Privacy Policy for CalmConnect

1. Introduction

CalmConnect (“we”, “our”, “us”) operates a non-clinical mental health and wellness technology platform for students, parents, psychologists, and educational institutions in India.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data in accordance with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act)
• Information Technology Act, 2000 and IT Rules, 2021
• Mental Healthcare Act, 2017
• Applicable Indian laws

By using CalmConnect’s website, mobile applications, dashboards, or services (“Platform”), you consent to the practices described in this Privacy Policy.

2. Scope of This Policy

This Privacy Policy applies to:

• Students using CalmConnect
• Parents using the Parent Portal
• Psychologists and mental health professionals
• Educational institutions (schools and colleges)
• Website and mobile application visitors

This Policy must be read together with the Terms and Conditions and applicable consent forms.

3. Data Fiduciary & Data Processor Roles

Under the DPDP Act, 2023:

• Educational Institutions act as Data Fiduciaries for enrolled students.
• CalmConnect acts as a Data Processor, processing data strictly under lawful instructions and consent.
• For direct individual users (non-institutional), CalmConnect acts as the Data Fiduciary.

4. Personal Data We Collect

We may collect the following categories of personal data:

6. How We Use Your Data

Your data is used strictly for:

• Account creation and authentication
• Providing wellness tools and resources
• Appointment facilitation
• Displaying consented assessments to psychologists
• Safety logging (Emergency Support feature)
• Generating anonymized institutional reports
• Platform analytics and performance improvement
• Legal and regulatory compliance

We do not sell or commercially exploit personal data.

7. Artificial Intelligence (AI) Usage

CalmConnect uses AI tools solely for wellness education, journaling assistance, and emotional support.

AI Systems Limitations:

• Do not provide diagnosis or treatment
• Do not predict suicide or self-harm
• Do not replace professional care
• Do not train public or third-party AI models using user data
• AI outputs are informational only.

8. Data Storage & Infrastructure

We use industry-standard third-party technology providers to securely operate the Platform, including cloud infrastructure, content delivery, and identity management services.

• Personal data may be stored on secure servers located in India or other jurisdictions permitted under applicable Indian law.
• All service providers are engaged under contractual confidentiality, data protection, and security obligations.

9. Data Sharing & Disclosure

We may share data only with:

• Authorized Psychologists: Only consented data for appointment purposes.
• Educational Institutions: Aggregated, anonymized reports (unless SOS intervention is required).
• Service Providers: Strictly for operational purposes (authentication, email, analytics).
• Legal Authorities: When required by law or court order.

Parents do not have access to student personal data or therapy information unless explicitly consented to by the student or required by safety laws.

10. Third-Party Service Providers

We engage trusted third-party service providers solely to support Platform operations. These providers process personal data only on our instructions and are bound by contractual confidentiality. We do not permit third-party service providers to use personal data for their own commercial purposes.

11. Cookies & Analytics

We use cookies to maintain login sessions, improve platform performance, and analyze usage trends. Users may disable cookies through browser settings, though this may affect platform functionality.

12. Data Retention

Personal data is retained only for the duration of account activity or as required by legal/regulatory obligations. Upon account termination, data is deleted or anonymized in accordance with the DPDP Act.

13. User Rights Under DPDP Act

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure
• Withdraw consent
• File grievances

Requests can be submitted via the contact details provided below.

14. Data Security Measures

We implement encryption at rest and in transit, role-based access controls, audit logging, and regular security monitoring. While we maintain reasonable safeguards, no system is 100% secure.

15. Data Breach Notification

In the event of a personal data breach, CalmConnect will notify the concerned Data Fiduciary (Institution) and/or the affected users without undue delay, in compliance with applicable statutory timelines (including CERT-In directives).

16. Children’s Privacy

We process children’s data only with verified parental/guardian consent or through institutional authorization. We do not knowingly process child data without lawful consent.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Material changes will be communicated through the Platform. Continued use constitutes acceptance.

18. Governing Law and Jurisdiction

This Privacy Policy shall be governed by the laws of India. The courts of Jammu & Kashmir, India shall have exclusive jurisdiction over any disputes arising under this Policy.

19. Contact Information

For privacy-related queries:

• Support: support@calmconnect.in

20. Grievance Officer (IT Rules, 2021)