Your privacy is the foundation of what we build. This policy explains what data Rightly collects, why, and the choices you have. It applies to rightly.co.in and the Rightly app.
1. What we collect
- Account information — your phone number, name, and email when you register.
- Session information — chat messages and files you share within a session (so we can deliver them and let you revisit past chats), and session metadata such as duration, type, and the therapist you spoke with. Voice calls are transmitted in real time and are not recorded.
- Payment information — wallet balance and transaction history. Card and banking details are handled by our payment partner (Razorpay); we never store them.
- For therapists — the credentials you submit for verification, including your qualifications, professional registration numbers where applicable, and identity documents.
- Technical data — device tokens for notifications and basic logs needed to keep the service working.
2. Sensitive data — handled as such
What you share in a therapy session can reveal information about your mental health. We treat all session content as sensitive personal data under India's Digital Personal Data Protection Act, 2023: it is used only to deliver your sessions, is never sold, never used for advertising, and never used to profile you.
3. How we use your data
- To operate the Platform — connect you with therapists, deliver sessions, process payments.
- To verify therapists' credentials before they can take sessions.
- To keep the Platform safe — investigating reports of abuse or credential fraud.
- To communicate with you about your account and sessions.
We do not sell your personal data. We do not show you advertising based on it.
4. Who can see what
- Your therapist sees the name you present and what you share with them in session.
- Rightly's team does not read your sessions in the ordinary course. Limited access may occur only where necessary to investigate a specific safety report, resolve a dispute you raise, or as required by law.
- Service providers — we use Google Firebase (data storage and delivery), Razorpay (payments), and Agora (real-time voice) to run the Platform. They process data on our behalf to provide these functions.
- Legal requirements — we may disclose data where required by law, or where necessary to prevent serious, imminent harm to a person.
5. How long we keep it
Account and session data is retained while your account is active so you can access your history. When you delete your account, your personal data is deleted or anonymised within a reasonable period, except records we're legally required to keep (such as payment records).
6. Security
Data is encrypted in transit, access is restricted within our systems, and payments are handled by a PCI-compliant processor. No system is perfectly secure, but we treat the security of this data as a core product responsibility, and we will notify you and the authorities of any breach as required by law.
7. Your rights
You can request access to, correction of, or deletion of your personal data, and withdraw consent for processing, by writing to hello@rightly.co.in. We respond to all requests, and you may escalate grievances to the Data Protection Board of India as provided under the DPDP Act.
8. Children
Rightly is for adults. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it.
9. Changes
If this policy changes materially, we'll tell you in the app or by email before the change takes effect.
10. Contact
Privacy questions and requests: hello@rightly.co.in