2.1 Introduction
TherapyBro ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian laws.
2.2 Data We Collect
- Account Data: Name, email, phone number, age, password hash, profile picture (optional)
- Usage Data: Chat history (with Adam/listeners), journal entries, mood logs, session duration, timestamps
- Payment Data: UPI handle / bank account (for wallet withdrawal), transaction history (amounts, dates)
- Device Data: Device type, OS version, app version, IP address, crash logs
- Crisis Data: Messages flagged as crisis risk, escalation actions taken, helpline contact attempts
2.3 Legal Basis for Processing
- Consent: You provide explicit consent by creating an account and using TherapyBro
- Contract: Processing necessary to provide the service (payments, sessions, chat)
- Legal Obligation: Retention of payment records for tax compliance (7 years)
- Vital Interests: Processing crisis data to prevent harm and escalate to emergency services
2.4 How We Use Your Data
- To provide the platform: Chat processing, session matching, payments
- To improve the platform: Anonymized chat analytics, feature development, AI training (anonymized only)
- For safety: Crisis detection, escalation, reporting to emergency services if needed
- For support: Responding to your queries, handling disputes
- For legal compliance: Tax records, regulatory reporting
- Marketing (opt-in only): Email updates about new features, promotions (you can unsubscribe anytime)
2.5 Data Retention
- Chat History: 12 months. After 12 months, auto-deleted OR archived (anonymized). Exception: Crisis flags retained forever (locked).
- Payment Records: 7 years (required by Indian tax law)
- Account Data: Retained as long as your account is active. Upon deletion, data deleted within 30 days (grace period for recovery).
- Device/Usage Data: 3 months (then anonymized for analytics)
- Deleted User Data: Hard-deleted after 30 days. Not recoverable.
2.6 Data Sharing
TherapyBro does NOT sell your personal data. We share data only with:
- Listeners: Only chat history relevant to their session (not full account history)
- Payment Providers: Razorpay/Cashfree (for payment processing only). They handle payments; we don't store full card/UPI details.
- Cloud Infrastructure: AWS/GCP (hosting, backups). Data encrypted in transit and at rest.
- Emergency Services: If you express imminent self-harm or suicide risk, we may share necessary information with 108, Tele-MANAS, or other crisis resources.
- Law Enforcement: Only if legally required by court order or government demand.
2.7 AI Training & Anonymization
We may use ANONYMIZED chat data to improve our AI companion (Adam/Eve). Anonymization means: no names, emails, identifiers removed. You cannot be re-identified. You can opt-out via Settings → Privacy → "Don't use my data for AI training".
2.8 Your Rights (DPDP Act, 2023)
- Right to Access: Request a copy of your data. Submit request to support@therapy-bro.com
- Right to Correction: Correct inaccurate data via your account settings
- Right to Deletion: Request deletion of your account and data. We'll delete within 30 days (except legally required data like tax records).
- Right to Data Portability: Export your chat history + account data in a machine-readable format (JSON)
- Right to Withdraw Consent: Withdraw consent for marketing/optional processing anytime
To exercise these rights, email: support@therapy-bro.com with "Data Rights Request" in the subject.
2.9 Data Security
- Encryption: All chat data is encrypted in transit (TLS 1.3) and at rest (AES-256)
- Access Controls: Only authorized TherapyBro employees can access data (audit logs maintained)
- Regular Security Audits: Annual penetration testing and security reviews
- Data Breach Notification: If a breach occurs, we'll notify affected users within 72 hours
2.10 Children & Minors
TherapyBro is not intended for anyone under 18. We do not knowingly collect data from minors. If we discover a minor using the platform, we'll delete their account immediately.
2.11 International Data Transfer
Your data is primarily stored in India. If stored outside India (e.g., AWS US region), we ensure equivalent protection under DPDP Act.
2.12 Data Controller & Officer
Data Controller: TherapyBro (Jaipur, Rajasthan)
Contact for Privacy Queries: support@therapy-bro.com
2.13 Changes to This Policy
We may update this Privacy Policy anytime. Changes are effective immediately upon posting. Significant changes will be announced via email or in-app notification.