1. Introduction

OpenAccess (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services via openaccess.thinkroman.com (“Platform”).

By using our Platform, you agree to the terms outlined here. For questions, contact us at admin@thinkroman.com.

2. Information We Collect

• Account Information: name, email, phone, organization or institution details.
• Demographics: gender, age group, location (optional for personalization).
• Health & Assessment Data: responses to PHQ-9, GAD-7, or other self-assessments.
• Usage Data: IP address, browser/device type, access logs, page interactions.
• Telehealth & Counseling Data: appointment records, chat interactions (where applicable).

3. How We Use Your Information

• To provide and personalize services
• To conduct AI-based triage and assessments
• To connect you with therapists, coaches, or providers
• To improve features, security, and user experience
• To comply with legal or regulatory obligations

We do not sell personal data. Limited sharing is done with trusted service providers (see “Third Parties”).

4. Sharing With Third Parties

• Service Providers: hosting, analytics, secure messaging, payment processors
• Institutional Clients (workplaces/colleges): aggregated, anonymized reports only
• Legal Requirements: when required by law, court order, or government request

5. Your Rights

• Access, correction, deletion of your data
• Withdraw consent (without affecting lawful use before withdrawal)
• Opt-out of targeted advertising and analytics
• File a complaint with your local data protection authority

6. Retention

We retain data only as long as necessary for the purposes described or as required by law.

7. Security

We use industry standards: encryption in transit and at rest, role-based access, and incident response protocols.

8. Children & Students

For campus programs, parental consent may be required for users under 18.

9. Cross-Border Transfers

Data may be processed in the U.S., India, and other jurisdictions. Appropriate safeguards are in place (e.g., SCCs under GDPR).