Privacy policy

Emoraa (“Emoraa”, “we”, “us”) is operated by [registered legal entity name], a company registered in India with its office at [registered office address]. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described in this policy.

This policy covers emoraa.com, our web app, and our WhatsApp and phone support. It does not cover what happens on a third-party video platform your therapist may use for a session (see section 5).

We collect only what we need to run your sessions and keep the service safe:

• Account details: name, email address, phone number, date of birth, gender (optional), preferred language, organisation (if you joined through one), and a hashed password. We never store your password in readable form.
• Booking and payment records: the service, therapist, date and time you chose, coupon or referral codes used, the amount paid, and the payment status. We keep only the card brand and last four digits, or a masked UPI ID. We never store full card numbers or CVVs.
• Health information you choose to share: answers on the pre-session intake form, self-check results, and anything you type into notes. This is sensitive, and we treat it that way (see section 4).
• Your therapist's session notes: clinical notes your therapist writes after a session. These are visible only to your therapist and, where legally required, to authorised clinical staff.
• Reviews: if you review a practitioner after a completed session, your rating and words. They are published only after we check them, under your initial or as “A client”.
• Free-tool progress, only if you turn it on: scores, bands and minutes from the free tools, never what you write. As a guest, nothing from the tools is saved. You can erase your record at any time from your progress page.
• Messages: what you send through the contact form, feedback form, WhatsApp, or our assistant, Manu.
• Technical data: a session cookie that keeps you signed in, and basic device and error information. If you accept analytics cookies, we also collect anonymous page-view statistics (see our cookie policy).

We do not record your therapy sessions, and we do not see or listen to what is said in them.

We process your personal data on the basis of your consent, for these purposes only:

• creating and securing your account, including verifying your email and phone;
• matching you with a therapist and arranging, reminding you of, and running your sessions;
• taking payments, issuing receipts, and handling refunds;
• giving your therapist the context you chose to share before you meet;
• replying to messages and support requests;
• preventing fraud and abuse and keeping the service secure;
• meeting our legal obligations, for example tax records and lawful requests from authorities.

We do not sell your data. We do not use your health information for advertising, and we do not share it with your employer, college, or school, even if they referred you or pay for your sessions.

Mental-health information is among the most personal data there is. We ask for your explicit consent before you share it. Access is limited to you and your therapist, and every access to a client record by our staff is logged.

Safety exception. If what you share suggests a serious and imminent risk to your life or someone else's, your therapist may need to act to keep people safe, for example by contacting emergency services or an emergency contact. This is the professional standard of care and is permitted under the DPDP Act for medical emergencies.

We share personal data only with service providers (“Data Processors”) that help us run Emoraa, under contracts that limit them to processing it on our instructions:

• Your therapist: your booking details and anything you share for your sessions.
• Database: Supabase, in Mumbai, India.
• Website hosting: [hosting provider and server region].
• Email delivery: Resend (verification links, receipts, reminders).
• SMS delivery: Twilio (one-time sign-in codes).
• Payments: [payment gateway, e.g. Razorpay], which processes your card or UPI details under its own PCI-DSS obligations.
• AI assistant: Anthropic processes messages you send to Manu so it can reply. Don't share anything with Manu that you wouldn't want processed this way.
• Error monitoring: Sentry receives technical error reports, with form contents and cookies removed.
• Analytics: PostHog receives anonymous page views, only if you accept analytics cookies. Private pages (your dashboard, bookings, sign-in, and crisis pages) are never tracked.
• Video sessions: your therapist may share a link to Google Meet, Jitsi, or Daily. When you join, that platform's own privacy policy applies.

We may also disclose data where Indian law requires it, for example to comply with a court order.

Our primary database is hosted in India (Supabase, Mumbai region). Some of the providers listed above, including Resend, Twilio, Anthropic, Sentry, and PostHog, may process data outside India. Any such transfer is made only to countries not restricted by the Government of India under section 16 of the DPDP Act, and with safeguards in our contracts.

• Account and intake data: for as long as your account is open, then deleted within [e.g. 90 days] of you closing it or asking us to delete it.
• Therapist session notes: [retention period required by professional guidelines, e.g. 3 years after the last session], then deleted.
• Payment and invoice records: 8 years, as required by Indian tax law. These records hold no health information.
• Security logs: up to [e.g. 1 year].

Under the DPDP Act, you can:

• ask what personal data we hold about you and how we use it;
• have inaccurate or incomplete data corrected or updated;
• have your data erased, except what we must keep by law;
• withdraw your consent at any time. This won't affect anything we did before you withdrew it, but we may no longer be able to provide sessions;
• nominate someone to exercise these rights for you if you die or become incapacitated;
• raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

You can correct most details yourself in your profile. For anything else, email connect@emoraa.com or our Grievance Officer (below). We reply within 30 days.

Under the DPDP Act, anyone under 18 is a child. If you are under 18, we need verifiable consent from a parent or lawful guardian before you can book a session, and we collect it during booking. We do not track children's behaviour or show them targeted advertising.

We encrypt data in transit (HTTPS everywhere), hash passwords, limit staff access by role and log it, rate-limit sign-in attempts, and keep card details off our servers. No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board as the DPDP Act requires.

For any question or complaint about your personal data, contact our Grievance Officer:

[Full name]
Grievance Officer, [registered legal entity name]
Email: [grievance@emoraa.com]
Address: [registered office address]

1. Write to us. Email the Grievance Officer (details above) or connect@emoraa.com. Say what happened, and include your booking reference if it is about a session. You don't need to use legal language.
2. We acknowledge it within 48 hours, with a reference number and the name of the person handling it.
3. We resolve it within 30 days, and tell you in writing what we found and what we did. If we need longer, we tell you why and when.
4. If you are not satisfied, you can complain to the Data Protection Board of India about anything to do with your personal data. A complaint about a practitioner's professional conduct can also go to the body they are registered with, which is shown on their profile.

The same facts in table form are on our transparency page, and how we protect your data is on our security page.

If we make a material change, we will update the date at the top of this page and tell signed-in users by email or in the app before it takes effect. Where a change needs your fresh consent, we will ask for it.