DPDP Notice

Last updated: 27 March 2026

This notice is issued under the Digital Personal Data Protection Act, 2023 ("DPDP Act") to inform Data Principals about how [Company Name Pvt. Ltd.] processes personal data through the SpotKare platform.

1. Data Fiduciary Details

Data Fiduciary: [Company Name Pvt. Ltd.]
Registered Address: Patna, Bihar, India
Contact: hello@spotkare.com

2. Purpose of Processing

We process personal data for the following purposes:

  • Therapy centre management and administration
  • Session recording, attendance tracking, and scheduling
  • Child progress tracking, assessments, and reporting
  • Communication between therapists, centre staff, and parents
  • Billing and subscription management
  • Platform security, audit logging, and compliance

3. Categories of Personal Data

  • Identity data: name, email address, mobile number
  • Professional data: role, centre and branch affiliation
  • Child data: name, date of birth, diagnosis, parent/guardian details
  • Therapy data: session notes, scores, progress observations, goals
  • Usage data: login timestamps, feature usage (aggregated, no PII)

4. Lawful Basis

We process personal data under the following lawful bases as defined by the DPDP Act:

  • Consent: Obtained at the time of account creation and data entry.
  • Legitimate use: Processing necessary for the performance of the service contracted by the therapy centre (Section 7 of the DPDP Act).

5. Data Principal Rights

Under the DPDP Act 2023, every Data Principal has the right to:

  • Right to Access: Obtain a summary of your personal data being processed and the processing activities.
  • Right to Correction: Request correction of inaccurate or misleading personal data.
  • Right to Erasure: Request deletion of personal data that is no longer necessary for the stated purpose.
  • Right to Grievance Redressal: File a complaint with our Grievance Officer if you believe your data is being mishandled.
  • Right to Nominate: Nominate another individual to exercise your rights on your behalf in case of death or incapacity.

6. Consent Mechanism

Consent is obtained through clear, affirmative action at the time of account registration. Users may withdraw consent at any time by contacting us. Withdrawal of consent may affect the ability to use certain features of the Service. Consent requests are presented in clear, plain language as required by the DPDP Act.

7. Children's Data

SpotKare processes children's personal data exclusively for therapy management purposes. In accordance with the DPDP Act, children's data is processed only with verifiable parental or legal guardian consent. Therapy centres using SpotKare are responsible for obtaining and maintaining this consent before entering any child's data. We do not undertake any processing of children's data that could be detrimental to their well-being.

8. Data Retention

  • Active account data: retained for the duration of the subscription
  • Post-termination: Centre Data retained for 90 days for export, then deleted
  • Audit logs: retained for 7 years as per regulatory requirements
  • Anonymised and aggregated data: may be retained indefinitely for service improvement

9. Cross-Border Transfer

SpotKare does not transfer any personal data outside India. All data is stored and processed on servers located in the Mumbai region. No external APIs receive personally identifiable information.

10. Grievance Officer

In accordance with the DPDP Act, we have appointed a Grievance Officer to address your concerns:

Grievance Officer
[Company Name Pvt. Ltd.]
Patna, Bihar, India
Email: hello@spotkare.com

The Grievance Officer will acknowledge your request within 48 hours and resolve it within 30 days.

11. How to Exercise Your Rights

To exercise any of your rights as a Data Principal, send an email to hello@spotkare.com with the subject "DPDP Rights Request". Include your full name, registered email or mobile number, and a description of the right you wish to exercise. We will verify your identity before processing the request.