Privacy Notice

1. Purpose and Scope of this Notice

The information you share with us is personal, and often difficult to speak about. This notice sets out, in plain terms, what personal data we collect, the purposes for which we collect it, who has access to it, how long we retain it, and the choices available to you in respect of it.

This notice is issued in compliance with our obligations as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 and the rules made under it. As our services relate to mental health care, we additionally observe the confidentiality standards under the Mental Healthcare Act, 2017, and require every person on our panel to be bound by confidentiality obligations appropriate to their role including, in the case of registered mental health professionals, the professional obligations applicable to them.

This notice applies to the TheraTalk user application. Separate notices apply to buddies and counsellors on our panel and to visitors to our website.

2. Notice at a Glance

• We collect only the personal data necessary to match you with a buddy or counsellor, deliver your sessions, process payment, and safeguard your wellbeing.
• What you share in a session is confidential. It is accessible to your buddy or counsellor. It is not accessible to our staff in the ordinary course, and it is never sold, nor used for advertising purposes.
• We process most of your personal data based on your consent, which you may withdraw at any time.
• In certain limited circumstances, we may process your personal data without obtaining your consent, where permitted by applicable law. This may include situations where it is necessary to protect your life or the life of another person, or where we are required to comply with a lawful order. Section 7 of the applicable law provides further details on these circumstances.
• You may request a copy of your personal data, request its correction, or request its erasure. Section 12 sets out how.
• The remainder of this notice sets out the detail underlying these points.

3. The personal data we collect

This section explains the types of personal data we collect and how it may be used.

We collect automatically:

On Android devices, if you accept the phone-number hint presented by Google Play Services at sign-in, your mobile number is made available to the application to complete the login field. This is optional and you may decline it.

We do not collect your contacts, photo library, location history, or social media accounts. Where the app asks for camera and microphone access, that is used only during a live session and only while the session is running. The Camera Permission is optional in nature.

4. Why we process your data

We do not use your session content, recordings, screening responses or mood check-ins to target advertising, to build advertising profiles, or to train any third-party artificial intelligence system.

5. Your consent, and how to withdraw it

You provide your consent by giving a clear affirmation, such as selecting the relevant consent box in the app. Simply using TheraTalk does not, by itself, mean that you have provided consent.

We present consent requests separately in the Consent Notice, so you can choose which activities you agree to and which you do not.

You can withdraw consent at any time, by writing to us by writing privacy@theratalk.in. Two things to know about withdrawal:

• Withdrawal applies going forward. It does not undo processing that was lawfully done before you withdrew.
• If you choose to withdraw your consent for information that is necessary to provide counselling services, this may affect our ability to continue providing certain parts of the service.

6. Confidentiality of Session Content and Recordings

• Transmission: Text messages, audio and video are transmitted over encrypted channels between your device and our systems.
• Recording of video sessions: Video counselling sessions are recorded. Recording is carried out through our real-time communications provider, and the resulting files are stored with our storage provider. Recordings are made for creating summaries and transcription purposes only. You will be informed before a session that will be recorded begins.
• Access to recordings: We have integrated the “Least Privilege Access” which means that it’s only accessible to a very limited number of people in the organization.
• Confidentiality of session content: What you share in a session is accessible to your buddy or counsellor. It is not accessible to our staff in the ordinary course. Access by our personnel is restricted to a limited number of named individuals, is permitted only for a specific and recorded reason investigating a complaint you have raised, responding to a safety incident, or a security investigation and is logged.
• Access to your own records: You may request a copy of the personal data we hold about you, including your session records, in accordance with Section 22 Where the Mental Healthcare Act, 2017 confers a right of access to mental health records, we will give effect to it, subject to the limited exceptions that Act recognises.

7. When we may share or disclose without your consent

These are narrow and we apply them narrowly.

• Risk to life or safety. If your buddy/counsellor forms a professional judgement that there is a serious and imminent risk to your life or health, or of serious harm to another identifiable person, we may contact your emergency contact, emergency services, or an appropriate healthcare provider and share the minimum information needed to respond. Wherever it is safe and practicable to do so, your buddy/counsellor will discuss this with you first.
• In some situations, we may be required to share your personal data in response to a court order or another valid legal requirement under Indian law. In such cases, we will share only the information that is necessary to meet that legal requirement.
• We do not disclose your information to your employer, family members, insurer, or anyone else on their request. If TheraTalk is provided to you through your employer or institution, they receive only aggregated, non-identifying utilisation figures never your identity, attendance, or session content.

8. Who we share your data with

We may share your personal data with certain service providers and people who help us provide and operate TheraTalk. We share only the information needed for the relevant purpose.

• Your buddy or counsellor: They may receive information such as your profile, intake information, screening responses and information you share during your sessions. This helps them provide your counselling sessions. They are based in India.
• Application hosting provider: Our hosting provider processes information needed to run the TheraTalk app and website. This may include technical information such as your IP address and server access details. The provider is based in San Francisco, California, USA.
• Database provider: We use a database provider to store information such as your profile, session records, chat messages, mood check-ins, SOS incidents, payment records, device information, reports, feedback and recording details. The provider is based in New York City, New York, USA.
• Login and session provider: This provider temporarily handles information such as one-time passcodes sent to your mobile number, login tokens and certain IP address information. This helps us securely log you in and keep you signed in. The provider is based in California, USA.
• Live audio and video provider: When you have a live audio or video session, this provider helps us deliver the session. It may process audio and video, messages sent during the session, session details and access tokens. If a session is recorded, the recording may also be processed by this provider. The provider is based in California, USA.
• Storage provider: We use a storage provider to securely store session recordings and other files used by the app. The provider is based in San Francisco, California, USA.
• Image storage provider: If you attach screenshots or images when giving us feedback, these may be stored with our image storage provider. The provider is based in California, USA.
• Payment provider: We use the provider to process payments and wallet top-ups. They may receive your name, email address, mobile number, order details and payment amount. If you pay by card, your card details are provided directly to them and are not received by us. They are based in Bengaluru, Karnataka, India.
• UPI apps, banks and payment providers: When you make a payment, the information needed to complete and verify the payment may be shared with the relevant UPI app, bank, card issuer or authentication provider through Razorpay. These providers may be located in Mumbai, Bengaluru or New Delhi, India.
• Push notification providers: To send notifications to your device, we may share your device token and the notification message. Depending on the notification, this may include your appointment details, session type, session identifier or the name of your buddy or counsellor. We use providers based in California, USA.
• Professional advisers and auditors: Where needed, we may share limited information with our lawyers, professional advisers or auditors for legal, audit or compliance purposes. We will share only what is reasonably needed for that purpose and require them to keep the information confidential. These advisers and auditors are based in India.
• We take reasonable steps to ensure that third-party service providers use your personal data only for the purposes for which it is shared and follow appropriate privacy and security requirements.

We do not use third-party analytics providers, customer relationship management platforms, external email providers or third-party support desk software. The usage figures shown in our internal administrative panel are generated from our own database.

We do not sell your personal data. We do not share it with data brokers or advertising networks.

9. Minor Users

TheraTalk is intended for users aged 18 and above.

If TheraTalk knowingly makes services available to a person under 18, we obtain verifiable consent from a parent or lawful guardian before processing that person’s data, in the manner required under the DPDP Act and rules. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

The rules recognise a limited exemption from certain of these requirements for mental health establishments and healthcare professionals, restricted to the provision of health services to the child to the extent necessary to protect their health. Where we rely on that exemption, we do so only within those limits.

The same protections apply where a user has a lawful guardian appointed under the law relating to guardianship.

10. Processing outside India

Several of the service providers listed in Section 8 operate infrastructure outside India, and your personal data may therefore be stored or processed outside India. Where this occurs, we require the provider to apply appropriate security safeguards, and we comply with any restriction notified by the Central Government on transfers to specified countries, together with any sector-specific requirement applicable to the data.

A current list of the countries in which your personal data is stored or processed is available on request from privacy@theratalk.in

11. How long we keep your data

Data Retention

When you withdraw consent, close your account, or the purpose we collected data for is no longer being served, we erase your personal data and require our processors to do the same unless we are required by law to retain it. Where legal retention applies, we restrict the data, so it is no longer used for anything other than that legal purpose and will communicate it with you.

12. Your rights

We will complete your rights request between 30 to 90 days of receiving it. We may ask you to verify your identity before we act as this protects you.

13. Your responsibilities

The DPDP Act places certain duties on you as a Data Principal. In practical terms: give us accurate information (particularly your identity, age and emergency contact details), do not impersonate anyone else, do not file false or frivolous complaints, and do not suppress material information when applying for anything. Failing these duties can attract a penalty of up to ₹10,000 under the Act.

Please also keep your login credentials secure and use a device you control.

14. Grievances and complaints

Step 1: Contact us.

Data Privacy Officer Name

—

Email

privacy@theratalk.in

Address

Poonam Estate Cluster-III,A/603, Srishti Complex, Thane, Maharashtra- 401107, India.

Response time

We acknowledge within 2 working days and complete the request between 30 to 90 days

Step 2 : Escalate to the Board. If you are not satisfied with our response, or we do not respond within the stated period, you may complain to the Data Protection Board of Indiain the manner and form it prescribes on https://www.meity.gov.in/data-protection-board-ofindia

15. Security

We apply reasonable security safeguards to protect your data, including encryption in transit and at rest, role-based access control, multi-factor authentication for administrative access, access logging, network security controls, periodic testing and staff confidentiality obligations.

If a personal data breach affects you, we will inform you clearly and without delay describing what happened, what it means for you, what we are doing about it, what you can do to protect yourself, and who to contact. We will also notify the Data Protection Board within the timelines required by law.

No system is perfectly secure. If you notice anything suspicious about your account, write to privacy@theratalk.in immediately.

16. Changes to this notice

If we change this notice in a way that materially affects how we use your data, we will notify you in the app or by email before the change takes effect, and where the change requires it ask for fresh consent. The version number and effective date at the top of this notice tell you which version applies.

17. Languages

This notice is available in English and other 22 languages mentioned under the 8th schedule of the Indian Constitution. You may ask for it by writing to privacy@theratalk.in .

18. In a crisis