Your privacy
Plain English, no small print. What we collect, why we have it, how long we keep it, and how to make us delete it.
Last updated: [FILL: date this notice was last reviewed]
The short version
- The website collects only what you type into the contact or feedback form. Feedback appears only after separate publication consent.
- The mood picker, mood tracker and reflections never leave your device. We cannot see what you chose or typed, because it is never sent to us.
- We do not use Google Analytics. We do not use advertising cookies. There is no tracking pixel on this site.
- You can ask us to delete everything you sent us, or remove feedback you agreed to publish, at any time without giving a reason.
What we collect, and why
Only what the contact form asks for. Each item is here for one reason: so a person can reply to you and arrange a first conversation.
| What | Why we need it |
|---|---|
| Whether the session is for you or for a child | So the right person replies, and so we know whether a guardian has to be involved before anything is arranged. |
| Your name | So we know who we're writing back to. |
| Your email or phone number | To reply to you. You choose which one — you don't have to give both. |
| Guardian name, and relationship to the child (only if the session is for someone under 18) | Because a parent or legal guardian has to be the one who starts contact for a child, and we have to be able to show that they did. |
| "What would you like support with" — the optional box | So the first reply is useful rather than generic. This field is optional and always will be. You can leave it empty and still book. |
| Your consent tick | Because under the DPDP Act we need a record that you agreed, and when. |
Anything you tell us during a session is a separate matter, governed by professional practice and by the limits described further down this page. It is not held in the website.
Feedback published on this site
A one-use feedback link asks for a first name and the words the person chooses to share. It also requires confirmation that they are 18 or older and separate permission to publish their exact words and first name. Once both boxes are checked and the form is submitted, those two items are published automatically. We do not ask for or publish a surname, phone number, email address, rating, photograph or session details.
Their words and first name are public, so search engines and other people may copy or cache them. Permission can be withdrawn at any time. Write to the contact at the bottom of this page and we will remove the feedback from the live site and make reasonable requests to update cached results. We cannot promise to erase copies that other people have already made.
The consent confirmation and adult confirmation are stored with the feedback submission. They are never stored with intake or session notes.
What we deliberately do not collect
Two parts of this site look like they would collect something. They don't.
- The mood picker and mood tracker. Whatever you tap or type is handled inside your own browser, in memory. The tracker can arrange entries into a calendar while its page is open, but it never sends them to a server, writes them to storage, or includes them in analytics. Refresh or close the tab and they are gone.
- The reflections. Same again. Nothing you answer is transmitted, saved or scored. There is no result, no number and no label at the end, by design.
- No account, no login, no password. There is nothing to sign up for.
- No health records on the website. The site does not hold case notes, diagnoses or session records of any kind.
How long we keep it
[FILL: retention period, e.g. 24 months] from the day you send the form. After that it is deleted from our database.
If you never end up booking, ask us and we will delete it sooner. If you do become a client, the enquiry is kept for the period above; anything held about your actual sessions is a separate record with its own retention, which we will explain to you at the first session.
Children's data and guardian consent
India's DPDP Act treats anyone under 18 as a child, and it requires verifiable consent from a parent or legal guardian before a child's personal data is processed. So:
- A parent or legal guardian has to be the one who contacts us about a child. A young person cannot submit the form for themselves.
- The form asks, before anything else, whether the session is for you or for someone under 18. Choosing "under 18" asks for the guardian's own name, their relationship to the child, and their explicit agreement.
- We ask for the guardian's details, not the child's. We do not need a child's name, school or history to answer a first enquiry, so we don't ask for them.
- We do not track children, we do not profile them, and we never show targeted advertising to anyone. There is no advertising on this site at all.
- A guardian can withdraw consent at any time by writing to the contact at the bottom of this page.
[FILL: the method the practice will use to verify that the person giving consent really is the child's parent or guardian — e.g. a confirmation call before the first session. The DPDP Rules 2025 expect this to be documented.]
The one limit on what we can keep to ourselves
This one is important and we would rather you heard it from us than found out later.
Under the POCSO Act 2012, if a child tells us they have been sexually abused, we are required by Indian law to report it to the authorities. We cannot keep that to ourselves, whoever asks us to. Not reporting it is itself an offence.
Please read this first.
If a child tells us they have been sexually abused, Indian law (the POCSO Act, 2012) requires us to report it to the authorities. We cannot keep that confidential. We will always explain this clearly, and we will support the child and the family through the process.
We say this out loud, in advance, to every family and to the child in words they can understand — before any session begins, not after. We do not present ourselves as a place to disclose abuse in secret, because we are not one and pretending otherwise would put a child at risk. What we do offer is awareness, prevention work with schools, and support for families going through the process. You can read the full note on ourchildren and teens page.
Separately, and as any counselling practice would, we may have to act if someone is in immediate danger of serious harm. We would tell you we were doing it.
Who else touches your data
We use a small number of outside tools to run the booking, the form and the site itself. Each one is a processor acting on our instructions — none of them may use what you sent for their own purposes.
- Booking tool.Cal.com. It sees the name and email you type into the calendar, and the time you picked. Its widget only loads if you press the button — opening this page does not contact it. Seecal.com/privacy.
- Where the form goes.When you send a note, it is written straight into our own database, hosted on Supabase in its Mumbai region — so what you type stays in India. Only the practice can read it. Your browser never talks to that database directly.
- Analytics.Vercel Web Analytics. It counts page views only. It does not set a cookie, does not build a profile of you, and never receives anything you typed — not even the part of the web address after a
?. SeeVercel's privacy policy. - Hosting.The site is served by Vercel, which keeps standard server logs, including IP addresses, for a short technical period.
Your form submissions are stored in India (Supabase, Mumbai). Vercel, which serves the site and counts page views, is a US company and may process technical request data (such as an IP address) outside India. [FILL: confirm the legal basis for that transfer and put written processor agreements in place with each tool before launch.]
Cookies and what's stored in your browser
We do not set advertising cookies, and we do not set any cookie for tracking. There is exactly one thing this site stores on your device:
- Key
cct-calm- What it holds
- A single on/off value — whether you turned Calm mode on.
- Why
- So that if you switched movement off, it stays off next time, and you never see a frame of animation you didn't ask for.
- Does it identify you?
- No. It contains no identifier of any kind.
- Is it sent to us?
- Never. It is read and written only by your own browser, and it is not attached to any request.
- Removing it
- Turn Calm mode off, or clear this site's data in your browser settings.
Analytics
We want to know roughly how many people read a page, so we know whether the crisis page is being found. That's the whole ambition.
- Cookieless and privacy-first. No cookie banner, because there's nothing to consent to.
- No Google Analytics. Not now, not later.
- No cross-site tracking, no fingerprinting, no advertising network.
- Nothing you type is ever sent into analytics — not a mood, not a reflection answer, not a word of the contact form.
Your rights, and how to use them
Under the DPDP Act you can ask us to do all of the following, and we have to do it. You do not need a lawyer, a form or a reason.
- See it. Ask what we hold about you and we'll send it.
- Correct it. Tell us what's wrong and we'll fix it.
- Delete it. Ask us to erase what you sent and we will, unless a law specifically requires us to keep something — in which case we'll tell you which part and why.
- Withdraw consent. As easily as you gave it. This stops any further contact from us and, where relevant, removes feedback you agreed to publish.
- Nominate someone. You can name a person to act for you if you die or become unable to act for yourself.
- Complain. If we don't sort it out, you can take it to the Data Protection Board of India.
Write to the contact below. We aim to reply within [FILL: response window the practice commits to, e.g. 7 working days].
Who to contact
[FILL: grievance officer name, role, email]
This is the named person responsible for privacy questions and complaints about this site. The DPDP Act requires the contact to be published, so this blank has to be filled before launch.
Changes to this notice
If we change what we collect or who processes it, we'll change this page and update the date at the top. If the change is a significant one, and we hold a way to reach you, we'll tell you directly rather than quietly editing the page.