Privacy Policy

VIBHA School of Psychology respects your privacy. This policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have. It is issued in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the rules made thereunder.

For the purposes of the DPDP Act, VIBHA School of Psychology is the Data Fiduciary and you are the Data Principal.

6.1 Data we collect#

You give us directly:

• Name, email address, phone or WhatsApp number, city of residence
• Educational and professional background provided during registration
• Payment records, transaction references, and billing details
• Assessment submissions, assignments, and course work
• Correspondence with us, including support and grievance communications

We collect automatically:

• Log data, IP address, browser and device type, pages visited, and time spent
• Cookies and similar technologies (see the Cookie Policy)
• Learning platform activity such as content accessed and progress

We receive from third parties:

• Payment confirmation and status from our payment gateway
• Attendance and participation data from Zoom
• Where you enrol through an institutional collaboration, verification of your enrolment status from that institution

We do not collect payment card numbers, CVV, UPI PINs, or net banking credentials. These are handled entirely by our payment gateway.

6.2 Sensitive data#

Please do not send us health information, clinical records, or details of your own therapy unless we specifically request it for a stated purpose. Where you do share sensitive personal data, we treat it as confidential and process it only for the purpose for which it was shared.

In case discussions and practical sessions, all clinical material used is anonymised or fictional. Learners must never share identifiable information about any real client, patient, or third party. See the Confidentiality Policy.

6.3 Why we process your data, and on what basis#

We process your data on the basis of your consent, and for legitimate uses permitted under the DPDP Act, for the following purposes:

We do not sell your personal data.

6.4 Who we share data with#

• Service providers who help us operate: hosting, database and storage providers, email delivery, payment gateway, Zoom, and community platforms. These parties process data on our instructions under contractual obligations of confidentiality and security.
• Institutional partners, where you enrolled through a collaboration, limited to enrolment status, attendance, and completion.
• Professional advisers such as accountants and lawyers, where necessary.
• Authorities, where disclosure is required by law, court order, or lawful request, or to establish, exercise or defend legal claims.
• A successor entity, in the event of a restructuring or transfer of business, subject to this policy.

6.5 Cross-border transfers#

Some of our service providers store or process data on servers outside India. Where this happens, we transfer data in accordance with the DPDP Act and applicable government restrictions, and require appropriate contractual safeguards.

6.6 Security#

We maintain reasonable security safeguards appropriate to the risk, including encrypted transmission, access controls on a need-to-know basis, hosting with reputable providers, and periodic review of our practices.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act.

6.7 Retention#

We retain personal data only as long as necessary for the purposes above:

• Enrolment, assessment and certification records: retained for eight years after course completion, so that we can verify certificates and meet statutory and tax obligations.
• Financial records: retained as required under Indian tax law, currently eight years.
• Marketing data: until you withdraw consent.
• Website analytics: ordinarily twenty-four months.

After these periods, data is deleted or irreversibly anonymised.

6.8 Your rights#

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how it is processed;
• Correct, complete, update, or erase your personal data;
• Withdraw consent at any time, as easily as you gave it — noting that withdrawal does not affect prior lawful processing, and that withdrawing consent essential to course delivery may end your access;
• Nominate another individual to exercise your rights in the event of your death or incapacity; and
• Grievance redressal through our process below, and thereafter to complain to the Data Protection Board of India.

To exercise a right, write to drsarthakpsychology@gmail.com from your registered email address. We respond within a reasonable period, ordinarily within thirty days. We may need to verify your identity first.

Note that requests to erase data may be limited where we are legally required to retain records, or where retention is necessary to verify a certificate we have issued.

6.9 Children's data#

Our Services are not directed at children under 18. Where a learner is between 16 and 18, we process data only with verifiable consent from a parent or legal guardian, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at them. If you believe a child's data has been collected without proper consent, contact drsarthakpsychology@gmail.com and we will delete it.

6.10 Data protection contact#

Kavya Bothra, Program Manager & Head Email: drsarthakpsychology@gmail.com Address: Available on request

6.11 Changes#

We may update this policy. The current version is always available on our website with its "Last updated" date. Where changes materially affect your rights, we will notify you by email.