Legal

Privacy Policy

Last updated: September 2026

This policy explains how shitalheals.in ("the Practice", "we") collects, uses, stores and protects your personal information, in line with the Information Technology Act, 2000 (Section 43A), the Digital Personal Data Protection Act, 2023 (DPDP Act), and the confidentiality provisions of the Mental Healthcare Act, 2017.

1. Information we collect

• Contact details: name, phone/WhatsApp number, email address, city/country, submitted via the booking form, WhatsApp, or email.
• Booking details: the track you select, preferred timing, and any notes you choose to share ahead of a session.
• Session information: brief clinical notes kept by the Practitioner to track progress across sessions.
• Payment information: online payments are processed directly by Razorpay. We do not store your card, UPI, or bank details ourselves.

2. How this information is used

• To respond to enquiries and confirm bookings;
• To schedule and deliver sessions (including generating secure video call links);
• To send confirmations and reminders by WhatsApp and email;
• To maintain session continuity and track progress over time;
• To process payments, once online payment is enabled.

Your information is never sold or used for advertising, and is not shared with any third party beyond what is described in this policy.

3. Where your data is processed

This site uses a small number of trusted third-party services to operate:

• Video calling platform, for delivering online consultations;
• Web3Forms (or an equivalent form-to-email service), to deliver booking-form submissions to the Practice's inbox;
• Razorpay, for payment processing. Razorpay is PCI-DSS compliant and handles your payment details directly; we never see or store your full card or bank information;
• WhatsApp and standard email, for scheduling and logistics only. Please avoid sharing detailed clinical information over these channels; save that for your scheduled session.

4. Data security

We take reasonable steps to protect your information, including limiting access to booking and session records to the Practitioner, avoiding storage of sensitive clinical detail in unsecured tools, and using reputable, encrypted third-party services (Google, Razorpay) for video and payments.

5. Data retention

Booking and session records are retained only as long as needed to provide ongoing care and to meet reasonable professional record-keeping practice. You may request deletion of your contact information at any time, subject to any minimum record-keeping the Practitioner reasonably needs to maintain for continuity of care.

6. Your rights

Under the DPDP Act, 2023, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion (subject to Section 5 above), and withdraw consent for future communication at any time. To exercise any of these rights, contact us using the details below.

7. Confidentiality of session content

Details shared in sessions are kept confidential and are not disclosed to third parties, except where there is a risk of serious harm to yourself or others, where required by law, or as permitted under Section 18 of the Mental Healthcare Act, 2017.

8. Children's data

Where the client is a minor, information is collected and used with parental/guardian consent, and shared with that parent/guardian as part of ongoing care (e.g. progress updates, home-practice plans).

9. Cookies & analytics

This site may use basic, privacy-respecting analytics to understand traffic (e.g. which pages are visited) and does not use invasive tracking or third-party advertising cookies.

10. Changes to this policy

This policy may be updated from time to time; the version published here is the one currently in effect.