Privacy Policy

Last updated 14 October 2026 · Notice version: Privacy notice 1.0

This policy explains how The Mind Project (“the clinic”, “we”) collects, uses, stores and shares your personal data, including information about your health, and the rights you have over it. It is written to meet the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, and the confidentiality duties of the Mental Healthcare Act, 2017.

1. Who is responsible for your data

The clinic that treats you is the Data Fiduciary: it decides why and how your personal data is processed. The clinic keeps its records on The Mind Project clinical software, which processes the data only on the clinic’s instructions, as its Data Processor.

2. What we collect

• Identity and contact details: name, date of birth, sex, pronouns, phone, email, address, preferred language, occupation, ABHA ID if you give it, and details of an emergency contact, guardian or nominated representative.
• Health information: the reason for your visit, past and present history, diagnoses, medicines, allergies, mental status and risk assessments, questionnaire scores, test results, consultation notes, prescriptions, letters and reports you share with us, and voice notes your clinician records about your care.
• Visit and administrative details: appointments, your place in the day’s queue, fees and payment status, and your consent decisions.
• Records of access: an audit trail of who opened or changed your record and when.

Staff of the clinic also have an account (name, work email or username, role and activity) which is processed to run the service securely.

3. Why we use it, and on what basis

• To assess, diagnose and treat you, plan your care, write prescriptions and keep your medical record: with your consent, which we record in your chart together with the version of this notice you were given.
• To send you documents such as your prescription on WhatsApp or by message: only with your separate consent for communication.
• To handle a medical emergency or a threat to your life or health, to comply with a law or a court order, or to keep records the law requires: as a legitimate use permitted by Section 7 of the DPDP Act, without separate consent.
• To keep the service secure: for example audit trails and sign-in checks.

We do not sell your data, use it for advertising, or make automated decisions about you. Questionnaire scores support your clinician’s judgement; they do not by themselves create a diagnosis.

4. Your consent

Consent is asked for clearly, for a specific purpose, and recorded with the date and notice version. You may withdraw consent at any time, as easily as you gave it, by telling the clinic or the grievance officer. After you withdraw, we stop new processing for that purpose (for example, new entries for clinical care are paused, and private prescription links are withdrawn when communication consent is withdrawn). Withdrawal does not undo processing done before, and records the law requires us to keep are kept for the required period.

For a child (under 18), consent is given by a parent or lawful guardian, whose identity we verify. For a person who has a lawful guardian, or who has appointed a nominated representative under the Mental Healthcare Act, 2017, we act with that person as the law allows. You may also give an advance directive about your mental health care.

5. Who can see your data

• The clinic team, by role: your consultant and the clinic’s clinical director see your clinical record; front-desk assistants see only registration, appointments, the queue and the history you report, not consultation notes, diagnoses, risk assessments or prescriptions. Every access is recorded.
• Service providers working for the clinic under contract, only to run the service:
  • Supabase: database, file storage and staff sign-in. Your records are stored in Mumbai, India.
  • Netlify: hosting. Requests to the website are processed on servers in Singapore while they are handled, and are not stored there.
  • WhatsApp (Meta): only when you agree to receive a document; the message carries a private link that expires after 7 days, not the document itself.
  • Google: if a clinician uses voice typing in the Chrome or Edge browser, their speech is converted to text by Google’s speech service; only the resulting text is saved.
• Others, only when the law requires or allows it: for example a court order, a public-health duty, or to protect you or someone else from serious harm. Under the Mental Healthcare Act, 2017, information about your mental health care is kept confidential and shared only in the circumstances that Act allows.

6. Where your data is kept, and for how long

Records are stored in India (Mumbai). Short-lived processing of requests happens in Singapore, a country to which transfer is permitted under the DPDP Act.

Medical records are kept for at least three years from your last visit, as required of registered medical practitioners, and longer where another law, an ongoing case or your continuing care requires it. When the retention period ends and no law requires us to keep the record, it is erased. Signed records are never changed after signing; a correction is added as a dated amendment.

7. How we protect it

Data is encrypted in transit (HTTPS) and stored encrypted by our database provider. Access is limited by role and checked on every request; staff accounts can be switched off at once; documents are kept in private storage and opened through short-lived links; prescription links expire and can be withdrawn; and an audit trail records access and changes. Staff are bound by professional confidentiality.

8. If there is a breach

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person without delay, as the DPDP Rules require, describing what happened, the likely consequences, what we are doing about it and what you can do to protect yourself.

9. Your rights

• Access: a summary of the personal data we hold about you, how it is used, and with whom it has been shared. You may also request a copy of your medical records; we provide them within 72 hours of a request where the professional regulations require it. Under the Mental Healthcare Act, 2017, access to some mental health information may be limited where your clinician judges that disclosure would cause serious harm; you will be told if this applies.
• Correction and completion: ask us to correct or update inaccurate or incomplete data.
• Erasure: ask us to erase data that is no longer needed. Medical records the law requires us to keep cannot be erased before the retention period ends.
• Withdraw consent (see section 4).
• Nominate a person to exercise these rights if you die or are unable to.
• Grievance redressal: contact the grievance officer below. We respond as soon as possible and in any case within 90 days. If you are not satisfied, you may complain to the Data Protection Board of India.

To use any of these rights, contact the clinic or its grievance officer. We may ask you to confirm your identity first.

10. Cookies

Only essential cookies are used, to keep clinic staff signed in securely. There are no advertising or tracking cookies. Patients do not need an account; a prescription link works without cookies.

11. Changes to this policy

When this policy changes, the clinic will tell you and, where needed, ask for your consent again. The version of the notice you were given is recorded with your consent.