Privacy Policy for Therapact

Last Updated: 15th July, 2026

Therapact Health Private Limited. ("we," "our," or "us") is deeply committed to protecting your privacy. Because our Service involves mental health and wellness, we process "Special Category" and "Sensitive Personal Data." This policy dictates how we collect, process, secure, and delete your data in accordance with global standards, including the GDPR, HIPAA, and the Digital Personal Data Protection Act (DPDP Act).

1. Data We Collect

We collect data directly from you and automatically through your use of the Service:

• Identity Data: Name, email address, date of birth, and account credentials.
• Sensitive Health Data: Mood logs, journal entries, psychological assessment scores, therapy notes, and any other mental health information you voluntarily input into the Service.
• Telemetry and Device Data: IP address, device identifiers, operating system, and usage analytics (e.g., session length, features accessed).
• Transaction Data: Billing information and subscription history (processed securely via third-party payment gateways).

2. Explicit Consent and Lawful Basis

We do not process your Sensitive Health Data without your explicit, informed, and prior consent. By opting in during account creation, you authorize Therapact to process this data specifically to provide the core functionalities of the Service. You maintain the right to withdraw this consent at any time, which will result in the immediate cessation of data processing and the deletion or anonymization of your sensitive records.

3. How We Use Your Data

We process your data strictly to:

• Deliver, personalize, and maintain the Therapact app.
• Provide algorithmic insights regarding your logged mental health patterns.
• Ensure the technical security and operational integrity of our systems.
• Comply with legal obligations and resolve disputes.

We do not and will never sell your personal data or sensitive health data to data brokers or advertisers.

4. Data Sharing and Sub-Processors

To operate the Service, we utilize secure, vetted third-party vendors (Sub-processors) such as cloud hosting providers (e.g., AWS, Google Cloud).

• Strict Contracts: These vendors are legally bound by Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs) that restrict them from using your data for any purpose other than providing the infrastructure for Therapact.
• Exceptions for Safety and Law: We may disclose your information if required by law, subpoena, or court order. Furthermore, if we have a good faith belief that disclosure is strictly necessary to prevent imminent risk of death or serious physical harm to yourself or a third party, we may alert emergency services or law enforcement (the "Duty to Warn").

5. Data Security and Encryption

Therapact employs enterprise-grade security protocols.

• Encryption: All personal and sensitive health data is encrypted in transit (using TLS/SSL) and at rest (using AES-256 encryption).
• Access Controls: Access to unencrypted user data by Therapact personnel is strictly prohibited unless explicitly requested by you for technical support purposes.

6. Data Retention and Deletion

We retain your personal data only for as long as your account remains active or as required by applicable laws.

• Upon requesting account deletion, Therapact will permanently erase your personal and sensitive health data from our active production systems within 30 days.
• Any data retained for clinical research or aggregate statistical analysis will be fully anonymized, rendering it impossible to link back to your identity.

7. Your Privacy Rights

Depending on your jurisdiction, you possess specific rights regarding your data:

• Right to Access: You may request a structured, digital copy of all data Therapact holds about you.
• Right to Rectification: You may correct inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): You may request the permanent deletion of your data.
• Right to Restrict Processing: You may withdraw your consent for specific types of data processing.

8. Contact the Data Protection Officer

For any questions, concerns, or requests to exercise your data rights, please contact our designated Data Protection Officer:

• Email: dpo@therapact.com
• Mailing Address: 4th & 5th Floor, Two Horizon Centre, Gurgaon, Haryana, India