Privacy Policy

1. Purpose and Scope

This Privacy Policy explains how [Organization/School Name] ("we," "us," "our") collects, uses, stores, shares, and protects personal and emotional well-being information of students who participate in our emotional well-being, counseling, or mental health support programs ("the Program").

This policy applies to all students enrolled in the Schools, their respective parents/guardians, and staff who administer or support the Program.

2. Information We Collect

3. How We Use This Information

4. Legal Basis and Consent

For students under the applicable age of consent, we obtain verifiable parental/guardian consent before collecting sensitive emotional or mental health data, except where disclosure is legally mandated (e.g., imminent safety risk).

Older students (per local law, e.g., 13+ or 16+) may be permitted to consent directly for certain confidential counseling interactions, consistent with school policy and jurisdictional requirements.

Consent can be withdrawn at any time by contacting the designated contact, though this may limit our ability to provide certain support services.

5. Confidentiality and Disclosure

Emotional well-being data is treated as highly sensitive and is shared only on a need-to-know basis:

We will never sell student emotional or mental health data, and we do not share it for advertising purposes.

Mandatory disclosure exception: Where a student discloses risk of serious harm to themselves or others, staff are obligated to escalate this information to appropriate personnel/authorities, even without consent, consistent with our duty of care and safeguarding policy.

6. Data Storage and Security

Data is stored on [secure servers / specific platform], with access restricted to authorized personnel via role-based permissions

Data is encrypted in transit and at rest

Physical records (if any) are kept in locked, access-controlled locations

Regular security audits and access logs are maintained

Staff receive training on confidentiality and safeguarding obligations

7. Third-Party Service Providers

8. Data Retention

Emotional well-being records are retained only as long as necessary for the student's support needs and as required by law/school policy (e.g., typically for the duration of enrollment plus [X years])

Records are securely deleted or anonymized after the retention period

Aggregate, de-identified data may be retained longer for program evaluation

9. Consent: under the DPDP Act, anyone under 18 is a "child," so verifiable parental/guardian consent is required regardless of age (no 13+ exception like in the US)

No behavioral tracking/ads: DPDP explicitly bars targeted advertising and tracking of children

Safety disclosures: added POCSO Act mandatory reporting alongside general safeguarding

Legal basis: swapped FERPA/COPPA/GDPR for DPDP Act, IT Rules 2011 (sensitive personal data), POCSO, Juvenile Justice Act, and a placeholder for board/regulator (CBSE, state board, UGC)

Rights & grievance: reframed as DPDP "Data Principal" rights, with a Grievance Officer contact and escalation path to the Data Protection Board of India

Worth flagging: India's DPDP Rules (which fill in operational details like consent-verification methods) are still being finalized, so some specifics may need revisiting once they're notified. This is still a template - have it reviewed by counsel before use.

1. Rights of Students and Parents/Guardians

2. Student Involvement and Age-Appropriate Transparency

We are committed to explaining, in age-appropriate language, what information is collected and why, and to involving students in decisions about their own data where developmentally appropriate.

3. Changes to This Policy

We may update this policy periodically. Material changes will be communicated to parents/guardians and, where appropriate, students, with an updated "Last Updated" date.

4. Contact Information