Privacy Policy

This Privacy Policy applies to the counselling practice of Rashmi Poduval ("we", "us", "our"), a qualified mental health counsellor practising in Bengaluru, Karnataka, India. This policy covers all personal information collected through our website at rashmipoduval.com, by telephone, by electronic communication, and during the provision of counselling services.

We are committed to protecting the privacy and dignity of every person who approaches us. The handling of your personal and health information is guided by the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Mental Healthcare Act, 2017 ("MHA 2017"), as well as our professional ethical obligations as a counsellor.

We collect only the information necessary to provide you with a safe, effective counselling service.

Contact and identity information:

• Full name and preferred name
• Email address and phone number
• City/locality (to determine session modality)
• Emergency contact name and number (provided at your discretion)

Health and clinical information (collected only during the intake process and sessions):

• Reason for seeking counselling and presenting concerns
• Relevant personal, family, and medical history as shared by you
• Session notes made during or after appointments
• Details of any prior mental health treatment or medication

Website technical data (automatically collected):

• Browser type, device type, and operating system
• Pages visited and time spent on the site
• IP address (anonymised where possible)
• Referral source (how you arrived at our website)

We do not knowingly collect personal data from children under the age of 18 without verifiable parental or guardian consent.

Under Rule 3 of the SPDI Rules, 2011, certain categories of data are classified as Sensitive Personal Data or Information (SPDI) and are accorded a higher standard of protection. The information you share with us that falls under SPDI includes:

• Physical and mental health condition
• Medical records and history
• Any sexual orientation disclosed during therapy
• Biometric data (if ever collected)
• Financial information relating to payment

Consent for the collection of SPDI is obtained at intake via our client information and consent form. By completing and signing that form, you consent to the collection and processing of your SPDI for the purposes of providing you with counselling services.

We use the personal information you provide solely for the following purposes:

• To provide, manage, and improve counselling services to you
• To schedule, confirm, and follow up on appointments
• To process fees and maintain financial records as required by law
• To maintain clinical notes and case documentation for continuity of care
• To respond to your enquiries submitted through the website or contact form
• To send you session reminders and relevant service communications
• To meet our legal, regulatory, and professional obligations
• To improve the functionality and content of our website (using anonymised analytics)

We will not use your personal information for direct marketing, sell your data to any third party, or use your clinical information for any purpose unrelated to your care without your explicit consent.

Confidentiality is a cornerstone of the therapeutic relationship. Everything you share in sessions is held in the strictest confidence. We will never discuss the content of your sessions with family members, employers, friends, or any other third party without your express written consent.

Under Section 23 of the Mental Healthcare Act, 2017, you have a right to confidentiality with respect to your mental health, treatment, and all other information obtained during the course of your care.

However, there are narrow legal and ethical circumstances in which confidentiality may not be maintained. These include:

• Imminent risk of harm: If you disclose a serious, credible, and imminent risk of harm to yourself or to an identifiable other person, we may be obligated to take reasonable protective action, which may include contacting your emergency contact or relevant authorities.
• Mandatory reporting: Where we are required by law to report information — for example, in cases of suspected child abuse under the Protection of Children from Sexual Offences (POCSO) Act, 2012, or other applicable legislation.
• Court order or legal process: If we receive a valid court order, subpoena, or other legal direction to disclose information, we will comply to the extent required by law and will, where legally permissible, inform you in advance.
• Clinical supervision: We may discuss aspects of our work in professional supervision settings (in anonymised form where possible) to maintain clinical quality. Supervisors are bound by the same professional confidentiality obligations.

We do not sell, rent, or trade your personal information to any third party. Your data may be shared only in the following limited circumstances:

• With your written consent: For example, if you request that we share a summary or report with your general practitioner, psychiatrist, HR department, or another professional.
• Referring professionals: If you have been referred to us by a doctor or other health professional and you consent to us sharing progress updates.
• Service providers: We may use trusted third-party platforms for scheduling (e.g., Google Calendar), video calls (e.g., Google Meet, Zoom), or payment processing. These platforms have their own privacy policies and we select only those that meet reasonable security standards. A list of current service providers is available on request.
• Legal or safety disclosures: As described in Section 5 above.

Where data is shared with technology service providers, we rely on contractual safeguards and, to the extent possible, data processing agreements to protect your information.

Cross-border data transfers: Some of our service providers (such as video conferencing platforms) may process data on servers located outside India. By using our services, you acknowledge this and consent to such transfers where necessary for service delivery, subject to the service provider's own privacy and security standards.

Many counselling sessions are conducted online via secure video platforms. The following applies to online sessions:

• Sessions are not recorded by us without your explicit consent given in writing prior to the session.
• You are responsible for ensuring privacy at your end — we recommend finding a private, quiet space where you cannot be overheard.
• We recommend using a headset to reduce the risk of others in your vicinity hearing the session.
• We cannot guarantee the security of the internet connection or the video platform itself. Please be aware of this inherent limitation of online communication.
• If you use a shared or work device, please clear browser history and cached data after sessions.

We take the security of your personal and clinical information seriously and implement reasonable technical and organisational measures to protect it against unauthorised access, loss, or disclosure, as required under Rule 8 of the SPDI Rules, 2011.

• Digital files and session notes are stored on password-protected devices and cloud services with access controls.
• Paper notes, if any, are stored in a locked cabinet accessible only to us.
• Communications containing sensitive information are conducted over encrypted channels where possible.
• Payment information is handled through secure payment gateways and is not stored by us in full.

No method of data storage or transmission over the internet is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

Our website may use cookies and similar tracking technologies to improve your browsing experience and to understand how visitors use our site.

• Essential cookies: Required for basic website functionality such as remembering your preferences. These cannot be disabled.
• Analytics cookies: We may use tools such as Google Analytics (in anonymised IP mode) to understand aggregate visitor behaviour. No personally identifiable information is collected through analytics.

You can control or disable cookies through your browser settings. Disabling analytics cookies will not affect your ability to book a consultation or use the website.

We retain client records for the following periods, guided by professional ethical standards and applicable law:

• Adult client records: A minimum of 7 years after the date of the last session.
• Minor client records: Until the client turns 25 years of age, or for 7 years from the date of the last session — whichever is longer.
• Enquiry data (non-clients): Contact information from website enquiries that did not progress to a counselling engagement is deleted within 12 months.

After the applicable retention period, records are securely destroyed. You may request early deletion of non-clinical data (e.g., contact details) at any time; however, we may retain clinical records for the minimum statutory period even after your request.

Subject to applicable law, you have the following rights in relation to your personal information:

• Right to access: You may request a copy of the personal information we hold about you.
• Right to correction: You may ask us to correct inaccurate or incomplete information.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time. This will not affect the lawfulness of processing prior to withdrawal.
• Right to deletion: You may request deletion of your personal data, subject to our legal and clinical record-keeping obligations.
• Right to grievance redressal: You have the right to raise a complaint with our Grievance Officer (see Section 12).

To exercise any of these rights, please write to us at the contact details below. We will respond within 30 days of receiving a valid request.

In accordance with Rule 5(9) of the SPDI Rules, 2011 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have designated a Grievance Officer to address complaints relating to your personal data.

If you are dissatisfied with our response, you may escalate your complaint to the relevant authority under the IT Act, 2000 or any applicable data protection legislation in force at the time.

We may update this Privacy Policy from time to time to reflect changes in our practice, technology, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page and, where the changes significantly affect your rights, we will notify you directly by email if we hold your contact details.

Continued use of our website or services after the updated policy becomes effective constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

For the terms that govern your use of our counselling services, please also read our Terms & Conditions.