Collection of Personal Data

Aroha (“we,” “our,” or “us”) collects personal data when you use our products and services, including:

Information you provide: Name, address, email, phone number, payment details, and other information when registering, using, or purchasing Aroha’s services.
Health and mental-health data: Information you enter or share with us, or with therapists using the platform, such as session notes and appointments.
Automatically collected data: Device identifiers, IP address, usage statistics, cookies, analytics, and other tracking technologies.

Purpose of Data Processing

We process personal data for specific, lawful purposes, including:

Providing, operating, and improving our services
Processing orders and payments
Authenticating users and maintaining account security
Communicating service updates and offers
Sending marketing emails with your explicit consent (you may withdraw at any time)
Compliance with legal obligations
Analyzing trends and improving user experience

You will be presented a standalone privacy notice in clear and accessible language at the time of data collection.
We obtain your free, specific, informed, unambiguous consent for processing personal and sensitive data. You may withdraw consent easily anytime from your account settings or by contacting support.
If you decline or withdraw consent for essential services, certain features may become unavailable.

User Rights under DPDP Act

You have the right to:

Access personal data held by Aroha
Correct incomplete or inaccurate information
Erase data no longer necessary for the stated purposes or upon withdrawal of consent
Withdraw your consent at any time
Request details about data processing and grievance redressal mechanisms

To exercise your rights:

Email us at support@aroha-health.com. We may verify your identity and respond within stipulated legal timelines.

Children’s Privacy

Aroha does not knowingly collect personal data from children without verifiable parental or guardian consent as prescribed by Indian law.
We do not show behavioral ads or track children’s activity for marketing.
If we become aware of inadvertently collected data from a child or minor, we will promptly delete it.

Data Retention and Deletion

We retain personal data only for as long as necessary for stated purposes, legal obligations, or to resolve disputes.
When data is no longer required, or on withdrawal of consent (unless retention is required by law), data is deleted or irreversibly anonymized as per defined retention schedules.

No Sale of Data: Aroha does not sell, rent, or lease your personal data to third parties.
Data may be shared:
- To comply with legal obligations
- With service providers/partners (IT, payments, analytics, hosting) bound by contract to protect your data and process it only for Aroha’s purposes
- With user consent, for additional features or integrations

International Data Transfers

Aroha does not transfer, store, or process personal data outside India. All personal and health data collected by Aroha remains within servers and systems located in India in compliance with applicable Indian data protection laws.

Security and Breach Notification

Aroha employs industry-standard security controls, including encryption, access controls, and activity monitoring.
In the event of a data breach likely to result in harm, we will promptly notify affected users and the Data Protection Board of India as per statutory requirements.

If Aroha is designated an SDF under Indian law, we will appoint a Data Protection Officer (DPO), conduct mandated audits, and comply with additional obligations.
If you use a registered Consent Manager, Aroha will support its requirements as per DPDP Act.

Policy Updates

Aroha may update this Privacy Policy from time to time. Users will be notified of significant changes, and ongoing use of services signifies acceptance of the revised policy. Please review this policy regularly.

Contact

For any privacy-related inquiries or to exercise your rights, contact:

Email: support@aroha-health.com