Privacy Policy

This Privacy Policy along with the Terms of Use available at Terms of Service governs the use of the Platform owned, operated and managed by VeriScript Private Limited, a company incorporated under the provisions of the Companies Act, 2013 and has a registered address at 7/20 Industrial Area, Kirti Nagar - 110015, West Delhi, New Delhi, India, 110015 (hereinafter "Company", "empaithy™", "We", "Us", "Our"). The terms capitalized but not defined in this Privacy Policy shall have the meaning ascribed to them in the Terms of Use.

This Privacy Policy is published by Us, in compliance with:

• Section 43A of the Information Technology Act, 2000;
• Regulation 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011 ("SPI Rules"); and
• Section 6 of the Digital Personal Data Protection Act, 2023 ("DPDP Act")

Definitions

• "Personal Information" as defined under the SPI Rules, means any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available to a body corporate, is capable of identifying such person.
• "Sensitive Personal Data or Information" as defined under the SPI Rules, means personal information about that person relating to:
  • passwords
  • financial information such as bank accounts, credit and debit card details or other payment instrument details
  • physical, physiological, and mental health condition
  • sexual orientation
  • medical records and history
  • biometric information
  • information received by body corporate under lawful contract or otherwise
  • visitor details as provided at the time of registration or thereafter
  • call information records
• "Personal Data" as defined under the DPDP Act, means any Information about an individual who is identifiable by or in relation to such Information.
• "Processing" as defined under the DPDP Act, in relation to personal Information, means a wholly or partly automated operation or set of operations performed on digital personal Information, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

For the purposes of this Privacy Policy, the term "Information" shall encompass and be synonymous with the terms Personal Information, Sensitive Personal Data or Information, and Personal Data as defined above.

This Agreement applies to:

• Individuals who are seeking mental well-being support, guidance, or information through the Platform; and
• Any other individuals or entities who access or interact with the Platform for various purposes.

General

Except to the extent mentioned in this Privacy Policy, we will not sell, share or rent Your Information to any third party or use Your email address/mobile number for unsolicited emails and/or SMS. Any emails and/or SMS sent by Us will only be in connection with the provision of agreed Services & products and this Privacy Policy. To carry out general marketing, We would be sending out emails to the Users registered on Our Platform or by any means and in any media.

Collection of Information

User-Submitted Information:

• Profile Information: When You create a profile on our Platform, we collect essential details such as Your name, email, phone number, password, One-Time Password (OTP), and profile picture. These elements are voluntarily provided by You, forming the foundation for a personalized User experience.
• Communication History: Your interactions on the Platform, including chat history that may reference advanced AI technologies like GPT, and journal Information entries, contribute to the richness of Your profile. These User-submitted Information elements are crucial for enhancing Your overall experience.

Automatically Collected Information:

• Contacts and Permissions: In certain scenarios, such as emergencies, we may fetch Your contacts, but only with Your explicit permission. This respects Your autonomy over personal networks, ensuring that Your Information remains under Your control.
• Subscription and Location Data: To facilitate seamless transactions and adhere to payment processing rules and government policies, we collect subscription Information, including card details. Location Information is gathered in compliance with relevant laws, ensuring transparency and legal adherence.
• Device Information: Technical processes involve the collection of device information to enhance Your User experience and improve service accuracy. This Information is invaluable for analytics and repair purposes, ensuring our Services align with Your unique device specifications.
• Audio Features with Consent: Introducing audio features adds a layer of convenience, but only with Your explicit consent. Microphone Information collected for real-time audio-to-text conversion is processed in a way that prioritizes Your privacy—note that the raw audio Information is never stored.
• Tracking Technologies: The Platform, designed for mobile devices, adopts a different approach for user authentication and session management. Instead of traditional web cookies, which are more common in browser environments, it utilizes session tokens. These tokens, unique identifiers assigned to a User's session upon login, are stored on the User's mobile device.

If You choose to integrate third-party Services with Our Platform, We may receive information from these Services in accordance with their privacy policy.

When You provide this Information to Us, You consent to its use for tailoring Our Services to Your needs, enhancing service quality, research and development, and legal compliance. We are committed to handling Your Information with utmost care and confidentiality, ensuring it's used only as per Your consent and legal requirements.

Use of Information

We are committed to using Your Information responsibly and transparently. We use the information collected for the following purposes or as otherwise described at the time of collection:

• Identity and Service Delivery: Profile Information serves as a cornerstone for identity management, allowing Us to create a personalized and secure environment for Our Users. Additionally, chat and journal entries, submitted by Users, undergo AI analysis to provide emotional support and generate valuable analytics.
• Emergency Situations: In situations identified as critical through AI analysis, User contacts play a pivotal role. The information stored in Your contacts is used judiciously during emergency scenarios, offering a swift and responsive approach to ensure User safety and well-being.
• Financial Transactions: Payment Information, including subscription charges, is collected to facilitate secure financial transactions. This information is processed in compliance with stringent security measures and payment processing protocols.
• Enhanced User Experience: Device information and location Information are harnessed to elevate the overall User experience. By tailoring Our Services to the unique specifications of each device, we ensure a seamless and optimized experience for Users.
• Audio Processing: With User permission, audio Information is collected to enable dynamic interactions with Our platform. Through sophisticated processing powered by OpenAI's API, this audio Information is converted into text. Importantly, no retention of the original audio Information occurs, prioritizing User privacy and confidentiality.
• Legal Compliance: To comply with legal obligations and protect Our rights and Our User's rights, including:
  • Auditing Our processes for compliance with legal, contractual and internal policy requirements;
  • Enforcing the terms and conditions governing Our Services; and
  • Preventing, identifying, investigating and deterring fraudulent, harmful, unauthorized, unethical or illegal activities, including security breaches or identity theft.

Sharing Your Information

We place great emphasis on highlighting the intricacies surrounding the sharing of Personal Information collected through Our Platform. Following are the various scenarios and considerations involved in the responsible sharing of Your Personal Information:

• Service Providers: To ensure seamless operations and enhanced features, Personal Information may be shared with specific service providers integral to our Platform. This includes Google Firebase (OTP Services), OpenAI (chat and journal analysis, audio processing), Microsoft Azure (secure storage and hosting), and Stripe (payment processing). Each service provider is carefully chosen for their expertise and adherence to stringent Information protection standards.
• Legal Obligations: There may arise circumstances necessitating the sharing of Personal Information to comply with legal obligations, regulatory requirements, or respond to lawful requests.
• Consent-Based Sharing: Personal Information may also be shared subject to the explicit consent of the User. Users are provided with transparent information regarding such sharing, and consent is sought before proceeding.
• Business Transitions: Personal information may be shared in the context of a business transition, such as a merger, acquisition, or sale of assets.
• Emergency Situations: Contacts stored on our Platform may be shared in identified emergency situations through AI analysis.
• Anonymized Aggregated Data: Aggregated and anonymized Information may be shared for analytical purposes, devoid of personally identifiable information.

User's Rights

In accordance with the provisions outlined in the Data Protection Legislations, the Users have the following rights:

• Right to Access Information: You have the right to request a summary of Your Information that We Process, including details of Processing activities and identities of third parties with whom Your Information has been shared.
• Right to Correction and Erasure: You can request correction, completion, updating, or erasure of Your Information that We hold, especially if it is inaccurate, incomplete, or outdated. Such requests can be made by contacting Us at support@empaithy.com.
• Grievance Redressal: You have the right to address any grievances regarding Our handling of Your Information and to that effect, We have appointed a grievance officer to whom you can address such grievances or concerns.
• Nomination Rights: You have the right to nominate an individual who can exercise Your Information rights on Your behalf in the event of Your incapacity or death.
• Account Deletion: You may request the deletion of Your account by visiting the relevant section on our Platform.
• Online Tracking Technologies Opt-Out: You can opt out of the tracking technologies used by Us, by denying the Platform the permission to track, or by writing to us at support@empaithy.com.
• Withdrawal of Consent: You may withdraw Your consent for Processing Your Information at any time. This includes requesting the deletion of Your account, which will be deemed as withdrawal of consent. Please be aware that withdrawing Your consent may mean that You will no longer be able to use Our Services.

Security

The security of Your Information is important to Us. We employ a comprehensive approach to safeguard Your Information against loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. This includes a combination of administrative, technical, and physical measures to ensure robust protection.

Frontend Storage and Security:

• Data Storage Practices: Our platform leverages Firebase as the chief solution for frontend data storage, encompassing the Firestore Database for managing various data types and Firebase Storage for file handling.
• Access Control: Access to our system is regulated through Firebase Authentication, ensuring that only verified and authorized users have the ability to engage with our services.
• Data Encryption: We employ stringent encryption protocols on both the server and client sides for robust protection during both transmission and storage phases.
• Network Protection: We implement advanced network security protocols including HTTPS and SSL/TLS encryption, along with Virtual Private Cloud (VPC) configurations.
• System Monitoring and Logging: Our system's operations and security-related events are continuously monitored using tools such as Firebase Analytics, Performance Monitoring, and Crashlytics.
• Backup and Disaster Recovery: We have established comprehensive backup and disaster recovery protocols for quick restoration of data in unforeseen situations.

Backend Storage and Security:

• Data Storage: Encrypted Information bases with Transport Layer Security (TLS) and storage encryption are employed at the backend.
• Encryption: Both at rest and in transit, Information encryption is enforced, providing continuous protection.
• Third-Party Processing: OpenAI and Microsoft Azure, as third-party service providers, implement their own robust Information protection measures.

Children

We strictly adhere to Data Protection Legislations and do not knowingly collect or solicit Information from individuals under the age of 18. Our Services are designed for users who are 18 years or older, and We do not permit minors under 18 to use Our Platform. We urge parents and guardians to supervise their children's online activities and contact Us at support@empaithy.com to remove any information provided by a minor without consent.

Changes to the Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time, with or without prior notice. In the event of significant changes in the way We handle Users' Personal Information, We will either prominently display a notice on Our website or send an email notification. The latest version of Our Privacy Policy will always be available on Our website, and We encourage You to check it periodically.

By continuing to use Our Platform or accessing Our website after the publication of a notice of changes, You are acknowledging and consenting to these revised terms.

If You object to any of the updated terms and no longer wish to use Our Platform, You are free to deactivate Your account.

Compliance with Laws and Law Enforcement

We will cooperate with government and law enforcement officials and private parties to enforce and comply with the law. We reserve the right to track IP addresses for the purposes of fraud prevention and to release IP addresses to legal authorities. We will disclose information about You to government or law enforcement officials or private parties when We believe it reasonably necessary to comply with the law, to protect the property and rights of the Company or a third party, to protect the safety of the public or any person, or to prevent or stop activity We may consider to be illegal, unethical or legally actionable.

Users are strongly encouraged to utilize this Platform exclusively for lawful and ethical purposes. Any User found participating in activities deemed unlawful or potentially harmful to others will face strict consequences. We retain the right to suspend the account of any User involved in such activities.

Data Retention

We retain the Information only for as long as necessary to fulfil the purposes for which it was collected and in accordance with legal and regulatory obligations, or until You withdraw Your consent. In determining the appropriate retention period for the Information, We take into account various factors including the volume, nature, and sensitivity of the Information; the potential risk of harm from unauthorized use or disclosure; the specific purposes for which We Process the information; and the requirements of applicable legal and regulatory frameworks.

Grievance Officer

If You have any questions or concerns regarding this Privacy Policy or the Company's practices for collecting, using, and disclosing the Information, please feel free to contact Our appointed Grievance Officer:

To: Grievance Officer
E-mail ID: support@empaithy.com
Address: New Delhi

We assure you that we will make every reasonable effort to promptly respond to and resolve any concerns or questions you may have.