Privacy Policy

Effective date: 20 October 2026
Last updated: 20 October 2026

Your privacy matters to us, especially because the reason you come to HappenCare may be deeply personal. This policy explains exactly what we collect, where it is stored, who can see it, how long we keep it, and what rights you have over it.

We have written it to describe what our systems actually do, not what we intend them to do one day.

1. Who we are

HappenCare is a sole proprietorship owned and operated by Mohammed Janish P T ("HappenCare", "we", "us", "our"). HappenCare operates the website happencare.com and related services (the "Platform").

Address: WA Allotment No. WS A06, 14/104M, 2nd Floor, Sahara Centre, Calicut Road, Angadipuram, Perinthalmanna, Malappuram, Kerala – 679321, India
Email: support@happencare.com
GSTIN: 32BFSPJ5817G1ZB

Under India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the "DPDP law"), HappenCare is the Data Fiduciary for the personal data described in this policy.

A note on terminology. The DPDP law does not divide personal data into "normal" and "sensitive" categories; it applies one standard to all personal data. Separately, the Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011 — which remain in force during the DPDP transition — treat information about a person's mental health condition as sensitive personal data or information. Information you share about your wellbeing therefore attracts the higher standard of care under those rules, and we handle it accordingly throughout this policy.

2. Who holds what

This is the most important section of this policy, so we have put it first.

HappenCare is a marketplace. Therapists are independent professionals, not our employees. That means some of your information is held by us, and some is held only by your therapist, under their own professional duty of confidentiality.

HappenCare does not sit inside your session. We do not record sessions, we do not join them, we do not transcribe them, and we do not store clinical notes. Nobody at HappenCare can see what you discussed.

2.1 If you change therapists

Your new therapist starts fresh. No notes, history, or impressions are passed from one therapist to another, because HappenCare never holds them. If you want your history shared, ask your previous therapist directly; they will decide under their professional obligations. We can tell your new therapist only what you tell us.

2.2 If your therapist leaves HappenCare

They keep whatever professional records they hold, under their own legal and ethical duties, and they must stop using your information for anything else. Your HappenCare account, bookings, and payment history are unaffected. If a therapist leaves before a session you have already paid for, our Refund & Cancellation Policy applies.

2.3 If you close your account

We delete your account and profile information. We keep your booking and payment records for the periods set out in Section 8, because tax and consumer protection law requires it. Any notes your therapist holds are theirs, not ours, and you would need to contact them about those.

3. What we collect

3.1 Information you give us

• Account information: name, email address, phone number, and either a password or a Google sign-in.
• Age confirmation: you confirm that you are 18 or older when you register.
• Booking information: the therapist and service you choose, the date and time, and your booking history.
• What you tell us about your wellbeing: anything you choose to enter in a booking or intake form, or send to our support team. You decide what to share. We ask only for what helps connect you with the right therapist.
• Emergency contact (optional): a name and phone number for use in a genuine emergency (Section 6.3).
• Communications: emails, support requests, and feedback.
• Testimonials: only if you separately agree to give one (Section 9).

3.2 If you sign in with Google

If you choose Google sign-in, Google shares your name, email address, and profile picture with us, and Google knows that you use HappenCare. We never receive your Google password. You can use email and password instead if you prefer.

3.3 Payment information

Payments are processed by Razorpay. We never see or store your full card number, CVV, UPI PIN, or bank login. We receive only the transaction ID, status, amount, and basic payment method details.

3.4 Collected automatically

• Technical and security data: IP address, browser and device type, pages visited, and login activity. This protects your account and helps us detect abuse.
• Analytics: we use Google Analytics to understand how the site is used, but only if you accept analytics cookies. See our Cookie Policy.

3.5 What we never collect

• Session recordings of any kind. Sessions are not recorded, by us or by your therapist.
• Clinical session notes.
• Anything produced by AI from your session. We do not use automated transcription, AI-generated notes or summaries, or any automated analysis of session content, and therapists are prohibited from using such tools on HappenCare sessions. If we ever introduce a feature of this kind it will require your separate opt-in consent, and it will never be applied to past sessions.
• We never sell personal data, to anyone, for any purpose.

4. Why we use it

We never use anything about your mental health for advertising, and we never share it with advertising platforms.

5. Consent, and how to withdraw it

We ask for your consent through a clear notice when you register and when you book. Consent for your wellbeing information, for marketing, and for testimonials is asked for separately. Saying no to marketing or testimonials never affects your ability to use HappenCare.

This notice is available in English and in Malayalam. You can ask us for it in any language listed in the Eighth Schedule to the Constitution of India.

To withdraw consent, or to close your account, email support@happencare.com. We do not yet offer a self-service button for this in your account, so we handle these requests by email, and we act on them as quickly as a button would. Withdrawal does not undo processing that already happened, and we may keep records the law requires us to keep (Section 8). If you withdraw consent that we need in order to run a booked session, we may not be able to provide it.

6. Who we share it with, and where it goes

6.1 Your therapist

Your name, contact details, booking details, emergency contact, and anything you wrote in the booking form. Nothing else.

6.2 Our service providers

Each provider may use your data only to provide its service to us.

Our WhatsApp and calendar messages never mention why you are seeking support. They contain only your therapist's name, the date and time, and the status of your booking.

6.3 Emergencies

If we or your therapist reasonably believe there is an imminent risk to your life or safety, or to someone else's, we may contact your emergency contact, emergency services, or the relevant authorities. The law permits this without your consent.

6.4 Legal requirements

Where we are required by law, a court order, or a lawful request from a government authority.

6.5 If the business changes hands

If HappenCare is restructured (for example, converted into a company) or acquired, your data may transfer to the successor, which remains bound by this policy. We will tell you if that happens.

7. Where your data is stored

Our database runs in Cloudflare's Asia-Pacific region. Several of the services above process data outside India, as the table in Section 6.2 shows. Indian law does not require personal data to be stored inside India; it restricts transfers only to countries the Government has specifically barred, and none of our providers operate from such a country.

Where we operate. We currently offer the Platform to people in India and in the Gulf Cooperation Council countries — the UAE, Saudi Arabia, Qatar, Oman, Kuwait, and Bahrain. If you are in a GCC country, your own data protection law may give you additional rights, such as the UAE's Personal Data Protection Law or Saudi Arabia's PDPL, and you may also be able to complain to the data protection authority where you live. Email us to exercise any of those rights and we will honour them.

We do not currently offer the Platform in the European Union, the United Kingdom, or elsewhere. If you believe we hold data about you and you are in one of those places, contact us and we will deal with your request under whichever law gives you the stronger protection.

8. How long we keep it

When a period ends, we delete the data or permanently anonymise it.

9. Confidentiality

Because of what people share with us, confidentiality deserves its own section.

• No one at HappenCare can see your session. We do not join, record, monitor, or transcribe sessions.
• Sessions take place in Google Meet rooms. Each therapist has their own room, and your therapist must admit you each time before you can enter. Please wait until they do, and never share the link with anyone.
• Access inside HappenCare is limited. Only the proprietor and a small number of named administrators can access account and booking data, and only to provide support, process a payment or refund, or respond to a safety or legal matter. Access is logged.
• Your therapist's duty is separate from ours. What you tell them is confidential under their own professional ethics, subject to the narrow exceptions set out in the Teletherapy Informed Consent: a serious and imminent risk of harm to you or someone else, abuse of a child or of an adult who cannot protect themselves, a court order, or anonymised professional supervision.
• Marketing is kept entirely separate. We never use anything you share about your wellbeing to target advertising.

10. How we protect your data

• All traffic is encrypted in transit (HTTPS/TLS), and Cloudflare protects the site against attacks.
• Passwords are stored only as salted, slow cryptographic hashes. We never store them in readable form, and we cannot see them.
• Sign-in attempts are rate-limited to resist guessing and credential-stuffing attacks.
• Access to the database and administrative tools is restricted to named individuals, protected by two-factor authentication, and reviewed periodically.
• Therapist verification documents (degree certificates, registration proof, identity documents) are sent to us by email and are held by our verification team. They are never published on the Platform and are not accessible from the website.
• Our service providers are bound by their own contractual security commitments.

No system is perfectly secure. Section 11 explains what happens if something goes wrong.

11. If there is a data breach

If personal data in our care is lost, exposed, or accessed without authorisation, we will:

1. Contain and investigate it immediately, and record what happened and when we learned of it.
2. Tell you without delay, in plain language, describing the breach and its extent, what it is likely to mean for you, what we have done about it, what you should do (for example, change your password), and who to contact.
3. Tell the Data Protection Board of India without delay, and give the Board a detailed report within 72 hours covering the causes, the remedial measures, our findings on who was responsible, and a summary of the notices we sent to affected users, as Rule 7 of the DPDP Rules, 2025 requires.
4. Report to CERT-In within 6 hours where the incident falls within CERT-In's directions.
5. Fix the cause and record the changes we made to prevent a recurrence.

We maintain an internal breach response procedure covering detection, containment, assessment, documentation, notification, and remediation, and we review it periodically.

12. Your rights

Under the DPDP law you can:

• Get a summary of the personal data we hold about you, how we use it, and who we have shared it with.
• Correct anything inaccurate, incomplete, or out of date.
• Ask us to erase your data, unless we are legally required to keep it.
• Withdraw consent at any time (Section 5).
• Complain to our Grievance Officer (Section 15).
• Nominate someone to exercise your rights if you die or become unable to act.

Email support@happencare.com with the subject "Data Request". We may need to verify your identity first, and we will respond within the time limits set by law. If our response does not satisfy you, you may complain to the Data Protection Board of India.

13. 18 and over only

HappenCare is for adults. You confirm you are 18 or older when you register, and our therapists are required to stop a session and report to us if they believe a client is a minor. If we learn that a user is under 18, we close the account, refund any unused session, and delete their data except where the law requires us to keep it. We do not knowingly collect children's data. If you believe a minor has registered, please tell us.

14. Changes to this policy

We may update this policy. If a change is significant, we will tell you by email or on the Platform before it takes effect, and ask for fresh consent where the law requires it. The "Last updated" date above always shows the current version.

15. Contact and Grievance Officer

Grievance Officer: Mohammed Janish P T
Email: support@happencare.com (subject: "Grievance")
Address: WA Allotment No. WS A06, 14/104M, 2nd Floor, Sahara Centre, Calicut Road, Angadipuram, Perinthalmanna, Malappuram, Kerala – 679321, India

Timelines and escalation options are on our Grievance Redressal page.

HappenCare is not an emergency service. If you are in crisis or at risk of harm, please see our Emergency Disclaimer or contact your local emergency services.