Privacy Policy

1. Who we are

InnerWhispers is run by InnerWhispers Wellness LLP, based in Warangal, Telangana, India ("InnerWhispers", "we", "us"). We provide mental health support through psychiatric consultations, therapy, counselling, assessments, peer support and our NAU community, online and in person.

For the personal information described here, we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). We also follow the Information Technology Act, 2000 and its rules on sensitive personal data, the Mental Healthcare Act, 2017 and the Telemedicine Practice Guidelines, 2020.

This policy covers our website, online self-checks and paid assessments, booking and payments, consultations and sessions, peer support, the NAU community and events, and anything you send us through our contact, careers or community forms. By using our services, you agree to the practices described here. Where we need your consent, we ask for it clearly and separately.

2. Information we collect

2.1 Information you give us

• Identity and contact details: full name, email address, phone number, date of birth or age, and gender (if you choose to share it).
• Booking details: the professional you choose, the type of service (consultation, counselling, therapy, assessment or peer support), online or in person, date and time, and your appointment history.
• Health information: what you tell us about your concerns, notes you add when booking, medical documents you choose to upload (such as prescriptions or reports), clinical notes made by your professional, and assessment results from sessions.
• Parent or guardian details: for clients under 18, the name, phone number, email and relationship of the parent or guardian.
• Payment details: the amount, order and transaction IDs, and payment status. Card, UPI and bank details go directly to our payment gateway and are never stored by us.
• Community and events: if you join NAU or attend events: your name, email, city, college or workplace, participation and feedback.
• Collaborations and careers: organisation details for partnerships, and the CV and details you send when applying for a role.
• Messages: anything you send through our contact or peer support forms, by email or on WhatsApp.

2.2 Information collected automatically

• Technical data: IP address, device and browser type, and basic security logs, needed to run and protect the website.
• Usage data: pages visited and how the site is used, collected only if you allow analytics cookies (see section 7).
• Data kept in your own browser: your cookie choice, and progress on a booking or self-check so a refresh doesn't lose your answers. This stays on your device and is cleared when you close the tab or finish.

2.3 Information from others

A referring professional, a parent or guardian, or the organisation that arranged your session may share details with us, with your knowledge. Our payment gateway confirms whether a payment succeeded.

2.4 Sensitive personal data

Information about your mental and physical health, medical records and history is sensitive personal data under Indian law. We collect it only with your consent, only for your care, and we protect it with the strictest controls described in this policy.

3. Online assessments and self-checks

• Free self-checks: your answers are scored in your own browser. They are not sent to us or saved by us. Progress is kept in your browser tab only until you finish.
• Name and email for your report: optional for free self-checks. They are used to put your name on your report and, only if you ask, to email it to you.
• Paid assessments: your name and email are required so we can send your receipt and report. We keep the payment record and a one-attempt pass reference. We do not keep your answers.
• Emailing a report: when you choose to email a report, your answers are sent to our server once to build the email, then discarded. Please remember that email is not fully private, so use an inbox you are comfortable with.
• Assessments with a professional: these are part of your clinical care and are kept in your confidential record (see section 10).

Self-check scores are a screen, not a diagnosis. We never use your answers for advertising or share them with anyone.

4. How we use your information

4.1 To provide and improve our services

• Schedule and manage your sessions, confirm bookings and send reminders.
• Deliver consultations, therapy, counselling, assessments and peer support.
• Recommend appropriate support, and coordinate care within our team when you need it.
• Process payments, issue receipts and handle refunds.
• Improve our website and services, using analytics only with your consent.

4.2 To communicate with you

• Booking confirmations, verification codes, reminders and reports you ask for.
• Answers to your questions and requests.
• Wellbeing resources and news, only if you opt in (see section 14).

4.3 For safety and legal reasons

• Keep accurate clinical records, as professional and ethical standards require.
• Act to protect you or someone else when there is a serious risk to life or safety.
• Meet our legal, tax and regulatory obligations, and keep our services secure.
• Keep our community respectful and safe.

4.4 Our legal basis

We process your information on the basis of your consent (for example, when you book, share health information or allow analytics), and for legitimate uses permitted by the DPDP Act, such as providing a service you have asked for, responding to a medical emergency, or complying with the law. You can withdraw consent at any time (see section 11). Withdrawing consent doesn't affect what we did before, and some services can't continue without the information they need.

5. Confidentiality of your mental health information

Confidentiality is at the heart of our work. Your right to confidentiality is also protected by the Mental Healthcare Act, 2017. Your personal and session information is never shared with:

• Your college, school or employer, even if they arranged or paid for your sessions.
• Your family or friends, unless you ask us to.
• Advertisers, data brokers or any third party for marketing.

Within InnerWhispers, only the professionals involved in your care, and staff who need to (for example, to arrange a booking), can see your information, and only what they need.

Rare exceptions. We may share information without your consent only when:

• There is a serious risk of harm to you or to someone else, and sharing is needed to keep people safe.
• We are required to by law, a court order or a lawful request from authorities.
• For a client under 18, a parent or guardian needs to know to keep them safe.

Otherwise, we share only with your clear, written consent, for example with another doctor you want us to send a report to. When we do share, we share only what is necessary, and where possible we tell you first.

6. Service providers we use

We use a small number of trusted providers to run our services. They act on our instructions, may only use your information to provide their service to us, and must keep it secure. We never sell your information.

Each provider also has its own privacy policy. Some may process data outside India. When that happens, we use providers with recognised security standards and follow any restrictions set under the DPDP Act.

If InnerWhispers is ever reorganised or merged, your information would only move under the same protections, and we would tell you first.

7. Cookies and similar technologies

We use a small number of cookies and browser storage:

• Essential: needed for the site to work, such as remembering your cookie choice and keeping your place in a booking. Always on.
• Maps and embeds: load content such as Google Maps, which may set its own cookies. Off until you allow them.
• Analytics: help us understand how the site is used so we can improve it. Off until you allow them.

You can change your choice any time on our Cookie Settings page, which also lists exactly what we store. You can also block cookies in your browser, though some features may then not work properly.

8. Online sessions

• Online sessions follow India's Telemedicine Practice Guidelines, 2020. Your professional will confirm your identity at the start.
• We do not record sessions. If a recording were ever useful, for example for supervised training, we would ask for your separate written consent first, and you can say no.
• Please join from a private place and a device you trust, so others can't overhear or see your screen.
• Session links are personal. Please don't share them.

9. How we protect your information

• Encrypted connections (HTTPS) across our website and booking system.
• Secure servers, with access limited to authorised people who need it for your care or our operations.
• Confidentiality commitments from everyone on our team and our providers.
• Verification codes to confirm your email, and secure payment pages from our gateway.
• Regular checks of our systems and practices.

No online system is completely secure, but we work hard to protect your information. If a personal data breach happens that affects you, we will inform you and the Data Protection Board of India as the law requires, and tell you what we are doing about it.

10. How long we keep your information

We keep information only as long as we need it for the purpose it was collected, or as long as the law requires. After that, we delete it or make it anonymous.

11. Your rights

Under the DPDP Act and other applicable law, you have the right to:

• Access a summary of the personal information we hold about you and how we use it.
• Correct, complete or update information that is inaccurate or out of date.
• Erase your information when it is no longer needed, except where the law requires us to keep it, such as clinical and tax records.
• Withdraw consent at any time, as easily as you gave it, including for messages and analytics.
• Raise a grievance with us, and if you aren't satisfied, with the Data Protection Board of India.
• Nominate someone to exercise these rights on your behalf if you are unable to.

To make a request, email privacy@innerwhispers.in from the email address you used with us. We may ask you to confirm your identity before we act, to protect your information. We will reply within 30 days.

12. Children and young people

Most of our services are designed for adults aged 18 and over. Young people under 18 can use our consultation and therapy services only with the consent and involvement of a parent or legal guardian, whose details we ask for when booking. We do not knowingly collect information from children without this consent. Our peer support calls and online self-checks are intended for adults.

We keep a young person's sessions as confidential as we safely can, and share with a parent or guardian only what is needed for their safety and care. If you believe a child has given us information without consent, contact us and we will delete it.

13. NAU community and group safety

When you join NAU or any InnerWhispers group or event:

• Personal details shared by others in the group must stay in the group. Please don't share them outside.
• Please be respectful. Harmful, triggering or abusive posts and behaviour are not allowed.
• We may remove anyone who breaks these guidelines, to keep the space safe.
• Group sessions are not recorded, and we never publish photos or stories of members without their clear consent.

We can't control what other members do with what you share in a group, so please share only what you are comfortable with.

14. Messages and marketing

We send messages about your bookings, reports and requests because you need them for the service. We send newsletters, wellbeing resources or event news only if you opt in. You can unsubscribe at any time using the link in each email, or by writing to us. We never share your contact details for others' marketing.

15. Changes to this policy

We may update this policy as our services or the law change. We will post the new version here with a new "Last updated" date, and for significant changes we will tell you by email or on the website. If you keep using our services after a change, the updated policy applies. Where we need your consent again, we will ask for it.

16. Contact us and grievances

For any question, concern or complaint about your privacy, please contact us:

We acknowledge grievances within 2 working days and aim to resolve them within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.