1. Introduction and Scope
Mindswell Innovations LLP ("Mindswell", "We", "Us", or "Our") is deeply committed to protecting the privacy and confidentiality of its Users, particularly given the sensitive nature of mental health information. This Privacy Policy explains how we collect, use, store, share, and protect your Personal Information and Sensitive Personal Information when you access or use the Platform.
This Privacy Policy is published in compliance with, inter alia:
- Section 43A of the Information Technology Act, 2000;
- The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ('SPDI Rules');
- The Digital Personal Data Protection Act, 2023 ('DPDPA') and rules thereunder, as applicable;
- The Mental Healthcare Act, 2017 and applicable rules, to the extent relevant to the Services and confidentiality of mental-health information;
- The Telemedicine Practice Guidelines, 2020 (Ministry of Health and Family Welfare, India).
By using the Platform, you acknowledge that you have received and read this Privacy Policy. Where applicable law requires consent for the processing of Personal Information, Mindswell will seek consent through a clear affirmative action for specified purposes. For mental-health or health information and other Sensitive Personal Information, Mindswell will seek specific consent at or before the point of collection, separate from general acceptance of these Terms where appropriate. If you decline or withdraw consent where withdrawal is permitted by law, certain features or Services may no longer be available; withdrawal will not affect processing already lawfully undertaken or retention required by law.
2. Information We Collect
2.1 Information Provided by You
When you register or use the Platform, we may collect:
(a) Patient Information
- Full name, age, date of birth, gender, contact details (email, phone number, address);
- Health and medical history, mental health conditions, symptoms, treatment history;
- Emergency contact information;
- Payment and financial information (processed by third-party payment gateways);
- Communications with Practitioners (session notes, prescriptions — subject to confidentiality);
- Feedback, ratings, and reviews of Practitioners.
(b) Practitioner Information
- Full name, professional qualification, registration number, council affiliation;
- Contact details, clinic/practice address, availability schedule;
- Banking and payment details for payout purposes;
- Identity documents uploaded during verification;
- Professional indemnity insurance details.
2.2 Information Collected Automatically
When you use the Platform, we automatically collect:
- Device information (device type, operating system, browser);
- IP address, geolocation data (city/region level);
- Usage data (pages visited, features used, session duration, click paths);
- Log data (access times, error logs, referrer URLs);
- Cookies and similar tracking technologies (see Section 8).
2.3 Information from Third Parties
We may receive information about you from:
- Payment processors and banking partners (transaction confirmations);
- Identity verification partners (KYC/AML checks for Practitioners);
- Analytics providers;
- Other Users (e.g., Practitioners sharing information about you as their Patient).
3. Sensitive Personal Information — Special Protections
Given the nature of our Platform, we collect and process Sensitive Personal Information ('SPI'), including:
- Physical and mental health conditions, diagnoses, and treatment histories;
- Prescriptions and medical records;
- Financial information (bank account and payment instrument details);
- Identity documents.
We collect and process SPI only for the specific purposes stated in this Privacy Policy and, where consent is required by applicable law, with explicit and specific consent obtained at or before collection. Consent for mental-health and health information will be sought through a clear affirmative step and will not rely solely on general use of the Platform. SPI is subject to heightened security measures as described in Section 7. You may withdraw consent where permitted by applicable law; however, doing so may limit your ability to use certain features of the Platform.
Mental health records and session-related information are treated with the highest level of confidentiality. We will not disclose such information to any third party except: (a) with your explicit consent; (b) as required by law or court order; (c) in a genuine medical emergency where disclosure is necessary to prevent serious harm; or (d) to the Practitioner involved in your care.
4. How We Use Your Information
We use the information we collect for the following purposes:
- To create and manage your account and verify your identity;
- To facilitate the booking, scheduling, and conduct of Sessions between Patients and Practitioners;
- To process payments and manage financial transactions;
- To verify Practitioner credentials and qualifications;
- To provide customer support and respond to queries;
- To send transactional communications (appointment confirmations, reminders, receipts);
- To improve the Platform, including through analytics, user research, and testing;
- To detect, investigate, and prevent fraudulent or illegal activity;
- To comply with legal obligations, court orders, or regulatory requirements;
- To send marketing communications (only where you have provided consent and in compliance with applicable law — you may opt out at any time);
- To generate anonymized, aggregated statistical data for research and business intelligence (in a form that does not identify you personally).
5. Disclosure and Sharing of Information
5.1 Sharing with Practitioners
Information shared by a Patient (including health information) may be shared with the Practitioner the Patient is consulting. Practitioners are bound by professional confidentiality obligations and by the terms of their agreement with Mindswell.
5.2 Service Providers
We share information with trusted third-party service providers who assist in operating the Platform, including payment processors, cloud hosting providers, communication infrastructure providers, and analytics tools. These providers are contractually required to maintain confidentiality and security of your data and may not use it for any purpose other than providing services to Mindswell.
5.3 Legal Disclosure
We may disclose your information where required by law, regulation, court order, or governmental authority. We may also disclose information where we believe in good faith that disclosure is necessary to: (a) protect the rights, property, or safety of Mindswell, its Users, or the public; (b) prevent or investigate possible wrongdoing; or (c) respond to legal process.
5.4 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of assets, your information may be transferred to the successor entity. We will provide notice before your Personal Information is transferred and becomes subject to a different privacy policy.
5.5 No Sale of Data
Mindswell does not sell, rent, or trade your Personal Information or Sensitive Personal Information to third parties for their marketing purposes.
6. Data Retention
We retain your Personal Information only for as long as necessary to fulfill the purposes for which it was collected and as required by applicable law. The following general retention periods apply:
- Account and registration data: Retained for the duration of your account plus 3 years after closure;
- Medical and health records (Session Records): Retained for the period required by applicable law and the professional or regulatory obligations applicable to the relevant Practitioner and record type. Because requirements may vary by jurisdiction and category of record, Mindswell may apply different retention periods and may retain records for a longer period where required by law or reasonably necessary for regulatory compliance or the establishment, exercise, or defence of legal claims;
- Payment records: Retained as required by applicable financial and tax laws (typically 7–8 years);
- Log and usage data: Retained for up to 1 year;
- Marketing preferences and consents: Retained until you withdraw consent.
Upon expiry of the applicable retention period, we will securely delete or anonymize your data. Practitioner records may be retained for longer periods to the extent required by medical regulatory requirements.
7. Data Security
We implement robust technical and organizational security measures to protect your Personal Information against unauthorized access, loss, destruction, alteration, or disclosure. Our measures include:
- End-to-end encryption of Session communications;
- AES-256 encryption of data at rest;
- TLS 1.2+ encryption of data in transit;
- Multi-factor authentication for Practitioner and administrative accounts;
- Role-based access controls limiting access to SPI to authorized personnel only;
- Regular security audits, penetration testing, and vulnerability assessments;
- ISO 27001-aligned information security management practices;
- Secure data center infrastructure with physical access controls.
Notwithstanding the above, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. In the event of a data breach affecting your rights, we will notify you in accordance with applicable law.
8. Cookies and Tracking Technologies
We use cookies, web beacons, and similar tracking technologies to enhance your experience on the Platform. Types of cookies we use include:
- Essential Cookies: Necessary for the Platform to function and cannot be disabled;
- Performance/Analytics Cookies: Help us understand how Users interact with the Platform (e.g., Google Analytics);
- Functionality Cookies: Remember your preferences (language, login status);
- Marketing Cookies: Used to deliver relevant advertising (only with your consent).
You may control cookie preferences through your browser settings. Disabling certain cookies may affect your ability to use some features of the Platform. For more details, please refer to our Cookie Policy available on the Platform.
9. Your Data Protection Rights
Subject to applicable law, you have the following rights in relation to your Personal Information:
- Right to Access: You may request a copy of the Personal Information we hold about you;
- Right to Correction: You may request correction of inaccurate or incomplete Personal Information;
- Right to Erasure: You may request deletion of your Personal Information, subject to legal retention obligations;
- Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances;
- Right to Data Portability: You may request your data in a structured, machine-readable format;
- Right to Withdraw Consent: You may withdraw consent to processing at any time, without affecting the lawfulness of processing prior to withdrawal;
- Right to Grievance Redressal: You may raise a complaint with our Grievance Officer (see Section 11).
To exercise any of these rights, please contact us at privacy@Mindswell.com. We will respond to verifiable requests within 30 days as required by applicable law.
10. Children's Privacy
The Platform is not directed at individuals under the age of 18. We do not knowingly collect Personal Information from minors. If a parent or guardian believes that a minor has provided Personal Information to the Platform without their consent, they should contact us immediately at privacy@Mindswell.com, and we will take steps to delete such information promptly.
11. Grievance Officer
In accordance with the Information Technology Act, 2000 and the rules thereunder, and the Consumer Protection (E-Commerce) Rules, 2020 as applicable, we have appointed a Grievance Officer to address privacy concerns and consumer complaints. To the extent required under the Digital Personal Data Protection Act, 2023 and applicable rules, Mindswell will also make available the business contact information of the person responsible for answering questions regarding the processing of Personal Data and will appoint a Data Protection Officer if required to do so as a Significant Data Fiduciary. If you have any questions, complaints, or concerns about this Privacy Policy, our data practices, or consumer-facing Platform services, please contact:
Grievance Officer — Mindswell
Name: Chit Rokad
Company: Mindswell Innovations LLP
Email: admin@mindswell.in
Phone: +919979095901
Address: 8, Parivar Society, Prem Chand Nagar road, Satellite, Ahmedabad, Gujarat - 380015
Office Hours: Monday to Friday, 10:00 AM to 6:00 PM IST
We will acknowledge your complaint within 48 hours and endeavor to resolve it within 30 days of receipt.
12. Amendments to this Privacy Policy
Mindswell reserves the right to update or modify this Privacy Policy at any time. We will notify you of material changes by posting the updated Policy on the Platform with a revised 'Last Updated' date, and, where appropriate, by email or in-app notification. Your continued use of the Platform after any such changes constitutes your acceptance of the revised Privacy Policy.
13. Cross-Border Data Transfers
Your information may be transferred to and processed in countries outside India where our service providers operate. When we transfer information outside India, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws, including contractual protections such as standard contractual clauses or equivalent mechanisms.
This document was prepared for Mindswell Innovations LLP. It is intended as a starting point and should be reviewed and finalized by qualified legal counsel familiar with all applicable laws before publication. © 2025 Mindswell Innovations LLP. All rights reserved.
MINDSWELL
PRACTITIONER ACKNOWLEDGEMENT & ACCEPTANCE
For Psychologists Providing Services Through the Mindswell Platform
Document
Mindswell Terms of Use & Privacy Policy
Document Version
Effective January 1, 2025 | Last Updated September 17, 2026
Company
Mindswell Innovations LLP
Acknowledgement
I, the undersigned psychologist/practitioner, confirm that I have received and had the opportunity to review the Mindswell Terms of Use & Privacy Policy set out in the preceding pages. I acknowledge that the document forms part of the terms governing my use of, and provision of professional services through, the Mindswell platform.
• I have read and understood the provisions applicable to Practitioners and agree to comply with them while using the Mindswell platform.
• I will provide services only within the scope of my qualifications, competence, registrations, memberships, and applicable professional requirements.
• I will maintain professional and ethical standards, patient/client confidentiality, appropriate records, and the privacy and security of information entrusted to me.
• I will promptly inform Mindswell of any material change to my professional qualifications, registration or membership status, or other information relevant to my eligibility to provide services.
• I understand that this signed page is retained as a record of my receipt and acceptance of the Terms of Use & Privacy Policy and does not replace any separate Practitioner Agreement entered into with Mindswell Innovations LLP.
Practitioner Details & Signature
Full Legal Name
Professional Title
Psychologist
Email / Mobile
Signature
Date & Place
Please sign and return this page to Mindswell for record-keeping.