Privacy Policy

1. The short version

PracMind is practice-management software for psychologists, therapists and counsellors, run by PETAERA TECHNOLOGIES LLP. This policy explains what information we handle, why, who sees it, how long we keep it and what you can do about it. The headlines:

• There are two kinds of information. Information about a practitioner and their practice (account, billing) is ours to look after. Information about a practitioner’s clients is the practice’s to decide about, and we process it for them (section 2).
• Mental-health information is sensitive. We protect all client information to the same high standard: it is encrypted, kept in India, never sold, never used for advertising and never used to train AI (section 9).
• Our own staff cannot read clinical content. Our administration tools see account, billing and usage details and counts, not notes or assessments.
• We use a small set of service providers, listed in section 6. Some deliver messages and email from outside India.
• AI features are optional and explained in section 8.
• Retention periods are in section 11; closing an account is in section 13; your rights are in section 12; and the contact for complaints is in section 19.
• If you are a client of a therapist, start with section 15.

2. Who we are and our role

PETAERA TECHNOLOGIES LLP (“PracMind”, “we”, “us”), 3/301, PONNETH HOUSE, KARALMANNA, Moochithottam Road and Near Nayara Pump 26th Mile, Tekkummuri, Cherppulassery, Palakkad, Kerala 679506, makes and runs PracMind.

If you are a client, your therapist or practice is the first point of contact for your information (section 15).

3. Information we collect

4. How and why we use information

5. Consent and your choices

We ask for agreement to the Terms of Service and this policy as separate boxes when you sign up. Optional uses are asked for separately, when they arise: the first-use notice for AI features, the Google consent screen when you connect a calendar, and the browser’s permission prompt for the microphone. A client agrees on the booking page, and we record the version of this policy and the time.

You may withdraw an optional consent whenever you like. You can disconnect Google Calendar in your integration settings and stop using an AI feature, and a team owner can switch AI features off for the team. For anything you cannot switch off yourself, such as a type of reminder, write to privacy@pracmind.in and we will stop it. Withdrawing does not affect what was done before, and some features will stop working. We may keep what the law requires us to keep.

We send no marketing.

6. Who we share information with

We share information only with the providers below, who help us run the Platform and act on our instructions. We give each only what its job needs. The same list is the list of sub-processors in our Terms of Service.

Reminders and emails carry scheduling details and a name. They do not carry clinical content, and emails link into the app instead.

We will tell practices at least 15 days before we add or replace a provider that handles client information.

7. What others in your practice can see

In a team practice the owner and the managers can see an administrative view of the practice’s clients: name, contact details, status, intake date, assigned therapist, session dates and payment status. They can also read what a person wrote about why they are seeking help before a therapist is assigned. They cannot see clinical notes, assessment responses or intake notes. A therapist can mark a client confidential, which replaces the name with a code and hides email and phone in the team views. This access exists for scheduling, billing, quality review and continuity of care, and each roster read is recorded in the access log.

A record belongs to the workspace in which it was created: team records stay with the team when a therapist leaves, and records from a therapist’s own practice stay with that therapist.

8. AI features and your information

AI features are optional and are used only when a therapist chooses to. They are voice dictation, restructuring one section of a note, and preparation summaries before a session.

• What is sent. The therapist’s voice recording (dictation); the text of one note section (restructuring); or the notes and assessment scores a summary needs (preparation summaries). A confidential client is referred to by code in a preparation summary.
• Where. Google’s Gemini models, through Google Cloud Vertex AI in the Mumbai region, over an encrypted connection.
• What we keep. We do not store the audio, the text or the model’s answer, other than what the therapist saves into the record. Our logs and access log hold technical details (the feature, the model, the time, the size), not the content.
• What Google may keep. Under Google’s terms Google may hold an input in memory for up to 24 hours, and an input that its abuse checks flag for up to 90 days. Google states that it does not use customer inputs to train its models. We cannot promise that nothing is kept.
• Training. We do not use client information to train AI models, and we have no right to.

A therapist is responsible for telling their clients and getting any consent the law requires before using an AI feature on information about them. The output is a draft for the therapist to review, not a diagnosis.

9. How we protect information

We keep documented security practices that aim at the “reasonable security practices and procedures” of rule 8 of the SPDI Rules. In particular:

• Encryption. Information is encrypted in transit (HTTPS with HSTS) and at rest. The database and file storage use encryption keys that we manage ourselves in Google Cloud’s key service.
• Isolation. The database separates each practice’s data with row-level security, and inside a team workspace access follows roles.
• Staff access. Our administration dashboard reads only account, billing and usage views and counts. The database role it uses has no privilege on the tables that hold clinical or client-identifying information.
• Access log. Access to client records is recorded (who, what, when, never the content), and so is administrative access to the database.
• Sign-in. Sessions are held on the server, so we can end one at any time; a browser whose session has been ended may keep working for up to 5 minutes. The dashboard signs you out after 15 minutes of inactivity, and a session lasts no more than 7 days.
• Links. Assessment, exercise and journal links are long random tokens, rate-limited, revocable, and expire after 30 days or when a journal’s window ends.
• Abuse protection. Rate limiting, keyed hashing of identifiers, and secrets held in a managed secret store.
• Backups. Automated, encrypted database backups with point-in-time recovery over the last 7 days. Backups expire on a rolling basis.

No system is completely secure, and you must keep your own devices and credentials safe. The independent security certifications that Google Cloud holds are Google’s; they do not certify PracMind.

10. If something goes wrong

If personal data is breached, we will report it to CERT-In as the Directions require, which is within 6 hours of noticing it. We will report to the Data Protection Board as the Rules require, and tell the affected practice without undue delay with what we know and what we are doing. The practice, as Data Fiduciary, tells its clients; we help it do so. Where we are the Data Fiduciary, we will tell the people affected without delay, and then give the Board the fuller report the Rules require within 72 hours.

11. How long we keep information

The 7-year clinical period is our own deliberately conservative choice. It exists so that practitioners are not left without records that they may need for their own professional and legal duties. Deleting a client inside PracMind removes them from view; permanent deletion follows this table. A request to erase information does not override a period the law requires, and where we keep something we will say why.

12. Your rights and how to use them

You have the right to:

• know and access a summary of the personal data we process about you, how it is processed, and who we have shared it with;
• correct inaccurate or incomplete data, and erase data we no longer need, subject to the retention duties above;
• withdraw consent at any time (section 5);
• nominate another person to exercise your rights if you die or become incapacitated;
• complain and get a reply (section 19).

Write to privacy@pracmind.in, preferably from the email address on your account. We may ask you to confirm who you are. We do not charge, and we aim to answer within 30 days. Practitioners can also ask for an export of their data in a structured, machine-readable format such as CSV or JSON.

For client information, the practice decides, so we pass your request to it, or tell you who it is. If you are not sure who holds your record, tell us what you know and we will help you find out.

13. Closing an account and deleting information

You can close your account in Settings (we email you a code to confirm), on the delete-account request page, or by writing to privacy@pracmind.in. Ask for your export first, because closing the account ends your access.

• Your access ends, your public booking page stops working and any linked Google Calendar access is revoked.
• We delete or anonymise your Account Data within 30 days.
• Client records and billing records are kept for the periods in section 11, and then deleted permanently.

If you are a client who wants information about you erased, tell your therapist or us. We will explain what can be erased now and what must be kept, and for how long.

14. Where information is stored, and transfers abroad

Information is stored and processed in India (Google Cloud, Mumbai). Some providers act outside India, namely those that deliver SMS, WhatsApp and email, sync calendars, send mobile notifications and serve fonts. They are marked in section 6. The Digital Personal Data Protection Act, 2023 allows such transfers except to countries the Government restricts, and we will follow any restriction. Under rule 7 of the SPDI Rules we transfer sensitive information only where it is needed to carry out the service or you have consented, and we send only what a feature needs.

15. For clients and people using a booking or assessment page

16. Children and minors

PracMind accounts are for adults. Practitioners may hold records about minors, and the practice is responsible for obtaining the consent of a parent or guardian where the law requires it. The Digital Personal Data Protection Act, 2023 asks for verifiable parental consent for a child’s data and forbids tracking, behavioural monitoring and targeted advertising aimed at children. We do none of these. The Rules give limited exemptions to healthcare professionals, and each practice should take its own advice on them. We keep a minor’s clinical record until they are 18, plus the period in section 11.

17. Cookies and similar technologies

We use only what the service needs: a secure session cookie to keep you signed in, a short-lived cookie during Google Calendar connection, and your browser’s local storage for preferences such as the workspace you last used, sidebar and tutorial progress. We use no advertising or analytics cookies and no third-party trackers.

Two third parties can see that you visited when they serve something to your browser: Google, which serves our fonts, and Razorpay, whose checkout script loads when you pay and sets its own cookies under its own policy. If we add analytics, we will update this policy and ask for consent where the law requires it. Blocking essential cookies will stop you signing in.

18. Changes to this policy

We may update this policy for new features, new providers or changes in the law. For a material change we will give at least 30 days’ notice by email and in the app. A change that is not material, or that the law requires at once, takes effect when posted. The version number and effective date are at the top of this page, and earlier versions are available on request.

19. Contact, grievances and complaints

The Grievance Officer is the person required by rule 5(9) of the SPDI Rules and rule 3(2) of the Intermediary Rules. We will acknowledge a complaint within 24 hours and resolve it within 15 days. If you are still not satisfied, you may complain to the Data Protection Board of India once it is constituted, after you have used this process. You may also approach a consumer commission.

20. Governing law

This policy is governed by the laws of India, and disputes are resolved as set out in the Terms of Service. Nothing in it limits a right you have under law.