Privacy policy

1. Who this policy covers

This policy applies to anyone who uses anxio.in or the Anxio app: people looking for support ("clients"), the licensed mental health professionals we work with ("experts"), and visitors browsing the site. In this policy, "Anxio", "we" and "us" refer to the team operating the platform. You can reach us using the contact details in section 13.

2. What we collect

We collect only what each part of the service needs to function.

• Account data. Name, email, phone number, and password (stored as a salted hash, never in plain text).
• Intake responses. What you tell us about what you're facing, so we can match you with a suitable expert. This is the most sensitive data we hold and is treated accordingly — see section 5.
• Session data. Booking times, session status, and — only if your expert chooses to keep them and you're informed of this — clinical notes made by your expert. Anxio does not record or store audio, video or chat content from sessions themselves.
• Payment data. Anxio never sees or stores your card, UPI or bank details. These go directly to Razorpay, our payment processor. We keep a record of the transaction amount, status and timestamp, not your instrument details.
• Device and usage data. Aggregate, non-identifying analytics — pages viewed, approximate load times, browser type — to keep the site working and fast. We do not run cross-site ad tracking.
• Expert verification data. For experts: licence numbers, qualifications and identity documents, used solely to verify credentials before anyone is listed.

3. Why we collect it

Each category above is collected for one of these purposes, and no other:

• To create and secure your account, and to verify who you are.
• To match you with an expert suited to what you've described.
• To schedule, hold and pay for sessions, and to issue receipts.
• To verify that experts listed on Anxio are licensed to practise.
• To respond when you contact us, and to meet legal and tax obligations.
• To detect and respond to safety risk during intake — see "The crisis path" in section 5.

We do not sell personal data. We do not use intake or clinical content to train AI models, ours or anyone else's, and we do not share it with advertisers.

4. How AI matching works with your data

The current guided home-page flow keeps your responses in your browser tab; it does not submit them for AI matching. Where server-based matching is enabled, your submitted intake text is sent to Sarvam AI to help identify relevant areas of support. We do not add account contact details or payment history to that request, but anything you include in the text itself may be sent. Please avoid including names, phone numbers or other identifying details in your description. Automated suggestions are not a diagnosis or a guarantee of suitability.

5. Sensitive personal data and the crisis path

Intake text and any clinical notes contain particularly sensitive personal information. We limit who can access them to: the expert you are matched with, and Anxio staff only where access is necessary (for example, a safety review) — every such access is logged with who, when and why.

If what you share at intake indicates you may be at risk, our system is designed to route you to crisis helpline information instead of a paid booking flow, and that trigger is recorded for review by a clinical lead so we can improve how we respond. This check runs whether or not you are logged in, and works without JavaScript.

6. Who we share data with

We share the minimum necessary with the processors that run the service, all bound by contract to use your data only to provide that service to us:

• Supabase (Mumbai region) — database, authentication and file storage.
• Razorpay — payment processing for session bookings.
• Resend — transactional email, such as booking confirmations and OTPs.
• Sarvam AI — processes intake text server-side to support expert matching.

We disclose personal data to courts, regulators or law enforcement only where legally required, and we will tell you unless we are legally prohibited from doing so.

7. Where and how data is stored

Your data is stored on infrastructure in the Mumbai (ap-south-1) region. It is encrypted in transit (HTTPS) and at rest. Access within Anxio is role-based: client sessions and admin sessions run on separate credentials, and a client login can never satisfy an admin check.

8. How long we keep it

• Account and booking data — kept while your account is active, and for as long afterward as tax and accounting law requires.
• Intake responses and clinical notes — kept for as long as needed to support your ongoing care and any legal retention duty on the expert who holds them, then deleted.
• Payment records — retained per Indian financial record-keeping requirements, held by Razorpay and Anxio's transaction ledger.
• If you delete your account, we erase personal data associated with it except where we are required by law to retain specific records, in which case we retain only that record and nothing more.

9. Privacy requests and your rights

You can contact us with a privacy request now. The DPDP Act has a phased commencement; its core processing obligations and individual-rights provisions are scheduled to take effect in May 2027. As applicable, these provisions include the ability to:

• Obtain a summary of personal data being processed, the processing activities, and information about relevant data sharing, subject to statutory exceptions.
• Correct or update inaccurate or incomplete data.
• Withdraw consent for processing that relies on it, at any time.
• Request erasure of your personal data, subject to our legal retention obligations above.
• Nominate another individual to exercise these rights in the event of your death or incapacity.
• Seek grievance redressal from us and, after exhausting that process, complain to the Data Protection Board of India when the relevant provisions apply.

To exercise any of these rights, contact us. We may need to verify your identity before handling a request. Applicable legal requirements and retention duties may limit what can be deleted or disclosed.

10. Cookies and browser storage

We use essential cookies to keep you signed in and remember your session. The guided home-page flow also stores your concern, name, email and progress in your browser's session storage so it can resume after a refresh. It does not store your password there. You can remove this saved information by resetting the flow or clearing the site's browser data. We do not use third-party advertising or cross-site tracking cookies.

11. Children

Anxio is intended for adults aged 18 and over. We do not currently support child accounts or bookings managed by a guardian. If you believe a child has submitted personal data, please contact us so we can review it and arrange deletion where appropriate.

12. Changes to this policy

If we make a material change to how we handle your data, we will notify you by email and update the date at the top of this page before the change takes effect.

13. Contact us

For privacy questions, requests or complaints, contact our support team at helplineanxioofficial@gmail.com, or use the contact page.