Privacy Policy

1. Introduction

Dr. Antonio D'Costa ("I," "me," "my," or "the Practice") operates an EMDR (Eye Movement Desensitization and Reprocessing) therapy practice providing teletherapy services to clients in India and internationally. This Privacy Policy explains how I collect, use, store, and protect your personal and health information in accordance with Indian laws, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (DPDPA), and the National Medical Commission Telemedicine Practice Guidelines, 2020.

By booking and using my therapy services, you consent to the practices described in this Privacy Policy.

2. Information I Collect

2.1 Personal Information

When you book a therapy session or communicate with me, I may collect:

• Name, age, and contact details (email address, phone number, WhatsApp number)
• Location and country of residence
• Payment information (collected through third-party payment processors)
• Communication records (emails, messages, call records)

2.2 Health Information

As a healthcare provider, I collect and process sensitive health information necessary for providing EMDR therapy, including:

• Medical history, symptoms, and presenting concerns
• Information about trauma, mental health conditions, and treatment history
• Session recordings (audio and/or video) and transcripts
• Clinical notes, assessments, and treatment plans
• Progress reports and treatment outcomes

2.3 Technical Information

When you visit my website or use my services, the following technical information may be collected:

• IP address (anonymized where possible)
• Browser type, device information, and operating system
• Website usage data through Google Analytics (only if you consent to cookies)
• Video conferencing platform metadata (connection logs, session duration)

3. How I Use Your Information

I use your personal and health information for the following purposes:

3.1 Providing Healthcare Services

• Conducting therapy sessions and providing EMDR treatment
• Creating and maintaining clinical records and treatment documentation
• Communicating with you about appointments, treatment plans, and follow-ups
• Recording sessions for clinical review, note-taking, and treatment continuity (with your explicit consent obtained during booking)

3.2 Administrative Purposes

• Scheduling appointments and managing bookings
• Processing payments through secure third-party payment processors
• Sending appointment reminders and administrative communications
• Responding to your inquiries and providing customer support

3.3 Legal and Professional Obligations

• Complying with Indian medical recordkeeping requirements
• Fulfilling tax and accounting obligations under Indian law
• Responding to legal requests, court orders, or government investigations
• Protecting against fraud, abuse, or illegal activity

4. Session Recording and Consent

Your Consent: By checking the required consent checkbox during the booking process and proceeding with your appointment, you explicitly consent to session recording. If you do not consent to recording, you will not be able to book or attend sessions.

Recording Purpose: Recordings are used solely for:

• Creating clinical notes and transcripts
• Reviewing treatment progress and session content
• Professional supervision and consultation (with your identity protected where possible)
• Ensuring quality and continuity of care

Recording Retention: Session recordings are retained temporarily and deleted once transcribed or when storage space is needed, typically within a period ranging from a few days to a few months. Transcripts and clinical notes are retained separately as part of your permanent clinical record.

5. How Long I Keep Your Information

I retain your personal and health information in accordance with Indian legal and professional requirements:

• Clinical Records (Notes, Transcripts, Treatment Plans): Retained for a minimum of 7 years from the date of last treatment, as required by Indian medical recordkeeping standards and professional best practices
• Session Recordings (Audio/Video): Retained temporarily and deleted once transcribed or when storage space is needed, typically within a few days to a few months
• Payment Records: Retained for 8 years from the end of the relevant financial year for tax and accounting purposes as required by the Income Tax Act, 1961
• Communication Records (Emails, Messages): Clinically relevant communications containing treatment information are documented in the clinical record and retained for 7 years. The original emails/messages may be deleted once documented. Administrative communications (appointment scheduling, reminders) may be deleted at any time.
• Website Analytics Data: Anonymized data retained according to Google Analytics default settings (typically 26 months), only if you consent to cookies

Some records may be retained for longer periods if required for legal, professional, or clinical continuity purposes, or if you request extended retention for your own records.

6. How I Protect Your Information

I take the security of your personal and health information seriously and implement reasonable security measures to protect it from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Using secure, password-protected accounts for storing clinical records and personal data
• Encrypting data where technically feasible (email communications, cloud storage)
• Limiting access to your information to only what is necessary for providing treatment
• Using secure video conferencing platforms with privacy protections
• Regular deletion of temporary data (session recordings) once no longer clinically necessary
• Physical and digital security measures to protect devices and storage locations

Important Limitation: While I implement reasonable security measures, no method of electronic transmission or storage is 100% secure. I cannot guarantee absolute security of your information, especially when using third-party platforms (Google, Zoom, WhatsApp, payment processors). By using my services, you acknowledge and accept these inherent security limitations.

7. Third-Party Services and Data Sharing

To provide therapy services, I use various third-party platforms and services. Your information may be stored or processed by these providers:

7.1 Services I Use

• Video Conferencing: Google Meet, Zoom, WhatsApp (for conducting therapy sessions)
• Appointment Scheduling: DaySchedule (for managing bookings) or direct communication via email, phone, or WhatsApp
• Data Storage: Google Drive, local device storage, or other cloud storage services (for clinical records, recordings, and notes)
• Payment Processing: Razorpay, PayPal, UPI platforms (Paytm, Google Pay, PhonePe), direct bank transfer (for processing payments securely)
• Communication: Email (Microsoft Outlook/Hotmail), WhatsApp, phone calls (for appointment reminders, administrative communication, and occasional sessions)
• Website Analytics: Google Analytics (only if you consent to cookies; used with IP anonymization)

Third-Party Data Processing: These third-party services have their own privacy policies and data practices. When you use my services, your data may be stored on servers operated by these providers, which may be located in India or internationally. I select service providers that implement reasonable security measures, but I am not responsible for their data practices beyond my control.

You can review the privacy policies of these services:

• Google Workspace: https://policies.google.com/privacy
• Zoom: https://www.zoom.com/en/trust/privacy/privacy-statement/
• WhatsApp: https://www.whatsapp.com/legal/privacy-policy
• Razorpay: https://razorpay.com/privacy/
• PayPal: https://www.paypal.com/in/legalhub/privacy-full

7.2 When I May Disclose Your Information

I will only disclose your personal or health information without your consent in the following limited circumstances required or permitted by Indian law:

• Legal Obligations: When required by court order, subpoena, government investigation, or applicable law
• Medical Emergencies: To prevent serious harm to you or others, or in life-threatening situations
• Professional Consultation: With other healthcare providers or clinical supervisors for treatment purposes (with your identity protected where possible)
• Child Protection: When there is reasonable suspicion of child abuse or neglect, as required by Indian law

In all other cases, I will seek your explicit written consent before disclosing your information to third parties.

8. Your Rights Under Indian Law

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian laws, you have the following rights regarding your personal and health information:

• Right to Access: You can request a copy of your clinical records and personal information I hold about you
• Right to Correction: You can request correction of inaccurate or incomplete personal information
• Right to Erasure: You can request deletion of your personal information, subject to legal and professional recordkeeping obligations (clinical records must be retained for 7 years)
• Right to Nominate: You can nominate another person to exercise your data rights on your behalf in case of death or incapacity
• Right to Grievance Redressal: You can file a grievance about data processing practices (see Section 11)

Important Limitation: Your right to erasure does not apply to clinical records that must be retained for 7 years under Indian medical recordkeeping requirements. However, recordings and non-essential communications can be deleted upon request.

To exercise these rights, contact me at support@drantoniodcosta.com or +91-8806965342.

9. International Data Transfers

This practice operates from India. If you are an international client accessing therapy services from outside India, your personal and health information will be transferred to and processed in India and potentially on servers operated by third-party service providers (such as Google, Zoom, WhatsApp) which may be located internationally.

Legal Basis: By using my services as an international client, you explicitly consent to the transfer of your data to India and its processing under Indian law. Your data is protected by Indian data protection laws (DPDPA 2023, IT Act 2000) and the security measures described in this policy.

Your Responsibility: As an international client, you are responsible for ensuring that your use of cross-border telemedicine services complies with the laws and regulations of your country of residence. I am not responsible for compliance with foreign data protection laws (such as GDPR, HIPAA, or others).

10. Cookies and Website Analytics

My website uses cookies and Google Analytics to understand how visitors use the site and improve user experience.

Your Choice: When you visit my website, a cookie consent banner will appear asking for your permission. You can choose to accept or reject cookies. If you reject cookies, no tracking or analytics will occur, and your website visit will remain anonymous.

What Google Analytics Collects: If you consent, Google Analytics collects anonymized information about your visit, including pages viewed, time spent on site, browser type, device type, and anonymized IP address. This data is used solely to improve website content and user experience.

You can manage your cookie preferences at any time using your browser settings or by returning to the website and changing your consent choice.

11. Grievance Redressal

If you have any concerns, complaints, or questions about how your personal or health information is handled, you can contact me directly:

I will acknowledge your grievance within 48 hours and respond with a resolution within 7 business days. If you are not satisfied with my response, you may escalate your complaint to the Data Protection Board of India once it becomes operational under the DPDPA 2023.

12. Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in my practice, legal requirements, or service providers. When I make significant changes, I will:

• Update the "Last Updated" date at the top of this policy
• Notify active clients via email or WhatsApp
• Post a notice on my website for 30 days

Your continued use of my services after changes to this Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with changes, you may discontinue services and request deletion of your information (subject to legal retention requirements).

13. Contact Information

If you have any questions about this Privacy Policy or how your information is handled, please contact me:

Professional Indemnity Insurance: This practice maintains professional indemnity insurance coverage for medical negligence and malpractice claims.