Roshni Carelight for the mind
Sign in

Privacy Policy

Effective Date: 12 October 2026

1. Introduction

Roshni Care ("we", "us", "our") is an online mental wellness platform operated from Pune, India. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use roshni.care and related services.

This policy is governed by the Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act 2023 ("DPDP Act"). By using the platform you consent to the practices described here.

2. Data We Collect

We collect the following categories of personal data:

  • Account data: name, email address, phone number, and password (stored as a bcrypt hash).
  • Health data (SPDI): onboarding quiz responses, session history, mood journal entries, and any information you share with your therapist during sessions. We do not record sessions. The spoken conversation is transcribed while we test follow-up notes.
  • Booking data: session dates, times, duration, and payment references. We do not store card numbers — all card data is handled by Razorpay.
  • Technical data: IP address, browser type, and anonymised error reports via Sentry.

3. Purpose of Collection

We use your data only for the purposes stated below:

  • Matching you with an appropriate therapist based on your onboarding responses.
  • Scheduling and delivering online therapy sessions via video, audio, or chat.
  • Maintaining clinical session records, as required for responsible mental health practice.
  • Processing payments through Razorpay.
  • Providing the mood journal and session history features.
  • Improving the platform and diagnosing technical issues (via anonymised telemetry).
  • Complying with legal obligations under Indian law.

4. Legal Basis for Processing

  • Explicit consent — required under SPDI Rule 5(1) and DPDP Act Section 6 before we collect health or sensitive data. You provide this consent at signup and during onboarding.
  • Contractual necessity — processing required to book and deliver a session you have paid for.
  • Legal compliance — where required by Indian law.

5. Sensitive Personal Data (SPDI)

Mental health condition, session history, onboarding quiz responses, and mood journal entries constitute Sensitive Personal Data or Information (SPDI) under Rule 3 of the IT (SPDI) Rules 2011. We collect this data only after obtaining your explicit consent.

SPDI is accessible only to you and your assigned therapist. Roshni Care staff access SPDI only on a strict need-to-know basis and never for commercial purposes.

You may withdraw consent at any time by contacting us at shivashish@roshni.care. Withdrawal of consent may affect our ability to deliver some features of the service.

6. Data Sharing

We do not sell personal data. We share data only with the following data processors who assist in delivering the service:

  • Cloudflare RealtimeKit — live video and audio for a session, and transcribes what was said. We do not record the session. We do not yet keep our own copy of the transcript.
  • Razorpay — payment processing. Razorpay handles all card data directly. Roshni Care receives only a payment reference ID. No card data is stored by Roshni Care.
  • ZeptoMail — transactional email, such as booking confirmations, session reminders and password resets, sent from notify.roshni.care. When discreet mode is on, reminder and reschedule emails leave out your therapist's name.
  • Amazon Web Services (AWS) — hosting infrastructure in the ap-south-1 (Mumbai, India) region. Data is stored on AWS servers within India.
  • Sentry — error monitoring. Error reports are anonymised where possible and used only for diagnosing technical issues.

We will not share personal data with any other third party without your prior written consent, except where required by Indian law or a court order.

7. Data Retention

  • Account data: retained for the duration of your account, then 1 year after account deletion.
  • Session records and booking records: retained for 3 years from the date of the session. We do not store recordings. Transcripts are produced for testing and are not yet kept in our own records.
  • Mood journal entries: deleted upon account deletion.
  • Backup copies: 30-day rolling retention; older backups are automatically deleted.

We retain data only as long as necessary for the stated purpose or as required by law, per Rule 5(4) of the SPDI Rules 2011.

8. Your Rights

Under the SPDI Rules 2011 and the DPDP Act 2023, you have the following rights:

  • Right to access: request a summary of personal data we hold about you.
  • Right to correction: request correction of inaccurate or incomplete data.
  • Right to erasure: request deletion of your data, subject to legal retention obligations.
  • Right to withdraw consent: withdraw consent for processing of sensitive data at any time.
  • Right to grievance redressal: lodge a complaint with our Grievance Officer (see Section 12).
  • Right to nominate: nominate another person to exercise your rights in the event of death or incapacity, per DPDP Act Section 14.

To exercise any of these rights, email shivashish@roshni.care with the subject line "Data Rights Request".

9. Security

We use TLS 1.2 or higher for all data in transit and AES-256 encryption for data at rest. Passwords are hashed with bcrypt and never stored in plaintext. Secrets are managed through AWS SSM Parameter Store, not in code or environment files. For full technical details, see our Security Standards page.

10. Cookies

We use session cookies to maintain your authenticated session (stored as an httpOnly cookie or in memory). We do not use advertising cookies, tracking pixels, or third-party analytics cookies. No cookie consent banner is required because we do not place non-essential cookies.

11. Children

Roshni Care is intended for users who are 18 years of age or older. We do not knowingly collect personal data from persons under 18. If you believe a minor has created an account, please contact us immediately at shivashish@roshni.care and we will delete the account and associated data promptly.

12. Grievance Officer

In accordance with Rule 5(9) of the IT (SPDI) Rules 2011, we have designated a Grievance Officer:

Name: Shivashish Singh

Email: shivashish@roshni.care

Address: Roshni Care, Pune, Maharashtra, India

We will acknowledge all grievances within 5 business days and resolve them within 30 days per Rule 5(9) of the SPDI Rules 2011.

13. Changes to This Policy

We will notify you at least 15 days before material changes to this policy take effect, via email to the address registered on your account or by a prominent notice on the platform. Continued use of the platform after the effective date constitutes acceptance of the revised policy.

14. Contact

For general privacy questions, email shivashish@roshni.care. We aim to respond within 5 business days.

WhatsApp