How we handle your information.

01 Who we are.

Higher Power Foundation (“the Foundation”, “HPF”, “we”, “us”, “our”) operates from 119, Karimkuttical · 6A Cross · Bensathya Enclave · Kalyan Nagar · Bengaluru — 560043. For the purposes of the Digital Personal Data Protection Act, 2023, the Foundation is the Data Fiduciary in respect of the personal data described in this policy.

02 The shortest version.

We collect personal data from three sources. The website (analytics and the contact form). The clinic (the intake forms, the session record, the family contact file). The family (photographs and the approved-contact list). We use it to run the programme — and for nothing else. We do not sell it, we do not share it for advertising, and we do not transfer it outside India.

03 What we collect.

Website. Device data (browser, operating system, IP address). Aggregated analytics. Anything you submit via the contact form — name, phone, email, the substance of what you wrote.
Clinical. Intake forms under the Mental Healthcare Act, 2017 — including substance use history, family medical history, psychiatric assessment, medication, session notes. Photographs only as object-focused contextual images (never patient-identifying).
Family. Name and contact details of the nominated family representative. The approved-visit list. The Family Communication Log dispatches.
Payment. Identifying details required for invoicing and statutory compliance.

04 Why we collect it.

Clinical care under the Mental Healthcare Act, 2017.
Statutory record-keeping under the Mental Healthcare (Rights of Persons with Mental Illness) Rules, 2018.
Communication with the nominated family contact.
Site analytics to improve navigation and content.
Legal obligations — tax, audit, court orders, and statutory authority requests where applicable.

05 Lawful basis under the DPDP Act, 2023.

We process personal data on two grounds:

Consent. Taken in writing at intake and re-taken at discharge.
Specified Legitimate Use. Where the law (the MHCA 2017, a court order, a statutory authority request) requires processing without separate explicit consent.

Consent can be withdrawn at any time by writing to the Grievance Officer. Withdrawal does not affect processing that has already taken place, nor does it extinguish our statutory retention obligations.

06 How long we keep it.

Clinical records. Ten years from the date of discharge.
Website analytics. Thirteen months in aggregated form.
Contact form submissions. Twelve months from response, then deleted.
Family Communication Log. Retained for the duration of the patient's clinical record.

07 Who we share it with.

Visiting clinicians and external laboratories on a need-to-know basis.
Statutory authorities where the MHCA 2017, the IT Act 2000, the DPDP Act 2023, or a court order requires disclosure.
Payment processors — the entity name and amount only.
Insurance providers, where the patient has authorised disclosure in writing.

We do not share personal data with marketers, advertisers, or research bodies without separate written consent.

08 Cross-border transfer.

We do not transfer personal data outside India. Our hosting infrastructure is in India.

Communication via WhatsApp Business is governed by WhatsApp's own privacy terms. We flag this here so you can consider it when receiving the Saturday family update. If you prefer not to receive updates via WhatsApp, an alternative channel (email, telephone) will be arranged on request.

09 Security.

We follow Reasonable Security Practices and Procedures per Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — physical, technical, and administrative safeguards, including access control, encryption at rest and in transit where applicable, and confidentiality covenants for every member of staff.

10 Your rights under the DPDP Act.

As a Data Principal, you have the right to:

Access the personal data we hold about you.
Correct or update inaccurate data.
Erase data, subject to our statutory clinical retention obligations.
Withdraw consent.
Nominate another person to exercise these rights in the event of your death or incapacity.
Have a grievance addressed by our designated Grievance Officer.

To exercise any of these rights, write to the Grievance Officer at the address below.

11 Grievance Officer.

Under section 8(10) of the DPDP Act, 2023, the Foundation has designated:

Aruna daCosta · Foundation Administrator

+91 98805 11880

aruna@higherpowerfoundation.org

We acknowledge a grievance within seven working days of receipt and respond within thirty working days with the outcome.

12 Children.

The DPDP Act, 2023 requires verifiable parental consent for processing the personal data of children under eighteen. We do not knowingly collect personal data of children through the website. Where a patient under eighteen is admitted to the programme, consent is taken from the parent or guardian per the Act.

13 Persons with disability.

Where the patient has a disability that affects their capacity to provide consent, consent is taken from the lawful guardian in accordance with section 9(3) of the DPDP Act, 2023, and the Mental Healthcare Act, 2017.

14 Cookies and similar.

The website uses essential cookies (session, security) and may use aggregated analytics cookies (for example, Google Analytics, configured with IP anonymisation). The website does not use advertising cookies, tracking pixels, or social media trackers. You may refuse non-essential cookies via your browser settings; this will not affect access to the site.

15 Changes to this policy.

We review this policy on a quarterly cadence and on every material change in law. The current edition number is stated in the website footer. Material changes are notified by email to active patient contacts and by an in-page notice on the website for thirty days following the change.

16 Contact.

For any question about how we handle personal data, contact Aruna daCosta on +91 98805 11880 or aruna@higherpowerfoundation.org.