transparency
Your data, plainly
Last updated 25 October 2026
What we collect, how we use it, how long we keep it, who handles it, and what to do if something goes wrong. The full legal version is our privacy policy.
1. What data we collect
Only what we need to provide care, with the reason next to each item. We never sell data and never use it for advertising.
Your account
| What | Why | Kept for |
|---|---|---|
| Name, email, password (stored only as a one-way hash) | To sign you in and contact you about your sessions | While your account is open |
| Mobile number, verified by a one-time code | Sign-in, reminders you agree to, and the one free session per number | While your account is open |
| Date of birth, gender, city and state | Guardian consent for under-18s, and to see which parts of India we reach | While your account is open |
Your care
| What | Why | Kept for |
|---|---|---|
| Bookings: practitioner, service, date, time, status and its history | To run your sessions and show you, and us, where each one stands | As payment records, below |
| Intake form and anything you tell your practitioner | So your practitioner can help you | [retention period required by professional guidelines] |
| Your practitioner's session notes | Clinical continuity. Read only by your practitioner | As above |
| Reviews you write after a session | Shown, after our check, to help others choose | Until you ask us to remove them |
Free tools
| What | Why | Kept for |
|---|---|---|
| As a guest: nothing | — | — |
| Signed in, tracking on: scores, bands and minutes. Never what you write | Your private progress page. Nobody else sees it | Until you erase it or close your account |
| Worry journal entries | Stay in your own browser. They never reach us | Until you delete them on your device |
Money
| What | Why | Kept for |
|---|---|---|
| Amount paid, method, and card brand + last four digits only | Receipts, refunds and the law. We never see or keep your full card number | 8 years, as Indian tax law requires |
2. How we process it
- Need to know. Your practitioner sees your bookings, intake and their own notes. Our admins see bookings and payments to run the service, but never your intake, notes or free-tool results.
- Automatic decisions. None about your care. The matcher and self-check only suggest; a person always decides.
- Logs. We do not log personal details, session content or health information. Admin actions are written to an internal trail, without clinical content.
- Health details stay off your device's storage and out of calendar files, so a shared phone or a synced calendar does not reveal why you booked.
3. How long we keep it
The “Kept for” column above is the short version. In full:
- Account data is deleted within [e.g. 90 days] of you closing your account or asking us to.
- Clinical records are kept for [period required by professional guidelines], then deleted.
- Payment records are kept for 8 years, as Indian tax law requires. They hold no health information.
- Free-tool progress is deleted the moment you press “Erase my record” on your progress page.
4. Who processes it
These companies process data on our behalf, under contracts that limit them to our instructions. Your practitioner is the only other person who sees your care details.
| Company | What it does | Where |
|---|---|---|
| Supabase (PostgreSQL database) | Stores everything in the tables above | Mumbai, India (ap-south-1) |
| [hosting provider] | Runs the website | [region] |
| Razorpay | Takes payments by UPI, card, netbanking or wallet | India |
| Resend / Google Workspace email | Sends verification links, receipts and reminders | May be outside India |
| Twilio | Sends one-time codes and the text reminders you agree to | May be outside India |
| Anthropic | Writes Manu's replies to the messages you send it | Outside India |
| Sentry | Technical error reports, with form contents and cookies removed | Outside India |
| PostHog | Anonymous page views, only if you accept analytics cookies | May be outside India |
5. How to raise a complaint
About your data, a session, a payment or anything else, contact our Grievance Officer:
[Full name]
Grievance Officer, [registered legal entity name]
Email: [grievance@emoraa.com]
Address: [registered office address]
- Write to us. Email the Grievance Officer (details above) or connect@emoraa.com. Say what happened, and include your booking reference if it is about a session. You don't need to use legal language.
- We acknowledge it within 48 hours, with a reference number and the name of the person handling it.
- We resolve it within 30 days, and tell you in writing what we found and what we did. If we need longer, we tell you why and when.
- If you are not satisfied, you can complain to the Data Protection Board of India about anything to do with your personal data. A complaint about a practitioner's professional conduct can also go to the body they are registered with, which is shown on their profile.
You can also see, correct or delete most of your data yourself from your profile. How we protect it is on our security page.