Privacy Policy

Ms Paul Therapies (“we”, “us”) is the practice of Aishani Paul, an RCI-licensed clinical psychologist (Registration No. A118537). This policy explains how we collect, use, store, and protect your personal data when you use this website or engage our services. We act as the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

1. Information We Collect

• Contact details: name, email, and phone number you provide via forms, email, WhatsApp, or booking.
• Intake and clinical information: details you share in intake forms and during sessions, and the clinical notes we maintain about your care.
• Booking information: appointment details collected through our scheduling tool.
• Payment information: processed by third-party payment providers; we do not store your card or bank details.
• Website usage data: cookies and analytics data about how you use the site (see Section 6).

Mental-health information is sensitive personal data and is treated with the highest level of care and confidentiality.

2. How We Use Your Information and Lawful Basis

We use your information, on the basis of your consent, to:

• Provide therapy and related clinical services
• Schedule, confirm, and manage appointments
• Communicate with you about your care and enquiries
• Send resources or newsletters you have opted in to receive
• Meet legal, regulatory, and clinical record-keeping obligations

We will never sell or rent your personal information. We do not use your clinical information for marketing.

3. Confidentiality and Its Limits

All therapeutic communications are strictly confidential, in line with RCI professional and ethical guidelines. We may disclose information only where required by law or to prevent serious harm, specifically: imminent risk of harm to yourself or others, suspected abuse or risk to a minor or vulnerable person, or a valid court order or legal requirement.

4. Service Providers (Data Processors)

We use trusted third-party services to operate the practice. They process data only on our instructions and under their own privacy terms:

• Scheduling and video sessions (booking and teletherapy platform)
• Email delivery and newsletter management
• Website hosting, content management, and analytics
• Payment processing (UPI / payment gateway)

Some providers may process data on servers outside India. We take reasonable steps to ensure your data is handled securely.

5. Data Security

We take reasonable technical and organisational measures to protect your personal information, including access-controlled and encrypted storage of clinical records, secure communication channels, and password-protected systems. In the event of a personal data breach, we will take prompt action and notify affected individuals and authorities as required under the DPDP Act.

6. Cookies and Analytics

This website may use cookies and analytics tools (such as Google Analytics) to understand how visitors use the site. No personally identifiable clinical information is collected through these tools. You can disable cookies in your browser settings at any time.

7. Data Retention

We retain clinical records for the period required by professional best practice and applicable law, after which they are securely deleted. Enquiry and marketing data is kept only as long as needed for the purpose it was collected, or until you withdraw consent.

8. Your Rights Under the DPDP Act

As a Data Principal, you have the right to:

• Access the personal data we hold about you
• Request correction or updating of inaccurate data
• Request erasure of your data, subject to legal and clinical retention requirements
• Withdraw consent for data processing at any time
• Nominate another individual to exercise your rights in case of death or incapacity
• Raise a grievance and seek redressal (see Section 10)

9. Children and Adolescents

Where services are provided to a minor (under 18), we obtain verifiable consent from a parent or legal guardian before collecting or processing the minor's personal data, in line with the DPDP Act.

10. Grievance and Contact

For any questions, requests, or grievances about your personal data, contact our Grievance point of contact, Aishani Paul, at [email protected]. We aim to respond to all requests within a reasonable timeframe.

11. Updates to This Policy

We may update this policy from time to time. The “last updated” date above reflects the most recent revision.