Privacy Policy
Draft for legal review. Not yet in force.
Draft for legal review. Not yet in force.
Legal Policies
1. Who we are
This policy explains how Mantraminds Behavioural Health Centre, a unit of Venture7 Technology Private Limited ("we", "us"), handles personal information about people in the United Kingdom, Singapore, Australia and New Zealand who use our website, intake form, chatbot or online well-being counselling.
We are the data controller (also called "organisation", "APP entity", "agency" or "Data Fiduciary", depending on the law) for this information.
Country-specific information is in the annexes at the end. If an annex differs from the main policy, the annex applies to people in that country.
We take particular care because some of what you share with us is about your mental and emotional well-being. That is sensitive information, and we treat it that way.
2. What we collect
| Category | Examples | When |
|---|---|---|
| Identity and contact | Name, email, phone number | Intake, booking |
| Eligibility | Age range (not date of birth), country of residence, time zone | Intake |
| Health and well-being information (sensitive / special category data) | What you'd like support with, your answers to the exclusion check, PHQ-9 and GAD-7 questionnaire answers and scores, anything you tell us during intro calls or sessions, counsellor session notes, re-screening results | Intake, sessions |
| Safety information | Current address and emergency contact name and number (collected by your counsellor at your first session) | First session |
| Booking and payment | Session dates, fees, payment status, refunds. Card details are handled by our payment provider; we do not see or store your full card number | Booking |
| Preferences | Language, counsellor gender preference, preferred times, how you heard about us | Intake |
| Communications | Emails, chatbot conversations, complaints | Any time |
| Technical | IP address, device and browser type, cookies (see section 10) | Website use |
We do not collect your date of birth or government ID numbers, and we do not record sessions.
Emergency contacts and partners: if you give us someone else's details, please make sure they know you have done so.
3. Why we use it, and our legal basis
| Purpose | Information | Legal basis (UK GDPR shown; see annexes for other countries) |
|---|---|---|
| Check you're eligible and that our service is a safe fit (screening and routing) | Eligibility, health information | Explicit consent for health data (Art. 9(2)(a)); steps before entering a contract (Art. 6(1)(b)) |
| Provide counselling, keep session notes, re-screen, supervise counsellors | Health, contact, safety | Contract (Art. 6(1)(b)); explicit consent (Art. 9(2)(a)) |
| Keep you or others safe where there is serious risk; safeguarding | Health, safety, emergency contact | Vital interests (Art. 6(1)(d), Art. 9(2)(c)); legal obligation where it applies |
| Take payment, give refunds, keep financial records | Booking and payment | Contract; legal obligation (tax and accounting) |
| Respond to enquiries and complaints | Contact, communications | Contract; legitimate interests (handling complaints well) |
| Follow up a partly completed intake once, by email | Contact only, never health answers | Legitimate interests (helping someone who started booking). You can opt out at any time |
| Send a welfare email with local support options after a crisis or referral outcome | Contact, route | Legitimate interests / vital interests. Never used for sales |
| Send well-being tips and updates | Contact | Consent (optional tick box). Withdraw at any time |
| Improve our service and website, and keep it secure | Technical, de-identified usage | Legitimate interests; consent for non-essential cookies |
| Meet legal obligations and defend legal claims | Any relevant information | Legal obligation; establishing or defending legal claims (Art. 9(2)(f)) |
Withdrawing consent. You can withdraw consent to us using your health information at any time by emailing contact@mantraminds.com. We can't provide counselling without it, so withdrawal will end the service. We may keep a minimal record (your consents, screening route and any safety actions) where the law allows, to show we acted responsibly.
No automated decisions with legal effect. Our intake uses your questionnaire answers to suggest a route (book, intro call, team review or referral). If you are not offered a booking, a member of our team is available to talk it through, and a senior clinician reviews "team review" cases. Contact us if you'd like a human to reconsider an outcome.
4. Who can see your information
Inside Mantraminds: access is limited to people who need it. - Counsellors and clinical supervisors can see health information for the clients they support. - Booking and administrative staff see only your name, contact details, country, booking details and screening route. They never see your questionnaire answers, scores or session notes. - Marketing tools never receive health information.
Service providers (processors) who handle information on our instructions, under contract, with confidentiality and security obligations:
| Service | Provider | Location of data |
|---|---|---|
| Booking and scheduling | [booking platform] | India |
| Secure video sessions | [video platform] | India |
| Client records and CRM | [CRM] | India |
| Payments and refunds | [payment provider] | India |
| Email and marketing (contact data only) | [email/marketing tool] | India |
| Hosting | [hosting/cloud provider] | India |
| Website analytics | [analytics tool] | [country/region] |
Others, only when necessary: your emergency contact, emergency services or authorities in a serious-risk situation (see our Client Agreement, section 7); professional advisers (lawyers, auditors) under confidentiality; regulators, courts or police where the law requires; a buyer or successor of our business, who would be bound by this policy.
We never sell your personal information, and we never share it for advertising.
5. International transfers — your information in India
Mantraminds is based in India, and our counsellors work from India. Your information, including your health information, is stored and accessed in India, and some service providers may store it in other countries listed in section 4.
India's data-protection law (the Digital Personal Data Protection Act 2023) may not give the same level of protection as the law in your country. To protect your information we: - ask for your explicit consent to this transfer, after telling you about it, at intake; - put contracts in place with our service providers requiring them to protect your information to the standard required by your country's law. Where required, these use recognised transfer terms (for example the UK International Data Transfer Agreement/Addendum); - apply the security measures in section 7, wherever your information is held; - remain accountable to you, and to your country's privacy regulator, for how your information is handled overseas.
See the annex for your country for more detail.
6. How long we keep it
| Information | How long |
|---|---|
| Client records (intake, consents, questionnaire results, session notes, safety actions) | [X] years after your last session, or longer if the law in your country requires |
| Intake answers from people who did not book | [X] months, then deleted or anonymised |
| Minimal record for crisis or referral outcomes (date, route, helplines shown, any welfare email) | [X] years, to show we responded safely |
| Partly completed intakes | [X] months |
| Payment and invoice records | As required by Indian tax and accounting law ([X] years) |
| Marketing preferences | Until you unsubscribe, plus a suppression record so we don't contact you again |
| Chatbot conversations | [X] months |
When information is no longer needed, we securely delete or anonymise it.
7. Keeping your information secure
We use measures appropriate to sensitive health information, including: - encryption in transit and at rest; - role-based access, so only clinical staff can see health information; - multi-factor authentication for staff accounts; - confidentiality agreements and data-protection training for all staff; - secure, end-to-end or encrypted video platforms; - separation of health information from marketing systems; - a documented process for responding to data breaches, including notifying you and the relevant regulators where the law requires.
No system is completely secure. If you think your information has been put at risk, please tell us at contact@mantraminds.com.
8. Your rights
Depending on where you live, you may have the right to: - access the information we hold about you and get a copy; - correct inaccurate information; - delete your information (subject to legal retention duties); - restrict or object to some uses, including any use based on legitimate interests; - data portability (UK); - withdraw consent at any time, without affecting what was done before; - nominate someone to exercise your rights if you die or become unable to (India); - complain to us, and to your country's privacy regulator (see the annexes).
To use any of these rights, email contact@mantraminds.com. We'll confirm your identity, then respond within [X days] or the time the law in your country requires, whichever is shorter. There is normally no charge.
9. Marketing
We'll send you well-being tips and updates only if you have opted in. Every email has an unsubscribe link. We never use your health information, or the fact that you are a client, for marketing, and we never send marketing to anyone whose intake ended with a crisis or referral outcome.
10. Cookies
We use essential cookies to make our website work. We use analytics and other non-essential cookies only if you agree through our cookie banner, where you can change your choices at any time. We do not use advertising or tracking pixels on our intake or booking pages. [Link to cookie settings]
11. Children
Our services are for adults aged 18 and over. We ask for an age range at the start of the intake. If someone selects "Under 18", we stop the intake, show youth support services, and do not keep their answers beyond [X days] for security purposes. If we learn we have collected information from a child, we'll delete it.
12. Changes to this policy
We may update this policy. If we make significant changes, we'll tell clients by email and update the date below.
13. Contact us
Privacy contact / DPO / Grievance Officer: [Name] · contact@mantraminds.com · E-303, LGF, Greater Kailash II, New Delhi 110048, India
We'd always like the chance to resolve a concern first, but you can complain to your privacy regulator at any time (see your annex).
Version [x.x] · Last updated [date]
Annex A — United Kingdom
Annex B — Singapore
Annex C — Australia
Annex D — New Zealand
Annex E — India (where Mantraminds is based)
Mantraminds is an Indian company and processes your information in India. Indian data-protection law applies to us, including the Digital Personal Data Protection Act 2023 and its Rules as they come into force. Under that law we are a "Data Fiduciary". We will: - process your personal data for the purposes you've consented to (or other lawful uses); - give you notice of what we process and why; - let you access, correct and erase your data, and nominate someone to act for you; - protect your data with reasonable security safeguards, and notify breaches as required.
Grievance Officer: [Name], contact@mantraminds.com. If you are not satisfied with our response, you may approach the Data Protection Board of India.