PRIVACY POLICY Effective Date: 20-Feb-2025 Last Updated: 20-Feb-2025 Introduction Souloxy, owned and operated by Dhinetra Health Technologies Private Limited, is committed to protecting your privacy and ensuring the confidentiality of your personal and health-related data. This Privacy Policy outlines how we collect, use, store, share, and protect your personal information when you use our Services, including our website, mobile applications, AI-powered chatbot, and other mental health solutions. This Privacy Policy explains how we collect, process, use, share, and safeguard personal information of individuals using our Services, including mental health practitioners, end-users, and visitors to our website and our portal (collectively referred to as "You" or "Users"). Your privacy and the security of your personal data are of utmost importance to us, and we are committed to protecting it in accordance with applicable laws. By accessing or using our services, you agree to the terms outlined in this Privacy Policy and our Terms of Use, which may be accessed at https://www.souloxy.com/privacy-policy , which govern your relationship with us. Any capitalized terms used but not specifically defined in this Privacy Policy shall have the meaning assigned to them in our Terms of Use. PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND OUR DATA PROTECTION PRACTICES. THIS PRIVACY POLICY IS AN INTEGRAL PART OF OUR TERMS OF SERVICE AND IS INCORPORATED BY REFERENCE. BY ACCESSING OUR SOLUTION, WEBSITE, USING OUR SERVICES, OR VOLUNTARILY PROVIDING US WITH YOUR INFORMATION, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREED TO THE TERMS OUTLINED IN THIS PRIVACY POLICY. YOUR CONTINUED USE OF OUR SERVICES CONSTITUTES YOUR CONSENT TO THE COLLECTION, PROCESSING, USE, AND DISCLOSURE OF YOUR PERSONAL DATA AS DESCRIBED HEREIN. WE RESERVE THE RIGHT TO MODIFY, UPDATE, OR REMOVE SECTIONS OF THIS PRIVACY POLICY AT OUR SOLE DISCRETION, AT ANY TIME. IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY POLICY, YOU SHOULD IMMEDIATELY DISCONTINUE USING OUR SERVICES AND REFRAIN FROM PROVIDING ANY PERSONAL INFORMATION. IF YOU ARE USING OUR SERVICES ON BEHALF OF ANOTHER INDIVIDUAL (SUCH AS A MINOR OR A DEPENDENT) OR AN ENTITY (SUCH AS YOUR EMPLOYER), YOU CONFIRM THAT YOU ARE AUTHORIZED TO: (I) ACCEPT THIS PRIVACY POLICY ON THEIR BEHALF, AND (II) PROVIDE CONSENT FOR THE COLLECTION, USE, AND DISCLOSURE OF THEIR INFORMATION IN ACCORDANCE WITH THIS PRIVACY POLICY. This Privacy Policy has been developed and published in compliance with applicable data protection laws, including but not limited to the Information Technology Act, 2000, and related Rules. It details the categories of information we collect, the purpose and methods of its collection, processing, storage, and deletion, as well as the conditions under which we may share or disclose user data while maintaining legal and regulatory compliance. Additionally, we adhere to both Indian and international data protection frameworks, including the Digital Personal Data Protection Act, 2023 (DPDP Act, India), General Data Protection Regulation (GDPR, Europe), and the Health Insurance Portability and Accountability Act (HIPAA, United States), ensuring that our data handling practices meet the highest standards of security and privacy. 1. Scope 1.1. This Privacy Policy applies to all users of Souloxy’s Services and website, including individuals seeking mental health support, therapists, psychologists, corporate clients, and healthcare partners. It governs the collection and use of personal data both online (through our website and mobile applications) and offline (via phone, email, or in-person interactions). Any updates to this policy will be published on our platform and website. 2. Information We Collect 2.1. We collect personal and sensitive data to provide an enhanced, secure, and personalized experience. The data we collect includes contact information (name, email, phone number), account credentials, demographic details (age, gender, profession), and payment information for paid services. As a mental health platform, we also collect health-related data such as therapy session records, mental health assessments, case notes from therapists, and any self-reported health conditions. Additionally, we automatically collect device and browser details, IP address, location data, and website activity logs to improve platform performance and user experience. 2.2. We may collect certain personally identifiable information, including Sensitive Personal Data or Information (SPDI), when you interact with our Services. This data is collected through various means, such as account registration, contact forms, surveys, or direct interactions with us. When you create a user profile, we request only the information that is lawfully necessary to provide and enhance our Services. The data fields that we may request include your name, email address, mobile number, password, gender, age, professional details, mental health-related information, language preferences, and sexual orientation. 3. Information We Collect Automatically 3.1. When you access and use our Services, we and our third-party service providers use various technologies to automatically collect information related to your usage patterns. This may include: (i) Information such as browser type, referral URLs, pages visited, time spent on the platform, and interaction with various features; (ii) Each device accessing our services is assigned a unique identifier, allowing us to enhance security and optimize user experience; (iii) If you engage with our customer support team, we may record calls for quality assurance and training purposes. 4. Cookies & Similar Technologies 4.1. We and our partners use cookies, web beacons, and similar tracking technologies to collect information about you and your devices. Cookies are small data files stored on your device to enhance your browsing experience and remember your preferences. These technologies help us improve platform functionality, personalize content, and analyze website traffic. There are two types of cookies we may use: (i) Temporary cookies that expire when you close your browser; (ii) These remain on your device until manually deleted or until they reach their expiration period. You have control over cookie settings through your web browser, where you can choose to enable, disable, or delete cookies. However, disabling cookies may affect the functionality of certain features on our platform. 5. Information from Other Sources 5.1. We may receive or proactively collect additional information about you from third-party sources, including business partners, social media platforms, marketing affiliates, or publicly available records. This information may be integrated with the data we collect directly from you to improve service delivery, enhance personalization, and facilitate communication between users and service providers. In cases where a third party seeks to engage with you through our website or services, we may process relevant information in accordance with this Privacy Policy. 6. Third-Party Links & Referrals 6.1. Our website and Services may contain links to external websites, applications, or services operated by third parties. While we strive to provide only reputable links, we do not control or endorse the privacy practices of these third parties. Users are encouraged to review the privacy policies of external websites before sharing personal data. We assume no responsibility for the content, data handling practices, or security of any third-party platforms accessed through our website. Third-party cookies, which may be used by external advertisers or analytics providers, are not covered under our Privacy Policy, and we encourage users to review third-party policies separately. 7. Information Collected Through Our Mobile Application 7.1. If you use our mobile application, we may collect additional technical data to enhance functionality, including but not limited to: (i) Manufacturer, model, operating system, mobile browser type; (ii) We may access location services (with your permission) to personalize service delivery; (iii) Frequency of app use, time spent on various sections, navigation patterns; (iv) Systems and software data to facilitate software updates, improve security, and provide customer support. Additionally, upon receiving explicit device permissions, we may access SMS or text messages for purposes such as: (i) Issuing and receiving one-time passwords (OTPs) for account verification; (ii) Auto-filling verification details during financial transactions (where applicable and permitted by law). We do not share or transfer SMS/text message data to any third party except as stated in this Privacy Policy. 8. How We Use Your Data 8.1. Our primary goal in collecting your information is to enhance your experience with our Services. We use your Sensitive Personal Data or Information to match you with the most suitable mental health professional. With your explicit consent, your mental health-related data is shared with the assigned counsellor to ensure that they can provide personalized and effective care. 8.2. Your data is processed for various purposes, including providing mental health services, securely storing session data, processing payments, improving platform functionality, sending appointment reminders, and complying with legal obligations. We may also use your information to send promotional messages and personalized recommendations. However, you have the right to opt out of marketing communications at any time. Our AI-driven chatbot provides assistance but does not replace clinical diagnoses. Any use of AI in decision-making is transparently disclosed to users. We do not sell your personal data. However, we may share it with therapists, healthcare providers, payment processors, regulatory authorities, and trusted third-party service providers for necessary platform operations. When shared, we ensure strict confidentiality and implement data protection measures such as anonymization where possible. 8.3. We use your email and mobile number to send reminders about upcoming therapy sessions, updates related to your account, and, where applicable, for marketing and promotional communications. You have the option to opt out of such communications at any time. Your Internet Protocol (IP) address is collected to help diagnose technical issues, administer our website, and improve platform security. However, your IP address does not contain any personally identifiable information. Occasionally, we may send you service-related notifications, such as maintenance alerts or temporary service disruptions. These are essential updates that you may not opt out of, as they are critical for service continuity. 8.4. All collected data, including Sensitive Personal Data, usage information, and other details related to your access and interaction with our services, may be retained for as long as necessary to fulfil operational, legal, regulatory, and evidentiary requirements. This includes compliance with statutory obligations, tax regulations, legal disputes, and other legitimate business interests. 8.5. To optimize user experience, we may use cookies, log files, device identifiers, location data, and tracking technologies to remember user preferences, personalize content, analyze site performance, monitor website traffic, and improve overall functionality. This may also extend to targeted advertising, where anonymized browsing data, such as the pages you visit or searches you perform, is used to curate relevant advertisements on external websites. However, this data remains anonymized and cannot be linked back to you personally, as no identifiable details such as name, address, or payment information are included. 8.6. We utilize third-party analytics tools to track and measure website traffic, feature usage, and engagement trends. These tools collect aggregated, non-sensitive information, such as web pages visited and device interactions, which help us refine and enhance our services. Data collected through such means is anonymized and cannot be used to identify any specific individual. 8.7. By using our Services, you consent to the collection of such information, including contact details (name, email, phone number), demographic data (gender, date of birth, location), and any additional details voluntarily shared through emails, inquiries, or other interactions with us. 8.8. Additionally, we reserve the right to use the collected data for purposes such as: (i) Publishing anonymized data on our website for research and awareness purposes; (ii) Communicating with you about new services, offers, and features that may be of interest; (iii) Conducting user feedback surveys to improve our platform and offerings; (iv) Analyzing anonymized practice data for business and commercial insights. 8.9. The information we collect may fall under ‘Personal Information’ or ‘Sensitive Personal Data or Information’ as defined under applicable data protection regulations. Personal Information refers to any details that can directly or indirectly identify an individual when combined with other available data. Sensitive Personal Data or Information may include, passwords, financial information, such as bank accounts, credit/debit card details, or payment data, physical, physiological, and mental health conditions, sexual orientation, medical records and history, biometric data. We may collect, use, and disclose publicly available information without requiring user consent. However, we remain committed to protecting your privacy and ensuring that any personal or sensitive data is processed in compliance with applicable laws and regulations. 9. Privacy Statement 9.1. If you wish to discontinue the use of your personal information for our Services, you may request deletion by contacting us at care@souloxy.com. We will retain your information only for as long as necessary to fulfil the lawful purposes for which it was collected or as required by applicable laws and regulations. If you would like to opt out of receiving non-essential communications, such as promotional messages or marketing updates, you can do so by emailing us at care@souloxy.com. 9.2. As part of standard internet communication protocols, when you access our website, we automatically receive certain technical information such as the URL of the site you visited before ours, your IP address, device details, browser type, operating system, and Internet Service Provider (ISP) information. This data helps us analyze trends, improve security, and enhance our platform's performance. However, we do not link this data to any personally identifiable information. We may share aggregated, non-personally identifiable insights with advertisers, partners, and investors to support our business growth while maintaining user privacy. 9.3. This Privacy Policy applies exclusively to Souloxy and its Services. We do not control external websites that may appear in search results or as third-party links on our platform. These sites may have their own data collection practices, and we do not assume responsibility for their privacy policies, content, or security measures. Visiting third-party websites linked from our platform is at your own risk, and we encourage you to review their privacy policies before engaging with them. 9.4. Our platform may enable communication between users, such as in forums or interactive features where individuals can share information. Please note that other users, moderators, or administrators engaging in these discussions are not authorized representatives of Souloxy and their opinions do not reflect our views. We disclaim any liability for reliance on or misuse of information shared in public interactions on our platform. 9.5. We do not collect user information from public records, government sources, or private organizations unless explicitly provided by users for registration or account management. We maintain a strict no-spam policy and do not sell, rent, or share your email address with third parties without your consent. 9.6. Souloxy follows industry-standard security protocols to protect your personal data from unauthorized access, misuse, or breaches. While we implement encryption, access controls, and security best practices, we cannot be held responsible for data loss or theft resulting from unauthorized access to your personal devices used to access our Services. Our information security framework includes technical, managerial, operational, and physical safeguards aligned with global data protection standards. Any third-party data processors working with Souloxy must adhere to strict confidentiality measures and comply with our security policies. 9.7. Your information will only be disclosed if legally required by government authorities, regulatory bodies, law enforcement agencies, or to prevent fraud, enforce our policies, or protect rights and safety. In the event of a company reorganization, merger, or asset sale, your data may be transferred to the acquiring entity, which will be bound by this Privacy Policy. Additionally, we may share relevant personal information with third-party contractors engaged in service delivery, customer support, or platform maintenance, ensuring that they comply with strict privacy and security measures. 9.8. By using our Services, you acknowledge and agree to the terms outlined in this Privacy Policy, ensuring that your data is processed lawfully and securely. If you have any concerns regarding privacy, security, or data usage, you can contact us at care@souloxy.com. 10. Visitor Information 10.1.Souloxy does not automatically collect any Sensitive Personal Data or Information from visitors who are merely browsing our website. However, certain provisions of this Privacy Policy apply to all visitors, and by continuing to use the website, you acknowledge and accept these terms. If you do not agree with any aspect of this policy, we advise you to discontinue browsing immediately. If you have navigated through pages on this website before reviewing this Privacy Policy and do not agree with how information is collected, processed, or stored, simply closing your browser should remove temporary cookies. However, we recommend that you manually clear cookies from your browser settings, as we cannot control or predict how individual devices handle stored browsing data. Visitors who voluntarily provide personal information through any means—such as email, website forms, or account registration—are no longer considered visitors but rather Users under this Privacy Policy. In such cases, all provisions applicable to Users, including data collection, usage, and protection practices, will apply. 11. Confidentiality and Security 11.1.Souloxy takes stringent measures to safeguard your personal information, ensuring it is stored securely in electronic format on our systems and, where necessary, on the systems of authorized employees. We implement industry-standard managerial, technical, operational, and physical security controls appropriate to the nature of the data we collect. User information is accessible only to authorized employees, agents, and third-party service providers on a need-to-know basis, and all personnel handling sensitive data are bound by strict confidentiality agreements. 11.2.Despite our best efforts, we cannot be held responsible for any breach of confidentiality, security failures, or unauthorized distribution of personal information caused by external third parties beyond our control, including but not limited to government actions, cyberattacks, hacking incidents, encryption breaches, technical failures, or poor internet and network services. Users are encouraged to adopt additional security measures, such as safeguarding their login credentials and using secure networks when accessing our services. 12. Data Security and Retention 12.1.We take extensive security measures to protect your personal data. All sensitive health information is encrypted during storage and transmission in compliance with HIPAA, GDPR, and DPDP Act standards. Access to your data is strictly restricted to authorized personnel, and we implement security controls to prevent unauthorized access, disclosure, or misuse. We retain personal data only for as long as required to fulfil our Services and legal obligations. Upon request, we allow users to delete or modify their personal data unless retention is mandated by law. 13. Your Rights 13.1.Under applicable data protection laws, you have the right to access, rectify, erase, or restrict the processing of your personal data. You can also request data portability or withdraw consent for data collection and processing. If you wish to exercise any of these rights, you may contact us at care@souloxy.com We will process your request within the legally mandated time frame. 14. International Data Transfers 14.1.As we operate globally, your data may be transferred and stored outside your country of residence. We ensure that any international data transfers comply with GDPR for EU users, DPDP Act for Indian users, and HIPAA for US-based data. Appropriate security measures are in place to protect your data in such transfers. 15. Data Breach Notification 15.1.In the event of a data breach, we will promptly notify affected users and relevant regulatory authorities within the required timeframes, as per GDPR, HIPAA, and DPDP Act guidelines. We will take immediate measures to contain and resolve the breach, ensuring such incidents are prevented in the future. 16. Opt-Out and Contact Preferences 16.1.If you wish to stop receiving non-essential communications, including marketing and promotional messages, you can unsubscribe through the link provided in emails or update your notification preferences in your account settings. For further assistance, you may contact us at care@souloxy.com 17. Children’s and Minors’ Privacy 17.1.Souloxy is committed to protecting the privacy of minors and strongly advises parents and guardians to supervise their children's online activities. Our website and Services are not intended for use by individuals under the age of 18. However, if a minor inadvertently accesses our platform, we encourage parents to contact us immediately to address any concerns regarding the data collected. 18. Consent to This Policy 18.1.By using the Souloxy platform, you acknowledge that this Privacy Policy is an integral part of our Terms of Use and that your continued use of our website and Services signifies your unconditional agreement to the collection, processing, and disclosure of your personal information as outlined in this policy. Your visit to our website and engagement with our Services are subject to these terms. 19. Changes to the Privacy Policy 19.1.Souloxy reserves the right to update or modify this Privacy Policy at any time, with or without prior notice. If significant changes are made regarding how we handle personally identifiable information, we will notify users through our website or other appropriate communication channels. Continued use of our Services after any updates constitutes acceptance of the revised terms. If you disagree with any modifications, you may contact us at data-privacy@souloxy.com for further clarification or to request account deletion. 20. Managing Your Information and Account 20.1.You are responsible for ensuring the accuracy of the personal information you provide, including your contact details and Sensitive Personal Data or Information submitted during account registration. If there are any changes to your information, or if you no longer wish to use our Services, you may update, correct, or delete inaccuracies by modifying your user profile or by contacting us through the email address provided on our website or our application. We will make reasonable efforts to process such requests promptly and update our active databases accordingly. If the modifications made to your personal data result in insufficient or inaccurate information that prevents us from effectively providing our Services, we reserve the right to restrict or terminate your access by sending written notice to your registered email address. Should you wish to delete your account or request that we no longer retain your personal data, you may contact us using the details provided on our website or application. However, even after account termination, we may retain your information and usage data as required to comply with legal obligations, resolve disputes, complete any outstanding service-related matters, prevent fraud, and enforce our agreements. Over time, this data may be anonymized and aggregated, and any retained information will be used solely for research and analytical purposes without personally identifying you. You also have the right to request the deletion of your personal data, subject to certain legal exceptions. Upon receiving a deletion request via care@souloxy.com, and after verification, we will proceed to delete your data from our records and instruct our service providers to do the same, unless retention is required by law or for legitimate business purposes. 21. Contact for Privacy Concerns 21.1.If you have any questions or a grievance about this Privacy Policy, our data collection and usage practices, or any concerns regarding how your information is handled, you may contact our Grievance Officer at data-privacy@souloxy.com. We will make every effort to address your queries promptly and will work toward an appropriate resolution.