Attrangi Private Limited
Legal Document

Privacy Policy

Effective Date: 23 JUL 2026

Last Updated: 23 JUL 2026

1Introduction

Aatrangi Private Limited (the "Company", "we", "us", or "our") operates the Hey Attrangi platform (the "Platform"), an AI-assisted mental wellness platform providing emotional wellbeing support, therapist consultations, and related services.

This Privacy Policy (this "Policy") describes how we collect, use, process, store, share, and protect the personal information of individuals who visit our website, use our web application, mobile applications (Android and iOS), or otherwise interact with our Platform and Services.

This Policy is designed to comply with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000, the Mental Healthcare Act, 2017, the Telemedicine Practice Guidelines, 2020, and other applicable laws of the Republic of India.

We are committed to protecting your privacy and handling your personal information with transparency, fairness, and accountability. We process personal data only for lawful, specific, and necessary purposes, and we implement appropriate safeguards to protect your information.

2Scope

This Policy applies to all individuals who interact with the Platform, including:

  • Users: Individuals who register on, access, or use any feature of the Platform.
  • Patients: Users who receive therapist-led clinical or therapeutic services through the Platform.
  • Caregivers: Parents or legal guardians who create and manage accounts for Minor Users.
  • Therapists: Licensed mental health professionals who provide Services through the Platform.
  • Institutional Administrators: Representatives of schools, colleges, universities, or other institutions that partner with the Company.
  • Support Personnel: Individuals who provide technical, administrative, or clinical support services.

This Policy covers all products, services, websites, applications, and platforms operated under the Hey Attrangi brand, including:

  • The website located at https://www.heyattrangi.com/
  • The web application
  • The Android mobile application
  • The iOS mobile application
  • The Therapist Portal
  • The Administrative Dashboard
  • The Institutional Dashboard
  • All application programming interfaces (APIs)
  • Any future products, modules, and official services developed by the Company

This Policy does not apply to third-party websites, applications, or services that may be linked to or integrated with the Platform. We are not responsible for the privacy practices of such third practices.

3Definitions

For the purposes of this Policy, the following terms shall have the meanings set forth below:

  • "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
  • "Sensitive Personal Data" means personal data that may pose a higher risk of harm to the Data Principal if compromised, including but not limited to health data, as may be defined under the DPDP Act and the rules thereunder.
  • "Health Information" means any information relating to the physical or mental health of a User.
  • "Data Fiduciary" means the Company as the entity that determines the purpose and means of processing personal data, as defined under the DPDP Act.
  • "Data Processor" means any entity that processes personal data on behalf of the Data Fiduciary.
  • "Data Principal" means the individual to whom the personal data relates, as defined under the DPDP Act.
  • "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, as defined under the DPDP Act.
  • "Minor" means an individual below the age of eighteen (18) years.
  • "Caregiver" means a parent or legal guardian who is legally authorized to make decisions on behalf of a Minor User.

4Information We Collect

We collect information that you provide directly to us, information that is automatically collected through your use of the Platform, and information that we receive from third parties.

Information You Provide

Account Creation Information: When you create an account on the Platform, we collect:

  • Your name and date of birth
  • Your email address and phone number
  • Your gender and other demographic information (optional)
  • Your password and security credentials
  • Your preferences and communication settings

Account Creation Methods: Accounts may be created using:

  • Google Sign-In: If you choose to sign in using Google, we receive your name, email address, and profile information from Google. We do not receive your Google password.
  • Phone OTP: If you choose to sign in using a phone number, we send a one-time password to your phone for verification.
  • Institutional Single Sign-On (SSO): If you access the Platform through an institution, we receive information from your institution to authenticate your identity.

Age Verification: Age verification currently relies upon self-declaration. Additional verification mechanisms may be introduced where appropriate.

Caregiver Information: If you are a Caregiver of a Minor User, we collect:

  • Your name, email address, and phone number
  • Your relationship to the Minor User
  • Your government-issued identification information, where required
  • Your consent records for the processing of the Minor User's personal data

Emergency Contact Information: We collect the names, contact numbers, and relationships of your designated Emergency Contacts.

Profile Information: We collect information that you choose to add to your profile, including but not limited to:

  • Profile picture
  • Bio or description
  • Wellness goals and preferences
  • Communication preferences
  • Any other information you choose to provide

Health Information: We collect health information that you provide through the Platform, including but not limited to:

  • Mood Logs: Records of your mood tracking activities, including mood ratings, notes, and patterns
  • Journal Entries: Content created through the guided journaling feature
  • Assessment Responses: Responses to psychological screening assessments and other questionnaires
  • Medication Information: Information regarding medications, including names, dosages, schedules, and adherence data
  • Audio Recordings: Audio recordings of therapy sessions
  • Therapy Transcripts: Transcripts of therapy sessions generated from audio recordings
  • AI Conversations: Records of your interactions with the AI conversational companion

Clinical Information: If you receive therapist-led services, we collect clinical information documented by your Licensed Therapist, including:

  • Clinical notes and observations
  • Treatment plans and therapeutic objectives
  • Diagnostic impressions
  • Progress notes

Images: We collect images that you upload to the Platform.

Support Requests: We collect information that you provide when you contact our support team, including:

  • Your contact information
  • The nature of your inquiry or concern
  • Any attachments or supporting information
  • Records of our communications with you

Feedback: We collect feedback that you provide regarding the Platform, Services, or AI System.

Institution Information: If you access the Platform through an institution, we collect information provided by your institution, including:

  • Your name and contact information
  • Your student or employee identification number

Information Automatically Collected

Usage Analytics: We collect information about how you use the Platform, including:

  • Pages and features you access
  • Time spent on the Platform
  • Features you engage with
  • Navigation patterns
  • Interaction history

Behavioural Interaction Data: We collect data regarding your interactions with the Platform, including click patterns and taps, scroll behavior, session duration and frequency, and feature usage patterns.

Device Information: We collect information about the device you use to access the Platform, including:

  • Device type and model
  • Operating system and version
  • Browser type and version
  • Screen resolution and orientation
  • Device identifiers (e.g., IP address, device ID)
  • Network information

Technical Information: We collect technical information, including:

  • IP addresses
  • Geographic location (approximate)
  • Timestamps and time zones
  • Page load times and performance metrics
  • Error logs and crash reports

Security Logs: We collect logs of security-related events, including:

  • Authentication attempts and login history
  • Access logs for sensitive systems and data
  • Security incident records
  • System activity and audit trails

System Logs: We collect technical logs regarding your use of the Platform, including timestamps, system performance data, and technical diagnostics.

Cookies: We collect information through cookies and similar tracking technologies. Please see the Cookies section of this Policy for more information.

Information from Third Parties

Payment Information: We collect payment-related information necessary for processing payments, including billing address and transaction details, collected only to the extent necessary for payment processing through our trusted payment providers.

Third-Party Authentication: If you sign in using Google Sign-In or institutional SSO, we receive information from these third parties to authenticate your identity.

5How We Use Information

We process your information for the following purposes:

  • Providing Services: To provide, maintain, and improve the Platform and its Services, including AI-assisted wellness support, therapist consultations, mood tracking, journaling, and wellness activities.
  • AI Assistance: To power AI features, including the conversational companion, personalized recommendations, wellness plans, and crisis detection.
  • Therapy: To facilitate therapist-led consultations and therapeutic interventions.
  • Clinical Documentation: To maintain accurate, complete, and timely clinical records in accordance with Section 25 of the Mental Healthcare Act, 2017 and professional standards.
  • Conversation Continuity: To maintain memory and context across conversations to support continuity of care.
  • Mood Analysis: To analyze your mood based on inputs, assessments, and interaction patterns to provide insights and recommendations.
  • Personalization: To tailor your experience, recommendations, and content to your preferences and needs.
  • Medication Reminders: To provide notifications to support adherence to prescribed medication regimens.
  • Wellness Activities: To recommend and facilitate engagement with wellness activities.
  • Appointment Management: To schedule, confirm, and remind you of appointments with Licensed Therapists.
  • Safety Monitoring: To monitor for potential safety concerns, including crisis situations.
  • Crisis Intervention: To identify and respond to mental health crises.
  • Identity Verification: To verify your identity and prevent fraud.
  • Fraud Prevention: To detect and prevent fraudulent or improper use of the Platform.
  • Security: To protect the Platform and your information from unauthorized access, disclosure, alteration, or destruction.
  • Customer Support: To respond to your inquiries, requests, and concerns.
  • Research: To conduct clinical research to improve understanding of mental health, wellbeing, and therapeutic outcomes, subject to appropriate safeguards.
  • Academic Publications: To publish research findings in academic journals and conferences, with appropriate safeguards to prevent identification of individual Users.
  • Institutional Research: To conduct research in collaboration with institutional partners.
  • AI Benchmarking: To measure and benchmark the performance of the AI System.
  • AI Validation: To validate the performance, accuracy, and safety of the AI System.
  • Future AI Improvement: To train, fine-tune, and improve future versions of the AI System.
  • Product Development: To develop and enhance the Platform's functionality, security, and user experience.
  • Legal Compliance: To comply with applicable laws, regulations, and legal obligations, including the DPDP Act, the Information Technology Act, 2000, and the Mental Healthcare Act, 2017.

We process your personal data only for the purposes for which consent has been obtained, or on the basis of legitimate uses as set forth in Section 7 of the DPDP Act.

6AI Processing

The Platform may utilize one or more artificial intelligence models and technologies to provide AI-assisted mental wellness services.

The Platform may utilize AI technologies developed internally by the Company and/or provided by trusted third-party service providers operating under appropriate contractual, privacy, confidentiality, and security obligations.

The AI System assists with:

  • Providing conversational emotional wellbeing support
  • Generating personalized recommendations and wellness plans
  • Analyzing mood and behavioral patterns
  • Identifying potential safety concerns and crisis indicators
  • Generating summaries and reports
  • Supporting clinical decision-making
  • Enhancing the user experience

Important Notes About AI:

  • The AI System is not a psychologist, psychiatrist, therapist, physician, or healthcare practitioner
  • The AI System does not independently diagnose any medical or psychological condition
  • The AI System does not prescribe medication
  • The AI System does not replace licensed mental healthcare professionals, clinical judgment, or therapeutic intervention
  • The AI System does not make clinical decisions, which remain solely with Licensed Therapists and other qualified mental health professionals
  • The AI System is a supportive tool designed to complement, not replace, professional mental healthcare
  • The AI System should not be relied upon as the sole source of mental health support, clinical guidance, or emergency response
  • Final clinical decisions remain with qualified mental health professionals whenever therapist-led care is involved.

For more information on AI processing, please refer to our AI Transparency Statement.

7Information Sharing

We share your information only as described in this Policy and in accordance with applicable law.

Sharing with Therapists

If you are a Patient receiving therapist-led services, we share your information with your assigned Licensed Therapist to facilitate clinical care. This includes:

  • Health Information, including mood logs, journal entries, assessment responses, and medication information
  • Clinical Information, including therapist notes, treatment plans, and progress notes
  • AI-generated reports and summaries
  • Audio recordings and therapy transcripts
  • Any other information necessary for the provision of clinical care

Sharing with Caregivers

If you are a Minor User, we share information with your Caregiver in accordance with the General Treatment Consent and the Teletherapy Consent. This includes:

  • Appointment reminders and therapy-related communications
  • Crisis and emergency notifications
  • Progress summaries (subject to the Licensed Therapist's clinical judgment)
  • Safety updates
  • Any other information necessary for the Caregiver to manage the Minor User's care

Sharing with Emergency Contacts

We share information with your designated Emergency Contacts in accordance with the Emergency Contact Authorization. This includes only information reasonably necessary to protect your health or safety, such as:

  • Your identity and name
  • The nature of the emergency or crisis
  • Your current known location (where available)
  • Relevant safety concerns
  • Recommended immediate actions
  • Contact instructions

Sharing with Authorized Clinical Personnel

We share information with authorized clinical personnel, including clinical supervisors, clinical governance personnel, and crisis response staff, for purposes including:

  • Clinical supervision and quality assurance
  • Crisis intervention and safety monitoring
  • Clinical documentation and record maintenance
  • Clinical governance and risk management

Sharing with Authorized Support Personnel

We share information with authorized support personnel, including technical support, customer support, and administrative staff, for purposes including:

  • Technical support and troubleshooting
  • Customer service and inquiry resolution
  • Platform maintenance and improvement
  • Administrative functions

Sharing with Trusted Service Providers

We share information with trusted third-party service providers who perform services on our behalf, including:

  • Cloud Infrastructure Providers: For secure data storage and processing
  • AI Providers: For AI models and technologies
  • Communication Providers: For email delivery, SMS delivery, and push notifications
  • Payment Providers: For payment processing
  • Video Consultation Providers: For secure video consultation infrastructure
  • Analytics Providers: For usage analytics and performance monitoring
  • Authentication Providers: For identity verification and authentication
  • Other Essential Service Providers: For any other services necessary for the operation of the Platform

All third-party service providers are bound by contractual obligations to protect your information, including confidentiality, privacy, security, and data protection obligations.

Sharing with Regulatory Authorities and Law Enforcement

We share information with regulatory authorities, law enforcement, and competent authorities where:

  • Required by applicable law, including the DPDP Act, the Information Technology Act, 2000, and the Mental Healthcare Act, 2017
  • Necessary to comply with a court order or legal process
  • Necessary to protect the rights, property, or safety of the Company, its Users, or others
  • Necessary to investigate or prevent fraud, security incidents, or illegal activities

Sharing with Emergency Services: We share information with emergency services, crisis intervention services, or competent authorities where necessary to protect the health or safety of a User or others.

We share information with our legal advisors where necessary for legal advice, dispute resolution, or the establishment, exercise, or defense of legal claims.

Sharing with Institutional Clients: If you access the Platform through a school, college, university, or other institution, we may share information with your institution as set forth in the Institutional Privacy section of this Policy.

Sharing with Successors: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the successor entity, subject to appropriate notice and consent requirements under applicable law.

No Sale of Information: We do not sell your personal information to third parties for marketing or advertising purposes. We never sell your individual data or share it without your clear consent.

8Institutional Privacy

If you access the Platform through a school, college, university, or other institution, the following privacy protections apply.

Information Institutions Do Not Receive

Institutions DO NOT receive:

  • Therapy conversations or session content
  • AI conversation history with the AI Companion
  • Journal entries or personal reflections
  • Individual clinical records or therapist notes
  • Mood logs or assessment responses at an individual level
  • Any information that could reasonably identify you as an individual in the context of your mental health
  • Any information that would constitute Health Information or Sensitive Personal Data at an individual level

Information Institutions May Receive

Institutions may receive only:

  • Aggregated Analytics: Statistical summaries of Platform usage at the institutional level, which do not identify individual Users
  • Anonymous Wellbeing Insights: Aggregated and anonymized insights regarding the wellbeing of the institutional population
  • Institutional Dashboard Information: Information displayed on the institutional dashboard, which is aggregated and de-identified
  • Statistical Reports: Reports that summarize usage patterns, engagement metrics, and outcomes at an institutional level

Information shared with institutions is de-identified and aggregated such that individual Users cannot be identified.

Institutions are bound by contractual obligations to maintain the confidentiality of any information shared and to use such information only for the purposes specified in their agreement with the Company.

9Cookies

We use cookies and similar tracking technologies to enhance your experience on the Platform, analyze usage, and provide personalized content.

Types of Cookies We Use

  • Essential Cookies: These cookies are necessary for the Platform to function properly. They enable core functionality such as security, network management, and accessibility. You cannot opt out of essential cookies.
  • Functional Cookies: These cookies enable enhanced functionality and personalization, such as remembering your preferences and settings.
  • Performance Cookies: These cookies collect information about how you use the Platform, such as which pages you visit and if you experience any errors. This information is used to improve the Platform's performance.
  • Analytics Cookies: These cookies help us understand how Users interact with the Platform, including usage patterns, engagement metrics, and feature adoption.
  • Marketing Cookies: These cookies are used to deliver relevant advertisements and marketing communications. Marketing cookies require your separate consent.

Your Cookie Choices

You can manage your cookie preferences through your browser settings. Most browsers allow you to:

  • View and delete cookies
  • Block cookies from specific websites

Please note that blocking essential cookies may affect the functionality of the Platform.

For more information about our use of cookies, please refer to our Cookie Policy.

10User Rights

As a Data Principal, you have the following rights under the DPDP Act:

  • Right to Access Information: The right to access information about your personal data, including what data is being collected and how it is being used.
  • Right to Correction: The right to request correction of inaccurate or incomplete personal data.
  • Right to Updating: The right to request updating of personal data.
  • Right to Erasure: The right to request erasure of personal data when the processing purpose is fulfilled or consent is withdrawn, subject to reasonable exceptions.
  • Right to Data Portability: The right to request the transfer of your personal data to another Data Fiduciary, where technically feasible.
  • Right to Withdraw Consent: The right to withdraw consent at any time, with the process for withdrawal being as easy as giving consent.
  • Right to Grievance Redressal: The right to file a complaint with the Data Protection Board of India.
  • Right to Nominate: The right to nominate an individual to exercise rights posthumously or in cases of incapacity.

How to Exercise Your Rights

You may exercise your rights by:

  • Contacting us at contact@heyattrangi.com
  • Using the account management features available on the Platform
  • Following the instructions provided in relevant communications

Limitations on Rights

We may limit the exercise of these rights where:

  • Required by applicable law
  • Necessary for the establishment, exercise, or defense of legal claims
  • Necessary for compliance with a legal obligation, including clinical documentation requirements under the Mental Healthcare Act, 2017
  • Necessary for regulatory record retention obligations
  • Otherwise permitted under the DPDP Act

Requests for access, correction, updating, or erasure shall be processed in accordance with this Privacy Policy, our Data Retention & Deletion Policy, and applicable law.

11Account Deletion

You may request deletion of your account at any time through the Platform's account settings or by contacting us at contact@heyattrangi.com.

When You Request Account Deletion:

  • Your account will be deactivated and you will no longer be able to access the Platform
  • Information required by applicable law or clinical documentation obligations may continue to be retained in accordance with our Data Retention & Deletion Policy and applicable law
  • Information that has been de-identified, anonymized, or aggregated may continue to be used for research and analytics purposes
  • Information that is necessary for the establishment, exercise, or defense of legal claims may be retained
  • Other information shall be handled in accordance with our Data Retention & Deletion Policy
  • Clinical records shall be retained in accordance with Section 25 of the Mental Healthcare Act, 2017 and applicable record retention requirements.

For Minor Users, account deletion requests must be made by the Caregiver.

12AI Memory

The AI System maintains memory of previous conversations and interactions to provide continuity of care and personalized experiences.

You May Request Deletion Of:

  • AI Memory: Information that the AI System remembers from previous conversations
  • AI Conversation History: Records of your interactions with the AI conversational companion
  • AI Generated Summaries: Summaries generated by the AI System based on your data

Deletion requests shall be processed in accordance with applicable legal obligations and clinical record retention requirements.

The Company reserves the right to retain certain information where required by law, for the establishment, exercise, or defense of legal claims, or for legitimate business purposes.

For more information on AI memory, please refer to our AI Transparency Statement.

13Security

We implement and maintain reasonable security safeguards to protect your information from unauthorized access, disclosure, alteration, or destruction, in compliance with the DPDP Act and the Information Technology Act, 2000.

Security Safeguards Include:

  • Encryption: Encryption of data at rest and in transit using industry-standard encryption protocols
  • Access Controls: Role-based access controls restricting access to authorized personnel on a need-to-know basis
  • Authentication: Multi-factor authentication for access to sensitive systems and data
  • Audit Logging: Comprehensive audit logs of all access to and modifications of your information
  • Monitoring: Continuous monitoring of systems for security incidents and unauthorized access
  • Secure Cloud Infrastructure: Information stored in secure cloud infrastructure managed by or on behalf of Aatrangi Private Limited
  • Incident Response: Procedures for investigating and responding to security incidents

We comply with the reasonable security practices and procedures required under the Information Technology Act, 2000 and the DPDP Act.

14Data Breach Response

In the event of a personal data breach, we are committed to:

  • Investigate: Promptly investigate the breach to determine its nature, scope, and impact
  • Contain: Take immediate steps to contain the breach and prevent further unauthorized access
  • Mitigate: Take reasonable steps to mitigate any harm to affected Data Principals
  • Notify Affected Users: Notify all affected Data Principals promptly upon becoming aware of a personal data breach, where required by law
  • Notify Competent Authorities: Notify the Data Protection Board of India and other competent authorities where required by law
  • Maintain Incident Records: Maintain accurate and complete records of the breach and our response
  • Review Security Controls: Review and enhance our security controls to prevent future breaches

We shall notify affected Data Principals of a personal data breach in the manner prescribed under the DPDP Act and the rules thereunder.

15International Processing

Your information is primarily processed within the Republic of India.

Where trusted third-party service providers process your information outside India, appropriate contractual, organizational, and technical safeguards shall be implemented in accordance with applicable law.

Cross-border data transfers are permitted under the DPDP Act unless the Central Government notifies a country or territory as restricted. We shall comply with any such restrictions notified by the Central Government.

We shall ensure that any cross-border transfer of personal data is lawful, secure, and transparent, aligning with the data protection standards required under the DPDP Act.

16Retention

We retain your information only for as long as necessary for the purposes for which it was processed, subject to legal, regulatory, and clinical documentation obligations.

Retention Periods Are Determined By:

  • Applicable legal and regulatory requirements, including the DPDP Act, the Information Technology Act, 2000, and the Mental Healthcare Act, 2017
  • Clinical documentation requirements under Section 25 of the Mental Healthcare Act, 2017
  • Applicable statutes of limitations
  • Business and operational needs
  • The Company's legitimate business purposes

For specific retention periods for different categories of data, please refer to our Data Retention & Deletion Policy.

17Children's Privacy

The Platform is available to individuals who are at least three (3) years of age.

Individuals below the age of eighteen (18) years are considered Minor Users and may only access the Platform under the following conditions:

  • A Caregiver must create and manage the Minor User's account
  • The Caregiver must provide verifiable consent for the processing of the Minor User's personal data in accordance with Section 9 of the DPDP Act
  • Therapy sessions with Licensed Therapists must always be managed by the Caregiver
  • The Minor User may independently access only the AI conversational companion, mood tracking, guided journaling, and wellness activities
  • The Caregiver shall be responsible for supervising the Minor User's use of the Platform

We do not knowingly collect personal data from Minor Users without verifiable parental consent.

If we become aware that we have collected personal data from a Minor User without verifiable parental consent, we will take steps to delete such information promptly, subject to legal and clinical documentation obligations.

18Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, legal requirements, or operational needs.

When we make material changes to this Policy, we will notify you through:

  • The Platform
  • Email to your registered email address
  • In-app notifications
  • A notice on our website
  • Any other appropriate means

The "Effective Date" at the top of this Policy indicates when it was last revised.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy, subject to any additional consent requirements under applicable law.

19Contact Information

If you have any questions, concerns, or complaints about this Policy or our privacy practices, please contact us:

Email: contact@heyattrangi.com

Website: https://www.heyattrangi.com/

If you are not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India in accordance with the DPDP Act.