Privacy Notice
Theraverse (“we”, “us”) operates MyTheraverseOS as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (India) (“DPDP Act”). This notice explains what personal data we collect, why, how long we keep it, and your rights.
1. Who this applies to
- Parents/guardians — account, contact, and child profile data
- Children — health, developmental, and care data entered by parents or extracted from documents
- Therapists & providers — professional profile and care-team communications
- Platform administrators — account and access management data
2. Personal data we collect
- Identity & contact: name, email, phone (optional), organisation, specialty
- Child profile: name or initials, date of birth, gender, diagnosis, comorbidities, milestones
- Health records: assessments, IEP goals, session notes, medications, genetic reports, diagnoses
- Documents you upload (PDF, images, text files)
- Technical: session cookies for authentication, IP address at consent events, user agent
- Payment metadata if you subscribe (via Razorpay — we do not store full card numbers)
3. Purposes & lawful basis
We process data based on Your freely given, specific, informed consent (DPDP Act §6–7) for care coordination, health record management, AI-assisted document extraction (only when you request it), messaging, and appointments.
We may rely on Limited legitimate uses such as security, fraud prevention, and compliance (DPDP Act §8) for security, abuse prevention, and legal compliance.
4. Children’s data
We process children’s personal data only with verifiable consent of a parent or lawful guardian. At signup you confirm guardianship and consent separately. You may use initials instead of a full name where appropriate. We do not use children’s data for behavioural advertising or profiling.
5. AI document processing
When you click Extract on an uploaded document, file content is sent to Anthropic Claude solely to structure clinical data for your review. Records remain pending review until you approve them. You must provide separate consent before AI extraction. You may withdraw this consent at any time in Privacy & Data settings.
6. Data processors
- Supabase — Authentication, database, and encrypted file storage (United States / EU (region-dependent))
- Anthropic — AI-assisted extraction from uploaded clinical documents (only when you trigger Extract) (United States)
- Vercel — Application hosting (United States / global edge)
- Razorpay — Payment processing (if you subscribe) (India)
Cross-border transfers occur only to provide the service, with contractual safeguards and your consent where required.
7. Retention
- Account & health records: up to 7 years after last activity, unless you request earlier erasure
- Consent logs: 7 years (legal evidence)
- Grievance records: 3 years
- Inactive accounts reviewed after 24 months
8. Security
We use encryption in transit (HTTPS), row-level access controls, private document storage, role-based access, and server-side authentication checks. No system is 100% secure; report concerns to grievance@mytheraverseos.com.
9. Your rights (Data Principal)
- Access — download a copy of your data (Privacy & Data → Export)
- Correction — update profile and child records, or submit a correction request
- Erasure — request deletion of your account and associated data
- Withdraw consent — withdraw optional consents (e.g. AI processing); core service may be limited
- Grievance — lodge a complaint with our Grievance Officer
- Nomination — nominate another person to exercise rights in the event of death or incapacity (contact us)
10. Breach notification
We will notify the Data Protection Board of India and affected Data Principals as required by law if a personal data breach is likely to cause harm.
11. Contact
Privacy queries: privacy@mytheraverseos.com
Grievance Officer: grievance@mytheraverseos.com (response within 30 days)