Data Processing Consent | Hey Attrangi

1Introduction

This Data Processing Consent governs how we collect, process, store, analyze, share, and protect your Personal Data, Sensitive Personal Data, and Health Information when you use the Hey Attrangi platform.

We process your data in compliance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, the Mental Healthcare Act, 2017, and other applicable laws of the Republic of India.

This Consent supplements our other policies, including our Privacy Policy, General Treatment Consent, AI Assistance Consent, Teletherapy Consent, Session Recording Consent, Emergency Contact Authorization, and Crisis Intervention Consent.

2Scope

This Consent applies to all users of the Platform, including adult users and minor users (through their caregivers), who access any feature of the Platform, including AI-assisted services, therapist-led services, or any other Platform features.

This Consent governs the processing of all Personal Data, Sensitive Personal Data, and Health Information collected, processed, stored, analyzed, shared, or protected by us in connection with the Platform and our Services.

This Consent does not govern processing activities that are exempt from consent requirements under applicable law (legitimate uses), which shall be governed by applicable law.

3Relationship with Other Documents

This Consent should be read together with the following documents:

Privacy Policy - Governs the collection, processing, storage, and disclosure of your personal data.
General Treatment Consent - Governs your consent to receive mental wellness and therapeutic services.
AI Assistance Consent - Governs your consent to use artificial intelligence features.
Teletherapy Consent - Governs your consent to receive therapist-led teletherapy services.
Session Recording Consent - Governs the recording of therapy sessions.
Emergency Contact Authorization - Authorizes us to contact your designated emergency contacts.
Crisis Intervention Consent - Governs crisis detection and intervention.
Data Retention & Deletion Policy - Governs the retention and deletion of your data.
Terms and Conditions - Governs your general use of the Platform.

In the event of any conflict between this Consent and any other document, the hierarchy established in our General Treatment Consent shall apply.

4Definitions

"Personal Data" - Any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023.
"Sensitive Personal Data" - Personal data that may pose a higher risk of harm if compromised, including but not limited to health data, as defined under the Digital Personal Data Protection Act, 2023.
"Health Information" - Any information relating to your physical or mental health.
"Data Fiduciary" - The entity that determines the purpose and means of processing personal data.
"Data Processor" - Any entity that processes personal data on behalf of the Data Fiduciary.
"Data Principal" - The individual to whom the personal data relates.
"Processing" - Any operation performed on personal data, whether or not by automated means.
"De-identification" - Removing or modifying personal identifiers so the data cannot reasonably be linked to an identifiable individual.
"Anonymization" - Rendering data irreversible so it cannot be linked to an identifiable individual by any means.
"Aggregation" - Combining data from multiple individuals into summary form so individual-level data cannot be identified.
"Pseudonymization" - Replacing identifying information with pseudonyms so the data cannot be attributed to a specific individual without additional information.
"Voice Input" - The functionality that allows you to speak to the AI companion using your device's microphone, with your speech being converted into text by a trusted speech recognition service.
"Transcript" - The text generated from your speech through the speech recognition process.

5Data Processing Principles

We adopt and adhere to the following data processing principles:

Lawfulness - We process personal data only on the basis of valid consent obtained in accordance with applicable law, or on the basis of legitimate uses as set forth in the law.
Fairness - We process personal data in a manner that is fair and not prejudicial to your rights and interests.
Transparency - We provide clear and transparent information regarding the collection, processing, storage, and sharing of your personal data through this Consent, our Privacy Policy, and other applicable notices.
Purpose Limitation - We process personal data only for the purposes for which consent has been obtained and that are specified in this Consent and our Privacy Policy.
Data Minimization - We collect and process only such personal data as is reasonably necessary for the specified purposes.
Accuracy - We make reasonable efforts to ensure that personal data is accurate and, where necessary, kept up to date.
Storage Limitation - We do not retain personal data longer than is necessary for the purposes for which it was processed, subject to legal, regulatory, and clinical documentation obligations.
Integrity and Confidentiality - We implement and maintain appropriate technical and organizational measures to ensure the integrity and confidentiality of personal data.
Accountability - We are accountable for our processing activities and demonstrate compliance with applicable data protection laws.
Privacy by Design - We integrate data protection principles into the design and development of the Platform and our Services.
Security by Design - We incorporate security measures into the design and development of the Platform and our Services.

6Categories of Data

We collect, process, and store the following categories of data:

Identity Information - Name, date of birth, gender, government-issued identification information, and other information that identifies you.
Profile Information - Username, profile preferences, communication preferences, and other information related to your profile on the Platform.
Contact Information - Email address, phone number, postal address, and other contact details.
Caregiver Information - Information regarding the caregiver of a minor user, including identity, contact information, and relationship to the user.
Emergency Contact Information - Names, contact numbers, and relationships of designated emergency contacts.
Health Information - Information relating to your mental and physical health, including but not limited to mood logs, journal entries, assessment responses, audio recordings, therapy transcripts, clinical notes, AI reports, and medication information.
Mood Logs - Records of your mood tracking activities, including mood ratings, notes, and patterns.
Journal Entries - Content you create through the guided journaling feature.
Assessment Responses - Responses to psychological screening assessments and other questionnaires.
Audio Recordings - Audio recordings of therapy sessions, as governed by the Session Recording Consent.
Therapy Transcripts - Transcripts of therapy sessions generated from audio recordings.
Clinical Notes - Clinical notes prepared by licensed therapists.
AI Reports - Reports and summaries generated by the AI System.
Medication Information - Information regarding medications, including names, dosages, schedules, and adherence data.
Images - Images you upload to the Platform.
Usage Analytics - Analytical data regarding your use of the Platform and its features.
Behavioural Interaction Data - Data regarding your interactions with the Platform, including usage patterns, feature engagement, and navigation.
Technical Information - Device information, browser information, IP addresses, and other technical data.
Device Information - Information about the device used to access the Platform, including device type, operating system, and hardware specifications.
Security Logs - Logs of security-related events, including authentication attempts, access logs, and security incidents.
System Logs - Technical logs regarding your use of the Platform, including timestamps and system performance data.
Payment-Related Information - Information necessary for payment processing, including billing address and transaction details, collected only to the extent necessary for payment processing.
Voice Input - Audio captured from your device's microphone when you choose to use voice input, processed solely for speech-to-text conversion. Raw audio is not retained after successful transcription. Only the generated transcript becomes part of your conversation history. No speaker identification, voice authentication, voice biometrics, voice profiling, voice cloning, or voiceprint creation is performed.

7Purposes of Processing

We process your data for the following purposes:

Account Creation - Creating and managing your account on the Platform.
Identity Verification - Verifying your identity and, where applicable, the identity of caregivers.
Clinical Care - Providing mental healthcare services through the Platform, including therapy, counselling, and clinical assessment.
Therapy - Facilitating therapist-led consultations and therapeutic interventions.
AI Assistance - Providing AI-powered features, including the AI conversational companion, personalized recommendations, and wellness plans.
Voice Input Processing - Converting spoken input into text for AI interaction when you choose to use voice input, as described in Clause 6. Raw audio is not retained after successful transcription.
Personalization - Tailoring your experience, recommendations, and content to your preferences and needs.
Conversation Continuity - Maintaining memory and context across conversations.
Mood Tracking - Enabling you to record, monitor, and track your emotional states.
Journaling - Enabling you to record your thoughts, feelings, and experiences.
Medication Reminders - Providing notifications to support adherence to prescribed medication regimens.
Psychological Screening - Administering screening tools to assess aspects of your mental health.
Clinical Documentation - Maintaining accurate, complete, and timely clinical records.
Safety Monitoring - Monitoring for potential safety concerns, including crisis situations.
Crisis Intervention - Identifying and responding to mental health crises.
Quality Assurance - Monitoring and evaluating the quality of our Services.
Research - Conducting clinical research to improve understanding of mental health and therapeutic outcomes.
Academic Collaborations - Collaborating with academic institutions on research projects.
Institutional Research - Conducting research in collaboration with institutional partners.
Internal Analytics - Analyzing usage patterns, trends, and outcomes.
AI Benchmarking - Measuring and benchmarking the performance of the AI System.
AI Validation - Validating the performance, accuracy, and safety of the AI System.
AI Evaluation - Evaluating the AI System's performance, safety, and effectiveness.
AI Model Improvement - Training, fine-tune, and improving future versions of the AI System.
Platform Improvement - Enhancing the Platform's functionality, security, and user experience.
Fraud Prevention - Detecting and preventing fraudulent or improper use of the Platform.
Security - Protecting the Platform and your data from unauthorized access, disclosure, alteration, or destruction.
Legal Compliance - Complying with applicable laws, regulations, and legal obligations.
Regulatory Compliance - Complying with regulatory requirements, including those under the Digital Personal Data Protection Act, 2023 and the Mental Healthcare Act, 2017.

8Third-Party Processing

We engage trusted third-party service providers to process data on behalf of the Platform for the following purposes:

Cloud Hosting - Secure cloud infrastructure for data storage and processing.
AI Technologies - AI models and technologies provided by third-party providers.
Email Delivery - Sending notifications, reminders, and communications to you.
Authentication - Identity verification and authentication services.
Analytics - Usage analytics and performance monitoring.
Crash Reporting - Monitoring and reporting of technical crashes and errors.
Payment Processing - Processing of payments for Services.
Video Consultation Infrastructure - Infrastructure supporting secure video consultations.
Push Notifications - Sending push notifications to you.
Speech-to-Text Processing - Converting voice input into text when you choose to use this feature. Trusted third-party speech recognition providers may temporarily process voice input solely for the purpose of transcription, operating under contractual confidentiality and security obligations. Raw audio is not retained after successful transcription.
Other Essential Platform Services - Any other services necessary for the operation of the Platform.

All third-party service providers we engage must operate under appropriate contractual arrangements that include:

Confidentiality Obligations - Contractual obligations to maintain the confidentiality of your data.
Privacy Obligations - Obligations to protect your data in accordance with applicable law.
Security Obligations - Obligations to implement and maintain appropriate security measures.
Data Protection Obligations - Obligations to comply with the Digital Personal Data Protection Act, 2023 and other applicable data protection laws.
Audit Rights - Rights for us to audit the provider's data protection and security practices.

9Cross-Border Processing

Your data is primarily processed within the Republic of India.

Where processing by trusted third-party service providers involves another jurisdiction, appropriate contractual, technical, and legal safeguards shall be implemented in accordance with applicable law.

Cross-border data transfers are permitted under the Digital Personal Data Protection Act, 2023 unless the Central Government notifies a country or territory as restricted. We shall comply with any such restrictions notified by the Central Government.

10Automated Processing

The AI System may assist with automated processing of your data for the following purposes:

Recommendations - Generating personalized recommendations for wellness activities, coping strategies, and self-care practices.
Prioritization - Prioritizing clinical concerns and safety alerts.
Risk Identification - Identifying potential clinical risks, including crisis situations.
Summaries - Generating summaries of your interactions and clinical data.
Clinical Support - Providing insights and information to support clinical decision-making.
Workflow Assistance - Assisting licensed therapists with documentation and workflow management.

You acknowledge and understand that:

Final clinical decisions remain with qualified mental health professionals whenever therapist-led care is involved;
Automated processing does not replace clinical judgement;
The AI System is a supportive tool that complements, not replaces, professional clinical decision-making; and
We maintain human oversight of automated processing activities.

11Research and AI Development

Subject to applicable law and this Consent, appropriately de-identified, anonymized, aggregated, or pseudonymized information may be used for the following purposes:

Clinical Research - Conducting research to improve understanding of mental health, wellbeing, and therapeutic outcomes.
Academic Publications - Publishing research findings in academic journals and conferences, with appropriate safeguards to prevent identification of individual users.
Institutional Collaborations - Collaborating with academic and research institutions on research projects.
Product Research - Conducting research to inform product development and improvement.
AI Benchmarking - Measuring and benchmarking the performance of the AI System.
AI Evaluation - Evaluating the AI System's performance, safety, and effectiveness.
AI Validation - Validating the performance, accuracy, and safety of the AI System.
Future AI Model Improvement - Training, fine-tuning, and improving future versions of the AI System.
Internal Analytics - Analyzing usage patterns, trends, and outcomes to inform service improvement.

We shall apply appropriate safeguards to research and AI development activities, including:

De-identification: Removing or modifying personal identifiers from data used for research or AI improvement;
Anonymization: Rendering data irreversible such that it cannot be linked to an identifiable individual, where feasible and appropriate;
Aggregation: Combining data from multiple individuals into summary form; and
Pseudonymization: Replacing identifying information with pseudonyms.

No research shall intentionally identify individual users. Any publications or presentations resulting from research shall not include information that could reasonably identify individual users.

12Your Rights

As a Data Principal, you have the following rights under the Digital Personal Data Protection Act, 2023:

Right to Access Information - The right to access information about your personal data, including what data is being collected and how it is being used.
Right to Correction - The right to request correction of inaccurate or incomplete personal data.
Right to Updating - The right to request updating of personal data.
Right to Erasure - The right to request erasure of personal data when the processing purpose is fulfilled or consent is withdrawn, subject to reasonable exceptions. Under the DPDP Act, we must erase personal data upon withdrawal of consent or when the purpose is no longer being served, unless retention is mandated by law.
Right to Grievance Redressal - The right to file a complaint with the Data Protection Board of India.
Right to Withdraw Consent - The right to withdraw consent at any time, with the process for withdrawal being as easy as giving consent.
Right to Nominate - The right to nominate an individual to exercise rights posthumously or in cases of incapacity.

Requests for access, correction, updating, or erasure shall be processed in accordance with our Privacy Policy, our Data Retention & Deletion Policy, and applicable law.

We may limit the exercise of your rights where:

Required by applicable law;
Necessary for the establishment, exercise, or defense of legal claims;
Necessary for compliance with a legal obligation, including clinical documentation requirements under the Mental Healthcare Act, 2017;
Necessary for regulatory record retention obligations; or
Otherwise permitted under the Digital Personal Data Protection Act, 2023.

13Withdrawal of Consent

You may withdraw this Consent at any time by providing written notice to us through the Platform or by email to contact@heyattrangi.com.

Withdrawal of consent shall be effective upon receipt of the notice by us, subject to any processing that may have already been completed prior to such withdrawal.

Upon withdrawal of consent, we shall cease processing your personal data for the purposes for which consent was withdrawn, except to the extent that continued processing is:

Required by applicable law;
Necessary for the establishment, exercise, or defense of legal claims;
Necessary for compliance with a legal obligation, including clinical documentation requirements under the Mental Healthcare Act, 2017;
Necessary for regulatory record retention obligations; or
Otherwise permitted under the Digital Personal Data Protection Act, 2023.

You acknowledge that upon withdrawal of consent:

AI services may become unavailable;
Therapy services may become unavailable where processing is essential for the provision of such services;
Previously anonymized research datasets may continue to be used; and
Information required by law or clinical documentation obligations may continue to be retained.

Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

14Security Safeguards

We implement and maintain reasonable security safeguards to protect your data from unauthorized access, disclosure, alteration, or destruction, in compliance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

Security safeguards include, but are not limited to:

Encryption - Encryption of data at rest and in transit using industry-standard encryption protocols.
Authentication - Multi-factor authentication for access to sensitive systems and data.
Role-Based Access Control - Access restricted to authorized personnel on a need-to-know basis.
Audit Logging - Comprehensive audit logs of all access to and modifications of your data.
Monitoring - Continuous monitoring of systems for security incidents and unauthorized access.
Secure Cloud Infrastructure - Data stored in secure cloud infrastructure managed by or on our behalf.
Incident Response - Procedures for investigating and responding to security incidents.
Business Continuity - Business continuity and disaster recovery procedures.
Backup - Regular backups of your data to prevent data loss.
Security Reviews - Periodic security reviews and assessments.

We shall comply with the reasonable security practices and procedures required under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.

15Governing Law

This Consent shall be governed by and construed in accordance with the laws of the Republic of India.

The courts of Dharwad, Karnataka, India shall have exclusive jurisdiction over any disputes arising out of or in connection with this Consent, subject to the dispute resolution provisions set forth below.

16Dispute Resolution

We and you shall make reasonable efforts to resolve any disputes arising out of or in connection with this Consent or data processing through good-faith negotiations.

If the dispute cannot be resolved through negotiations within thirty (30) days of the date on which either party notifies the other of the dispute, the dispute shall be referred to mediation in accordance with the provisions of the Arbitration and Conciliation Act, 1996.

If mediation is unsuccessful, the dispute shall be finally settled by arbitration in accordance with the Arbitration and Conciliation Act, 1996. The arbitration shall be conducted in English at Dharwad, Karnataka, India, by a sole arbitrator appointed by mutual agreement of the parties or, failing such agreement, by us.

You acknowledge that you may also have the right to file a complaint with the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023.

Nothing in this section shall prevent either party from seeking interim or injunctive relief from a court of competent jurisdiction.

17Acknowledgement

By providing this Consent, you (or in the case of a minor user, the caregiver) acknowledge that:

You have read, understood, and agreed to all the terms and conditions set forth in this Consent;
You have had the opportunity to ask questions and seek clarification regarding any aspect of this Consent or data processing;
You understand the data processing principles set forth in this Consent;
You understand the categories of data collected and the purposes for which they are processed;
You understand that your data may be shared with trusted third-party service providers operating under appropriate contractual obligations;
You understand that your data may be processed outside India, subject to appropriate safeguards;
You understand that automated processing, including AI assistance, may be used in connection with your data;
You understand that your de-identified, anonymized, aggregated, or pseudonymized data may be used for research and AI development;
You understand your rights as a Data Principal, including the right to access, correction, erasure, and grievance redressal;
You understand that you may withdraw this Consent at any time, and that withdrawal may impact your access to Services;
You understand that we have implemented reasonable security safeguards to protect your data;
You understand that voice input is optional and that raw audio is not retained after successful transcription;
You understand that microphone permission may be withdrawn at any time through your device settings;
You understand that speech recognition may occasionally generate inaccurate transcripts and that you remain responsible for reviewing important information;
You understand that this Consent is a legally binding document and that you are providing this Consent freely, without any coercion, undue influence, fraud, misrepresentation, or mistake; and
You have received a copy of this Consent or have been provided with access to it through the Platform.

18Digital Signature

By checking the box or clicking the "I Agree" button on the Platform, I acknowledge that I have read, understood, and agree to be bound by the terms of this Data Processing Consent. I confirm that I am providing this Consent freely, voluntarily, and without any coercion, undue influence, fraud, misrepresentation, or mistake.

I understand that this digital acknowledgement constitutes my legally binding signature and consent under applicable law.

Contact Us

If you have any questions about this Data Processing Consent or our data practices, please contact us:

Email: contact@heyattrangi.com

END OF DOCUMENT