Privacy Policy

Mental health information is among the most personal information there is. We collect only what we need to connect you with care, we never sell it, and we never use it for advertising.

This policy is issued by ThinkRoman Ventures LLP, which operates OpenAccess and acts as the Data Fiduciary. It explains how we handle personal information under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

• Account details: name, email, WhatsApp number, and login records.
• Assessment answers: your responses to check-ins such as PHQ-9 and GAD-7, and results you choose to bring from OpenAccess Navigator.
• Care records: appointments, messages, documents you upload, and notes or prescriptions written by your Provider.
• Payment records: amounts, dates and payment status. Card and bank details are handled by Razorpay; we do not store them.
• Technical data: device and browser type, approximate region (to show the right prices, providers and policies), and security logs.
• Campus data: if you join through your college, your verified college email and membership.

• To match you with a suitable Provider and run your sessions.
• To let you and your Provider message, share documents and keep records.
• To take payments and send receipts and appointment reminders.
• To keep the Platform secure and prevent misuse.
• To meet legal and professional record-keeping duties.
• To improve the service using de-identified, aggregated information only.

• You can see your own records in your account.
• Your Provider can see your assessment results, messages and care records so they can help you.
• OpenAccess care operations staff can access records only when needed to support you or keep you safe.
• Your college, if you joined through Campus, sees only anonymous, aggregated figures. It never sees whether you used the service, what you discussed, or your results.

We may share information without your consent only where the law requires it, or to protect someone’s life or safety in an emergency.

These companies process data on our behalf, only to provide their service to us, under contracts that require them to protect it:

• Vercel: Website hosting
• MongoDB Atlas: Encrypted database
• 100ms: Video and voice sessions
• Pusher: Real-time messaging
• Cloudflare R2: Document storage
• Resend: Email delivery
• WhatsApp (Meta), via our messaging service: Sign-in codes and appointment updates
• Razorpay (India) and PayPal (International): Payments
• OpenAI: Optional AI writing assistance that helps therapists format their own notes and profile text

Care is always delivered by people. Where a Provider chooses to use AI writing assistance to tidy their own notes, the Provider reviews and remains responsible for the final record.

Some of our service providers store or process data outside India. When that happens we use providers with strong security commitments and transfer data only as the law allows.

We keep your account while it is active. Care records are kept for the period required by medical and professional record-keeping rules, then deleted or anonymised. Other data is deleted when it is no longer needed, usually within 12 months of closing your account.

All connections are encrypted, data is encrypted at rest, access is limited by role, and sessions take place in private rooms. See our Confidentiality & Data Security page for details.

Under the Digital Personal Data Protection Act, 2023 you can:

• ask for a summary of the personal data we hold and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it, subject to legal record-keeping duties;
• withdraw your consent at any time (this may stop some services);
• nominate someone to exercise your rights if you die or become unable to;
• raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

We use only the cookies needed to run the Platform, and no advertising trackers. See our Cookie Policy, and change your choices any time via Cookie Preferences.

OpenAccess is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has used the Platform, contact us and we will delete their data.

We will post any changes here and tell you directly if a change significantly affects how we use your information.

To use your rights or ask a question, contact us:

• Email: admin@thinkroman.com
• Phone / WhatsApp: +91 81691 97853
• Post: ThinkRoman Ventures LLP, 1-98/8/c/10, Plot no. 13A, Arunodaya Colony (Fiitjee Lane), Madhapur, Hyderabad, Telangana 500081, India

For grievances about your personal data: