Privacy Policy

1. Who we are

Auradeck is a practice management platform for mental health professionals in India, operated by Auradeck (“Auradeck”, “we”, “our”, “us”). This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and your rights under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

This policy applies to the Auradeck website (including getauradeck.com and app.getauradeck.com), the Auradeck dashboard, and all related services. It should be read together with our Terms and Conditions.

2. Data we collect

2.1 Therapist account data

When you create an account or use the Service we may collect: name, email address, phone number, professional licence or registration details (if provided), practice details (specialty, mode of practice, fee, languages), and, if you use Google Sign-In or connect Google Calendar, the Google data described in Section 6.

2.2 Client data you enter

Name, email, phone, demographic information (age band, gender, occupation, city), session history, clinical notes, intake form responses (including mental health screening scores such as PHQ-9 and GAD-7), invoices, uploaded files, and any other information you choose to record about your clients. This data belongs to you and your clients. We process it only on your instructions as a Data Processor under the DPDP Act.

2.3 Usage and technical data

Server logs (IP address, request path, timestamp) retained for 30 days for security and debugging purposes. We also use a single session cookie (auradeck_token) to keep you signed in.

3. How we use your data

We use personal data for the following purposes:

• To provide, maintain and improve the Auradeck Service and its features
• To send transactional emails on your behalf (session reminders, worksheets, invoices) to your clients via our email processor
• To generate AI-assisted clinical notes via Google Gemini when you actively use the transcript / note-assist feature (opt-in)
• To detect and prevent fraud, abuse and security incidents
• To comply with applicable law and respond to lawful requests

We do not sell your data or your clients’ data. We do not use client health data for advertising or for training general-purpose AI models.

4. Data storage and security

All data is hosted in India. The Auradeck application runs on Vercel in its Mumbai region, and data and uploaded files are stored with Supabase on Amazon Web Services (AWS) infrastructure in the Mumbai region. Clinical notes are encrypted at rest using AES-256-GCM under keys managed so that access remains under your control as far as practicable. All data is transmitted over HTTPS (TLS 1.2 or higher).

We take database backups before significant changes to the Service. Deleted client records are soft-deleted and permanently purged after 30 days, subject to any longer retention required by law.

We implement reasonable technical and organisational measures consistent with the DPDP Act and the Information Technology Act, 2000 to protect personal data against unauthorised access, loss, destruction or alteration.

5. Third-party processors

We use the following processors to operate the Service, some only when the related feature is turned on. Each processes data only for the stated purpose and under contractual safeguards:

We do not sell personal data. Sub-processors are engaged only under contracts that require appropriate security and confidentiality safeguards.

6. Google user data

Auradeck uses Google APIs only for the optional features below. You choose whether to use them.

Google Sign-In (scopes: openid, email, profile). We receive your name, email address and profile picture, and use them only to create your account and sign you in.

Google Calendar (scope: calendar.events). When you connect Google Calendar from Settings, Auradeck:

• creates an event with a Google Meet link in your primary calendar when you schedule a session, titled with the client’s name and inviting the client’s email address if you have entered one;
• reads the start time, end time and title of other events in your primary calendar for the days you are viewing, so your Auradeck calendar can show when you are busy. These events are shown to you and are not stored by Auradeck beyond the temporary display.

Storage. We store the OAuth access and refresh tokens, encrypted, so the calendar connection keeps working. Selecting “Disconnect” in Settings deletes the stored tokens immediately. You can also revoke access at any time from your Google Account at myaccount.google.com/permissions.

Sharing and Limited Use. We do not sell Google user data, share it with third parties for advertising, use it for advertising, or use it to develop or train AI or machine-learning models. Google Calendar data is never sent to Google Gemini or any other AI service. Auradeck staff do not read your Google data unless you ask us to for support, it is needed for security, or the law requires it.

Auradeck’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Your rights under the DPDP Act, 2023

As a Data Principal under the DPDP Act you have the right to:

• Access – request a copy of the personal data we hold about you
• Correction – correct inaccurate or incomplete data
• Erasure – request deletion of your account and associated personal data
• Data portability – where applicable, receive data in a commonly used electronic format
• Grievance redressal – raise a complaint with our Data Protection contact

To exercise any of these rights, email hello@getauradeck.com. We will respond within the timelines prescribed under the DPDP Act and Rules (generally within a reasonable period not exceeding 30 days unless a longer period is permitted). You may also approach the Data Protection Board of India.

8. Therapist responsibility (Data Fiduciary)

You are responsible for obtaining appropriate consent from your clients before entering their personal or health data into Auradeck. You are the Data Fiduciary for your clients’ data; Auradeck acts as a Data Processor on your behalf. We encourage you to maintain your own privacy notice for clients and to comply with the Mental Healthcare Act, 2017 and all other applicable professional and legal obligations. Where you process data of children (persons under 18), you must obtain verifiable parental or guardian consent as required by the DPDP Act.

9. Cookies

Auradeck uses a single session cookie (auradeck_token) to keep you signed in. No third-party tracking cookies are used. No advertising cookies are used.

10. Data retention

We retain therapist account data and client data for as long as your account remains active or as needed to provide the Service. After you request deletion of your account, we will delete or anonymise personal data within a reasonable period, subject to any legal retention requirements (for example, tax or professional record-keeping obligations that may apply to you as the Fiduciary). Soft-deleted client records are permanently purged after 30 days.

11. Changes to this policy

We will notify you by email at least 14 days before any material changes to this policy take effect. Continued use of Auradeck after that date constitutes acceptance of the revised policy. The “Last updated” date at the top of this page will always show the most recent revision.

12. Contact and Grievance Redressal

For any privacy-related questions, to exercise your rights, or to raise a grievance:

Data Protection / Privacy contact and general enquiries: hello@getauradeck.com

Auradeck
India

We will acknowledge privacy grievances within a reasonable time and endeavour to resolve them in accordance with the DPDP Act. You also have the right to approach the Data Protection Board of India.

— End of Privacy Policy —