Privacy Policy

1. Information we collect

We collect the following information when you use Manovikalpa:

• Account information: name, email address, encrypted password
• Therapy chat messages and session history
• Mood logs including emoji, label, score, and optional notes
• Medical records: diagnoses, medications, and session notes you enter

2. How we use your information

• To provide and improve the Manovikalpa service
• To generate AI therapy responses (your messages are sent to Anthropic Claude API)
• To display your mood trends and history
• To store and retrieve your medical records
• If you turn on "Share my medical records with the AI for this session" in the chat interface, all diagnoses you have entered, both your current and past/discontinued medications, and your 3 most recent session notes are included in that specific session's AI context, solely to make the AI's response more relevant to you. This is off by default and only applies to the session where you enable it — it is never shared automatically or without your explicit action each time.
• To send password reset emails when requested

3. Third-party services

We use the following third-party services:

• Anthropic Claude — processes your chat messages to generate AI responses. Under our commercial API agreement, Anthropic does not use your conversation content to train its models. Manovikalpa's AI layer is built to support multiple providers (including OpenAI and Groq); if we route production traffic through an additional provider, we will update this section beforehand.
• Supabase — stores your data in a PostgreSQL database
• Vercel — hosts the application
• Resend — sends transactional emails
• Upstash Redis — rate limiting to protect the service

4. Cross-border data transfer

Your primary data (account details, mood logs, journal entries, thought records, and medical records) is stored in a database hosted in Mumbai, India. Some processing still takes place outside India as part of our infrastructure providers' global operations - for example, chat messages are sent to Anthropic's Claude API (see Section 3) and our application hosting provider operates a global edge network. By using Manovikalpa, you consent to this cross-border transfer of your personal data where applicable, in accordance with the DPDP Act, 2023.

5. Data security

We implement the following security measures:

• Passwords are hashed using bcrypt and never stored in plain text
• All data is transmitted over HTTPS
• Rate limiting prevents unauthorized bulk access
• JWT sessions expire after 24 hours
• Access to raw chat content and medical records is restricted to authorized personnel and limited to resolving support requests you raise, investigating security incidents, or complying with a legal obligation — we do not routinely review individual users' conversations

6. Data retention

We retain your data for as long as your account is active. You may request deletion of your account and associated data by contacting us at support@manovikalpa.com, and we will complete this within 30 days. Deleted data may still exist in routine database backups for up to 30 days before being fully purged. Security and audit logs are retained for a minimum of one year, as required under the DPDP Rules, 2025, even where deletion has been requested.

Some of our service providers retain limited data independently of our own deletion process. Payment and transaction records are retained by our payment processor, Razorpay, for the period required under applicable financial regulations, regardless of any account deletion request — this is a legal requirement we cannot override. Analytics data is deleted from our analytics provider when your account is permanently deleted, though the underlying removal of historical analytics events is processed on that provider's own periodic schedule rather than instantly. Error-tracking data is retained by our error-monitoring provider for a bounded period (30–90 days) before it ages out automatically.

7. Your rights

Under the DPDP Act, 2023, you have the following rights:

• Right to access your personal data
• Right to correct inaccurate data
• Right to delete your data (right to be forgotten)
• Right to data portability
• Right to withdraw consent
• Right to grievance redressal

You can exercise your right to access by downloading a complete export of your data at any time from Settings, free of charge. To exercise any other right, contact us at support@manovikalpa.com.

8. Grievance Officer

Our Grievance Officer, as required under the Digital Personal Data Protection Act, 2023, is:

Shanmukha, Founder
Email: grievance@manovikalpa.com

For any data-related grievances or complaints, please contact our Grievance Officer at the email address above. We will acknowledge your complaint within 7 days and respond within 30 days, as required under applicable Indian data protection regulations.

9. Children's privacy

Manovikalpa is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately.

10. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes via email. Continued use of Manovikalpa after changes constitutes acceptance of the updated policy.

11. Contact us

For privacy-related questions or to exercise your rights, contact us at support@manovikalpa.com