Privacy Policy

1. Information We Collect

We may collect personal information when you:

• Submit a form on this website (name, email, phone, therapy preferences, presenting concerns)
• Request, book, or attend a therapy session (individual, couples, or group programmes)
• Participate in a corporate wellness workshop or group session
• Make a payment through our payment processor
• Reach out via email, phone, WhatsApp, or other messaging platforms
• Complete a consent form or intake document

Information we may collect includes:

• Name, age, and contact information (email, phone number)
• Preferred availability and communication preferences
• Information about your mental health, presenting concerns, and therapy goals (only during sessions)
• Payment information processed through Razorpay (we do not store card details)
• Information you choose to share voluntarily (via forms, email, or messaging)
• Technical information (browser type, device type, approximate location — from analytics tools only)
• Google Calendar information (if you use Google Appointment Scheduling for booking)

You are never required to share more than you are comfortable with. Information about therapy concerns should only be shared during sessions with your therapist, not via website forms.

2. How Your Information Is Used

Information shared is used only to:

• Respond to your enquiry or booking request
• Coordinate and confirm therapy sessions or group programmes
• Send transactional emails and messages — booking confirmations (with session time and join details), calendar invites, payment receipts, and session reminders
• Send administrative follow-ups if you begin a booking on our website but do not complete it (for example, a link to continue where you left off)
• Communicate rescheduling or cancellation information
• Provide clinical supervision and care coordination among our clinical team
• Process payments and maintain invoicing records
• Ensure continuity of care (e.g., if your assigned therapist becomes unavailable)
• Improve our services through anonymised feedback

Your information is not used for marketing purposes without your explicit consent. We will never send promotional emails or messages unless you opt in. Transactional and administrative messages about your enquiry or booking are not marketing.

3. Our Team & Multi-Therapist Model

Arora Space operates with a team of qualified clinical psychologists:

• Latika Arora — Clinical Director and Lead Psychologist
• Associate Psychologists — Qualified clinicians working under Latika's clinical supervision

Depending on your needs and availability, you may be matched with any qualified clinician on our team. All therapists operate under the same ethical and confidentiality standards. Your assigned therapist will be confirmed during your initial booking communication.

Access to your information within our team is limited to:

• Your assigned therapist (for session notes and clinical care)
• Latika Arora (for clinical supervision and quality assurance)
• Administrative staff, if necessary, for scheduling and invoicing only (never clinical details)

All team members are bound by the same confidentiality agreements and professional ethics standards.

4. Data Architecture & Technology

We use secure, professional-grade tools to manage your information:

• Google Workspace — Email, calendar, and appointment scheduling (secure, HIPAA-aligned infrastructure)
• Supabase (PostgreSQL) — Encrypted database for storing client records, session notes, and invoices
• Vercel — Secure API endpoints connecting form submissions to our database
• Razorpay — Payment processing (PCI-DSS compliant; we do not store your payment details)
• Resend — Transactional email delivery (booking confirmations, receipts, reminders, and administrative booking follow-ups)
• Google Forms — Intake and consent collection (linked to our database for continuity)
• PostHog — Product analytics for website usage and booking funnel (pages and funnel steps only; not clinical content)
• Meta Pixel — Advertising measurement for Meta ads (page views and booking conversion events; not clinical content)

Clinical records and session notes stay within our care systems in India. Website analytics (PostHog), advertising measurement (Meta Pixel), and transactional email (Resend) may process limited contact or usage data via their cloud infrastructure under their data processing terms — never therapy notes, session content, or payment card details.

5. Payments & Financial Information

Payments are processed securely through Razorpay, an industry-standard payment gateway.

• This website and our apps do not store your card, UPI, net banking, or banking details
• Razorpay handles all payment data in accordance with PCI-DSS (Payment Card Industry Data Security Standard)
• We store only the payment confirmation, amount, date, and method (e.g., "UPI," "Card") in our records — never sensitive payment credentials
• Invoices are generated and stored in our database for accounting and record-keeping purposes

For Razorpay's privacy practices, please refer to their privacy policy: https://razorpay.com/privacy/

6. Confidentiality & Session Information

All information shared during therapy sessions is treated with care, respect, and strict confidentiality, in line with professional and ethical standards.

Confidentiality Limits

Your therapist may break confidentiality only when:

• There is a serious, imminent risk of harm to yourself or others
• Disclosure is required by law (court order, legal obligation)
• To contact emergency services in a crisis
• Child safety is at risk (mandatory reporting in India)

Any such disclosure will be made thoughtfully and with your knowledge whenever possible. We will inform you if we believe we must break confidentiality.

Special Note for Couples and Group Sessions

• In couples therapy, confidentiality applies to both partners equally. Information disclosed in a couples session cannot be shared with one partner privately without discussion in the couples setting.
• In group programmes and workshops, participants should not share personal health information, as group confidentiality cannot be guaranteed. Corporate wellness sessions are psychoeducational, not confidential clinical spaces.

7. Data Storage & Retention

How long we keep your information:

• Session records and therapy notes — Retained for 7 years after the final session, in accordance with Indian clinical and legal standards
• Payment records and invoices — Retained for 8 years for GST and income tax compliance
• Lead/enquiry records — Retained for 2 years or until you opt out
• Group programme participant records — Retained for 3 years after programme completion

After the retention period, records are securely deleted or anonymised. You may request earlier deletion, subject to legal and clinical requirements (e.g., we cannot delete records if required by law or if deletion would compromise your care).

8. Data Protection & Security

Reasonable measures are taken to protect personal information:

• Encryption — Data in transit (to our servers) and at rest (in our database) is encrypted
• Access controls — Only authorized team members have access to client records
• Secure infrastructure — We use professional-grade, HIPAA-aligned platforms (Google Workspace, Supabase, Vercel)
• Regular audits — Our systems are regularly reviewed for security vulnerabilities
• Credential management — API keys and sensitive credentials are never shared via email or chat; stored only in secure environment variables

While we implement industry best practices, no system is 100% secure. We encourage you to protect your login credentials and contact us immediately if you suspect unauthorized access to your account.

9. Sharing of Information with Third Parties

Your personal information is never sold, rented, or shared with third parties for commercial or promotional purposes.

Information may be shared only in these circumstances:

• Required by law — Court orders, legal subpoenas, or government requests
• Emergency situations — To contact emergency services or prevent imminent harm
• Service providers — Trusted vendors who process data on our behalf under strict confidentiality agreements (e.g., Razorpay for payments, Resend for transactional email, Google for workspace services, PostHog for website analytics, Meta for ad measurement)
• Corporate wellness partners — If you participate in a corporate wellness programme, limited non-clinical data (attendance, module completion) may be shared with your employer at their request

For Corporate Wellness Programmes

• Your employer will receive only aggregate or anonymised data (e.g., "X employees attended module Y")
• No personal health information, therapy topics, or individual disclosures will be shared with your employer
• Your consent will be obtained before any data is shared

10. Cookies & Website Analytics

Our website uses PostHog for product analytics and the Meta Pixel to measure Meta (Facebook/Instagram) ad performance and booking conversions. We do not sell your data.

• PostHog may store a cookie or local storage identifier so we can see return visits as the same anonymous visitor
• Meta Pixel may set cookies used for ad delivery, measurement, and attribution on Meta platforms
• Events cover funnel steps and technical context (page path, device type, booking value) — not therapy topics, session notes, or card details
• Session recording is disabled on this site
• You may clear site data or block cookies in your browser; core booking still works without analytics

11. Your Rights & Choices

You have the right to:

• Request access to your personal information — We will provide a summary of what we store about you
• Request corrections — If information is inaccurate, we will correct it
• Request deletion — You may ask for your information to be deleted, subject to legal and clinical requirements
• Opt out of communications — You may unsubscribe from any non-clinical emails or messages
• Withdraw consent — If we are processing data based on your consent, you may withdraw it at any time

To exercise these rights, contact us using the details at the end of this policy. We will respond within 7–10 business days.

12. Testimonials & Shared Experiences

Any testimonials, case studies, or shared experiences displayed on our website or marketing materials:

• Are shared with explicit written permission
• Are anonymised and do not include identifying information (names, dates, specific details)
• Do not include sensitive personal or therapy information unless explicitly agreed in writing

13. Data Breach Notification

In the unlikely event of a data breach, we will:

• Notify affected individuals within 30 days
• Provide details of the breach and steps taken to mitigate it
• Offer support and resources to protect your information
• Comply with any legal notification requirements

14. Changes to This Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in our services, technology, or legal requirements. The most current version will always be available on our website. Significant changes will be communicated to you via email or notification on our website.

15. Data Protection Compliance

We comply with applicable data protection laws in India, including the Digital Personal Data Protection (DPDP) Act, 2023. If you believe your privacy rights have been violated, you may lodge a complaint with the Data Protection Board of India or contact us directly.

16. Contact Us

If you have questions, concerns, or wish to exercise your privacy rights, please reach out:

• Email: contact@aroraspace.com
• WhatsApp: +91 9953189361
• Contact Form: Available on our website