Privacy Policy

1. What Sleepy Orange Is

Sleepy Orange is a companion app to Gatekeeper, operated by The Zen India Therapeutics Private Limited (CIN U62013DL2024PTC429803) ("The Zen India," "Company," "we," "us," "our"). Most Users arrive because their mental health professional ("Expert") has an existing relationship with them through Gatekeeper, our practice-management platform for Experts. Sleepy Orange extends that relationship between sessions — delivering your care plan, supporting private self-tracking and reflection, and providing psychoeducation and crisis resources. Sleepy Orange is not a marketplace and not a messaging or chat platform: it does not currently offer in-app messaging with your Expert, or any social or community features.

2. The Core Promise: What We Share With Your Expert

3. Definitions

• "Personal Data" — any data about an identifiable individual, per the Digital Personal Data Protection Act, 2023 ("DPDPA") and DPDP Rules, 2025.
• "Data Fiduciary" — us, for the personal data described in this Policy. "Data Principal" — you.
• "Expert" — an independent mental health professional who manages their practice on Gatekeeper.
• "Care Plan" — tasks your Expert assigns you in Gatekeeper, which appear in Sleepy Orange for you to complete.

4. Who Uses Sleepy Orange

Sleepy Orange is available to adult Users (18 and older) only.

• MHP-linked Users: you have an existing relationship with an Expert who uses Gatekeeper. Your name and email are pre-provisioned from your clinical record in Gatekeeper; you verify your identity with a one-time code sent to your email, and set a password for subsequent logins.
• Self-serve Users: you sign up directly with your email, without a linked Expert, verify that email with a one-time code, set a password, and complete a short intake framed as personalisation — presenting concerns, goals, and an optional brief screener. This intake is not a clinical assessment and is not used to generate a diagnosis.
• If your therapy relationship with a linked Expert ends, your account becomes dormant for care-plan purposes: you keep your historical data, trackers, and library access, but lose the live care plan.
• If you signed up self-serve and later connect with an Expert, your existing data merges into the linked account — it is not reset or lost.

5. Information We Collect and What We Share With Your Expert

Mood, journal, and tracker data are not given a separate "sensitive personal data" category under the DPDPA the way GDPR treats health data, but we treat this information with the same elevated care regardless — encryption, restricted access, and no default sharing, described further in Section 12.

If you attach a photo to a Gratitude Jar entry, Sleepy Orange requests camera or photo-library permission at that point, not before — you can decline and still use every other journalling feature. Photos are stored with the same access restrictions as the rest of your journal (private to you, encrypted in transit and at rest) and are deleted when you delete the entry.

6. How We Use Your Information

• Provision your account, whether MHP-linked or self-serve, and verify your identity by OTP.
• Display your care plan and record task completion for your Expert to see, per Section 2.
• Power the mood check-in, tracker, and journalling features for your private use.
• Recommend psychoeducational content from the Library.
• Provide the crisis affordance available on every screen.
• Process payments and maintain your invoice/payment history.
• Operate app lock (PIN/biometric) settings you choose to enable.
• Maintain security, debug issues, and improve the product.
• Comply with legal and regulatory obligations.

7. Consent

We collect consent per-purpose — free, specific, informed, unconditional, and unambiguous, in line with the DPDPA — rather than a single blanket acceptance, and we keep granular, purpose-wise consent records (a consent log) rather than inferring consent from continued use. You can withdraw consent for a given purpose at any time in-app; this may limit the features that depend on it.

8. How We Share Your Information

We do not sell your personal data. Beyond the Expert-sharing described in Section 2, we share it only as follows:

8.1 Service providers

Hostinger, Zoho, and Razorpay are confirmed third-party processors. Analytics and support-desk functions are handled in-house rather than through an external vendor. Backups run on Google Cloud Platform; we'll confirm and record the specific GCP region here before launch, and execute a Data Processing Agreement with each external processor. We do not use WhatsApp or SMS messaging for Sleepy Orange — all account verification and notifications are sent by email.

8.2 Legal and corporate

• Regulators, courts, or law enforcement where legally required.
• In connection with a merger, financing, or asset sale, subject to continued protection under this Policy or a comparable one.

9. Cross-Border Data Transfers

The DPDPA uses a blacklist model: transfers outside India are permitted except to countries the Central Government specifically restricts by notification. Where a service provider (Section 8.1) is located outside India, that transfer is lawful under this model unless such a restriction applies; we'll flag it plainly here once vendors are confirmed rather than leaving it implicit.

10. Regulatory Context

• Mental Healthcare Act, 2017: given the clinical context of your relationship with your Expert, we apply the confidentiality expectations of Section 23 of the Act to how we handle your data, even though the Expert — not Sleepy Orange — is the one bound by it directly as your treating professional.
• ABDM/DISHA: Sleepy Orange does not integrate with India's Ayushman Bharat Digital Mission or fall under the DISHA framework yet. If that changes in the future, this Policy will be updated to reflect the additional compliance layer that would introduce.

11. Data Retention

We keep your account data and care-plan/clinical-adjacent data for 5 years from the date your account becomes inactive or is closed, after which it is deleted or irreversibly anonymized, except where a longer period is required by law or by your Expert's own professional record-keeping obligations. Two things are worth stating plainly rather than glossing over: first, the DPDP Rules, 2025 set a one-year minimum retention floor for certain logs, which can sit in tension with an erasure request — where that applies, we pseudonymise rather than fully delete the underlying log data, so an erasure request removes your data from active use without necessarily purging every backend log instantly. Second, the 5-year figure is a single default applied across account and care-plan data for simplicity; [CONFIRM with your Experts whether any category of clinical-adjacent data needs a longer period to match their own professional record-keeping obligations before this is finalized].

12. Data Security

• Encryption in transit and at rest (AES-256), with access to mood, journal, and tracker data restricted to you — not visible to your Expert or Company staff outside standard operational access (support, security investigations).
• App lock (PIN or biometric) is a device-level convenience feature you can enable; it protects against casual access to your device, not a guarantee against all forms of compromise, and should be described to users as such rather than as an absolute security promise.
• We will notify you and the Data Protection Board of India of any breach affecting your data without undue delay, in plain language describing the nature and extent of the breach, its likely consequences, and the mitigation steps we're taking. (Separately, we report qualifying breaches to the Data Protection Board within 72 hours — an internal process commitment, not itself a promise to you, but the two should be consistent.)

13. Your Rights

• Access a summary of your personal data and our processing of it.
• Correction and updating of your personal data.
• Erasure of personal data no longer necessary for its purpose, subject to the retention nuances in Section 11.
• Grievance redressal through our Grievance Officer (Section 16). We commit to a response window well under the DPDP Rules' 90-day outer limit: acknowledgment within 7 days, substantive response within 30 days.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity — a right worth surfacing clearly given the mental-health context.
• Withdraw consent for a given purpose at any time, as easily as it was given.

14. Crisis Resources

A crisis-resource access point is available on every screen of Sleepy Orange. Sleepy Orange is not an emergency service — if you are in crisis or having thoughts of harming yourself or others, contact your local emergency number or a crisis helpline such as Tele-MANAS (1-800-891-4416, India) directly. Interactions with the crisis-resource access point are not logged, and are never visible to your Expert.

15. Items Still Pending Before This Policy Is Fully Final

16. Grievance Officer

Grievance Officer / Privacy Contact: Somil Garg

Email: admin@thezenindia.in

Correspondence address: 565, Kasturba Gandhi Marg, Niti Khand-1, Indirapuram, Uttar Pradesh 201014, India

Registered office: P.No. 934, KH N-115, Gali-1, Mala Devi School Marg, Shahdara, Delhi, India 110032

If unsatisfied with our response, you may escalate to the Data Protection Board of India once operational.

17. Contact Us

Email: connect@thezenindia.in

Phone: (India) +91 98992 99775, (US) +1 347 879 5210

18. Changes to This Policy

We'll notify you in-app or by email of material changes before they take effect. Continued use after that constitutes acceptance.