Privacy Policy

1. Who We Are

Sukh Serenity (“Sukh”, “we”, “us”) is an online platform connecting adults in India with independent counselling therapists. For the DPDP Act, Sukh is the Data Fiduciary: we decide why and how your data is used.

Registered address: C-6, Sector 56, Noida, Gautam Buddha Nagar, Uttar Pradesh 201307
Website: www.sukhserenity.com
Email: admin@sukhserenity.com

This policy applies to clients using the Sukh app and website. It sits alongside our Terms and Conditions and the consent forms you sign when you join. Therapists on Sukh are independent professionals and are covered by their own agreement with us.

2. What We Collect

We collect data you give us and a small amount created when you use the app.

• Name, phone number and email: to create your account, log you in with an OTP and contact you about bookings.
• Confirmation that you are 18 or older and in India: Sukh serves adults in India only.
• Emergency contact name and number: so your therapist can reach someone if you may be at risk of harming yourself or others.
• Therapist, session dates, times and length, booking and waiver history: to run your sessions and payouts.
• Payment details (amount, status and reference): to take payment and issue refunds. Razorpay handles card, UPI and bank details; Sukh does not store them.
• Consent records: your signature, typed name, IP address, device, browser, form version and signing time, to prove what you agreed to and when.
• Messages you send our admin team on WhatsApp or email: to help with bookings and support.

What we do not collect or keep

• We do not record sessions and cannot see or hear what you discuss.
• We do not store clinical notes on the platform.
• The short voice note your therapist sends after your first session goes through WhatsApp; Sukh does not store it.
• We do not sell your data or use it for advertising.

Please do not send clinical or sensitive details to our admin team over WhatsApp or email. Keep those for your therapist, in session.

3. Why We Use Your Data, and Your Consent

We use your data on the basis of your consent, which you give when you sign up with a clear notice of what it covers. We use it to:

• Create and secure your account.
• Match you with a therapist and book, remind you about and run sessions.
• Take payments and issue refunds.
• Send booking confirmations, reminders and service messages on WhatsApp and email.
• Keep you safe, including contacting your emergency contact where your therapist decides there is serious risk.
• Handle support requests, complaints and waiver requests.
• Keep records required by law and prove your consent if questioned.

We will ask for fresh consent before using your data for anything new.

Withdrawing consent

You can withdraw consent at any time, as easily as you gave it, by writing to us using the contact details in section 9. Withdrawal does not undo prior processing and may mean we can no longer provide sessions because some data is needed to run them. For the clinical onboarding consent form, we ask you to confirm it again every 90 days.

4. Who Sees Your Data

Your therapist sees your name, phone number, session history and emergency contact. What you say in session stays between you and your therapist, who is bound by professional ethics and the law. Sukh has no access to it. A therapist may break confidentiality only where the law requires it, or where they judge there is serious risk of harm to you or others.

Our team: A small admin team, including our operations intern, sees booking and contact details to help with logistics. Our Consultant Clinical Psychologist supervises therapists and may receive a short anonymised case summary that does not identify you.

Service providers (data processors): Each provider handles data only on our instructions and under its data-protection terms.

The law: We share data with courts, police or regulators only where the law requires it. We do not sell or rent your data or share it with advertisers.

5. Where Your Data Is Kept

Your main account, booking and consent data is stored in Mumbai, India. Some providers process data outside India. Your email address and email content pass through Resend servers in Tokyo, and Sentry would process technical error data in the EU if enabled. Google, Meta, Vercel and Upstash also run global systems, so some technical data may be handled abroad.

The DPDP Act allows transfers outside India except to countries the Government of India restricts. We use providers that protect data under their security and data-protection terms, and will update this section if restricted countries or our providers change.

6. How Long We Keep It

We keep personal data only as long as needed for the reasons in section 3 or as the law requires.

• Consent records (signature, typed name, IP, device and time): at least 7 years, so we can prove what you agreed to.
• Account, contact and booking history: while your account is active and for 3 years after you stop using Sukh.
• Payment and invoice records: as long as tax and accounting law requires.
• Admin WhatsApp and email messages: up to 3 years after your last session.

When the time is up, we delete the data or remove anything that identifies you. If you ask us to erase your data (section 7), we will do so unless law requires some records to be kept, such as consent and payment records. We will tell you what we kept and why.

7. Your Rights

Under the DPDP Act you can ask us to show you a summary of personal data we hold and who we shared it with; correct inaccurate or outdated data and complete missing data; erase data once it is no longer needed, subject to legal retention; withdraw consent; respond to a complaint through our Grievance Officer (section 9); and nominate someone to exercise these rights if you die or become unable to do so.

To exercise these rights, write to the Grievance Officer. We may ask you to confirm your identity so we do not disclose your data to the wrong person. We aim to respond within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India once it is operational.

8. Security, Children, Cookies and Changes

Security: Data is encrypted in transit, stored with access controls, and available only to people who need it for their work. Login is by one-time password; please do not share your OTP. No system is completely safe. If a breach affects your data, we will notify you and the Data Protection Board of India as the law requires.

Children: Sukh is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If we learn that we have, we will delete it.

Cookies: The app uses only cookies and local storage needed to keep you logged in and working. We do not use advertising or cross-site tracking cookies.

Changes: If we change this policy in a way that affects you, we will tell you in the app, WhatsApp or email before it takes effect, and ask for your consent again where the law requires it. The date at the top shows the latest version.