1. How we think about your privacy
Looking for mental health support is personal. We collect only what we need to help you find a counselor and manage your sessions, we explain why we ask for each detail, and we never sell your information.
2. What we collect
We collect the account and booking details you provide, such as your name, email, mobile number and, during customer account setup, date of birth. Guest bookings use the contact details you enter and an adult-age confirmation, without collecting a date of birth. We keep your booking timezone to show session dates and times and prepare notifications. The public matching quiz uses preferences such as concerns, language, budget and session format to suggest counselors. Anonymous quiz answers are not saved to a profile; signed-in customers can save and update their answers. Daily check-ins about how you are feeling stay private to you; counselors never see them.
You can log how you feel and write journal notes. A check-in stores your mood and, if you choose, a short note, the feelings you pick, what is around you and your energy. These are health-related information. They are private to you: counselors and clinics cannot see them, and Leshya staff never read your journal notes. We use them only to show them back to you.
For payments, we keep the booking amount, payment status, and a payment reference so your booking and any refund can be traced. When you use a discount code we keep your email address, in a normalized form, with the code use, so a code can be used only as many times as the code allows for each email address (once by default). Payments are collected by Leshya and processed by our payment partner Razorpay; we never see or store your card, bank, or UPI credentials. Counselors additionally share professional details for review, such as qualifications, registration numbers, and withdrawal account details. Like most services, we also collect basic device and usage information to keep Leshya secure and to understand what to improve.
Counselors upload photos or PDFs of their qualifications for document review. These files are stored privately in Supabase and are available to the counselor and authorised Leshya reviewers. For a counselor at a clinic, the clinic's admins can also see them so they can review that counselor. They do not appear on public profiles. We retain document versions and review history so a reviewed file cannot be silently replaced. After verification, a counselor can ask to edit or remove a qualification, with any new file, from their profile; the reviewer decides, and the verified entry stays as it is until then. A replaced or removed entry and its files are kept with the review history and are not shown publicly.
Counselors can keep encrypted session notes and photos for a booking. Only the counselor who wrote them can read them. Clients, clinics and other counselors cannot, and notes never appear in Leshya's admin screens, emails, notifications, analytics or exports.
When someone buys or receives a gift card, we keep the buyer name and email, recipient name and email, gift message if provided, card code, balance, expiry, payment status, and redemption history so the card can be delivered and its balance tracked. Anyone with the code can redeem it, not only the named recipient.
For counselor and clinic plans, we keep the selected plan, payment and refund references, coupons, benefits, grant and expiry dates, and review decisions needed to manage access and billing. Counselors and clinics can also provide practice website text, images, page settings, and contact details for hosting their sites. A contact phone number and reply-to email that a counselor or clinic sets for client emails are shown to its clients in emails about their bookings. Clinics provide their name, address, team member details and roles. We record membership changes and the person recording a desk payment so the clinic can account for its actions. For an organisation inquiry, we keep the contact details, organisation information and service requirements submitted to us.
If you leave a review, we store your rating, review text and its connection to a completed booking. Your first name, rating and review may appear on public counselor pages. For invitations and referrals, we keep the attribution and reward status needed to administer the program.
3. How we use it
We use your information to run your bookings, connect you with your counselor, send confirmations and reminders, personalize your experience, keep the platform safe, and meet our legal duties. We use practice website content to host and display a counselor's or clinic's pages. Bookings made from those pages still use Leshya's booking and online payment tools. We send product updates only when you have chosen to receive them, and you can opt out at any time.
Search indexing for a practice website is off by default. An owner can choose to allow search engines to index eligible published public website pages. Private account, booking and Journal pages are excluded. Search engines decide whether to index pages, so indexing is not guaranteed.
If you sign up for our monthly email on the resources pages, we store your email address and the time you agreed. We use it to send one email a month, nothing more. Every email carries an unsubscribe link, and leaving takes one click.
We also use contact and account information for clinic invitations, review decisions, plan-expiry notices, payment and refund updates, reminders to finish account setup according to your notification choices, and reminders to reconnect a calendar that has stopped working. An inquiry is used to respond to the service request. A feature waitlist email is used to tell you about that feature. These are separate from optional marketing subscriptions.
For gift cards, we email the code to the recipient. Anyone with the code can use it toward a session, so keep it private.
4. Who sees your information
Your counselor sees what they need to hold your session: your name and booking information. Counselors do not see your email address or phone number, including in their client list, search and downloads. If you give an emergency contact in your first-session answers, your counselor can see it. We use trusted services to run Leshya, including Supabase for data storage and sign-in, Vercel for hosting and practice addresses, Razorpay for online payment processing, Resend for email, browser push services for notifications, and Google or Microsoft to create meeting links for online sessions. Each of these receives only what it needs to do its job. If you allow ads cookies, Meta and Google receive the limited page and sign-up signals described in section 8, never health information. Guest booking, newsletter signup and the organization inquiry form use Cloudflare Turnstile to block automated sign-ups; it looks at basic browser signals, which Cloudflare processes under its own terms and privacy policy. When you tap Use my location, your device's coordinates go to BigDataCloud (location lookup) to fill in your city, pincode and state, and a pincode you enter in an address form goes to postalpincode.in (pincode lookup) to fill in the city and state. When you describe what you are looking for in your own words, the sentence is read on our servers, run by Supabase, to suggest concern tags and to check whether you may need urgent help. It is used for that one search only. It is not stored, logged or sent to analytics; only the tags you keep are used to search. We share information with authorities only when the law requires it or when someone's safety is at risk.
If your counselor practises at a clinic, the clinic's team also sees what it needs to run your visits: authorised clinic admins can see your name, contact details, session times and whether a session is paid, and can export the clinic's client list. A counselor at the clinic who is not a clinic admin sees their own bookings, without your email address or phone number. Clinics must protect exported files and use them only to run sessions and the practice, not for unrelated marketing. Leshya remains answerable to you for your personal data, so if you believe a clinic has misused it, tell us and we will act. First-session answers are not available through the clinic admin console. Your daily check-ins stay private to you alone.
When a clinic removes a member, that person loses access to the clinic's bookings, client contacts and exports. Existing booking records remain available to the clinic for continuity and accounting. Removing access cannot erase copies already exported. A practice address limits the client area to that practice, and its sign-in session does not carry over to another practice address. Booking and online payment details entered there are handled by Leshya and the relevant counselor or clinic as described above.
If you add people to a couple or group session, we keep the name and email you give for each of them so the session details can reach them. We use those details for nothing else, and anyone added this way can write to us to have their details removed.
If you connect your Google Calendar, what Leshya asks for depends on your role. Counselors grant two scopes: calendar.events, to create, update, and cancel calendar events for sessions booked through Leshya, including adding a Google Meet link, and calendar.freebusy, to read your busy and free times so clients are only offered slots when you are available. Customers grant one scope, calendar.events, so the sessions you book and their meeting links are added to your own calendar. In both cases Leshya only touches events it creates for your Leshya sessions. It does not read, edit, or delete your other calendar events, and never uses this data for advertising or sells it. We store your Google authorization tokens to perform only the actions above. You can disconnect Google Calendar from your account settings to remove the stored tokens and stop future syncing. Events already added to your calendar remain there. You can also revoke Leshya's access in your Google account settings.
Leshya's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this calendar data to train or improve any AI or machine learning models.
5. How we protect and keep it
Your data is encrypted in transit and at rest, and access inside Leshya is limited to people who need it to support you. We keep your information while your account is active. When your account is deleted, we delete your profile, contact details, check-ins, journal notes and preferences. Payment and invoice records are kept for 8 years after account deletion, to meet Indian tax law, and used only for that. We remove them after that. The email address stored with a discount code use is kept for 90 days after you delete your account, then deleted. A counselor's session notes and photos are kept until the counselor deletes them or their account is deleted. A client deleting their account does not remove them, because they are the counselor's own record.
6. First-session questions and consent
For account customers, a counselor may ask first-session questions so they can prepare. This depends on the counselor's intake settings and the offering booked. Guest bookings do not use this account-based intake and consent flow. Your answers are stored encrypted for your relationship with that counselor and may be updated and reused for later bookings with them. You and your counselor can read them. Application access is limited to you and your counselor. Leshya staff do not have application access to these answers, and they are not available through clinic admin screens. Leshya operates the encrypted storage and access controls used to provide this feature.
A first-session preparation link in your email can open your form without signing in until the session starts. Anyone holding that link may be able to use it, so keep it private. After the session starts, that link no longer gives access without signing in to the booking account.
Before that first session we also ask you to agree to two things: that you understand the nature of counseling on Leshya and the limits of confidentiality, and that you agree to us storing your responses and session records to run your sessions. We record which version of this consent you agreed to. If we change the wording, we ask you to agree again the next time you book a first session.
You can withdraw this consent at any time from your account, under My account in the Privacy tab. Withdrawing it does not cancel sessions you have already booked. It means we will ask you to agree again before your next first session, and you can ask us to remove your saved answers.
7. Your choices and rights
You can view and update your details from your account, change your notification choices, and ask us to correct or delete your information, subject to applicable law and necessary record retention. If you are under 18, a parent or guardian gives consent for you, and they can withdraw it at any time. Age, guardian details, and consent are declarations from the people providing them and are not independently verified by Leshya. To delete your account, use Delete account at the bottom of My account (customers) or General profile (counselors), in the app or on the web. We complete it within 30 days. We use your email address only to send you the deletion notices, and the request does not keep a copy of it. The steps are also on our delete account page. To make any other request, write to us and we will respond promptly.
For clients, tips and updates from Leshya are emails you choose to get, by turning on Tips and updates in your account notifications. They are off unless you turn them on, and you can turn them off in your account at any time. Counselors receive Leshya product tips and marketing emails by default. Every one of these emails, for clients and counselors, has an unsubscribe link that works in one click. Booking emails and reminders are separate and keep arriving.
9. Changes and contact
When this policy changes in a way that matters, we will tell you before the change takes effect. For any question, request, or concern about your privacy, write to us at support@leshya.app. Our grievance officer for data protection matters is Chhavi Kothari, reachable through that same channel or by post atParsho, C1-401, Samarth Enclave, Vesu, Surat, Gujarat, India, 395007. Parsho operates Leshya and is responsible for the personal data described here. We acknowledge a complaint within 24 hours and aim to resolve it within 15 days. Privacy or content complaints that the law requires us to handle sooner are expedited.