Privacy Notice

1. Purpose and Scope of this Notice

The information you share with us is personal, and often difficult to speak about. This notice sets out, in plain terms, what personal data we collect, the purposes for which we collect it, who has access to it, how long we retain it, and the choices available to you in respect of it.

This notice is issued in compliance with our obligations as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 and the rules made under it. As our services relate to mental health care, we additionally observe the confidentiality standards under the Mental Healthcare Act, 2017, and require every person on our panel to be bound by confidentiality obligations appropriate to their role including, in the case of registered mental health professionals, the professional obligations applicable to them.

This notice applies to the TheraTalk user application. It does not cover buddies and counsellors on our panel.

2. Notice at a Glance

• We collect only the personal data necessary to match you with a buddy or counsellor, deliver your sessions, process payment, and safeguard your wellbeing.
• What you share in a session is confidential. It is accessible to your buddy or counsellor. It is not accessible to our staff in the ordinary course, and it is never sold, nor used for advertising purposes.
• We process most of your personal data based on your consent, which you may withdraw at any time.
• In certain limited circumstances, we may process your personal data without obtaining your consent, where permitted by applicable law. This may include situations where it is necessary to protect your life or the life of another person, or where we are required to comply with a lawful order. Section 7 of the applicable law provides further details on these circumstances.
• You may request a copy of your personal data, request its correction, or request its erasure. Section 12 sets out how.
• The remainder of this notice sets out the detail underlying these points.

3. The personal data we collect

This section explains the types of personal data we collect and how it may be used.

We collect automatically:

On Android devices, if you accept the phone-number hint presented by Google Play Services at sign-in, your mobile number is made available to the application to complete the login field. This is optional and you may decline it.

We do not access your contacts, your location or your social media accounts. The app opens your photo library only when you choose a picture for your profile photo, feedback or a support ticket, and only the pictures you pick are uploaded. The microphone is requested when you start a voice or video call, and the camera only for video calls; you can use chat and voice calls without giving camera access, and you can turn your camera off during a video call.

4. Why we process your data

We do not currently send marketing messages such as newsletters or promotional offers. If we start, we will ask for your separate, optional consent first.

We do not use your session content, recordings, transcripts, summaries or mood check-ins to target advertising, to build advertising profiles, or to train any third-party artificial intelligence system.

5. Your consent, and how to withdraw it

You provide your consent by giving a clear affirmation, such as selecting the relevant consent box in the app. Simply using TheraTalk does not, by itself, mean that you have provided consent.

At sign-up you accept the Terms & Conditions, this Privacy Policy and the Cookie Policy by ticking one box. Call recording is a separate consent that you can turn on or off at any time under Profile > Privacy & Consent > Manage Consents. Voice and video calls can only take place while call recording is on; chat sessions do not need it. Every change you make is recorded with the date and the version of the statement you saw.

You can turn off call recording in the app at any time. To withdraw any other consent, write to privacy@theratalk.in or delete your account in the app. Two things to know about withdrawal:

• Withdrawal applies going forward. It does not undo processing that was lawfully done before you withdrew.
• If you choose to withdraw your consent for information that is necessary to provide counselling services, this may affect our ability to continue providing certain parts of the service.

6. Confidentiality of Session Content and Recordings

• Transmission: Data between the app and our servers is sent over encrypted (HTTPS) connections. Live calls and chat messages are carried by our live audio, video and messaging provider (see Section 8). On Android, screenshots and screen recording are blocked on the chat and call screens.
• Recording of sessions:The audio of voice and video sessions is recorded, only if you have turned on call recording under Privacy & Consent; voice and video sessions cannot start without it, and chat sessions are not recorded. Recording is carried out through our real-time communications provider, and the resulting files are stored with our storage provider. Recordings are used only to create transcripts and session summaries (see the AI transcription and summary provider in Section 8).
• Session summaries: After a session, a short written summary is produced from the chat messages or the call transcript. It is shown to the buddy or counsellor of that session, who can edit it, and the summary of your most recent session is shown to the buddy or counsellor of your next session so that they can continue your care. Summaries and transcripts are not shown in the app to you.
• Access by our staff:Our administration panel does not show chat messages, recordings, transcripts or session summaries. Our administrative staff can see your profile details, appointments, session times and charges, payment records, safety alerts, feedback and support tickets, so that they can run the service and help you. Recording files are held in our storage provider's account, which only a limited number of our technical staff can access.
• Access to your own records: You may request a copy of the personal data we hold about you, including your session records, in accordance with Section 12. Where the Mental Healthcare Act, 2017 confers a right of access to mental health records, we will give effect to it, subject to the limited exceptions that Act recognises.

7. When we may share or disclose without your consent

These are narrow and we apply them narrowly.

• Risk to life or safety. If your buddy/counsellor forms a professional judgement that there is a serious and imminent risk to your life or health, or of serious harm to another identifiable person, we may contact your emergency contact, emergency services, or an appropriate healthcare provider and share the minimum information needed to respond. Wherever it is safe and practicable to do so, your buddy/counsellor will discuss this with you first.
• In some situations, we may be required to share your personal data in response to a court order or another valid legal requirement under Indian law. In such cases, we will share only the information that is necessary to meet that legal requirement.
• We do not disclose your information to your employer, family members, insurer, or anyone else on their request.

8. Who we share your data with

We may share your personal data with certain service providers and people who help us provide and operate TheraTalk. We share only the information needed for the relevant purpose.

• Your buddy or counsellor: They may receive information such as your name, profile and intake information, what you share during your sessions, and the summary of your most recent session (see Section 6). This helps them provide your counselling sessions. They are based in India.
• Application hosting provider: Our hosting provider runs the servers for the TheraTalk app and website and processes the data that passes through them, including technical information such as your IP address. Our app servers are located in Singapore. The provider is based in San Francisco, California, USA.
• Database provider: We use a database provider to store information such as your profile, session records, chat messages, mood check-ins, SOS incidents, payment records, device information, reports, feedback and recording details. The provider is based in New York City, New York, USA.
• SMS verification provider: When you sign in, this provider receives your mobile number to send you a one-time passcode by SMS, and the passcode you enter so that it can be checked. The provider is based in San Francisco, California, USA.
• Login and session provider: This provider temporarily holds information such as one-time passcode records (for up to 5 minutes), sign-in tokens (for up to 7 days) and certain IP address information. This helps us securely log you in and keep you signed in. The provider is based in California, USA.
• Live audio, video and messaging provider: This provider delivers your live voice and video calls and your chat messages. It processes audio and video during calls, chat messages, session details and access tokens. When call recording is on, it records the audio of the call and saves it to our storage provider. The provider is based in California, USA.
• AI transcription and summary provider: Session audio recordings are sent to this provider to be transcribed, and chat messages and those transcripts are sent to it to create a short session summary that is shown to your buddy or counsellor. The provider is based in San Francisco, California, USA.
• Advertising measurement provider (TheraTalk app):To measure how our advertising performs, the TheraTalk app sends this provider app events (completed registration, viewed a buddy profile, started a checkout, scheduled an appointment, completed a purchase, with the amount) together with your device's advertising identifier on Android. The provider's software in the app also records standard app events automatically, such as app installs and app opens. It does not receive the content of your sessions or messages. The provider is based in Menlo Park, California, USA.
• Storage provider: We use a storage provider to store session audio recordings, profile photos and the screenshots you attach to feedback. Profile photos and feedback screenshots are stored at unlisted web addresses that can be opened by anyone who has the address. The provider is based in San Francisco, California, USA.
• Support desk provider: When you raise a support ticket, it is created with this provider together with your name, email address (if you gave one), mobile number, the ticket category and description, any images you attach, and your app version, platform and operating-system version. Passwords, passcodes and card numbers typed into a ticket are removed before it is sent. The provider is based in Chennai, Tamil Nadu, India.
• Payment provider: We use the provider to process payments and wallet top-ups. It receives your email address, mobile number, order details and payment amount. If you pay by card or UPI, your card details or UPI PIN are provided directly to them and are not received by us. They are based in Bengaluru, Karnataka, India.
• UPI apps, banks and payment providers: When you make a payment, the information needed to complete and verify the payment may be shared with the relevant UPI app, bank, card issuer or authentication provider through Razorpay. These providers may be located in Mumbai, Bengaluru or New Delhi, India.
• Push notification providers:To send notifications to your device, we share your device token and the notification message. Depending on the notification, this may include your appointment details, session type, session identifier, or the name of your buddy or counsellor. A new chat message notification shows only the sender's name, never the text of the message. We use providers based in California, USA.
• Professional advisers and auditors: Where needed, we may share limited information with our lawyers, professional advisers or auditors for legal, audit or compliance purposes. We will share only what is reasonably needed for that purpose and require them to keep the information confidential. These advisers and auditors are based in India.
• We take reasonable steps to ensure that third-party service providers use your personal data only for the purposes for which it is shared and follow appropriate privacy and security requirements.

Apart from the advertising measurement and support desk providers described above, we do not use third-party analytics, crash-reporting or customer relationship management tools, and we do not send you emails through an email provider. The usage figures shown in our internal administrative panel are generated from our own database.

We do not sell your personal data and we do not share it with data brokers. The only advertising-related sharing is the advertising measurement described above.

9. Minor Users

TheraTalk is only for users aged 18 and above.

Sign-up asks for your age and does not allow anyone who enters an age under 18 to continue. We do not offer accounts for children and do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a person under 18 is using TheraTalk, please write to privacy@theratalk.in.

10. Processing outside India

Several of the service providers listed in Section 8 operate infrastructure outside India, and your personal data may therefore be stored or processed outside India. Where this occurs, we require the provider to apply appropriate security safeguards, and we comply with any restriction notified by the Central Government on transfers to specified countries, together with any sector-specific requirement applicable to the data.

A current list of the countries in which your personal data is stored or processed is available on request from privacy@theratalk.in

11. How long we keep your data

Data Retention

When you withdraw consent or the purpose we collected data for is no longer being served, you can ask us to erase your personal data (see Section 12). Where we must keep data by law, we restrict it so that it is used only for that legal purpose, and we will tell you.

12. Your rights

We will complete your rights request between 30 to 90 days of receiving it. We may ask you to verify your identity before we act as this protects you.

13. Your responsibilities

The DPDP Act places certain duties on you as a Data Principal. In practical terms: give us accurate information (particularly your identity, age and emergency contact details), do not impersonate anyone else, do not file false or frivolous complaints, and do not suppress material information when applying for anything. Failing these duties can attract a penalty of up to ₹10,000 under the Act.

Please also keep your login credentials secure and use a device you control.

14. Grievances and complaints

Step 1: Contact us.

Data Privacy Officer Name

—

Email

privacy@theratalk.in

Address

Poonam Estate Cluster-III,A/603, Srishti Complex, Thane, Maharashtra- 401107, India.

Response time

We acknowledge within 2 working days and complete the request between 30 to 90 days

Step 2 : Escalate to the Board. If you are not satisfied with our response, or we do not respond within the stated period, you may complain to the Data Protection Board of India in the manner and form it prescribes on https://www.meity.gov.in/data-protection-board-ofindia

15. Security

We apply reasonable security safeguards to protect your data, including encrypted (HTTPS) connections, sign-in with one-time passcodes, role-based access control so that each member of our administrative staff sees only what their role needs, logging of financial and other sensitive administrative actions, limits on repeated or excessive requests, screen-capture blocking on Android during sessions, and staff confidentiality obligations.

If a personal data breach affects you, we will inform you clearly and without delay describing what happened, what it means for you, what we are doing about it, what you can do to protect yourself, and who to contact. We will also notify the Data Protection Board within the timelines required by law.

No system is perfectly secure. If you notice anything suspicious about your account, write to privacy@theratalk.in immediately.

16. Changes to this notice

If we change this notice in a way that materially affects how we use your data, we will notify you in the app or by email before the change takes effect, and where the change requires it ask for fresh consent. The version number and effective date at the top of this notice tell you which version applies.

17. Languages

This notice is currently available in English. If you need help understanding it, write to privacy@theratalk.in.

18. In a crisis