the right to lodge a complaint with a supervisory authority. Because we are established in Portugal, our lead supervisory authority is the CNPD, which can be contacted through www.cnpd.pt, without prejudice to your right to complain to the supervisory authority of the EU member state in which you live, work, or where the alleged infringement took place.
To exercise any of these rights, please contact us at privacy@pink-elephant.co. We may need to verify your identity before acting on your request, and we will respond within the timeframes required by the GDPR.
Where another community member has mentioned or described you in content they posted, rather than you having provided that information yourself, the same rights apply to you. Because it may be impossible for us to identify and contact every such person individually, we rely on the exception available under Article 14(5) GDPR in relation to providing you with information proactively, but we remain fully able to act on a request that you make to us directly, including by removing or restricting content about you where appropriate.
11. Children
States of Mind is not directed at children, and we do not knowingly collect personal data from children below the age at which they may consent to information society services on their own behalf, which in Portugal is 13 years under Law No. 58/2019. Our Terms of Use nonetheless require every user to be at least 18 years old, having regard to the sensitive nature of the content and community we host. If we learn that we hold personal data from someone who does not meet this requirement, we will take reasonable steps to delete it. A parent or guardian who believes their child has provided us with personal data may contact us at privacy@pink-elephant.co.
12. Third-Party Links
Our website contains links to, and content produced by, third parties, including contributors, experts and organizations we write about, as well as integrations such as sign-in providers and our community and podcast platforms. This notice does not cover the privacy practices of those third parties, and we encourage you to read their own privacy notices before providing them with personal data.
13. Changes to This Notice
We may update this notice from time to time, including to reflect changes in our processing activities, our service providers, or the law. We will post the updated version on our website with a revised effective date and, where the changes are material, we will take reasonable additional steps to bring them to your attention.
14. How to Contact Us
If you have a question about this notice or about how we process your personal data, please contact us at:
Email: privacy@pink-elephant.co
Pink Elephant, Unipessoal Lda
Edifício Amoreiras Square, Rua Carlos Alberto da Mota Pinto, no. 17, second floor
1070-313 Lisboa, Portugal
