How we protect your information

• Encrypted in transit. Every page and request uses HTTPS, and browsers are told never to fall back to an unencrypted connection (HSTS).
• Stored in India. Our database runs in Mumbai, with row-level security switched on for every table so it can only be reached through our own server.
• Passwords are never stored. Only a one-way hash (bcrypt) is kept. Not even our team can see your password.
• Sessions you can trust. Sign-in uses a secure, http-only cookie that page scripts cannot read. Changing your password signs you out everywhere else.
• Every request is checked on the server. We check who you are and that the booking, payment or profile is yours before showing or changing it. Hiding a button is never our protection.
• No card numbers. Payments go straight to Razorpay. We keep only the card brand and last four digits.
• Limits on guessing. Sign-in, one-time codes and other sensitive actions are rate-limited, and error messages never reveal whether an account exists.
• Least access. Practitioners see only their own clients. Admins run bookings and payments but cannot read session notes, intake forms or your free-tool progress. Every admin action is recorded.
• Quiet logs. We don't log personal details or anything said in a session. Error reports have form contents and cookies removed before they leave our server.
• Browser protections. Pages can't be framed by other sites, and strict headers limit what the browser will load.

We do not hold ISO 27001 or any other security certification yet. We would rather tell you that than show a badge we haven't earned. We follow the Digital Personal Data Protection Act, 2023, and we will list certifications here only once they are awarded.

A full independent security review is planned before we take our first clients.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India, as the DPDP Act requires: what happened, what data was involved, and what you can do.

Found a weakness? Please email connect@emoraa.com with the subject “Security” before telling anyone else, and give us a reasonable time to fix it. Please don't access other people's data while testing. We will reply, keep you updated and thank you.

[Full name]
Grievance Officer, [registered legal entity name]
Email: [grievance@emoraa.com]
Address: [registered office address]

1. Write to us. Email the Grievance Officer (details above) or connect@emoraa.com. Say what happened, and include your booking reference if it is about a session. You don't need to use legal language.
2. We acknowledge it within 48 hours, with a reference number and the name of the person handling it.
3. We resolve it within 30 days, and tell you in writing what we found and what we did. If we need longer, we tell you why and when.
4. If you are not satisfied, you can complain to the Data Protection Board of India about anything to do with your personal data. A complaint about a practitioner's professional conduct can also go to the body they are registered with, which is shown on their profile.

What we collect and who processes it is set out on our transparency page.