Privacy Policy

Version: 1.1 Last updated: 11 October 2026 Grievance Officer: Mufassil Dingankar Grievance contact: therapeticka@gmail.com · +91 900 439 9494

1. Summary

therapeticka® is a wellness practice owned and operated by Mufassil Dingankar, a sole proprietor trading as therapeticka®, based in Thane, Maharashtra, India.

This policy explains how we handle personal data collected through therapeticka.com, the 7-Day Self-Observation Challenge, bookings, payments, and our communication channels.

We treat the daily observations you submit during the 7-Day Challenge as health data. They are handled with the same care as clinical information.

Our commitments:

We do not sell your personal data.
We do not disclose your personal data to third parties for their own advertising or marketing, or to data brokers.
We do not use your health observations to train AI models, and we contractually restrict service providers from doing so. [To be verified per vendor.]
We do not use fear, urgency, or guilt in how we communicate with you.

Your rights are set out in §11. If you are in the EU or EEA, additional rights apply to you under the GDPR.

This policy is a summary in plain language. Where a clause requires legal precision, the formal text governs.

2. Who we are

Data Fiduciary (India): Mufassil Dingankar, sole proprietor trading as therapeticka®, S-26/B-6, Phase I, Devdarshan CHS, Dongripada, Ghodbunder Road, Thane West - 400 615, Thane, Maharashtra, India.

Controller (GDPR, for individuals in the EU/EEA): Same entity as above, where GDPR applies under Art. 3(2).

Contact for all privacy matters:

Grievance Officer: Mufassil Dingankar
Email: therapeticka@gmail.com
Phone: +91 900 439 9494
Postal: S-26/B-6, Phase I, Devdarshan CHS, Dongripada, Ghodbunder Road, Thane West - 400 615, Thane, Maharashtra, India
Availability: Monday to Saturday, 10:00–18:00 IST

EU representative (GDPR Art. 27): [PENDING — To be appointed if the territorial-scope assessment confirms a requirement.]

Data Protection Officer: Not appointed. We are not a Significant Data Fiduciary under the DPDP Act, and the scale of our processing does not trigger a mandatory DPO under GDPR Art. 37. The Grievance Officer answers privacy questions.

2A. Indian law currently in force

Until the substantive provisions of the DPDP Act 2023 come into force (currently scheduled for approximately May 2027), we comply with:

Information Technology Act, 2000, section 43A
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”)
CERT-In Directions, 28 April 2022 (cyber-incident reporting)

Health information you provide to us is “sensitive personal data or information” under the SPDI Rules. We collect it only with your consent, which you give electronically when you submit it, and we apply reasonable security practices to protect it.

When the DPDP Act’s substantive provisions commence, we will update this policy in line with the Act and its Rules.

3. What we collect

We collect personal data at the following capture points. Each consent-based capture point shows its own short notice at the point of collection, with a link to withdraw consent.

F-01 · Website use and analytics

Strictly necessary data (always collected): IP address, browser and device information, requests to our servers — used to deliver the site securely. IP addresses are used for security and diagnostics only and are not used to identify you personally.
Optional analytics (only with your consent): a pseudonymous identifier stored in a cookie (anon_id), pages visited, referrer, session events, and approximate location derived from your IP address.
This data is pseudonymous, not anonymous. It can be linked to you if combined with other information (for example, if you sign up later). We do not set analytics cookies or load analytics scripts until you consent.
Legal basis: strictly necessary data — DPDP s.7(a) for legitimate use / consent under SPDI; GDPR Art. 6(1)(f) (legitimate interest in operating a secure website). Optional analytics — consent (SPDI; GDPR Art. 6(1)(a) + ePrivacy).

F-02 · Contact form

Data: name, email address, message content.
Purpose: responding to your enquiry.
Retention: 24 months from last correspondence.
Note: If your enquiry contains health information (symptoms, conditions), we treat it as health data under §4.

Data: name, email address, timezone (for correct prompt timing), age confirmation, consent timestamp.
Purpose: creating your account and sending daily observation prompts.
Retention: until account closure or 24 months of inactivity, whichever is earlier.

F-04 · 7-Day Challenge daily observations — health data

Data: your daily responses across the five t®SIGNAL domains (Circadian, Metabolic, Stress, Interaction, Energy), timing of entries, any free-text notes you add, and the Day-7 Reveal generated from them.
Purpose: generating your Day-7 Reveal; supporting a subsequent consultation if you choose one.
Legal classification: health data. Treated as sensitive.
Retention: until you request deletion, or 24 months from your last entry — whichever is earlier.
Day-7 Reveal generation: see §5A.

F-05 · Consultation booking

Data: name, email address, phone number, preferred language, session type (online/in-person), booking notes.
Purpose: confirming and delivering your consultation.
Retention: booking metadata 24 months from consultation; invoices per F-06. Health information in booking notes is moved into your clinical record (§8).

F-06 · Payments

Processor: Payments are processed by Razorpay Software Private Limited, an RBI-authorised payment aggregator, through the Employz.ai booking widget. Razorpay processes your payment details as an independent controller under its own privacy policy and RBI obligations.
Data we receive: payment status, amount, date and time, transaction or UPI reference, payment method type, and — where exposed by Razorpay — card network, last four digits of the card, and the name, email, and phone number entered at checkout.
Data we do not receive: full card numbers, CVV, bank login credentials, UPI PIN.
Retention: invoices and accounting records for 8 years from the end of the financial year to which they relate.

F-07 · WhatsApp communication

Data: phone number, WhatsApp profile name, message content (including attachments), timestamps, delivery/read metadata.
Processor: Meta Platforms Inc. — role depends on the WhatsApp channel type (Business App vs Cloud API). We treat Meta as a processor for message content and as an independent controller for account and usage data.
Retention: 24 months from last message. Attachments containing clinical information are moved into your clinical record within 30 days and deleted from WhatsApp.

F-08 · Email correspondence

Data: email address, content, attachments, timestamps.
Processors: Google Workspace, Mailgun (transactional delivery).
Retention: 24 months from last correspondence, unless it forms part of a clinical record (§8) or an accounting record (F-06).

F-09 · [Merged into F-01]

Data: your consent choices by channel and purpose, timestamps, IP address at time of consent.
Purpose: honouring your preferences; demonstrating compliance.
Legal basis: retention necessary for compliance with law and to establish that consent was validly obtained (DPDP s.6(10); GDPR Art. 7(1)).
Retention: duration of your relationship with us plus 36 months.

What it does: if you separately agree, when you create a Challenge account we link your earlier anon_id browsing to your account, to understand how you found us.
Consent: a separate optional choice from analytics consent, off by default, never applied to anyone under 18.
Withdrawal: we delete the link within 7 days. Aggregated statistics already produced are unaffected.
Retention: until withdrawal, account erasure, or 24 months from creation — whichever is earliest.

F-12 · Marketing communications (optional)

Data: name, email address, WhatsApp number, consent records.
Purpose: sending news, programmes, and educational content you opted in to receive.
Legal basis: consent, separately for each channel.
Opt-out: unsubscribe link in every email; reply STOP on WhatsApp; [/preferences/].
Retention: until you opt out; we then keep only your email/phone on a suppression list.

3A. Required and optional information

Name and email are required to join the Challenge. Daily observations are required to generate the Day-7 Reveal. Name, contact details, and payment are required to book a consultation. If you do not provide required information, we cannot provide that service.

Analytics, browsing-linking, and marketing are always optional.

3B. What we do not do

We do not sell personal data.
We do not disclose personal data to third parties for their own advertising or marketing.
We do not disclose health observations to any recipient other than those listed in §9, except where required by a law applicable to us or a lawful court/regulator order. Where the law allows, we will tell you.

4. Health data — additional safeguards

Your 7-Day Challenge observations and clinical consultation records are the most sensitive data we hold.

Encryption: data travelling between your device and our systems is encrypted in transit using TLS. Data stored in Google Cloud is encrypted at rest. Email and WhatsApp are protected by the encryption those services provide; standard email is not end-to-end encrypted.
Access: individual observations and clinical records can be accessed only by Mufassil Dingankar and — where engaged — named clinical support personnel on a need-to-know basis, and by processors in §9 solely to operate our systems.
No AI training: We do not use your observations to train AI models. The vendor that generates the Day-7 Reveal draft is contractually restricted from using your observations for model training. [Vendor to be finalised — see §5A.]
Separation: Challenge observations are held separately from clinical records (§8).
Deletion: you may request deletion of your observations at any time (§11). Where the law requires retention, we keep the data only for that purpose, restrict access, and delete or anonymise it when the legal period ends.

5. Why we use your data — purposes and legal bases

We process personal data only for specified purposes and on a legal basis applicable to the relevant processing operation.

Purpose	Data	Indian law basis	GDPR basis
Strictly necessary website operation and security	F-01	Legitimate use (SPDI / DPDP s.7(a))	Art. 6(1)(f)
Optional website analytics	F-01	Consent	Art. 6(1)(a) + ePrivacy consent
Linking pre-sign-up browsing	F-11	Consent (separate)	Art. 6(1)(a) (separate)
Challenge account and daily prompts	F-03	Consent	Art. 6(1)(b)
Recording observations and generating Day-7 Reveal	F-04	Consent	Art. 6(1)(b) + Art. 9(2)(a) explicit consent
Booking and delivering consultations	F-05	Consent	Art. 6(1)(b) + Art. 9(2)(h) (healthcare provision under professional secrecy)
Taking payment	F-06	Consent / legitimate use	Art. 6(1)(b)
Keeping invoices and accounting records	F-06	Compliance with legal obligation (Companies Act s.128(5), CGST Act s.36)	Art. 6(1)(c)
Responding to enquiries	F-02, F-07, F-08	Consent / legitimate use	Art. 6(1)(b) pre-contractual, or Art. 6(1)(f); health content Art. 9(2)(a)
Marketing communications	F-12	Consent (separate, per channel)	Art. 6(1)(a) + ePrivacy
Consent record-keeping	F-10	Compliance with legal obligation / DPDP s.6(10) burden of proof	Art. 6(1)(c) + Art. 7(1)
Security, fraud prevention, logs	Logs, account data	Retention required under SPDI r.8 and CERT-In Directions	Art. 6(1)(f); health data minimised in logs
Establishing, exercising or defending legal claims	As needed	Legal obligation / legitimate use	Art. 6(1)(f) + Art. 9(2)(f)

Legitimate interests (GDPR): We rely on legitimate interests to operate a secure, functioning website; prevent fraud and abuse; respond to enquiries; comply with Indian legal obligations; and defend legal claims. You may object to this processing (§11). We do not rely on legitimate interests to process health data. For health data we rely on explicit consent (Challenge observations) or the provision of healthcare under professional secrecy (consultations).

5A. Day-7 Reveal — how it is produced

Your Day-7 Reveal is generated by software that analyses your daily responses across the five t®SIGNAL domains and produces a draft. Every Reveal is then reviewed and, where necessary, edited by Mufassil Dingankar before it is sent to you.

The Reveal is educational and observational. It is not a diagnosis, prescription, or medical advice.
It is not used to decide whether you can access any service, its price, or any other matter with legal or similarly significant effect on you.
Because a human reviews every Reveal before it is sent, your Reveal is not a solely automated decision under GDPR Art. 22. You nevertheless may ask for information about how your Reveal was produced, give your view on it, or contest it — write to therapeticka@gmail.com.
Software vendor: [AI VENDOR TO BE FINALISED]. The vendor will be contractually restricted from using your observations for model training and required to delete them on completion of the Reveal.

Consent on therapeticka® is:

Specific. We ask for consent for each purpose, separately. Consent to receive your Day-7 Reveal does not imply consent to marketing.
Per channel. WhatsApp consent is separate from email consent, which is separate from analytics consent.
Free. You can refuse or withdraw consent without affecting services that do not depend on it.
Informed. Each consent-based capture point shows a short notice at the point of collection describing what data is collected, why, who receives it, and how to withdraw.
Withdrawable. You can withdraw consent as easily as you gave it.

To withdraw consent: visit [/preferences/], email therapeticka@gmail.com, use the unsubscribe link in any marketing email, or reply STOP on WhatsApp. We act on withdrawal within 48 hours for marketing and analytics and within 7 days for other processing. Service providers stop processing within the same period, unless the law requires us to retain the data (§7). Withdrawal does not affect processing lawfully carried out before withdrawal.

If you withdraw consent that a service depends on (for example, recording observations for the Challenge), we will stop that service and tell you the consequences before you confirm.

7. How long we keep your data

Data class	Retention	End of retention
Contact form (F-02)	24 months from last correspondence	Deletion
Challenge account (F-03)	Until account closure or 24 months of inactivity, whichever is earlier	Deletion
Observations and Reveal (F-04)	Until you request deletion, or 24 months from last entry	Deletion
Booking metadata (F-05)	24 months from consultation	Deletion
Invoices and accounting (F-06)	8 years from end of relevant financial year	Deletion
WhatsApp (F-07)	24 months from last message	Deletion
Email (F-08)	24 months from last correspondence	Deletion
Optional analytics (F-01)	14 months	Deletion
Consent records (F-10)	Duration of relationship + 36 months	Deletion
Browsing link (F-11)	Per F-11 (until withdrawal, erasure, or 24 months)	Deletion
Marketing suppression list (F-12)	Until you ask us to contact you again	Deletion
Security and access logs	At least 1 year; maximum 24 months	Deletion

Backups: deleted data may remain in encrypted backups for up to 35 days before being overwritten. Backups are not used for any other purpose.

Legal holds: we may keep specific data longer where needed to comply with law or a court or regulator order, or to establish or defend a legal claim — only for that purpose.

We review these periods at least annually.

8. Clinical records

If you have a consultation with Dr. Mufassil Dingankar — whether online or in person — consultation notes, case history, assessments, and prescriptions created during that consultation are clinical records.

Clinical records are stored on Google Cloud and on the practitioner’s local device. They are governed by this policy. They are not published or shared with anyone other than the practitioner and — where engaged — named clinical support personnel on a need-to-know basis.

Retention of clinical records: 8 years from the date of last consultation, in line with common Indian medical-recordkeeping practice. You may request access to, correction of, or deletion of your clinical records under §11, subject to legal retention requirements and professional recordkeeping obligations.

Clinical information you send us through the website, the Challenge, WhatsApp, or email — for example reports or prescriptions — is moved into your clinical record and deleted from the original channel where technically possible.

9. Who receives your data

We use third-party service providers. Their roles depend on the specific processing activity.

Recipient	Role	Purpose	Data	Location	EU transfer safeguard
Google Cloud / Firebase	Processor	Hosting, database, storage, authentication	Website, Challenge, account data	Database asia-south1 (Mumbai); Firebase Authentication may process in the US; CDN global	Google Cloud DPA incl. EU SCCs
Google Analytics for Firebase (if enabled)	Processor	Optional analytics	Pseudonymous ID, events, approximate location	US / global	Google DPA / SCCs
Google Workspace	Processor	Email	Email content, attachments	Global (or data region if configured)	Google Cloud DPA incl. SCCs
Mailgun (Sinch)	Processor	Transactional email delivery	Email address, name, subject, content	US / EU region	EU–US DPF / SCCs
Employz.ai	Processor	Booking widget	Name, email, phone, booking details, notes	India (to be verified)	SCCs if sub-processing outside India
Razorpay Software Pvt Ltd	Independent controller	Payment processing	Payment and checkout details	India	Not a transfer outside India
Meta (WhatsApp)	Processor for message content; independent controller for account and usage data	Messaging	Phone, profile name, messages, metadata	Global	Meta SCCs / DPF
[AI vendor — Day-7 Reveal]	Processor	Generating Reveal draft	Observations (pseudonymised where possible)	[To be finalised]	[To be finalised]
Professional advisers, auditors	Independent controller	Legal, tax, audit	As necessary	India	—
Courts, regulators, law enforcement	Independent controller	Where legally required	As required	India / where you reside	—

Disclosure required by law. We disclose personal data where required by a law applicable to us or by a lawful order of a court, regulator, or law-enforcement agency. We check that the request is lawful and disclose only what is required. Where the law allows, we will tell you.

DPA status. We are in the process of accepting or executing the applicable data processing terms for each processor. The current list of DPAs is available on request.

10. International processing and transfers

Our main database is in Google Cloud asia-south1 (Mumbai, India). Some recipients in §9 process data in other countries, including the United States.

India: We transfer personal data outside India only to countries not restricted by the Central Government under DPDP Act s.16 (once in force), and in compliance with any requirements notified under the DPDP Rules and any sectoral law requiring data to remain in India.

EU/EEA residents: When you give us personal data directly, we collect it in India, and GDPR applies to our processing under Art. 3(2). The European Commission has not adopted an adequacy decision for India. Where we transfer your data onward to recipients outside India in countries without an EU adequacy decision, we use the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) or the recipient’s certification under the EU–US Data Privacy Framework, with supplementary measures where needed. You may request a copy of the relevant safeguards by writing to therapeticka@gmail.com.

11. Your rights

Your rights depend on the law applicable to the processing. We will provide the rights applicable under Indian law and, where GDPR applies, the rights provided by the GDPR. We do not represent that a right available under one regime is automatically available under another.

All users

Access: a summary of the personal data we process and our processing activities, and the identities of the data fiduciaries and processors with whom we have shared your data, and a description of what was shared.
Correction, completion, and updating of inaccurate or incomplete data.
Erasure of data no longer needed, or for which you withdraw consent, unless the law requires us to keep it.
Withdrawal of consent at any time.
Grievance redressal through our Grievance Officer.
Nomination of a person to exercise your rights in the event of your death or incapacity (DPDP s.14).

Additional rights for EU/EEA residents

Portability of data you provided, processed by automated means on the basis of consent or contract.
Restriction of processing.
Objection to processing based on legitimate interests, and an absolute right to object to direct marketing at any time.
Not to be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions (§5A).

How to exercise

Use [/preferences/] or email therapeticka@gmail.com with:

Your name
The email address or phone number you used with us
Your specific request

We verify your identity before acting and ask only for what verification requires. A nominee or guardian must provide proof of authority.

Timelines

We acknowledge requests within 3 working days and respond within one month of receipt. For complex or numerous requests, we may extend this by up to two further months for EU/EEA residents and will tell you why within the first month. Grievances are resolved within 30 days and in any event within the period prescribed under Indian law. Requests are free unless manifestly unfounded or excessive.

Exercising your rights will not affect services that do not depend on the data concerned. If erasure or withdrawal makes a service impossible — for example, deleting observations before Day 7 — we will tell you before acting.

Complaints

India: If you are not satisfied with our Grievance Officer’s response, or do not receive one within the prescribed period, you may complain to the Data Protection Board of India. Under the DPDP Act, you must first use our grievance mechanism.
EU/EEA: You may complain at any time to the supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement.

12. Security and breach notification

Security measures

We apply reasonable security safeguards appropriate to the risk, including:

TLS encryption in transit for our website and systems
Encryption at rest in Google Cloud
Access restricted to named individuals on a need-to-know basis
Multi-factor authentication on Google Workspace, Google Cloud, and administrative dashboards where supported
Logging of access to our database and administrative consoles, with logs kept for at least one year
Encrypted backups
Contractual security obligations on our processors

Personal data breaches

India: We will inform each affected individual without delay, and the Data Protection Board of India without delay, followed by a detailed report within 72 hours of becoming aware (or any longer period the Board allows). We report cyber-security incidents to CERT-In within 6 hours of noticing them where the CERT-In Directions require.

EU/EEA: We notify the competent supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals. Where the breach is likely to result in a high risk to you, we notify you without undue delay.

Notification content: what happened, what data was affected, likely consequences, what we are doing, what you can do, and whom to contact.

We keep an internal record of all personal data breaches as described in our Personal Data Breach Response Plan.

13. Cookies and similar technologies

Strictly necessary cookies are set without consent because the site cannot work without them. All other cookies and scripts are set only after you opt in, and you can change your choice at any time at [/preferences/]. Rejecting is as easy as accepting.

Name	Provider	Category	Purpose	Duration
`session`	therapeticka®	Strictly necessary	Session state	Session
`consent_state`	therapeticka®	Strictly necessary	Stores your cookie choices	12 months
`anon_id`	therapeticka®	Analytics (opt-in)	Pseudonymous identifier	24 months
`_ga`, `_ga_*` [to be verified]	Google	Analytics (opt-in)	Visitor distinction	Per configuration
[From cookie scan]	Employz.ai	Necessary for booking	Booking widget	[To be verified]
[From cookie scan]	Razorpay	Necessary for payment	Payment security and fraud prevention	[To be verified]
[From cookie scan]	[Embedded content]	Opt-in	[●]	[To be verified]

We do not use advertising or retargeting cookies or marketing pixels (including Meta Pixel) on this site.

[To be verified by cookie scan before publication.]

14. Children and persons with disabilities

The 7-Day Challenge, website accounts, and our communications are for adults (18+). We ask you to confirm your age at sign-up. If we learn that a person under 18 has signed up without verifiable parental consent, we will delete the account and its data.

Consultations for a child are booked by a parent or lawful guardian. Before processing a child’s personal data, we obtain the verifiable consent of the parent or guardian by checking identity and age details, as permitted under applicable law.

We do not track, behaviourally monitor, or profile children, and we do not direct targeted advertising at them. Analytics and browsing-linking are disabled for any account identified as belonging to a child.

Where an adult with a disability has a lawful guardian, we obtain the guardian’s verifiable consent and verify the guardianship.

EU/EEA residents: Where GDPR Art. 8 applies, we follow the age threshold of your Member State.

15. Changes to this policy

When we materially change this policy, we will:

Create a new version (v1.1 → v1.2, etc.)
Retain the prior version in the version history
Notify you by email if the change affects your rights
Publish material changes at least 14 days before they take effect, unless the law requires a change sooner

Version history:

v1.0 — 11 October 2026 — Initial draft (superseded)
v1.1 — 11 October 2026 — Legal review integration; entity clarified; SPDI Rules added; legal bases corrected; over-reach removed

16. Contact and grievance

Grievance Officer: Mufassil Dingankar Email: therapeticka@gmail.com Phone: +91 900 439 9494 Postal: S-26/B-6, Phase I, Devdarshan CHS, Dongripada, Ghodbunder Road, Thane West - 400 615, Thane, Maharashtra, India Availability: Monday to Saturday, 10:00–18:00 IST

Response target: we aim to acknowledge privacy enquiries within 3 working days. Response deadlines are in §11.

Language: This policy is available in English. You may request it in Hindi, Marathi, or any other language listed in the Eighth Schedule to the Constitution of India by writing to therapeticka@gmail.com. If translations differ, the English version prevails to the extent the law allows.

Governing law: This policy is governed by the laws of India. Nothing in it limits any right you have under the mandatory data protection law of the country where you live, including the right of EU/EEA residents to bring proceedings before the courts of their Member State (GDPR Art. 79(2)).

Last reviewed: 11 October 2026 Next review due: 11 October 2027, or upon material change

This policy is a summary of how we handle personal data. It is not legal advice. Full legal text of applicable Indian and EU laws is available on request.