Soft and warm background illustration, gentle botanical elements like delicate leaves or b

Privacy Policy

This Policy explains how Unfinished Stories collects, uses, stores, and discloses personal and health data, in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000, and the Mental Healthcare Act, 2017 (MHCA). For international clients, applicable foreign data laws also apply (see Clause 8A).

1. Data We Collect

Identity & contact data: name, date of birth, gender, phone, email, address.

Clinical data: mental health history, presenting concerns, past diagnoses, medication history, prior therapy, family history.

Financial data: billing records and payment references (card/UPI data is processed by secure third-party gateways and not stored by the Practice).

Website data: IP address, browser type, pages visited — via cookies for functional/analytical purposes only. No health data is collected passively through the website.

2. Legal Basis & Consent

Data is processed on the basis of:

(a) your free, specific, informed, and unambiguous consent (DPDPA 2023);

(b) legitimate use necessary to provide contracted services; and

Explicit consent for health data is obtained through your Informed Consent Form at intake. You may withdraw consent at any time in writing — this does not affect prior processing but may affect service continuity.

3. Confidentiality

All information shared in therapy is held in strict confidence. Nothing is disclosed to third parties without your written consent, except in the following mandatory circumstances:

(a) imminent risk to life (self or others) — disclosure to emergency services or nominated contact per MHCA 2017, S.23;

(b) child safeguarding — reporting to child protection authorities under POCSO 2012 and JJ Act 2015;

For international clients involving child safeguarding, the Practitioner will take all reasonable steps to alert authorities in the client's country.

Clinical supervision involves only anonymised case discussion. You will be informed of any intended disclosure wherever it is safe and legally permissible to do so.

4. Data Storage, Retention & Security

Records are stored in encrypted digital format / locked physical files / both, protected by [password protection, AES-256 encryption, two-factor authentication]. Data is held primarily in India. Where cloud infrastructure is used abroad, the Practitioner ensures equivalent security standards and, for EU/UK clients, appropriate transfer safeguards (e.g., Standard Contractual Clauses).

Clinical records are retained for a minimum of 7 years from the last session, after which they are securely destroyed. In the event of a data breach likely to cause high risk, you will be notified as required by DPDPA 2023.

5. Data Sharing

Your data is never sold or marketed to any third party. Trusted service providers (telehealth platforms, payment processors, cloud storage) may access only data necessary to deliver their services and are bound by confidentiality obligations.

Nominated emergency contacts are informed only in life-risk situations, and only to the degree necessary.

Third-party platforms (e.g., Zoom, Google Meet) have their own Privacy Policies, which clients are encouraged to review.

6. Your Rights (DPDPA 2023)

As a Data Principal, you have the right to:

Access — summary of data held;

Correction & Erasure — subject to retention obligations;

Grievance Redressal — response within 30 days;

Nominate — appoint someone to exercise rights in the event of death or incapacity;

Withdraw Consent — at any time.

To exercise any right, email [unfinishedstories.therapy@gmail.com] with subject "Data Rights Request".

7. Your Rights under the MHCA 2017

As a mental health service user, you have rights under MHCA 2017 including:

access to services without discrimination (S.18);

advance directive on treatment preferences (S.5–9);

a nominated representative (S.14);

confidentiality of mental health records (S.23);

dignity in all interactions (S.20);

and informed consent and information about treatment alternatives (S.22). Full text: www.indiacode.nic.in.

8. Rights of the Practitioner

The Practitioner retains professional autonomy within ethical and legal limits;

the right to decline or discontinue services that compromise ethical obligations or safety;

the right to personal safety and to report abuse or harassment;

and the right to clinical supervision including anonymised case consultation.

8A. International Data Rights

EU/UK (GDPR/UK GDPR): Practitioner acts as Data Controller. Processing of health data is based on explicit consent (Art. 9(2)(a)). Rights include access, rectification, erasure, restriction, portability, and objection. Complaints to national DPA (UK: ico.org.uk; Ireland: dataprotection.ie). Cross-border transfers use Standard Contractual Clauses where required.
Australia (Privacy Act 1988): Data handled per Australian Privacy Principles. Complaints to OAIC: www.oaic.gov.au.
Canada (PIPEDA): Consent obtained for all processing. Complaints to OPC: www.priv.gc.ca.
US: Practitioner is not a HIPAA-covered entity but voluntarily adopts equivalent confidentiality standards. State-specific rights (e.g., CCPA) honoured to the extent practicable.

Note: For any rights request, include your country of residence. The Practitioner will apply the standard most protective of your rights and respond within 30 days.

9. Website, Amendments & Complaints

The Website is informational only — its use does not create a therapeutic relationship.

Analytics tools collect only anonymised, aggregated data; no targeted advertising or profiling occurs.

This Policy may be updated periodically. Material changes will be posted on the Website and notified by email at least 14 days in advance. Continued use of services constitutes acceptance.

Grievance Officer: Janice James, New Delhi, India] | unfinishedstories.therapy@gmail.com | +91 9315331185

India complaints: RCI — www.rehabcouncil.nic.in; State Mental Health Authority; Data Protection Board of India (DPDPA 2023).

International complaints: EU/UK — national DPA; Australia — OAIC (www.oaic.gov.au); Canada — OPC (www.priv.gc.ca); US — relevant state authority.