Your privacy is our priority. We are transparent about how we collect, use, and protect your personal and mental health information.
MentalSaathi ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and related services (collectively, the "Service"). Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Service.
We collect information in the following ways: a) Information You Provide Directly: • Account Registration: username, email address, password (hashed), full name, age, gender, phone number • Profile Information: profile picture, parents' name, parents' phone number • Health & Wellness Data: journal entries, daily mood check-ins (mood scores), anxiety levels, sleep quality, energy levels, social interaction levels • Community Participation: posts, comments, likes, tags on community content • Crisis Logs: records of mental health concerns flagged in your check-ins • Course Enrollment: information about courses you enroll in and your progress b) Information Automatically Collected: • IP addresses, browser type, operating system • Pages visited, time spent on pages, referral sources • Cookies and similar tracking technologies for session management • Log data from our servers c) Third-Party OAuth: If you sign in with Google, we receive: email, name, profile picture, phone number (if you grant permission), gender, and birthday (used to calculate age) from Google's People API.
We use the collected information for: • Providing and maintaining the Service • Creating and managing your account • Delivering mental health support and wellness features • Personalizing your experience (recommending courses, tracking streaks) • Analyzing mood trends and mental health patterns for your benefit • Detecting mental health crises and providing crisis support resources • Communicating with you about updates, support, and new features • Sending wellness reminders and check-in prompts • Improving and optimizing the Service • Security, fraud detection, and account protection • Complying with legal obligations • Conducting research (only with explicit consent and anonymized data) We will NOT sell, rent, or trade your personal information to third parties for marketing purposes.
We implement industry-standard security measures to protect your data: • Passwords are hashed using strong cryptographic algorithms (Werkzeug security) • All data transmitted to our servers uses HTTPS encryption • Access to sensitive data is restricted to authorized personnel only • Your mental health data is treated as highly sensitive personal information • We conduct regular security audits and updates • Data is stored in secure cloud infrastructure with encryption at rest However, no method of transmission over the internet is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.
Our Service integrates with Google Sign-In and Google's People API for authentication: • When you sign in with Google, we verify your identity via Google's OAuth 2.0 service • We request only necessary scopes: profile, email, phone numbers (optional), birthday (optional), gender (optional) • Google's privacy policy governs Google's collection and use of data • We do NOT store your Google access tokens; they are used only to fetch your profile once • We do not share your data with Google beyond what is necessary for sign-in Other third-party services: • Email sending (Brevo or Gmail SMTP) for OTP verification • SMS sending (Fast2SMS) for phone verification • We use PostHog for product analytics and Sentry for error monitoring; session replay and heatmaps are disabled on sensitive pages like journals and MindCheck Each service has its own privacy policy; we encourage you to review them.
• Your account data is retained as long as your account is active • Journals, community posts, and wellness data are retained for historical analysis and continuity of care • If you request account deletion, we will remove your account and associated personal data within 30 days, except where: - Legally required to retain - Needed for security or fraud prevention - Required to complete financial or legal obligations • Crisis logs and sensitive health records are retained for your safety and recovery support • You can export your data at any time (data portability right)
Depending on your jurisdiction, you have rights including: GDPR (European Users): • Right to Access: request a copy of your personal data • Right to Rectification: correct inaccurate data • Right to Erasure: request deletion of your data (with exceptions) • Right to Restrict Processing: limit how we use your data • Right to Data Portability: receive your data in a portable format • Right to Object: object to certain data processing • Right to Lodge a Complaint: contact your local data protection authority CCPA (California Users): • Right to Know: what personal information is collected • Right to Delete: request deletion of your personal information • Right to Opt-Out: opt-out of data sales (we do not sell data) • Right to Non-Discrimination: no discrimination for exercising your rights To exercise any of these rights, contact us at privacy@mentalsaathi.com with "Data Request" in the subject line.
• MentalSaathi is intended for users ages 13 and above (teen mental health support) • We comply with COPPA (Children's Online Privacy Protection Act) for users under 13 • If we discover a child under 13 has registered without parental consent, we will delete their account and notify parents • Parents/guardians of teen users can request access to the teen's account data and can request account deletion • We may collect a parent/guardian's phone number for emergency contact and consent verification • Teens under 18 should inform parents/guardians before registering For children under 13: parents may contact privacy@mentalsaathi.com to manage their child's account.
MentalSaathi handles mental health data with special care: • All mental health data (journals, mood scores, crisis logs) is classified as sensitive personal information • This data is encrypted and stored separately from other profile data • Mental health records are never shared with marketing partners or used for profiling • Your mood trends and journal content are visible only to you and, where applicable, crisis support staff • We comply with healthcare privacy regulations (HIPAA principles where applicable) • Mental health data shared in the community is pseudonymous; your identity is protected unless you explicitly identify yourself
• You can participate in community posts either with your name or anonymously (if you choose "anonymous" posting) • Community posts are visible to other users but cannot be linked to your personal account if posted anonymously • You can delete your community posts at any time • Likes and comments use your account username (not anonymous unless your username is pseudonymous) • MentalSaathi reserves the right to moderate content that violates community guidelines
• We use session cookies to maintain your login state • Cookies do not store sensitive information like passwords • You can disable cookies in your browser settings, but some features may not work properly • We use privacy-conscious analytics to measure page views, session duration, and feature usage without building marketing profiles • Optional: we may use non-invasive error logging to improve service reliability
• If you are located outside India, your data may be transferred to and processed in India • By using MentalSaathi, you consent to the transfer and processing of your data as described in this policy • We comply with applicable international data protection regulations (GDPR, CCPA, etc.) • Users outside the EU/US should be aware of data transfer implications
In the event of a data breach affecting your personal information, we will: • Notify affected users within 30 days of discovery (or as required by law) • Provide details of the breach, data affected, and steps you should take • Inform relevant authorities as legally required • Offer credit monitoring or identity protection services if applicable Contact us immediately if you suspect unauthorized access to your account.
• We may update this Privacy Policy to reflect changes in our practices or legal requirements • Major changes will be announced via email notification and in-app notification • Your continued use of the Service after changes constitutes acceptance of the updated policy • We recommend reviewing this policy periodically for updates Last Updated: May 2026
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact: Email: privacy@mentalsaathi.com Mail: MentalSaathi Privacy Team Support Portal: https://mentalsaathi.in/support Data Protection Officer (if applicable): dpo@mentalsaathi.com For GDPR/CCPA requests, please include: • Your full name and registered email • Specific request type (access, deletion, rectification, etc.) • Any relevant account information • Timeline preference (responses within 30 days) Response time: We aim to respond to all privacy inquiries within 15 business days.
Important: This Privacy Policy is legally binding. By using MentalSaathi, you acknowledge that you have read, understood, and agree to be bound by this policy. If you do not agree with any part of this policy, please do not use our Service.