Privacy Policy

Mental health information is among the most personal information there is. We collect only what we need to connect you with care, we never sell it, and we never use it for advertising.

This policy is issued by ThinkRoman Ventures LLP, which operates OpenAccess. It explains how we handle personal information under applicable data-protection laws where you live, such as the GDPR in the EU and UK and state privacy laws in the US.

• Account details: name, email, WhatsApp number, and login records.
• Assessment answers: your responses to check-ins such as PHQ-9 and GAD-7, and results you choose to bring from OpenAccess Navigator.
• Care records: appointments, messages, documents you upload, and notes or prescriptions written by your Provider.
• Payment records: amounts, dates and payment status. Card and bank details are handled by PayPal; we do not store them.
• Technical data: device and browser type, approximate region (to show the right prices, providers and policies), and security logs.
• Campus data: if you join through your college, your verified college email and membership.

• To match you with a suitable Provider and run your sessions.
• To let you and your Provider message, share documents and keep records.
• To take payments and send receipts and appointment reminders.
• To keep the Platform secure and prevent misuse.
• To meet legal and professional record-keeping duties.
• To improve the service using de-identified, aggregated information only.

• You can see your own records in your account.
• Your Provider can see your assessment results, messages and care records so they can help you.
• OpenAccess care operations staff can access records only when needed to support you or keep you safe.
• Your college, if you joined through Campus, sees only anonymous, aggregated figures. It never sees whether you used the service, what you discussed, or your results.

We may share information without your consent only where the law requires it, or to protect someone’s life or safety in an emergency.

These companies process data on our behalf, only to provide their service to us, under contracts that require them to protect it:

• Vercel: Website hosting
• MongoDB Atlas: Encrypted database
• 100ms: Video and voice sessions
• Pusher: Real-time messaging
• Cloudflare R2: Document storage
• Resend: Email delivery
• WhatsApp (Meta), via our messaging service: Sign-in codes and appointment updates
• Razorpay (India) and PayPal (International): Payments
• OpenAI: Optional AI writing assistance that helps therapists format their own notes and profile text

Care is always delivered by people. Where a Provider chooses to use AI writing assistance to tidy their own notes, the Provider reviews and remains responsible for the final record.

Some of our service providers store or process data outside your country. When that happens we use providers with strong security commitments and transfer data only as the law allows.

We keep your account while it is active. Care records are kept for the period required by medical and professional record-keeping rules, then deleted or anonymised. Other data is deleted when it is no longer needed, usually within 12 months of closing your account.

All connections are encrypted, data is encrypted at rest, access is limited by role, and sessions take place in private rooms. See our Confidentiality & Data Security page for details.

Depending on where you live, you can:

• access a copy of your personal data;
• correct inaccurate data;
• ask us to delete your data, subject to legal record-keeping duties;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time;
• complain to your local data-protection authority.

We do not sell personal information, and we do not share it for targeted advertising.

We use only the cookies needed to run the Platform, and no advertising trackers. See our Cookie Policy, and change your choices any time via Cookie Preferences.

OpenAccess is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has used the Platform, contact us and we will delete their data.

We will post any changes here and tell you directly if a change significantly affects how we use your information.

To use your rights or ask a question, contact us:

• Email: admin@thinkroman.com
• Phone / WhatsApp: +91 81691 97853
• Post: ThinkRoman Ventures LLP, 1-98/8/c/10, Plot no. 13A, Arunodaya Colony (Fiitjee Lane), Madhapur, Hyderabad, Telangana 500081, India