Privacy Policy

1. Scope & International Compliance

We operate globally and adhere to international privacy regulations, including:

• UAE Data Protection Law: Federal Decree-Law No. 45/2021 on Personal Data Protection (PDPL).
• European Union: General Data Protection Regulation (GDPR) (EU 2016/679).
• India: Digital Personal Data Protection Act (DPDP Act) 2023.

2. Information We Collect

Because we provide developmental and psychological support, we collect both general personal data and sensitive health data (with explicit consent):

2.1 Personal Data

• Contact Information (parent/adult name, email address, phone number, mailing address, country of residence).
• Billing Information (payment receipts, currency preferences, billing address processed securely via third-party payment gateways).

2.2 Health & Sensitive Data (Special Category Data)

• Clinical intake forms, developmental histories, speech assessment logs, session notes, and audio/video recordings (if recorded with explicit written consent for supervision or clinical reviews).
• Child details (date of birth, school grade, communication observations, diagnostic reports).

2.3 Automatically Collected Technical Data

• IP address, browser type, device information, operating system, pages viewed, and cookies.

3. Legal Basis for Processing (GDPR & International Frameworks)

We process your personal data under the following legal bases:

• Explicit Consent: For processing health data, conducting tele-therapy sessions, and communicating with minors.
• Performance of a Contract: To fulfill session bookings, assign Therapy Success Managers, and manage billing.
• Legitimate Interests: To improve platform technical reliability, ensure security, and optimize service delivery.
• Legal Obligation: To satisfy accounting, record-keeping, or regulatory requirements.

4. How We Use Your Information

• To conduct 1-on-1 speech, language, behavioural, and psychological tele-consultations.
• To coordinate progress updates with parents via Therapy Success Managers.
• To process payments securely.
• To send operational updates, appointment reminders, and transactional communications.
• To fulfill clinical quality audits (internal anonymized reviews).

5. International Data Transfers

PURPLETHERAPY ONLINE PRIVATE LIMITED is based in India, with cloud infrastructure and service providers operating globally (e.g., AWS, secure WebRTC communication nodes).

• Transfers from UAE / Middle East: Data is stored and processed with appropriate technical and organizational measures as required under the UAE PDPL.
• Transfers from EU / UK: Data transferred outside the European Economic Area (EEA) is protected under Standard Contractual Clauses (SCCs) or adequacy frameworks to ensure an equivalent level of data protection.

6. Data Sharing & Third-Party Vendors

We never sell your or your child’s personal data. We only share information with:

• Clinical Team: Assigned speech therapists, psychologists, and Therapy Success Managers bound by clinical confidentiality agreements.
• Vetted Service Providers: Cloud hosting services, secure video conferencing tools, payment gateways, and CRM platforms that comply with privacy standards.
• Legal Requirements: When required by applicable law, court orders, or law enforcement authorities.

7. Children’s Privacy & Parental Rights

Our Services involve children under the age of 18. We do not knowingly collect personal data directly from children without verifiable parental consent. All intake forms, evaluations, and account registrations must be completed by a parent or legal guardian.

8. Data Security & Retention

8.1 Security: We employ encryption in transit (TLS 1.2+) and at rest, strict role-based access controls, and secure clinical logging protocols.

8.2 Retention: We retain clinical and personal records for as long as necessary to provide therapy, satisfy accounting requirements, or comply with professional clinical record-keeping obligations under applicable law.

9. Your Privacy Rights

Depending on your geographic location (e.g., UAE, EU/UK, India), you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you or your child.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): Request deletion of personal data, subject to clinical record retention obligations required by law.
• Right to Withdraw Consent: Withdraw consent at any time for non-essential processing.
• Right to Data Portability: Request transfer of your data to another provider in a structured format.

To exercise any of these rights, email us at privacy@purpletherapy.co.

10. Cookies & Tracking

We use essential cookies for site functionality and analytical cookies to understand how users interact with our website. You can manage or disable cookie preferences directly through your web browser settings.

11. Contact Information

If you have questions, concerns, or complaints regarding this Privacy Policy or our data handling practices, please contact our Data Protection Officer:

• Entity Name: PURPLETHERAPY ONLINE PRIVATE LIMITED
• Privacy Contact Email: privacy@purpletherapy.co / info@purpletherapy.co
• Address: Bengaluru, Karnataka, India
• Website: www.purpletherapy.co