Privacy Policy

1. Who we are

Auradeck is a practice management platform for mental health professionals in India, operated by Auradeck Technologies Private Limited ("Auradeck", "we", "our", "us"). This policy explains what personal data we collect, why we collect it, how we protect it, and your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act).

2. Data we collect

Therapist account data: name, email address, phone number, professional license number, practice details (specialty, mode, fee, languages), and, if you use Google sign-in or connect Google Calendar, the Google data described in section 6.

Client data you enter: name, email, phone, demographic information (age band, gender, occupation, city), session history, clinical notes, intake form responses (including mental health screening scores such as PHQ-9 and GAD-7), invoices, and uploaded files. This data belongs to you and your clients. We process it only on your instruction.

Usage data: server logs (IP address, request path, timestamp) retained for 30 days for security and debugging purposes.

Product analytics: when a therapist uses the signed-in app, we record which kind of page they opened and when they create a client, session or note or sign a note, along with a scrambled account ID and browser and device type. This never includes names, contact details, notes, form answers or record IDs, and it is not collected on pages clients open.

3. How we use your data

• To provide the Auradeck service and its features
• To send transactional emails on your behalf (session reminders, worksheets, invoices) to your clients via Resend
• To generate AI-assisted clinical notes via Google Gemini when you use the transcript feature
• To detect and prevent fraud, abuse, and security incidents
• To comply with applicable law

We do not sell your data or your clients' data. We do not use client health data for advertising.

4. Data storage and security

The Auradeck application is hosted on Vercel, and our database and client file storage are provided by Supabase. Clinical note bodies are encrypted at rest with AES-256-GCM, and stored Google OAuth tokens are encrypted at rest. All data is transmitted over HTTPS (TLS 1.2+).

We maintain automated database backups with a minimum 7-day retention period. Deleted client records are soft-deleted and permanently purged after 30 days.

5. Third-party processors

6. Google user data

Auradeck uses Google APIs only for the optional features below. You choose whether to use them.

Google sign-in (scopes: openid, email, profile). We receive your name, email address and profile picture, and use them only to create your account and sign you in.

Google Calendar (scope: calendar.events). When you connect Google Calendar from Settings, Auradeck:

• creates an event with a Google Meet link in your primary calendar when you schedule a session, titled with the client's name and inviting the client's email address if you have entered one;
• reads the start time, end time and title of other events in your primary calendar for the days you are viewing, so your Auradeck calendar can show when you are busy. These events are shown to you and are not stored by Auradeck.

Storage. We store the OAuth access and refresh tokens, encrypted, so the calendar connection keeps working. Selecting “Disconnect” in Settings deletes the stored tokens immediately. You can also revoke access at any time from your Google Account at myaccount.google.com/permissions.

Sharing. We do not sell Google user data, share it with third parties, use it for advertising, or use it to develop or train AI or machine-learning models. Google Calendar data is never sent to Google Gemini or any other AI service. Auradeck staff do not read your Google data unless you ask us to for support, it is needed for security, or the law requires it.

Auradeck's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Your rights (DPDP Act 2023)

As a data principal under the DPDP Act, you have the right to:

• Access, request a copy of the personal data we hold about you
• Correction, correct inaccurate or incomplete data
• Erasure, request deletion of your account and all associated data
• Grievance redressal, raise a complaint with our Data Protection Officer

To exercise any of these rights, email privacy@auradeck.in. We will respond within 30 days.

8. Therapist responsibility

You are responsible for obtaining appropriate consent from your clients before entering their personal or health data into Auradeck. You are the data fiduciary for your clients' data; Auradeck acts as a data processor on your behalf. We encourage you to maintain your own privacy notice for clients.

9. Cookies

Auradeck uses a single session cookie (auradeck_token) to keep you signed in. No third-party tracking cookies are used. No advertising cookies are used. In the signed-in app, Mixpanel keeps an anonymous identifier in your browser's local storage for product analytics. It is removed when you sign out.

10. Changes to this policy

We will notify you by email at least 14 days before any material changes to this policy take effect. Continued use of Auradeck after that date constitutes acceptance of the revised policy.

11. Contact

Data Protection Officer: privacy@auradeck.in
Auradeck Technologies Private Limited
India