← MyTheraverseOSv1.0.0 · Updated 6 October 2026

Privacy Notice

MyTheraverseOS (“we”, “us”) operates MyTheraverseOS as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (India) (“DPDP Act”). This notice explains what personal data we collect, why, how long we keep it, and your rights. Our public privacy policy is a separate page: Privacy Policy. Consent is asked against this notice.

1. Who this applies to

  • Parents/guardians — account, contact, and child profile data
  • Children — health, developmental, and care data entered by parents or extracted from documents
  • Therapists & providers — professional profile and care-team communications
  • Platform administrators — account and access management data

2. Personal data we collect

  • Identity & contact: name, email, phone (optional), organisation, specialty
  • Child profile: name or initials, date of birth, gender, diagnosis, comorbidities, milestones
  • Health records: assessments, IEP goals, session notes, medications, genetic reports, diagnoses
  • Documents you upload (PDF, images, text files)
  • Technical: session cookies for authentication, IP address at consent events, user agent
  • Payment metadata if you subscribe (via Razorpay — we do not store full card numbers)

3. Purposes & lawful basis

We process data based on Your freely given, specific, informed consent (DPDP Act §6–7) for care coordination, health record management, AI-assisted document extraction (only when you request it), the care assistant (only when that consent is on), speech-to-text (only when that consent is on), WhatsApp (only when that consent is on), and appointments.

We may rely on Limited legitimate uses such as security, fraud prevention, and compliance (DPDP Act §8) for security, abuse prevention, and legal compliance.

4. Children’s data

A parent creates the account. A child does not sign up. We process a child’s personal data when that parent declares they are the parent or lawful guardian and consents on the child’s behalf. That declaration is stored with the parent account. This form does not verify identity or age. You may use initials instead of a full name where appropriate. We do not use children’s data for behavioural advertising or profiling.

5. AI document processing

When you click Extract on an uploaded document, file content is sent to Anthropic Claude solely to structure clinical data for your review. Records remain pending review until you approve them. You must provide separate consent before AI extraction. You may withdraw this consent at any time in Privacy & Data settings.

6. Care assistant

When you turn on care-assistant consent in Privacy & Data, messages you send can include your child’s name, date of birth, diagnosis, comorbidities, milestones, and approved goals. That context is sent to Anthropic Claude to draft a reply. A WhatsApp reply also needs the separate WhatsApp consent below. Turning the care-assistant switch off stops further messages from being sent. Earlier replies already stored in your account stay until you ask for erasure.

7. Speech-to-text

Pre-session notes can be dictated. When you turn on speech-to-text consent in Privacy & Data, the recording is sent to Sarvam AI in India to produce text. That recording may include information about your child. Turning the switch off stops further recordings from being sent. The microphone control will not start a recording until this consent is on.

8. WhatsApp

If you message MyTheraverseOS on WhatsApp, Twilio carries that message. We forward it to the care assistant only when WhatsApp consent is on in Privacy & Data, and only when care-assistant consent is on as well. The reply does not repeat your message. Turning WhatsApp consent off stops further messages on that channel from being processed.

9. Data processors

  • Supabase — Authentication and database (India (Mumbai, ap-south-1))
  • Amazon S3 — Private storage of uploaded health documents, therapist résumés, and profile photos. Files open through short-lived links (India (Mumbai, ap-south-1))
  • Anthropic — AI document extraction when you trigger Extract, and the care assistant when care-assistant consent is on (United States)
  • Vercel — Application hosting (United States / global edge)
  • Sarvam AI — Translation of the interface and assistant replies into Indian languages you choose; speech-to-text only when that consent is on (India)
  • Twilio — Deliver WhatsApp messages when WhatsApp consent is on (United States)
  • Bhashini (MeitY, Government of India) — Fallback translation of the app interface and assistant replies into Indian languages you choose (India)

Cross-border transfers occur only to provide the service, with contractual safeguards and your consent where required.

10. Retention

  • Account & health records: up to 7 years after last activity, unless you request earlier erasure
  • Consent logs: 7 years (legal evidence)
  • Grievance records: 3 years
  • Inactive accounts are listed for review after 24 months. An administrator runs the 7-year, 3-year, and 7-year deletions from Privacy requests.

11. Security

We use encryption in transit (HTTPS), row-level access controls, private Amazon S3 document storage, role-based access, and server-side authentication checks. No system is 100% secure; report concerns to hello@mytheraverseos.com.

12. Your rights (Data Principal)

  • Access — download a readable copy of your data, including uploaded files (Privacy & Data → Export)
  • Correction — update profile and child records, or submit a correction request
  • Erasure — in Privacy & Data, an erasure request is sent to an administrator and the person is signed out. The administrator then deletes the account, child profiles, health records, and files. The account remains until then. The consent and request log is kept without your name, email, IP address, or the text you typed.
  • Withdraw consent — the switches on Privacy & Data turn a purpose off. Choosing Withdraw consent in Submit a request deletes uploaded documents and entries extracted from those files. The account stays. The switches are not changed by that deletion.
  • Grievance — submit it on Privacy & Data. The grievance officer replies there within 30 days. You can also email hello@mytheraverseos.com.
  • Nomination — name someone on Privacy & Data. They accept a link that does not include health information. The product does not detect a death. After an administrator confirms it, the same link can download the data. Accepting does not give them a login.

13. Breach notification

If we become aware of a personal data breach, each account holder sees a notice in the app. That notice describes what happened, the likely impact, and what you can do. Questions go to hello@mytheraverseos.com. We also prepare a notice for the Data Protection Board of India. An administrator submits that notice to the Board, and the time of that submission is recorded. The detailed notice is due within 72 hours of becoming aware.

14. Public screening questionnaires

The How it works page can store a screening without an account. We keep your name, email, which questionnaire you completed, and your Yes / No / Sometimes answers. M-CHAT-R, the sensory checklist, and the developmental intake are about a child. The parent stress index is about you. You must tick consent before anything is stored. For a questionnaire about a child, you must also declare that you are the parent or lawful guardian. That declaration is not an identity or age check.

A signed-in parent can also save the same 20-question checklist on their child's profile when they start without documents. Those answers live with the account, can be changed in Settings, and are included in a data export or erasure. They are not a diagnosis. Booking a therapist does not send the checklist to that therapist by itself. Uploading reports later uses the same health-record flow as a parent who started with documents.

Platform administrators review public responses from the How it works page for the founding cohort. They are not a diagnosis, and that public form does not share them with a therapist, school, or therapy centre. To see or delete a public response, email hello@mytheraverseos.com from the same address you entered. We delete it when you ask, unless the law requires us to keep it.

15. Founding-cohort waitlist

Joining the waitlist stores your name, email, phone number, and whether you are a parent, therapist, therapy centre, or school. We use that to contact you when the founding cohort opens and to show how many people have joined, as counts by role, not as a public list of names. You must tick consent before a signup is stored. Platform administrators can see the list. It is not a health record and it is not shared with a therapist or school from this form.

To see or delete a signup, email hello@mytheraverseos.com from the same address you entered. We delete it when you ask, unless the law requires us to keep it.

16. Contact

Privacy queries: hello@mytheraverseos.com
Grievance Officer: hello@mytheraverseos.com (response within 30 days)