Privacy Policy

1. Overview, Legal Entity & App Identity

This Privacy Policy explains how CENTRE FOR ADVANCED ACADEMIC STUDIES LLP (operating as “CAAS Wellness” or “CAAS,” “we,” “us,” or “our”) collects, uses, protects, and discloses personal information when you use our web platform (https://www.caaswellness.com) and Android mobile applications.

CAAS Wellness provides secure, professional online counselling and mental wellness support from verified psychologists and healthcare experts. We are committed to maintaining the highest standards of data privacy, user data protection, and strict clinical confidentiality.

2. Information We Collect

We collect the minimum amount of personal and sensitive data necessary to provide a secure, compliant, and effective counselling service. The categories of information collected depend on your role:

3. Health and Counselling Data Safeguards

Because CAAS Wellness is a mental health and wellness platform, all health-related and clinical consultation data is handled with maximum technical and administrative safeguards:

• Encrypted Clinical Session Reports: Following completed consultations, the treating psychologist may record clinical notes, presenting concerns, symptom assessments, and professional recommendations. These reports contain sensitive health data and are encrypted at rest.
• Strict Access Controls: Clinical reports are accessible exclusively by the authoring practitioner and authorized platform system administrators. Patients/students cannot access these raw clinical notes, and reports are NEVER shared with university administrators, employers, parents, or third parties.
• No Audio or Video Recording: Consultation sessions occur via real-time WebRTC streams powered by Agora. CAAS Wellness and Agora do not record, intercept, or store the video or audio content of counselling sessions. Calls exist strictly live in transit.

4. Security of Payments (Razorpay)

Payment credentials are processed directly through Razorpay's payment gateway interfaces.

CAAS Wellness does not collect, process, or store sensitive payment credentials(such as credit/debit card numbers, CVVs, net banking passwords, or UPI PINs). All payment instrument credentials are submitted directly into Razorpay's encrypted checkout interfaces.

We retain only payment transaction status, Razorpay order IDs, payment IDs, transaction signatures, GST invoice references, and refund logs necessary to confirm bookings, execute refunds, and maintain statutory tax accounting records under Indian law.

5. Third-Party Subprocessors & SDKs

We partner with specific third-party service providers solely to provide essential core application features:

• Supabase Auth: Manages authentication identity sessions, password hashing, and OAuth logins (Google Sign-In).
• Agora SDK: Enables encrypted live real-time video and audio consultation streams. Media content is not stored by Agora.
• Razorpay: Handles payment gateway checkout, card/UPI tokenization, payment capture, and refund processing.
• Cloudflare R2 / AWS S3: Hosts static media, psychologist avatars, verification documents, and encrypted clinical records using short-lived, signed access URLs.
• Firebase Cloud Messaging (FCM): Delivers transactional push notifications, session reminders, and booking confirmations to mobile devices.

6. Mobile App Permissions (Google Play)

The CAAS Wellness Android application requests runtime permissions only when strictly required for core functionality:

• CAMERA: Requested during video consultations so your treating practitioner can see you.
• RECORD_AUDIO / MODIFY_AUDIO_SETTINGS: Requested during audio and video calls so you can speak with your practitioner.
• POST_NOTIFICATIONS: Requested to deliver essential session reminders, schedule updates, and appointment alerts.
• BLUETOOTH / BLUETOOTH_CONNECT: Requested to route consultation call audio to connected wireless headphones or headsets.

Permissions are activated solely during active user interactions and are never used for hidden background monitoring or unauthorized data collection.

7. Data Retention & Anonymization

We retain personal data only for as long as your account remains active or as needed to provide our services.

When an account is deleted via in-app or web deletion, personal profile identity attributes (name, email, phone number, OAuth tokens, emergency contacts, demographic details, payout fields) are anonymized or cleared, FCM push notification tokens and daily mood check-in records are deleted, and user-uploaded files are purged from Cloudflare R2 cloud storage. Statutory accounting logs (such as Razorpay GST tax invoices) are retained in an isolated, anonymized archive for up to 7 years as required by Indian tax and financial regulations.

8. Account Deletion & Self-Service Options

In full compliance with Google Play User Data policies and international privacy standards, CAAS Wellness provides direct self-service account and data deletion options:

Initiating account deletion cancels upcoming scheduled consultations, deletes active OAuth & FCM tokens, purges user uploaded cloud files, and anonymizes profile records.

9. Data Security & Encryption

We implement industry-standard technical measures including HTTPS (TLS 1.3) encryption in transit, Fernet (AES-128-CBC with HMAC-SHA256 authentication) database encryption at rest for sensitive practitioner credentials and clinical notes, strict role-based access controls, and short-lived signed storage URLs.

10. Children & Minors Policy

CAAS Wellness services are intended for university students and adult individuals (aged 18 and older). Minors under 18 years of age must use the platform only with the explicit consent and supervision of a parent or legal guardian.

11. Emergency & Medical Disclaimer

Emergency Notice: CAAS Wellness is an online counselling and mental wellness platform for pre-scheduled consultations. CAAS Wellness does NOT provide emergency medical care, psychiatric hospitalization, or crisis intervention services. If you or someone you know is in immediate crisis, experiencing self-harm urges, or facing a medical emergency, please call local emergency services immediately (such as 112 in India) or contact national mental health helplines (such as KIRAN at 1800-599-0019).