Privacy Policy & Data Notice
Relicus Psychology LLP is dedicated to safeguarding your personal and clinical mental health data with uncompromising transparency and legal compliance.
Effective & Last Updated: October 2026
1. Scope & Legal Framework
This Privacy Policy applies to Relicus Psychology LLP (operating under the brand name Relicus Psychological Services, hereinafter referred to as 'Relicus', 'we', 'our', or 'us').
We process your personal and sensitive data in strict accordance with Indian legislation, including the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and the Consumer Protection (E-Commerce) Rules, 2020.
As a Data Fiduciary under the DPDP Act 2023, we are committed to processing your personal data lawfully, transparently, and solely for specified, lawful healthcare, assessment, and consultation purposes.
2. Statutory Notice to Data Principals (Section 5, DPDP Act)
Before or at the time of collecting your personal data, Relicus provides this notice informing you of:
The precise categories of personal data being collected.
The specific purpose for which your personal data will be processed.
The manner in which you may exercise your Data Principal rights (including withdrawal of consent, data correction, and data erasure).
The contact details of our Grievance Officer and the mechanism to lodge a complaint with the Data Protection Board of India (DPBI).
3. Affirmative Consent Architecture (Section 6, DPDP Act)
No Bundled or Implied Consent: Consent on Relicus is always free, specific, informed, unconditional, and unambiguous with clear affirmative action (such as an unchecked opt-in checkbox). We do not bundle consent into acceptance of terms.
Ease of Withdrawal: You have the statutory right to withdraw your consent at any time as easily as it was granted. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
To withdraw your consent, you may contact our Grievance Officer at connect@relicus.in or grievance@relicus.in.
4. Processing of Children's Personal Data (Section 9, DPDP Act)
A Child is legally defined under the DPDP Act 2023 as any individual who has not completed eighteen (18) years of age.
Relicus requires verifiable consent from a parent or lawful guardian before processing any personal data of a minor or delivering psychological consultation to a minor.
Relicus strictly complies with the statutory prohibition under Section 9(2) and Section 9(3) of the DPDP Act: we DO NOT undertake tracking, behavioral monitoring, or targeted advertising directed at children.
5. Categories of Personal Data We Collect
Identity & Contact Data: Name, email address, WhatsApp/mobile number, age, gender, and emergency contact details.
Health & Psychological Data: Clinical notes, self-assessment test submissions, reason for seeking therapy, and session history (treated as sensitive personal data with heightened encryption).
Payment & Transaction Data: Razorpay order ID, payment receipt token, fee amounts, and transaction status. We do not store raw credit/debit card numbers or UPI PINs on our servers.
Technical & Device Data: Pseudonymized IP address, browser type, operating system, and analytical cookies (only upon consent).
6. Purpose Limitation & Data Minimization
We strictly abide by the principle of data minimization—collecting only what is strictly necessary to:
Facilitate scheduled appointments with qualified mental health professionals.
Maintain confidential clinical continuity and treatment records.
Send automated appointment confirmations, reminders, and video links via secure transactional channels (Twilio WhatsApp / SMTP Email).
Process digital payments securely via RBI-authorized payment gateways.
Meet statutory medical record-keeping and tax compliance requirements under Indian law.
7. Authorized Third-Party Data Processors
We never sell, rent, or trade your personal data. Data is shared strictly on a need-to-know basis under formal Data Processing Agreements with verified technical sub-processors:
Payment Gateway: Razorpay Software Pvt. Ltd. (PCI-DSS compliant payment processing).
Cloud Storage & Database: MongoDB Atlas (AWS Mumbai Region) for encrypted database storage.
Transactional Notifications: Twilio Inc. (WhatsApp/SMS) and Hostinger (SMTP emails).
Media CDN: Cloudinary Inc. (secure practitioner verification documents).
AI Wellness Assistant: OpenAI Inc. / Groq Inc. (temporary conversational wellness assistance; conversations are stripped of identifying card numbers and passwords).
Usability Analytics: Microsoft Clarity & Google Analytics 4 (only activated upon affirmative cookie consent).
8. Data Security & Technical Safeguards
Relicus enforces industry-leading security practices:
Encryption: End-to-end TLS 1.3 encryption in transit and AES-256 encryption at rest for sensitive clinical records.
Access Controls: Role-based access control (RBAC), multi-factor admin authentication, and automated audit logging.
Defense-in-Depth: Strict Content Security Policies (CSP), HTTP-only cookies, Rate Limiting (Upstash Redis), and Cross-Origin Resource Sharing (CORS) enforcement.
9. Data Retention & Erasure Schedule
Personal information is retained only as long as necessary to fulfill the healthcare and administrative purposes for which it was collected.
Clinical consultation records are retained in compliance with clinical guidance and medical council standards (typically 7 years), after which they are securely purged or anonymized.
When you exercise your Right to Erasure, we securely delete non-statutory records within thirty (30) days.
10. Your Statutory Rights Under the DPDP Act
As a Data Principal, you are entitled to exercise the following legal rights:
Right to Access Information: Request a summary of your personal data being processed and the identities of all third parties with whom it has been shared.
Right to Correction & Erasure: Correct inaccurate data, complete incomplete details, or request erasure of your data.
Right of Grievance Redressal: Access our expedited grievance redressal mechanism for any privacy or data handling concerns.
Right to Nominate: Nominate any individual who shall, in the event of death or incapacity, exercise your data rights.
To exercise any of these rights, email: grievance@relicus.in.
11. Grievance Redressal Officer & Statutory Redressal
In accordance with Section 8(10) of the DPDP Act 2023 and the Consumer Protection (E-Commerce) Rules 2020, Relicus has designated a Grievance Officer:
Legal Entity: Relicus Psychology LLP
Designation: Data Protection & Grievance Officer
Turnaround Commitment: Acknowledgment within forty-eight (48) hours; final resolution within thirty (30) days.
Right to Escalate: If your grievance is not resolved satisfactorily by our Grievance Officer, you have the statutory right under the DPDP Act to file a complaint before the Data Protection Board of India (DPBI).