For clients living outside India in the countries listed in our International Terms of Service. Clients in India: please see the policies on mantraminds.com.

Clients en France : lire ce document en français.

International Privacy Policy

1. Who we are

This policy explains how Mantraminds ("we", "us"; our full legal details are in section 1 of our Terms of Service), handles personal information about people in the countries we currently serve (the United Kingdom, Ireland, the Netherlands, Germany, Portugal, Sweden, France, Switzerland, Norway, Denmark, Finland, Singapore, Hong Kong, Japan, South Korea, Sri Lanka, Bangladesh, Nepal, Australia, New Zealand, Fiji, Trinidad and Tobago and Suriname) who use our website, sign-up form or online well-being counselling.

We are the data controller (also called "organisation", "APP entity", "agency" or "Data Fiduciary", depending on the law) for this information.

• Registered office: E-303, LGF, Greater Kailash II, New Delhi 110048, India
• Privacy Officer (Data Protection Officer / Grievance Officer): contact@mantraminds.com

Country-specific information is in the annexes at the end. If an annex differs from the main policy, the annex applies to people in that country.

We take particular care because some of what you share with us is about your mental and emotional well-being. That is sensitive information, and we treat it that way.

2. What we collect

We do not collect your date of birth or government ID numbers, and we do not record sessions.

Your WhatsApp number: email is our usual way of contacting you. We use your WhatsApp number only if we need to reach you urgently, for example about your safety or a session that can't go ahead. WhatsApp messages are carried by WhatsApp (Meta) under its own terms.

Emergency contacts and other people: if you give us someone else's details, please make sure they know you have done so.

3. Why we use it, and our legal basis

Withdrawing consent. You can withdraw consent to us using your health information at any time by emailing contact@mantraminds.com. We can't provide counselling without it, so withdrawal will end the service. We may keep a minimal record (your consents, screening outcome and any safety actions) where the law allows, to show we acted responsibly.

No automated decisions. All screening is done by people: our team reads your sign-up answers, and your counsellor goes through the questionnaires with you at the start of your first session. Decisions about whether to offer sessions are made by people, and you can ask us to reconsider.

4. Who can see your information

Inside Mantraminds: access is limited to people who need it.

• Counsellors and clinical supervisors can see health information for the clients they support.
• Booking and administrative staff see only your name, contact details, country, booking details and whether sessions were offered. They never see your questionnaire answers, scores or session notes.
• Marketing tools never receive health information.

Service providers (processors) who handle information on our instructions, under contract, with confidentiality and security obligations:

Others, only when necessary: your emergency contact, emergency services or authorities in a serious-risk situation (see our Terms of Service, section 7); professional advisers (lawyers, auditors) under confidentiality; regulators, courts or police where the law requires; a buyer or successor of our business, who would be bound by this policy.

We never sell your personal information, and we never share it for advertising.

5. International transfers — your information in India

Mantraminds is based in India, and our counsellors work from India. Your information, including your health information, is stored and accessed in India.

India's data-protection law (the Digital Personal Data Protection Act 2023) may not give the same level of protection as the law in your country. To protect your information we:

• ask for your explicit consent to this transfer, after telling you about it, when you sign up;
• put contracts in place with our service providers requiring them to protect your information to the standard required by your country's law. Where required, these use recognised transfer terms (for example the UK International Data Transfer Agreement/Addendum);
• apply the security measures in section 7, wherever your information is held;
• remain accountable to you, and to your country's privacy regulator, for how your information is handled overseas.

See the annex for your country for more detail.

6. How long we keep it

When information is no longer needed, we securely delete or anonymise it.

7. Keeping your information secure

We use measures appropriate to sensitive health information, including:

• encryption in transit and at rest;
• role-based access, so only clinical staff can see health information;
• multi-factor authentication for staff accounts;
• confidentiality agreements and data-protection training for all staff;
• secure, end-to-end or encrypted video platforms;
• separation of health information from marketing systems;
• a documented process for responding to data breaches, including notifying you and the relevant regulators where the law requires.

No system is completely secure. If you think your information has been put at risk, please tell us at contact@mantraminds.com.

8. Your rights

Depending on where you live, you may have the right to:

• access the information we hold about you and get a copy;
• correct inaccurate information;
• delete your information (subject to legal retention duties);
• restrict or object to some uses, including any use based on legitimate interests;
• data portability (UK and EU);
• withdraw consent at any time, without affecting what was done before;
• nominate someone to exercise your rights if you die or become unable to (India);
• complain to us, and to your country's privacy regulator (see the annexes).

To use any of these rights, email contact@mantraminds.com. We'll confirm your identity, then respond within one month or the time the law in your country requires, whichever is shorter. There is normally no charge.

9. Marketing

We'll send you well-being tips and updates only if you have opted in. Every email has an unsubscribe link. We never use your health information, or the fact that you are a client, for marketing, and we never send marketing to anyone whose intake ended with a crisis or referral outcome.

10. Cookies

When you first visit, a banner lets you accept or decline optional cookies. Today we use only what our website needs to work: your browser remembers the country you chose, your cookie choice and whether you closed a location suggestion. To suggest the right country page, our website reads your device's time zone in your browser; it is sent to us only as part of your sign-up, so our team can check that the country you chose matches. If we add analytics, they will run only if you have accepted. You can change your choice at any time using Cookie settings at the bottom of every page. We do not use advertising or tracking pixels on our sign-up or booking pages.

11. Children

Our services are for adults aged 18 and over. We ask for an age range when you sign up. If someone selects "Under 18", we stop the sign-up, show youth support services, and do not keep their answers beyond 30 days for security purposes. If we learn we have collected information from a child, we'll delete it.

12. Changes to this policy

We may update this policy. If we make significant changes, we'll tell clients by email and update the date below.

13. Contact us

Privacy Officer (DPO / Grievance Officer): contact@mantraminds.com · E-303, LGF, Greater Kailash II, New Delhi 110048, India

We'd always like the chance to resolve a concern first, but you can complain to your privacy regulator at any time (see your annex).

Version 1.5 (test phase) · Last updated 20 October 2026

Annex A — United Kingdom

• Law: UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, and Privacy and Electronic Communications Regulations (PECR) for cookies and marketing.
• Controller: Mantraminds, India (legal details in section 1 of our Terms of Service). We are not established in the UK, but UK GDPR applies because we offer services to people in the UK.
• Special category data: your health information is processed with your explicit consent (Art. 9(2)(a)), and in an emergency to protect vital interests (Art. 9(2)(c)).
• Transfers: your information is processed in India, which does not have a UK "adequacy" decision. We use the safeguards in section 5, including the UK International Data Transfer Agreement or Addendum with service providers where required.
• Rights requests: we respond within one month (extendable by two months for complex requests).
• Complain to: the Information Commissioner's Office (ICO) — ico.org.uk · 0303 123 1113.

Annex B — Singapore

• Law: Personal Data Protection Act 2012 (PDPA) and its Regulations.
• Data Protection Officer: Privacy Officer, contact@mantraminds.com.
• Consent: we collect, use and disclose your personal data with your consent (including the consents you give when you sign up), or as otherwise permitted by the PDPA. You may withdraw consent by contacting our DPO. We'll explain the likely consequences before acting on it.
• Transfer Limitation Obligation: your personal data is transferred to India. Before transferring, we take steps to ensure the recipient protects it to a standard comparable to the PDPA, through legally enforceable obligations such as contracts. We tell you about the transfer and obtain your consent when you sign up.
• Data breaches: we'll notify the PDPC and affected individuals where required by the PDPA.
• Marketing: we do not send marketing messages by phone call, SMS or fax to Singapore numbers without complying with the Do Not Call provisions.
• Complain to: the Personal Data Protection Commission (PDPC) — pdpc.gov.sg.

Annex C — Australia

• Law: Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
• Health information: information about your well-being is "health information" and "sensitive information" under the Privacy Act. We collect it only with your consent and where it's reasonably necessary for our service (APP 3).
• Anonymity: you can make general enquiries without identifying yourself, but we need your identity to provide counselling safely (APP 2).
• Cross-border disclosure (APP 8): your personal information is disclosed to, and held in, India. Before disclosing it, we take reasonable steps to ensure overseas recipients handle it consistently with the APPs. We remain accountable for their handling of it.
• Access and correction (APPs 12–13): we respond within a reasonable period, normally within 30 days.
• Data breaches: we follow the Notifiable Data Breaches scheme and will notify you and the OAIC where an eligible data breach occurs.
• Complain to: first to us. If you're not satisfied with our response within 30 days, contact the Office of the Australian Information Commissioner (OAIC) — oaic.gov.au · 1300 363 992.

Annex D — New Zealand

• Law: Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC). The HIPC rules apply to the health information we hold about you, in place of the matching Information Privacy Principles.
• Collection (Rule 3): this policy and the intake notices tell you what we collect, why, who will receive it, whether it's optional, what happens if you don't provide it, and your rights to access and correct it.
• Disclosure overseas (Rule 12 / IPP 12): your health information is held and accessed in India. India's laws may not protect your information in a way comparable to New Zealand law. We ask for your authorisation for this when you sign up, after telling you this. We also require recipients, by contract, to protect your information to New Zealand standards.
• Access and correction (Rules 6–7): we respond as soon as reasonably practicable, and within 20 working days.
• Data breaches: we'll notify the Privacy Commissioner and affected people about notifiable privacy breaches.
• Complain to: the Office of the Privacy Commissioner — privacy.org.nz · 0800 803 909.

Annex F — Ireland

• Law: EU GDPR and the Data Protection Act 2018, regulated by the Data Protection Commission (DPC).
• EU GDPR applies because we offer services to people in Ireland. You can complain to the Data Protection Commission (dataprotection.ie). We rely on your explicit consent to use health information.

Annex G — Hong Kong

• Law: Personal Data (Privacy) Ordinance (Cap. 486), regulated by the Office of the Privacy Commissioner for Personal Data (PCPD).
• We handle your personal data in line with the six Data Protection Principles. You can contact the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk).

Annex H — Sri Lanka

• Law: Personal Data Protection Act No. 9 of 2022 (amended 2025); regulator: Data Protection Authority of Sri Lanka.
• We rely on your explicit consent to use health information and to store it in India. You can contact the Data Protection Authority of Sri Lanka once it is operating.

Annex I — Bangladesh

• Law: Personal Data Protection Act, 2026 (formerly the Personal Data Protection Ordinance 2025); regulator: National Data Management Authority.
• We rely on your explicit consent to use health information and to store it in India, subject to any transfer rules under Bangladesh's data protection law as they come into force.

Annex J — Netherlands, Germany and Portugal

• Law: EU GDPR, with the Dutch UAVG, the German BDSG and Portugal's Lei n.º 58/2019.
• We rely on your explicit consent to use health information and to store it in India. You can complain to the data protection authority in your country: the Autoriteit Persoonsgegevens (Netherlands), your state data protection authority (Germany) or the CNPD (Portugal).

Annex K — Sweden, Japan, Fiji, Trinidad and Tobago and Suriname

• Sweden: EU GDPR and the Swedish Data Protection Act; you can complain to the Swedish Authority for Privacy Protection (IMY).
• Japan: the Act on the Protection of Personal Information (APPI). Before collecting information about your mental well-being we ask for your consent, including consent to store and access it in India.
• Fiji, Trinidad and Tobago and Suriname: we handle your information to the same standard described in this policy, with your explicit consent to store it in India.

Annex L — Switzerland

• Law: Federal Act on Data Protection (revFADP) and the Data Protection Ordinance. Information about your health and well-being is sensitive personal data.
• Transfers: your data is stored in India, which is not on the Swiss Federal Council's list of countries with adequate data protection. We transfer it on the basis of your explicit consent and because the transfer is directly necessary to provide the counselling you have booked (revFADP Art. 17(1)(a) and (b)), alongside contractual safeguards with our providers.
• Complain to: the Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch.

Annex M — France, Norway, Denmark and Finland

• Law: EU GDPR (in Norway through the EEA Agreement), with France's Loi Informatique et Libertés, Norway's personopplysningsloven, Denmark's databeskyttelsesloven and Finland's tietosuojalaki.
• Health information is special-category data. We process it only with your explicit consent.
• Transfers: your data is stored in India, which has no EU/EEA adequacy decision. We protect transfers with the European Commission's Standard Contractual Clauses and additional safeguards, and with your explicit, informed consent.
• Complain to: the data protection authority in your country: the CNIL (France, cnil.fr), Datatilsynet (Norway, datatilsynet.no), Datatilsynet (Denmark, datatilsynet.dk) or the Office of the Data Protection Ombudsman (Finland, tietosuoja.fi).

Annex N — South Korea

• Law: Personal Information Protection Act (PIPA), overseen by the Personal Information Protection Commission (PIPC).
• Separate consents: information about your health and well-being is sensitive information (PIPA Art. 23), and your information is transferred to India (Art. 28-8). We ask for two separate consents when you sign up: one to use sensitive information and one for the transfer to India. Transfer details: the items (name, contact details, age range, payment record, sign-up answers and session notes); the recipient (Mantraminds, New Delhi, India · care@mantraminds.com); timing and method (over an encrypted connection when you sign up and each time you use the service); purpose and retention (to provide and manage your sessions, for the periods in section 6). You can refuse, but we can't provide sessions without these consents.
• Your rights: you can ask to see, correct or delete your information, ask us to stop using it, or withdraw consent at any time by emailing contact@mantraminds.com.
• Complain to: KISA's Personal Information Infringement Report Centre (118, privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr).

Annex O — Nepal

• Law: Individual Privacy Act, 2075 (2018) and Individual Privacy Regulation, 2077 (2020). Information about your physical or mental health is sensitive.
• We collect and use it only with your consent, and only to provide your sessions. Your information is stored securely in India, and we ask for your consent to this when you sign up.
• Nepal doesn't have a data protection authority. If you're unhappy with how we've handled your information, please contact us first. You can also complain to the police or the District Court under the Act.

Annex E — India (where Mantraminds is based)

Mantraminds is based in India, is operated by an Indian company (see section 1 of our Terms of Service) and processes your information in India. Indian data-protection law applies to us, including the Digital Personal Data Protection Act 2023 and its Rules as they come into force. Under that law we are a "Data Fiduciary". We will:

• process your personal data for the purposes you've consented to (or other lawful uses);
• give you notice of what we process and why;
• let you access, correct and erase your data, and nominate someone to act for you;
• protect your data with reasonable security safeguards, and notify breaches as required.

Grievance Officer: Privacy Officer, contact@mantraminds.com. If you are not satisfied with our response, you may approach the Data Protection Board of India.