Privacy Notice
Version 2.0 · not yet in effect
Who we are
SantoshOm is an online mental-health platform operated by Vishwas Healing & Health Care. For the purposes of the Digital Personal Data Protection Act 2023 we are the Data Fiduciary for the personal data described here.
SantoshOm
What we collect
Everything below is collected because it is needed to provide therapy services. We do not collect data speculatively.
Account details
- Name
- Email address
- Phone number
- Date of birth
Health information · sensitive
- The reason for therapy you write when booking
- Your therapist's clinical session notes
- Session history, times and mode
Payment records
- Amount, currency and status
- Payment gateway reference IDs
Card and bank details are handled entirely by Razorpay and never reach our servers.
Consent records
- What you agreed to and when
- Policy version
- IP address and device/browser at the time of consent
Kept as proof that consent was validly obtained, as the DPDP Act requires.
Journal entries and intake selections are stored only in your own browser and are never sent to us.
Our lawful basis
We process your data on the basis of your consent, which you give when you create your account and can withdraw at any time. The DPDP Act does not recognise a 'legitimate interest' basis for private companies, and we do not rely on one.
Where the law requires us to keep something — payment and tax records, for example — we keep it even after you delete your account, and only for that purpose.
Who we share it with
| Who | What they get | Where |
|---|---|---|
| Supabase Database and file storage | All account and session data | India (AWS Mumbai, ap-south-1) |
| Zoom Video sessions | Meeting time and duration only — no name, email or health information | United States outside India |
| Razorpay Payments | Amount, currency and our internal order reference — no name, email or phone | India |
| DoubleTick / WhatsApp Session reminders | Your phone number and the fact a session is upcoming | India, delivered via WhatsApp (Meta) outside India |
| Google (Gmail) Transactional email | Your name, email address and the message contents | United States outside India |
We do not sell personal data, and we do not share it with advertisers, employers or insurers.
How long we keep it
| Account details | under review | Kept while your account is active |
| Health information | under review | Clinical record-keeping |
| Payment records | 8 years | Required by Indian tax and companies law — retained even after account deletion |
| Consent records | under review | Proof of valid consent |
How we protect it
Connections to our servers and database are encrypted and certificate-verified. Passwords are hashed and never stored in readable form. Access to clinical notes is restricted to the therapist you are matched with. Sessions expire automatically, and repeated failed sign-in attempts are rate-limited and locked out.
Your rights
You can download a copy of your data, correct your details, withdraw consent and delete your account yourself, under Account (Profile on mobile). For anything else — including nominating someone to act for you — contact the Grievance Officer below; we respond within 30 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.