Version 1.0 — February 2026
This Data Protection Impact Assessment (DPIA) evaluates the data protection risks associated with the MINDSETOR employee well-being platform. It is conducted pursuant to Article 35 of the General Data Protection Regulation (EU) 2016/679 and is required because the Platform processes health data (Special Category Data, Art. 9 GDPR) at scale.
Organization: MINDSETOR (David Chakrian), Edmond Jasparstraat 48A, 6217HR Maastricht, Netherlands. KVK: 77361199.
Platform: MINDSETOR — AI-driven employee well-being platform for proactive burnout prevention.
Assessment Date: February 2026
Review Schedule: Annually, or upon significant changes to processing activities.
MINDSETOR collects, stores, analyzes, and visualizes employee health and behavioral data to detect early signs of burnout and facilitate timely professional intervention. The platform operates as a data processor on behalf of subscribing organizations (Controllers).
The data follows this path:
| Dimension | Detail |
|---|---|
| Data Subjects | Employees of subscribing organizations (+ family members) |
| Data Volume | Daily health metrics per user; mood check-ins 1-3x/week |
| Geographic Scope | Netherlands (pilot), expanding EU |
| Processing Duration | Continuous during service agreement |
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Platform services (account, gamification) | Performance of contract | Art. 6(1)(b) |
| Health data processing (sleep, HRV, activity) | Explicit consent | Art. 9(2)(a) |
| Mood self-reports | Explicit consent | Art. 9(2)(a) |
| Burnout risk scoring | Explicit consent + Legitimate interest | Art. 9(2)(a), Art. 6(1)(f) |
| Care Hub sessions | Contract + Explicit consent | Art. 6(1)(b), Art. 9(2)(a) |
| Session clinical notes | Legal obligation (Dutch Wkkgz/WGBO) | Art. 6(1)(c), Art. 9(2)(h) |
| Aggregated employer reports | Legitimate interest of Controller | Art. 6(1)(f) |
| Team Wellbeing aggregate (opt-in) | Explicit consent (separate toggle) | Art. 9(2)(a) |
Explicit consent is collected during onboarding via a two-checkbox consent step:
Both checkboxes must be actively checked before account creation proceeds. Consent can be withdrawn at any time by deleting the account.
| Risk | Likelihood | Impact | Residual Risk | Mitigation |
|---|---|---|---|---|
| Unauthorized access to health data | Low | High | Low | Firestore security rules enforce user-level isolation. Firebase Auth with secure sessions. Google Cloud SOC 2 / ISO 27001. |
| Employer access to individual health data | Low | Very High | Low | "Employer Firewall": minimum 10-user threshold for any aggregated data. Individual data never exposed to employer dashboard. Enforced at database security rule level. |
| Re-identification from aggregated data | Low | High | Low | Rule of 10 prevents small-group identification. Leaderboard nicknames enabled by default. No demographic breakdowns in employer reports. |
| Re-identification from Team Wellbeing aggregate | Low | High | Low | 30% proportional threshold (floor of 3). Employer has zero visibility. Only team members see aggregate. Individual opt-in/out not visible to others. Server-side aggregation; no individual scores in team collection. |
| Automated profiling leads to adverse employment decisions | Low | Very High | Low | Risk scores never shared with employers. Human-in-the-loop: users can request specialist review. Scores are informational only, no automated decisions. |
| International data transfer (Daily.co, USA) | Medium | Medium | Medium | Standard Contractual Clauses (SCCs) in place. Only video session data transferred. No health metrics transmitted to Daily.co. |
| Data breach / exfiltration | Low | Very High | Low | AES-256 encryption at rest. TLS 1.2+ in transit. Google Cloud infrastructure with automated threat detection. 72-hour breach notification. |
| Excessive data retention | Low | Medium | Low | Defined retention periods per data type. Account deletion permanently erases identifiers. Anonymized data retained only for research. |
| Coerced participation by employer | Medium | High | Medium | Service Agreement requires employers to communicate voluntary nature. Platform requires individual consent. Users can delete account at any time. |
The overall residual risk of the MINDSETOR platform is assessed as LOW.
The combination of technical safeguards (encryption, isolation, EU hosting), organizational measures (consent, DPA, professional confidentiality), and the "Employer Firewall" design principle effectively mitigates the identified risks associated with processing health data.
The primary residual risk relates to international data transfer for video sessions (Daily.co, USA), which is mitigated through Standard Contractual Clauses. This risk will be reassessed if the EU-US Data Privacy Framework status changes.
No prior consultation with the supervisory authority (Autoriteit Persoonsgegevens) is deemed necessary at this time, as residual risks have been mitigated to an acceptable level.
This DPIA will be reviewed:
Assessed by: David Chakrian, Founder & Data Controller
Date: February 7, 2026
Contact: support@mindsetor.com
