How we handle your personal data.

Amita Care is a tele-mental health and psychotherapy platform operated from India. This policy explains what information we collect when you use the Amita Care website and app, how we use it, and the rights you have over it. It applies to clients, therapists and organisations who use the platform.

We collect only what we need to run the service:

• Account data — name, email, phone number, password (hashed), date of birth, and your chosen therapist.
• Clinical data — anything you share during a session or in messaging with your therapist, plus session notes and assessment responses.
• Usage data — IP address, device type, and the pages you visit on Amita Care, used to keep the service secure and to improve it.
• Payment data — handled by our payment processor. We do not store full card numbers.

We use your data to provide the service you have asked us for:

• To match you with a therapist and to deliver your sessions.
• To send you appointment confirmations, reminders and security-related notifications.
• To process your payments and produce invoices.
• To improve the platform — using aggregated, de-identified analytics only.
• To meet our legal obligations under Indian law.

We do not sell your data to advertisers. We do not use clinical content to train AI models.

Anything you share in a session is treated as confidential between you and your therapist. Under the Mental Health Act, 2017, confidentiality may be set aside only in a small number of clearly defined situations: (1) to improve the therapeutic process while maintaining your anonymity, (2) to ensure your immediate safety, or (3) where there is a risk to public safety. Your therapist will discuss these limits with you at the start of your first session.

We share your data only with:

• The therapist you have chosen.
• Service providers we rely on (hosting, payments, email delivery) — bound by data-processing agreements.
• Regulators, courts or law enforcement when we are legally required to do so.

For organisation-sponsored accounts, only utilisation summaries and credit usage are shared with the sponsoring organisation. Session content is never shared with employers.

We retain clinical records for the period required by law in India. Account data is kept while your account is active and for a reasonable period after closure to handle billing and disputes. You can request deletion at any time using the controls in your account or by writing to us.

All data is encrypted in transit using TLS. Sensitive fields are encrypted at rest. Access to clinical data is restricted to your therapist and to a small set of audited engineering staff for the purpose of running the platform. We follow industry-standard practices for vulnerability management, dependency review and incident response.

Under India's Digital Personal Data Protection Act, 2023 you have the right to:

• Access the data we hold about you.
• Correct anything that is wrong or out of date.
• Withdraw your consent and ask us to delete your data.
• File a grievance with our designated officer.

You can exercise these rights from inside your account, or by writing to privacy@amitacare.com.

Therapists may optionally connect their Google Calendar to Amita Care so that personal calendar events block matching availability slots on Amita Care, and Amita Care bookings are mirrored back to their Google Calendar. Connecting is opt-in and the therapist controls it.

Scopes we request: calendar.readonly (to read the therapist's existing calendar events so we can detect conflicts) and calendar.events (to create / update / delete the events we mirror for Amita Care sessions).

What we store: the OAuth access and refresh tokens, the calendar ID, and the event IDs of mirrors we have created. We do not copy event titles, descriptions, attendee lists or any other event content into our database — we read events at sync time and immediately discard them after computing the slot conflict.

What we do with it: calendar data is used solely for the therapist's own scheduling. It is never shared with clients, with other therapists, with the platform's organisations, or with any third party. It is never used for advertising and never used to train AI models.

Revocation and deletion: a therapist can revoke access at any time using the Disconnect button on their Calendar page in Amita Care, or directly from their Google account permissions page. On disconnect we delete the stored OAuth tokens and our local record of mirrored event IDs within minutes. If you delete your Amita Care account, all stored Google data is deleted as part of account closure.

Amita Care's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small number of cookies — strictly necessary cookies to keep you signed in, and an analytics cookie to understand which pages are used. We do not run third-party advertising or tracking cookies.

Amita Care is intended for adults. Minors may access the platform only under the consent and supervision of a parent or legal guardian, in line with applicable law.

We update this policy when our practices change. The “last updated” date at the top reflects the most recent revision. We will notify account holders of significant changes by email.

For any privacy question or to lodge a grievance, write to privacy@amitacare.com or send a message via the contact form. We acknowledge grievances within five working days.