1. Identity of Data Fiduciary
This Privacy Policy ("Policy") governs the collection, processing, storage, and disclosure of personal data by [COMPANY NAME] ("Company", "we", "us", "our"), a company incorporated under the laws of India, having its registered office at Pune, Maharashtra, India ("BookMySessions" or the "Platform").
This Policy is published in compliance with:
- The Digital Personal Data Protection Act, 2023 (“DPDP Act”)
- The Information Technology Act, 2000 and IT (SPDI) Rules, 2011
- The Information Technology (Intermediary Guidelines) Rules, 2021
- Any other applicable Indian and international data protection laws
Data Fiduciary: [COMPANY NAME]
Grievance Officer / DPO: [NAME]
Email: privacy@bookmysessions.in
Response Time: Within 72 hours of receipt
2. Scope and Acceptance
By downloading, installing, registering on, or using the BookMySessions mobile application ("App"), you ("User", "Data Principal") expressly consent to the collection and processing of your personal data as described in this Policy. If you do not agree, you must immediately cease using the App and delete your account.
This Policy applies to:
- Seekers — users seeking peer support and guidance from Experts
- Experts — independent service providers listed on the Platform
- Visitors — persons who access the App without a registered account
3. Age Restriction — Strictly 18+
THE PLATFORM IS STRICTLY FOR USERS AGED 18 YEARS AND ABOVE.
We do not knowingly collect, process, or store personal data of individuals under the age of 18. If we discover that a minor has registered or is using the Platform, we will immediately suspend the account, delete all associated data, and where applicable, report the matter to competent authorities under the POCSO Act, 2012 and the Juvenile Justice Act, 2015.
Any User who provides false age information to bypass this restriction bears sole and full legal liability for such misrepresentation. The Company disclaims all liability arising from access by minors facilitated by User misrepresentation.
Parents or guardians who believe their minor child has registered must contact us immediately at privacy@bookmysessions.in.
4. Personal Data We Collect
4.1 Data Provided Directly by You
Account Identity Full name, display name, email address, phone number, date of birth
Profile Avatar/profile photo, biography, professional credentials (Experts only), language preference
Authentication Encrypted PIN hash + salt (no plaintext PIN stored), biometric preference flag, device tokens
Communication Chat messages, session records, support tickets
Financial BMS Coin transaction history, payment method tokens (processed by third-party gateways — we do not store raw card/UPI data)
Verification Government-issued ID documents (Experts only, for KYC)
4.2 Data Collected Automatically
Device Device model, OS version, app version, unique device identifiers
Usage Session durations, feature interactions, crash logs, error reports
Network IP address, connection type (collected by Firebase infrastructure)
Location Coarse location (country/state via IP only — we do not collect GPS location)
4.3 Sensitive Personal Data (SPDI)
The following constitutes SPDI and is processed with heightened protection:
- Mental health-related disclosures made during sessions
- Financial information (BMS Coin balances and transaction records)
- Biometric data flag — we store only a boolean; biometric verification is handled entirely on-device by the OS (we never receive or store actual biometric data)
- Encrypted PIN credentials
5. Purposes of Processing
Account creation and authentication Consent (DPDP §6); Contract performance
Connecting Seekers with Experts; facilitating sessions Contract performance
Processing BMS Coin purchases, transfers, and refunds Contract performance; Legal obligation
Safety interventions (crisis detection, POCSO reporting) Legitimate interest; Legal obligation (overrides consent)
Platform security, fraud prevention, abuse detection Legitimate interest
Compliance with court orders and law enforcement Legal obligation
Moderator review of flagged content Legitimate interest
Aggregated, anonymised platform analytics Legitimate interest (data is de-identified before use)
Push notifications (opt-out available) Consent
We will not process your data for purposes beyond those listed above without obtaining fresh, specific consent.
6. Data Sharing and Disclosure
6.1 We Do NOT Sell Your Data
We do not sell, rent, trade, or commercially exploit your personal data to any third party.
6.2 Sharing With Other Users
Seekers can see a Expert's public profile (display name, avatar, credentials, ratings). Experts can see a Seeker's display name and avatar during an active session. Neither party is permitted to share the other's personal data outside the Platform.
6.3 Service Providers (Data Processors)
Google Firebase Authentication, database, cloud functions, push notifications
Real-Time Media Provider Voice/video session infrastructure
Payment Gateway Partners BMS Coin purchases (payment tokens only)
Google Cloud Platform Server hosting, Secret Manager
All processors are contractually bound to process data only per our instructions.
6.4 Legal Disclosures
We may disclose personal data without your consent where required:
- By a court order or valid legal process
- To law enforcement investigating offences under POCSO, IPC, or IT Act
- To prevent imminent risk to life (including suicide risk)
- To CERT-In in the event of a reportable data breach
7. Data Retention
Active account data Duration of account existence
Session records (metadata) 3 years from session date
Chat message content 1 year from session date (or account deletion, whichever is earlier)
Financial transaction records 7 years (Indian accounting and tax law)
KYC documents (Experts) 5 years from last active session
Safety/incident reports Permanently (legal obligation)
Deleted account data 30-day grace period, then permanent deletion (except legally mandated retention)
Backups Purged within 90 days of account deletion
8. Data Security
We implement the following security measures:
- Encryption in transit: TLS 1.2+ for all API communications
- Encryption at rest: Firebase-managed AES-256 encryption
- Sensitive fields: PIN credentials stored as SHA-256 salted hashes in a private Firestore subcollection
- Access controls: Role-based access; super-admin functions require server-side custom claim verification
- Session tokens: Firebase Auth JWTs with standard expiry
- Storage rules: Expert photos limited to owner-write; admin exports deny all public access
Limitation: No system is perfectly secure. Despite our measures, we cannot guarantee absolute security against all cyber threats.
9. Data Breach Response
- 1. Detection to Containment: We will act to contain the breach within 24 hours of detection.
- 2. Regulatory Notification: We will notify the Data Protection Board of India within the prescribed timeline.
- 3. User Notification: We will notify affected Data Principals promptly, describing: (a) nature of data affected; (b) likely consequences; (c) remedial measures taken; (d) steps users can take.
- 4. Users who store sensitive information in chat messages beyond what is necessary for sessions do so at their own risk.
10. Your Rights as a Data Principal
Right to access Email grievance officer
Right to correction In-app profile settings or email
Right to erasure In-app account deletion or email
Right to grievance redressal Email grievance officer (72-hour response)
Right to nominate Nominate a person to exercise rights in case of death/incapacity — email request with supporting documentation
Certain data may be retained beyond a deletion request where required by law (e.g. financial records, safety/POCSO reports).
Escalation: If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India once constituted.
11. Crisis and Mental Health Disclaimer
SAFE SPACE IS NOT A MENTAL HEALTH TREATMENT PLATFORM.
Experts on BookMySessions are peer support providers — they are not licensed psychiatrists, psychologists, or clinical therapists unless explicitly verified and disclosed. Nothing on this Platform constitutes medical advice, clinical diagnosis, or psychiatric treatment.
If you or someone you know is in immediate danger or experiencing a mental health crisis:
- Emergency: 112
- iCall: 9152987821
- Vandrevala Foundation: 1860-2662-345 (24/7)
- NIMHANS: 080-46110007
The Company explicitly disclaims all liability for any self-harm, suicide, or harm to others arising from or connected to use of the Platform.
12. Third-Party Services
The App integrates third-party infrastructure (Firebase and a real-time voice/video provider). These services have their own privacy policies. We are not responsible for the data practices of third parties. Review:
- Google/Firebase Privacy Policy: policies.google.com/privacy
- Real-time voice/video provider: privacy policy available on request
13. Cookies and Tracking
The App is a native mobile application and does not use browser cookies. We use Firebase Analytics SDKs for usage telemetry. You may opt out by toggling Anonymous Stats off in Privacy Settings within the App.
14. Changes to This Policy
We may update this Policy from time to time. Material changes will be notified via in-app notification at least 15 days prior to taking effect. Continued use of the App after the effective date constitutes acceptance of the revised Policy.
15. Contact and Grievance Redressal
Grievance Officer: [NAME]
Company: [COMPANY NAME]
Address: Pune, Maharashtra, India
Email: privacy@bookmysessions.in
Response Time: Within 72 hours
If not resolved within 30 days, you may escalate to the Data Protection Board of India.
This Privacy Policy is governed by and construed in accordance with the laws of India. Disputes shall be subject to the exclusive jurisdiction of the courts at Pune, India.