1. Our two roles
For a therapist’s own account information, Well-Being is the data fiduciary. For a therapist’s clients’ information (including clinical notes), the therapist is the data fiduciary and Well-Being is a data processor acting only on the therapist’s instructions. Clients should also read their therapist’s own privacy notice.
2. Information we handle
Provided by therapists
- Account and profile details: name, email, credentials, bio, photo, services, availability.
- Payment details you choose to display (for example a UPI ID) and your connected Google account, if you link one.
About clients
- Identity and contact details, booking history, and consent records.
- Sensitive clinical information — session notes, assessments (such as PHQ-9 / GAD-7) and mood logs. This content is encrypted at rest (AES-256-GCM) and is not readable by Well-Being outside the therapist’s authenticated session.
Collected automatically
- Sign-in and session data, and audit logs recording access to records (for security).
- Product analytics (PostHog). We use PostHog to understand feature usage and improve the product. Autocapture and session recording are disabled, we send only coarse page views with client/patient identifiers stripped from the URL, and we respect your browser’s Do-Not-Track signal. We never send names, clinical notes, assessments, or other identifying or health information to analytics.
- Basic technical and error logs needed to run and protect the service.
3. Why we use it and our lawful basis
We use this information only to provide and secure the service: to run your bookable page and scheduling, store notes for you, generate payment links and receipts, create video-call links, and keep the service safe. We rely on your consent and on the necessity of providing the service you asked for. We do not sell personal data or use clinical content for advertising.
4. Who we share it with
We share data only with service providers (processors) that help us run Well-Being, under contract:
- Vercel — application hosting and content delivery (compute may run outside India).
- Supabase — database and encrypted file storage, hosted in the Mumbai (India) region.
- Upstash — a cache used for rate-limiting and abuse prevention.
- Google — when a therapist signs in with Google or connects their Google account, to verify identity and (optionally) create Google Meet links via the Google Meet API. We request only the
openid,email,profileandmeetings.space.createdscopes; we do not access Gmail, Calendar, Drive, or contacts. - PostHog — privacy-preserving product analytics (see section 2).
- Razorpay — payment gateway for online/card payments where used. UPI payments are made directly between client and therapist; Well-Being does not store card details and takes no commission on session fees.
Google user data & Limited Use.Well-Being’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google account data is used only to provide the sign-in and Meet-link features you request; it is never sold, used for advertising, or transferred to others except as needed to provide those features or as required by law.
5. Storage, security and retention
Clinical content is encrypted at rest (AES-256-GCM), access is audit-logged, and access follows deny-by-default rules. Our database and file storage are hosted in the Mumbai (India) region; some providers (for example our hosting/CDN and analytics) may process limited data outside India under contractual safeguards. We keep information while your account is active and for up to 90 days after you close it (or longer where the law requires), after which we delete or anonymise it.
6. Your rights
Subject to law, you can ask to:
- access the personal data we hold about you and get a copy (export);
- correct or update inaccurate data;
- delete your data / close your account;
- withdraw consent, and know who your data has been shared with.
Clients: many of these requests are handled through your therapist, who controls your clinical records. To make a request to Well-Being, contact us at wellbeingwithus@gmail.com.
7. Grievances and breaches
Our grievance contact is Shubham Gurav (wellbeingwithus@gmail.com). If a personal-data breach occurs, we will act on it and notify the affected people and the Data Protection Board of India as required by law, aiming to do so without undue delay after becoming aware.
8. Children
Well-Being is not directed at children, and accounts require users to be at least 18. Where a therapist’s client is a minor, the therapist is responsible for obtaining verifiable consent from a parent or lawful guardian, as required by the DPDP Act.
9. Changes and contact
We will post updates to this policy here and update the effective date. Questions or requests: wellbeingwithus@gmail.com.