01
Who we are
This policy explains how MINDCARTER PSYCHOLOGICAL SERVICES PVT. LTD (OPC) ("MINDCARTER", "we"), the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), handles your personal data. Read it with our Counseling Terms.
If you use our website or portals, you are a Data Principal. We also handle your information in line with the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which classify mental-health information and medical records as sensitive personal data or information.
MINDCARTER PSYCHOLOGICAL SERVICES PVT. LTD (OPC)
Platform: www.mindcarter.com
Module No. A, Tejaswini, Technopark, Thiruvananthapuram, Kerala, India
Email: info@mindcarter.com
Phone: +91 97784 59864
02
Scope of this policy
This policy covers:
- Our public website, including enquiry and contact forms.
- The client portal, where you book sessions, keep a wellness journal, manage your profile and message support.
- The counselor portal used by our counselors.
- The Corporate Counselling dashboard used by employers who sponsor our programmes.
- Email and phone communication connected with the services above.
It does not cover third-party websites we link to. Those have their own privacy policies and we are not responsible for them.
03
What we collect
- Identity and contact: name, age or date of birth, phone, email, preferred language, account details.
- Booking and payment: appointments, payment status, support messages.
- Counseling information: intake answers, goals, session notes, safety and referral notes, consent records. This can include health and personal details you choose to share.
- Technical: device, log and security data. Only essential cookies are used unless you opt in to others.
We collect only what we need. Please do not upload ID or medical records unless we ask through our secure process. In more detail:
| Category | What it includes | How we get it |
|---|---|---|
| Account details | Name, email address, phone number, password (stored only as a one-way bcrypt hash), profile photo, account role and status. | You provide it at sign-up, or your employer provides your name and work email when adding you to a Corporate Counselling roster. |
| Google sign-in data | Your Google account identifier, name and email, if you choose to sign in with Google. | From Google, with your permission, at the moment you sign in. |
| Profile details | Date of birth, emergency contact name, number and relationship to you, preferred language, and your notification preferences. | You provide these when completing your portal profile. |
| Consent records | When you accepted these terms and confirmed you are 18 or over, and when you confirmed informed consent to counseling, with the version you agreed to. | Recorded when you confirm each one in the portal. |
| Intake answers | Your answers to the pre-consultation form completed before each booking — who the session is for, what you would like support with, goals, preferred language and any safety concern. | You provide them before booking. |
| Health and counseling data | Wellness journal entries (including mood ratings from 1 to 5, tags and free text), notes your counselor writes about your sessions, safety and referral notes, and assessment-related information. | You write journal entries yourself; your counselor writes session notes. |
| Booking and payment data | Session date, time, duration, type, status, fee, payment status, cancellation reason, refund status and meeting links. We never see or store your card, UPI or bank details — Razorpay handles them. | Generated when you book, pay for, reschedule or attend a session. |
| Support data | Support tickets you raise and the messages in those threads. | You provide it when contacting support. |
| Technical and security data | IP address, browser user-agent string, session tokens (stored as hashes), one-time verification codes (stored as hashes), password-reset tokens and activity logs. | Collected automatically when you sign in and use the site, to keep your account secure. |
| Employment data (Corporate Counselling only) | Your employer's name, your work email, department and job title. | Provided by your employer when they add you to their roster. |
04
Why we use it
- To run bookings, payments, reminders and support.
- To provide counseling and keep professional records.
- To keep you safe in an emergency.
- To secure the platform and prevent fraud.
- To meet legal and professional duties.
- To improve the service, using anonymised data.
We do not sell your data or use it for advertising. Booking confirmations, reminders and similar emails are transactional messages tied to your care — not marketing.
05
Your consent and rights
We ask for your clear consent before using your data for counseling and tell you what it is for. You can withdraw consent at any time by contacting your counselor, or by writing to info@mindcarter.com. Earlier use stays lawful, but services that need the data may stop.
We may also process data for certain legitimate uses permitted by the DPDP Act, such as responding to a medical emergency involving a threat to your life or health, and to comply with law.
Under the DPDP Act you can:
- ask for a summary of your data and who it is shared with;
- correct or update it — you can edit most profile fields yourself in the portal;
- ask us to erase it, unless law or professional duty requires us to keep it;
- nominate someone to act for you if you die or cannot act;
- raise a grievance with us.
You also have the right, under the Mental Healthcare Act, 2017, to access your own mental health records, subject to the limited exceptions in that Act.
To exercise any of these rights, email info@mindcarter.com from the address registered on your account. We may ask you to verify your identity before acting. The Act also asks you to exercise these rights in good faith: not to impersonate anyone, suppress material information, or file false or frivolous complaints.
06
Who can see your data
- Your counselor.
- Supervisors and clinical consultants, under confidentiality.
- A few staff for support and security, on a need-to-know basis.
- Authorities, only where the law requires.
Session notes written by your counselor are visible only to that counselor, and your intake answers only to the counselor you booked with. Access is restricted by role and enforced on the server, not just hidden in the interface.
Employers, insurers, family members and payers
They do not receive session content. Employer programs get only anonymised group reports, with safeguards against identifying individuals: figures for small groups are withheld, and your employer cannot see whether or how often you personally book sessions, or which counselor you see.
If your employer sponsors your access, they can see who is on their roster (the name, work email, department and job title they provided) and whether each person has activated their account — nothing more.
We share data with service providers only as far as needed to run the service, under contract:
| Who | What they process | Why |
|---|---|---|
| Our cloud hosting and database providers | All application data | To host the website, the portals and the database that stores your records. |
| Razorpay (payments) | Your name and email (pre-filled at checkout), the payment details you enter there, and the amount of each payment — never session content | To take payment for individual sessions and process refunds. |
| Resend (email delivery) | Your name, email address and the contents of transactional emails | To deliver verification codes, booking confirmations, reminders and password resets. |
| Your Google account identifier and email if you use Google sign-in; session date, time and a neutral title if your counselor has connected Google Calendar | To sign you in, and to create the calendar event and Google Meet link for a video session. | |
| Professional and legal advisers, auditors and authorities | Only what is strictly necessary | Where we are required to comply with law, a court order, or a lawful request from a government agency. |
07
Storage, security and transfers
We use encryption in transit and at rest, login controls, access limited to those who need it, activity logs, secure backups and staff confidentiality training. No system is completely risk-free.
- Passwords are stored only as bcrypt hashes — we cannot read your password, and neither can our staff.
- Sessions use signed, expiring tokens; only a hash of each token is stored, and sessions can be revoked immediately.
- One-time verification codes and password-reset tokens are stored as hashes and expire after a short window.
- Third-party calendar credentials are encrypted at rest with AES-256-GCM.
Our infrastructure providers may store or process data on servers outside India. The DPDP Act permits this except to territories the Central Government restricts; we will comply with any such restriction and relocate data where legally required.
If a breach affects your data, we will tell you and the Data Protection Board as the law requires, and explain what you can do.
08
How long we keep data
| Data | Kept for |
|---|---|
| Counseling notes and consent records | As long as professional and legal record-keeping duties require, then deleted |
| Booking and payment records | As long as tax and accounting law requires us to keep them |
| Recordings or transcripts (only if you agree) | Deleted within 31 days |
| Security logs | 1 year |
| Account and support messages | 1 year after account closure |
Afterwards we securely delete or anonymise the data. Backups are cleared on a rolling schedule, so deleted data also leaves our backups over time. Sign-in sessions, one-time codes and password-reset links are deleted automatically once they expire.
10
Children
The service is for adults only. If we learn that someone under 18 has registered, we will close the account, delete their data unless the law requires otherwise, and help them find suitable support.
11
Changes to this policy
We may update this policy as our services or the law change. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle your data, we will tell you by email or in the portal and, where the law requires it, ask for fresh consent.
12
Grievance redressal
If you have a question or complaint about how we handle your data, write to our Grievance Officer. We acknowledge within 3 working days and reply within 15 working days.
Grievance Officer
MINDCARTER PSYCHOLOGICAL SERVICES PVT. LTD (OPC)
Module No. A, Tejaswini, Technopark, Thiruvananthapuram, Kerala, India
Email: info@mindcarter.com
Phone: +91 97784 59864
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India established under the DPDP Act.
Related policies