Privacy policy

Created on: 03.05.2026

The website 'www.minddhara.com' and all other associated/ancillary websites, products and services ("Website/Platform") are property of and managed by MindDhara Private Limited, a company incorporated under the Companies Act, 2013 having its registered office at Flat No-102, Tower-25, Palm Hills, Sector-77, Narsinghpur, Gurugram, Haryana – 122004 (hereinafter referred to as "Company" which expression shall, unless it be repugnant to the context thereof, be deemed to include permitted successors and assigns).

For the purposes of this Privacy Policy, accessing of and/or using the Platform to avail various mental health, mentorship, and professional development services as provided on the Website or accessing the credentials and/or information of the services made available or disseminated or uploaded therein, including all information, tools and services made available shall hereinafter collectively be referred to as the "Services".

As used herein, "Users" shall mean anyone who uses or accesses the Services/Platform on any computer, mobile phone, tablet, or other device.

You are encouraged to read this Privacy Policy regarding the collection, use, and disclosure of Your information from time to time to keep Yourself updated with the changes & updates that are made to this Policy. The Privacy Policy covers the products and services provided through the Platform. The products and services provided by third-party affiliate or partner platforms are not covered under this Policy. Where the User faces any difficulty or has any query related to the services of such third parties, they may refer to their respective Privacy Policies available on their sites.

This Policy forms an electronic contract within the provisions of the Information Technology Act, 2000 ("IT Act"), the rules made thereunder and the amended provisions pertaining to electronic documents/records in various statutes as amended by the IT Act, from time to time. This Policy does not require any physical, electronic or digital signature.

This Policy shall, at all times, be read and construed in consonance and along with the Terms and Conditions of use and access of the Platform ("T&C").

The Company shall not differentiate between who is using the device to access the Platform, so long as the login/access credentials match with yours. In order to make the best use of the Platform and enable Your Information to be captured accurately, it is essential that You have logged in using your own credentials.

This Policy highlights inter alia the type of data shared/collected from a User in the course of the User's usage of the Platform. The Policy further intends to apprise the User of the purposes for which the data of the User is collected and the Platform's policy with regard to sharing such personal information with third-party entities.

The terms "We" / "Us" / "Our" individually and collectively refer to and are synonymous with the term 'the Company' and the terms "You" / "Your" / "Yourself" are to be construed to be synonymous with the term 'User'.

All defined terms used within this Policy but not specifically defined herein shall draw their meaning from the definition ascribed to such term under the T&C.

Consent

By accessing or using the Platform, providing Your Personal Information, or making a payment to the Company, You signify that You have read, understood and agreed to the collection, storage, processing, disclosure and transfer of Your Personal Information in accordance with the provisions of this Privacy Policy and under applicable law.

Where the User is below 18 years of age, the parent or legal guardian of such User shall provide informed consent digitally at the time of registration on behalf of the child or young person, for the receipt of mental health and related services through the Platform and to the collection, storage, processing, disclosure and transfer of their Personal Information in accordance with this Privacy Policy.

The User acknowledges that Personal Information is being provided out of free will, either directly to the Company or through a third-party platform or organisation. The User has the option to not provide the Personal Information sought to be collected. The User may also withdraw consent at any point in time by writing to the Company at hello@minddhara.com. Where the User is accessing the Platform through a third-party platform or organisation, withdrawal of consent must be communicated to such third party or organisation in writing, who shall then notify the Company to take appropriate action.

The Company may subsequent to such withdrawal of consent, at its sole discretion, continue or discontinue the provision of its Services to such User.

Where the Company introduces newsletter or promotional communications in the future, such communications shall be sent only upon obtaining prior consent from the User, which may be withdrawn at any time by writing to hello@minddhara.com.

Legal Basis for Processing

For the purposes of the Digital Personal Data Protection Act, 2023, the Company acts as a Data Fiduciary in relation to the personal data processed through the Platform.

The Company processes Your Personal Information on the following legal grounds:

• Your Consent: The Company relies on your explicit consent as the primary legal basis for the collection, storage, processing, disclosure and transfer of Your Personal Information. Such consent is obtained at the time of registration on the Platform. In respect of personal data relating to mental health, health records, therapy sessions, diagnoses, clinical observations ("Sensitive Personal Data"), a separate and explicit opt-in consent shall be obtained prior to the collection of such data. You may withdraw Your consent at any time in accordance with the provisions of the Consent section of this Policy.
• Contractual Necessity: Certain Personal Information is necessary for the Company to deliver the Services you have subscribed to or paid for. Where such Information is not provided, the Company may be unable to fulfil its contractual obligations to the User.
• Legal Obligation: The Company may collect, retain or disclose certain Personal Information where required to do so under applicable Indian law, including but not limited to the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, the Mental Healthcare Act, 2017, and applicable financial record-keeping requirements under the Income Tax Act, 1961 and the Goods and Services Tax Act.
• Legitimate Interest: The Company may process certain limited categories of Personal Information on the basis of its legitimate interests, including fraud prevention, platform security, and internal reporting, provided that such interests are not overridden by the fundamental rights and freedoms of the User.

Where the Company processes the personal data of individuals located in the European Union or the United Kingdom, it does so on the following legal bases under the General Data Protection Regulation (GDPR): consent (Article 6(1)(a) and Article 9(2)(a)) for the collection of sensitive health data and for marketing communications; performance of a contract (Article 6(1)(b)) for the delivery of Services; compliance with a legal obligation (Article 6(1)(c)) for data retained under applicable law; and legitimate interests (Article 6(1)(f)) for fraud prevention, platform security, and internal reporting.

DPDP Act Compliance Note: Processing of sensitive personal data, including any health, mental health, or clinical information, requires the User's explicit opt-in consent under the DPDP Act, 2023. The Company shall never process sensitive personal data on the basis of implied or assumed consent. The User shall always be given the opportunity to review and explicitly accept the Company's Sensitive Data Processing Notice before any such data is collected.

The Company's Sensitive Data Processing Notice is presented to the User as a separate and explicit step during the registration process, prior to the commencement of any MindDhara Couch service, and must be expressly accepted before any sensitive personal data is collected.

Sensitive Data and Confidentiality

We recognise that mental health information is among the most sensitive categories of personal data. We apply the highest standard of care and protection to any sensitive personal data that passes through the Platform.

Access Controls

Session notes, mental health history, diagnoses, clinical observations, and any ancillary data generated in the course of a therapeutic or psychiatric engagement are maintained primarily by the relevant Practitioners. The Company does not ordinarily access such records and restricts any technical or administrative access to the minimum necessary for platform maintenance, security, legal compliance, or operational support, subject to strict confidentiality obligations. Where the Company's authorised technical staff require access to the Platform's systems for maintenance or security purposes, such access is restricted to the minimum necessary and is subject to strict confidentiality obligations. No such access extends to clinical records held by Practitioners.

Not Used for Advertising or Profiling

Sensitive personal data, including any health or mental health information shared by the User on or through the Platform, shall never be used for advertising, marketing, behavioural profiling, or any commercial purpose, directly or indirectly. This prohibition applies without exception.

Explicit Opt-In Required

The Company shall not collect any sensitive personal data unless and until the User has explicitly opted in by agreeing to the Sensitive Data Processing Notice, which is presented as a separate and distinct step in the Platform flow prior to the commencement of any MindDhara Couch service. A pre-ticked or implied consent shall not be treated as valid consent for the purposes of sensitive data collection. The User may withdraw this consent at any time by writing to hello@minddhara.com, subject to any legal obligations to retain particular categories of data.

Confidentiality

All Practitioners operating on the Platform are bound by their respective professional codes of conduct, including the ethical guidelines of the Rehabilitation Council of India (RCI) and the National Medical Commission (NMC) and applicable State Medical Councils as applicable. The confidentiality of all information disclosed during a therapeutic or psychiatric engagement is the professional responsibility of the relevant Practitioners. We do not and cannot guarantee the conduct of independent Practitioners beyond the contractual obligations imposed through the Platform's freelancer agreement. Users also have a statutory right to confidentiality under Section 23 of the Mental Healthcare Act, 2017, which applies to all information shared in the course of a mental health consultation and which the Company and its Practitioners are bound to respect.

Session Recording

The recording of any consultation or therapy session conducted through the Platform is strictly prohibited. No session, whether conducted by video, audio, or text, may be recorded by the Company, the Practitioners, or the User, except with the prior express written consent of all parties to the session. We do not record any sessions by default and do not store any session recordings on our servers.

Professional Credentials

All Practitioners listed on the Platform are required to provide proof of registration with the relevant statutory body, including the Rehabilitation Council of India, the National Medical Commission (NMC) and applicable State Medical Councils. Users may request confirmation of their assigned Practitioner's registration details by writing to hello@minddhara.com.

Clinical Supervision

Where a Practitioner determines that clinical supervision or peer consultation is necessary in the interest of the quality of care provided to the User, such supervision shall be conducted only with the prior written consent of the User, obtained by the Practitioner through a consent form provided by the Platform. Any information shared in the course of such supervision is subject to the same confidentiality obligations that apply to the therapeutic engagement itself.

Group, Couples, and Family Therapy

Where the Platform introduces formats involving more than one participant, including couples therapy, family therapy, or group sessions, separate and specific consent covering the sharing of information between participants will be obtained from each participant prior to the commencement of such engagement. The terms governing such formats will be communicated to Users at the time they are introduced.

The Platform may deliver Services directly through the MindDhara Clinic or may act as an intermediary facilitating connections between Users and Practitioners engaged on the Platform. Where Services are delivered through the MindDhara Platform, We do not control or direct the clinical conduct of such Practitioners. Where Services are delivered directly through the MindDhara Clinic, We shall make reasonable efforts to ensure quality of delivery in accordance with Our Terms and Conditions.

Collection of Information

The Company may, during the User's usage of the Platform, collect the following personal and non-personal information and such other information from the Users for accessing the Platform ("Information"), as part of the voluntary registration process, any online survey or interaction on the Platform or combination thereof, as may be required from time to time. The Information shall be collected in order to conduct operations on the Platform and deliver its Services.

Personal Information

• Full name of the User;
• Email address (primary/alternative) of the User;
• Phone number (mobile and/or alternative) of the User;
• Date of birth of the User; and
• Personal information received from Google through which the User has registered to the Platform, including name, profile picture and email address. The Company does not access any other information associated with the User's Google account.

All research conducted through MindDhara ATLAS is designed and overseen in accordance with the ethical guidelines of the Indian Council of Medical Research (ICMR) for health research involving human participants. Prior to the commencement of any research study, the relevant protocol shall be reviewed to ensure compliance with applicable ethical standards. Participants in any research study may withdraw their participation and consent at any time without affecting their access to the Platform's Services.

Documents Uploaded for MindDhara Forward

Where the User engages with MindDhara Forward (mentorship and career guidance services), the User may upload documents including academic transcripts, Statements of Purpose, CVs, and recommendation letters. These documents are stored on the Company's servers solely for the purpose of facilitating the mentorship or advisory engagement. Such documents and all associated personal data shall be deleted from the Company's servers upon conclusion of the relevant Service, or upon account closure, whichever is earlier. Where an account has been closed, any residual data retained solely for dispute resolution, fraud prevention, or regulatory compliance purposes shall be purged no later than 6 months from the date of closure, unless a longer retention period is required by applicable law.

MindDhara Couch: Therapist and Counsellor Engagements

MindDhara Couch is Our online mental health counselling and therapy service through which Users may access Sessions with Practitioners. Services under MindDhara Couch may be delivered directly through the MindDhara Clinic (where Practitioners are employed by or contracted directly to MindDhara) or facilitated through the MindDhara Platform (where Practitioners operate as independent professionals). Session notes, clinical observations, prescriptions, and any ancillary data generated in the course of a therapeutic or psychiatric engagement are maintained by the relevant Practitioners. The Company does not ordinarily access such records and restricts any technical or administrative access to the minimum necessary for platform maintenance, security, legal compliance, or operational support, subject to strict confidentiality obligations.

MindDhara ATLAS: Research Data

Where the User wishes to participate in applied psychological research conducted through MindDhara ATLAS, separate and explicit consent shall be obtained from the User at the time of participation and prior to any collection of data for research purposes. Only anonymised and aggregated data is used for such purposes, and no personally identifiable information shall be used for research without such prior, specific consent. Research data is never sold, licensed, or shared with commercial third parties.

Payment Information

To process payments for the Company's services and digital products, the Company collects transactional details including the amount charged, the date of transaction, and the payment method used. The Company does not store full payment card numbers. All payment card data is processed directly by Razorpay Software Private Limited, the Company's PCI-DSS compliant payment gateway provider, and is never transmitted to or retained on the Company's servers. Users are encouraged to review Razorpay's privacy policy for further information on how payment data is handled.

Technical and Device Data

When you access the Platform, certain technical information is automatically collected, including:

• Internet Protocol (IP) address of the User;
• Browser type and version;
• Device model and operating system; and
• Configuration of the Platform at the time of access.

Usage Data

The Company may collect information about how the User interacts with the Platform, including the pages visited, features used, and duration of sessions. This information is collected in aggregated and anonymised form wherever reasonably practicable and is used solely to improve the performance and usability of the Platform.

Communications

Where the User contacts the Company through email or any feedback mechanism made available on the Platform, the Company may collect and retain the content of such communications, including the User's contact details and the nature of the query, solely for the purpose of responding to and resolving the User's communication.

Purpose and Use of Information

Personal data shall only be processed for lawful purposes expressly communicated to the User at the time of collection or otherwise permitted under applicable law.

All Information collected/stored by the Platform shall be used for:

• Identifying and reaching the User in connection with the Services;
• Resolving service and billing problems via email;
• Scheduling appointments with Practitioners and sending reminders for upcoming, follow-up, or cancelled appointments;
• Informing the User of the Company's products, services, and where prior consent has been obtained, promotional communications and newsletters;
• Continually improving the existing Platform and service offerings;
• Conducting research and surveys using Information in anonymised form only, which cannot be linked back to the User;
• Implementing necessary security practices to ensure all personal data is protected;
• Administering User accounts in the normal course of business;
• Contacting the User in cases where fraud, illegal activities, or breach of privacy is recorded;
• Enabling Practitioners and Psychiatrists on the Platform to communicate with the User as and when necessary in order to provide the Services requested;
• Making disclosures as may be required under applicable law; and
• Processing the User's financial transactions in a timely manner.

The Platform may share the minimum necessary Information with Practitioners and Psychiatrists to facilitate the delivery of Services. There may be occasions where such professionals use third-party tools, including video conferencing platforms, to conduct sessions. Users are advised to review the privacy policies of such third-party tools independently.

The Company is dedicated to maintaining the privacy and integrity of your Personal Information. If you wish to opt out of any communications from us, you may write to us at hello@minddhara.com.

Where a Practitioner determines, in the exercise of their professional judgement, that a User's condition requires in-person evaluation or treatment that cannot adequately be delivered through the Platform, they are obligated to refer the User for such in-person care. The Platform is not a substitute for emergency mental health services or inpatient psychiatric care.

Who We Share Your Data With

We do not sell, rent, or trade Your personal data to any third party for commercial purposes, under any circumstances.

The Company may share Your Information with the following parties, strictly to the extent necessary for the delivery of its Services:

• Your assigned Practitioner under MindDhara Couch, whether engaged through the MindDhara Clinic or the MindDhara Platform, will receive only the personal information relevant to Your care, including the reason for seeking support and any mental health history You have voluntarily disclosed. No Practitioner has access to data belonging to Users not under their care.
• Where a Practitioner proposes to use a third-party tool including video conferencing platforms, assessment tools, or digital therapeutics in the course of a session, they are required to inform the User and obtain their consent before doing so. Users are advised to review the privacy policies of any such third-party tools independently.
• Your assigned study-abroad advisor on MindDhara Forward will receive only academic and career-related information relevant to Your engagement, including documents you upload such as transcripts, statements of purpose, and CVs. This information is not accessible to Practitioners or other staff.
• Razorpay Software Private Limited, the Company's PCI-DSS compliant payment gateway provider, receives transactional details including the amount charged, the date of payment, and payment method, solely for the purpose of processing Your payment. The Company does not transmit or store your full card details.
• Third-party cloud and hosting infrastructure providers store Your data on secure servers located in India. All such providers are engaged under written data processing agreements that expressly require them to: (a) process Your personal data only on the Company's documented instructions and for no other purpose; (b) implement and maintain security safeguards that meet or exceed the standards required under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025; (c) not engage any sub-processor without the Company's prior written authorisation; and (d) promptly notify the Company of any actual or suspected breach of personal data. The Company retains audit and information-seeking rights over all processors to monitor compliance with these obligations.
• Regulatory and governmental authorities, courts, or law enforcement agencies may receive Your personal data where the Company is required to disclose it under applicable Indian law, a valid court order, or a legally enforceable government request. The Company will, where legally permitted, notify you of such a request prior to complying.
• Where a Practitioner, in the exercise of their independent professional judgement, determines that a User poses a risk of harm to themselves or to others, they may share necessary information with emergency services, the user's emergency contact, or other persons essential to maintaining safety, consistent with their obligations under applicable professional codes of conduct. The Company is not the decision-maker in such cases; that responsibility rests with the Practitioner.
• Where the Company provides employee wellness services to a corporate partner, only aggregated and fully anonymised data that cannot be attributed to any individual is shared with that organisation. Individual session data, mental health history, and any personally identifiable information is never disclosed to an employer or partner organisation.

The Company makes all User Information accessible to its employees, agents, and third parties only on a need-to-know basis and binds its employees to strict confidentiality obligations. The Company shall not be responsible for any breach of security or for the acts of any third parties that are beyond its reasonable control.

Retention of Data

The Company retains Your personal Information for as long as Your account remains active on the Platform. Following the closure of Your account, personal data that is not subject to any legal retention obligation will be deleted or irreversibly anonymised within 30 days of the date of closure. You may request deletion of Your data at any time by writing to hello@minddhara.com, and the Company will process such request within 30 days, subject to the obligations described below.

Certain categories of data are subject to mandatory retention periods under applicable Indian law, irrespective of account status or deletion requests:

• Financial and transactional records, including payment history, are retained for a period of 7 years from the date of the transaction, as required under the Income Tax Act, 1961 and the Goods and Services Tax Act.
• Session records held by Practitioners are subject to the record-keeping obligations of the Rehabilitation Council of India and the National Medical Commission, as applicable. The Company does not hold or control such records; retention obligations in respect of clinical records rest with the relevant Practitioners.
• Where data is retained solely for the purposes of dispute resolution, fraud prevention, or regulatory compliance following account closure, such data will be purged no later than 6 months from the date of closure, unless a longer period is required by applicable law.

Cookies

The Platform uses cookies, small data files stored on Your device, to enable core functionality, remember your preferences, and collect aggregated usage statistics that help the Company improve the Platform. The Company uses three categories of cookies: essential cookies that are necessary for the Platform to function; functional cookies that remember your settings and preferences; and analytics cookies that collect anonymised information about how you interact with the Platform.

You can manage or disable non-essential cookies at any time through Your browser or device settings, or through the cookie preferences tool on the Platform. Please note that disabling certain cookies may affect the functionality or performance of some features of the Platform.

We do not use advertising cookies and do not track Your activity across third-party websites for the purposes of targeted advertising or behavioural profiling.

Non-essential cookies, including functional and analytics cookies, shall not be placed on Your device until You have actively and affirmatively indicated Your consent through the cookie preferences tool presented upon Your first visit to the Platform. No non-essential cookie shall be placed by default, and a pre-selected or pre-ticked option shall not be treated as valid consent. You may withdraw or modify Your cookie preferences at any time through the cookie preferences tool accessible in the Platform footer. Withdrawing consent for non-essential cookies will not affect the functionality of essential cookies required for the Platform to operate.

Data Security

The Company implements administrative, technical, and physical security measures designed to protect Your personal Information from unauthorised access, use, disclosure, alteration, or destruction. All data transmitted between Your device and the Platform is encrypted using HTTPS/TLS protocols. Data stored on the Company's servers is encrypted at rest.

Access to personal Information is restricted to authorised staff and Practitioners on a strict need-to-know basis. The Company applies role-based access controls and least-privilege principles to limit access to the minimum information necessary for the performance of authorised responsibilities. All persons with access to personal information are bound by confidentiality obligations.

The Company conducts periodic security reviews and vulnerability assessments designed to identify and address potential security weaknesses. Where the Company engages third-party service providers, including cloud infrastructure providers, communication tools, analytics providers, or payment processors, reasonable due diligence is undertaken to assess their security and confidentiality standards prior to engagement.

In the event the Company becomes aware of a breach of security that compromises Your personal data, We will notify affected Users immediately upon becoming aware and in accordance with applicable law, and will take all reasonable steps to contain, investigate, and remediate the incident.

Notwithstanding the above, the Company shall not be held responsible for any breach of security or loss of data attributable to events beyond its reasonable control, including acts of government, unauthorised access by third parties, or failures of internet or telecommunications infrastructure.

Security Incident Response

In the event of an actual or suspected personal data breach, the Company shall follow the below incident response process:

• Upon becoming aware of a breach, the Company's authorised personnel shall immediately assess the scope, nature, and affected data categories, and initiate containment measures.
• The Company shall notify the Data Protection Board of India and all affected Users without delay, as required under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Notifications to affected Users shall include: the nature of the breach; the categories of personal data affected; the likely consequences; and the steps the Company has taken or proposes to take to address the breach.
• The Company shall maintain a confidential internal incident log recording all breaches, whether or not they meet the threshold for mandatory notification, including the facts, effects, and remedial actions taken.
• Where third-party processors are involved, they are contractually required to notify the Company immediately upon becoming aware of any breach affecting personal data processed on the Company's behalf, so that the Company can fulfil its own notification obligations.

Your Rights

Under the Digital Personal Data Protection Act, 2023 and other applicable Indian law, you have the following rights in respect of Your personal Information held by the Company:

• Right to Access: You may request a copy of the personal Information the Company holds about you, along with a summary of the purposes for which it is being processed.
• Right to Correction: You may request that any inaccurate or incomplete personal Information held by the Company be corrected or updated.
• Right to Erasure: You may request that the Company delete Your personal Information. Such requests will be processed within 30 days, subject to any legal obligation the Company may have to retain certain categories of data as described in the Collection of Information section of this Policy.
• Right to Withdraw Consent: You may withdraw Your consent to the processing of Your personal Information at any time by writing to hello@minddhara.com. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to such withdrawal. The Company may, subsequent to such withdrawal, at its sole discretion continue or discontinue the provision of its Services to you.
• Right to Grievance Redressal: You may raise a complaint in respect of any aspect of the Company's handling of Your personal Information by writing to grievance@minddhara.com. The Company will acknowledge and respond to all such complaints within 30 days of receipt.
• Right to Nominate: Under the DPDP Act, 2023, You may nominate another individual to exercise Your data protection rights on your behalf in the event of Your death or incapacity. Such nomination may be made by writing to grievance@minddhara.com.
• Right to Data Portability: Where You are located in the European Union or the United Kingdom, You have the right to receive a copy of the personal Information you have provided to the Company in a structured, commonly used, and machine-readable format, and to request that such Information be transmitted to another data controller where technically feasible.
• Right to Object: Where You are located in the European Union or the United Kingdom, You have the right to object to the processing of Your personal Information where the Company relies on legitimate interests as its legal basis for processing. The Company will cease such processing unless it can demonstrate compelling legitimate grounds that override Your interests, rights, and freedoms.
• Right to Lodge a Complaint with a Supervisory Authority: Where You are located in the European Union or the United Kingdom, in addition to your right to approach the Data Protection Board of India, You have the right to lodge a complaint with the data protection supervisory authority in your country of residence.

The exercise of any of the above rights is subject to applicable legal obligations and the Company's legitimate interests in fraud prevention, platform security, and regulatory compliance. To exercise any of these rights, You may write to the Company at hello@minddhara.com.

Children's Privacy

We do not knowingly collect personal Information from Users under the age of 18 without verifiable parental or guardian consent. Where a User is below 18 years of age, the Company shall obtain verifiable consent from the parent or legal guardian of such User prior to the collection or processing of any personal data. Such consent shall be obtained through a verification mechanism at the time of registration that requires the parent or legal guardian to confirm their identity and their relationship to the minor User. The Company shall not process the personal data of a minor User unless and until such verifiable parental or guardian consent has been obtained. The Company shall not use the personal information of a minor for advertising, marketing, behavioural profiling, or any commercial purpose, under any circumstances. Where the Company becomes aware that personal data of a minor has been collected without verifiable parental consent, it shall delete such data without undue delay.

We shall never use the personal Information of a minor for advertising, marketing, or behavioural profiling purposes, under any circumstances.

Data Storage and Transfers

All personal Information collected by the Company is stored on servers located within India. The Company complies with applicable data localisation requirements under Indian law, including the Digital Personal Data Protection Act, 2023.

In the event that any personal Information is required to be transferred outside India, including for the purposes of cloud infrastructure, technical operations, or service delivery, such transfer will be carried out only in accordance with the safeguards and conditions prescribed under the DPDP Act and applicable rules, and only to jurisdictions or recipients that provide an adequate level of data protection.

Changes to This Policy

The Company reserves the right to update or modify this Policy at any time. Where any change materially affects Your rights or the manner in which Your personal Information is processed, the Company will notify you by email or through an in-app notification prior to the change taking effect. The date of the most recent update to this Policy is displayed at the top of this page. Your continued use of the Platform following notification of any change constitutes your acceptance of the revised Policy.

Contact and Grievances

For any queries, concerns, or complaints relating to this Policy or the processing of Your personal Information, You may contact the Company's Grievance Redressal Officer at the details set out below. All complaints will be acknowledged and responded to within 90 days of receipt.

In accordance with the Information Technology Act, 2000, and the rules made thereunder, the Company has appointed a Grievance Redressal Officer whose details are set out below. Users are encouraged to first raise their complaint with the Grievance Redressal Officer before escalating to the Data Protection Board of India.

Grievance:

• Email: hello@minddhara.com
• MindDhara Private Limited, Sector-77, Narsinghpur, Gurugram, Haryana – 122004.

Users are requested to direct all data protection and privacy grievances specifically to the above address to ensure timely triage and resolution separate from general customer support queries.

If You are not satisfied with the Company's response to your complaint, You have the right to escalate your grievance to the Data Protection Board of India, which has been established under the Digital Personal Data Protection Act, 2023 to adjudicate disputes relating to personal data processing.