Version 1.0 — February 2026
This Data Protection Impact Assessment (DPIA) evaluates the data protection risks associated with the MINDSETOR employee well-being platform. It is conducted pursuant to Article 35 of the General Data Protection Regulation (EU) 2016/679 and is required because the Platform processes health data (Special Category Data, Art. 9 GDPR) at scale.
Organization: Mindsetor B.V., Brightlands Smart Services Campus, Smedestraat 2, 6411 CR Heerlen, Netherlands. KVK: 42042393. RSIN: 869442958.
Platform: MINDSETOR — AI-driven employee well-being platform for proactive burnout prevention.
Assessment Date: February 2026
Review Schedule: Annually, or upon significant changes to processing activities.
MINDSETOR collects, stores, analyzes, and visualizes employee health and behavioral data to detect early signs of burnout and facilitate timely professional intervention. MINDSETOR acts as the sole data controller (Art. 4(7) GDPR) for all personal data processed through the Platform. Employers purchase access to the service but do not determine the purposes or means of processing individual health data; they receive only aggregated reports as described in Section 3.
The data follows this path:
| Dimension | Detail |
|---|---|
| Data Subjects | Employees of subscribing organizations (+ family members) |
| Data Volume | Daily health metrics per user; mood check-ins 1-3x/week |
| Geographic Scope | Netherlands (pilot), expanding EU |
| Processing Duration | Continuous during service agreement |
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Platform services (account, gamification) | Performance of contract | Art. 6(1)(b) |
| Health data processing (sleep, HRV, activity) | Explicit consent | Art. 9(2)(a) |
| Mood self-reports | Explicit consent | Art. 9(2)(a) |
| Burnout risk scoring | Explicit consent + Legitimate interest | Art. 9(2)(a), Art. 6(1)(f) |
| Care Hub sessions | Contract + Explicit consent | Art. 6(1)(b), Art. 9(2)(a) |
| Session clinical notes | Legal obligation (Dutch Wkkgz/WGBO) | Art. 6(1)(c), Art. 9(2)(h) |
| Aggregated employer reports (non-personal, k=10 + sparse-cell suppression) | Legitimate interest of MINDSETOR as controller (B2B service delivery) | Art. 6(1)(f) |
| Team Wellbeing aggregate (opt-in) | Explicit consent (separate toggle) | Art. 9(2)(a) |
Explicit consent is collected during onboarding via a two-checkbox consent step:
Both checkboxes must be actively checked before account creation proceeds. Consent can be withdrawn at any time by deleting the account.
| Risk | Likelihood | Impact | Residual Risk | Mitigation |
|---|---|---|---|---|
| Unauthorized access to health data | Low | High | Low | Firestore security rules enforce user-level isolation. Firebase Auth with secure sessions. Google Cloud SOC 2 / ISO 27001. |
| Employer access to individual health data | Low | Very High | Low | "Employer Firewall": k=10 minimum-cell-size plus complementary sparse-cell suppression (CBS methodology) for any aggregated data. Individual data never exposed to employer dashboard. Enforced at database security rule level. |
| Re-identification from aggregated data | Low | High | Low | k=10 minimum-cell-size with complementary sparse-cell suppression (CBS methodology) prevents small-group identification and blocks differencing across adjacent breakdowns. Leaderboard nicknames enabled by default. No demographic breakdowns in employer reports. |
| Re-identification from Team Wellbeing aggregate | Low | High | Low | 30% proportional threshold (floor of 3). Employer has zero visibility. Only team members see aggregate. Individual opt-in/out not visible to others. Server-side aggregation; no individual scores in team collection. |
| Automated profiling leads to adverse employment decisions | Low | Very High | Low | Risk scores never shared with employers. Human-in-the-loop: users can request specialist review. Scores are informational only, no automated decisions. |
| International data transfer (Agora, USA) | Medium | Medium | Medium | Standard Contractual Clauses (SCCs) in place. Only video session data transferred. No health metrics transmitted to Agora. |
| Data breach / exfiltration | Low | Very High | Low | AES-256 encryption at rest. TLS 1.2+ in transit. Google Cloud infrastructure with automated threat detection. 72-hour breach notification. |
| Excessive data retention | Low | Medium | Low | Defined retention periods per data type. Account deletion permanently erases identifiers. Anonymized data retained only for research. |
| Coerced participation by employer | Medium | High | Medium | Service Agreement requires employers to communicate voluntary nature. Platform requires individual consent. Users can delete account at any time. |
The overall residual risk of the MINDSETOR platform is assessed as LOW.
The combination of technical safeguards (encryption, isolation, EU hosting), organizational measures (consent, DPA, professional confidentiality), and the "Employer Firewall" design principle effectively mitigates the identified risks associated with processing health data.
The primary residual risk relates to international data transfer for video sessions (Agora, USA), which is mitigated through Standard Contractual Clauses. This risk will be reassessed if the EU-US Data Privacy Framework status changes.
No prior consultation with the supervisory authority (Autoriteit Persoonsgegevens) is deemed necessary at this time, as residual risks have been mitigated to an acceptable level.
This DPIA will be reviewed:
Assessed by: David Chakrian, Founder & Sole Data Controller
Date: February 7, 2026
Contact: support@mindsetor.com
