Privacy Policy
With effect from October 19, 2026
Welcome to Soulthing (the “Platform”). This Platform and its suite of products and services are owned and operated by Soulhealth Tech Private Limited, having its registered office at A 13 A, Block A, Industrial Area, Sector 62, Noida, Uttar Pradesh, 201309, which expression shall mean and include its officers, successors, and permitted assigns. This Privacy Policy is issued by Soulthing for therapist applicants, freelance practitioners, employees and team leads who use the Soulthing therapist app or participate in onboarding, verification, assignment, service delivery, payment or support processes.
This document is published in accordance with the provisions of the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”), when applicable to the relevant processing, Soulhealth is the Data Fiduciary determining the purposes and means of processing the personal data described here. The rules made thereunder require publishing the rules and regulations, privacy policy, and terms of use on an online portal of the Company. We request that you go through this Privacy Policy and the Terms of Use carefully before you decide to access this Platform. This Policy applies alongside the relevant employment/engagement agreement, professional code, onboarding notices and feature-specific notices. For the purposes of this Privacy Policy, the words “Soulthing”, “Company”, “we”, “us” or “our” refer to the Company and all references to “you”, or “your”, as applicable, mean the person who accesses, uses, and/or participates in the Platform in any manner or capacity.
General Terms:
The Company shall not be held liable for disclosure of any information if such disclosure is in accordance with this Privacy Policy, the Terms of Use, and/or applicable law.
By accessing or using the Platform, or by otherwise giving us your information, you confirm that you have the capacity to enter into a legally binding contract under the laws of India, and have read, understood, and agreed to the practices and policies outlined in this Privacy Policy and agree to be bound by the Privacy Policy.
You hereby consent to our collection, use, sharing, and disclosure of your information as described in this Privacy Policy. We reserve the right to change, modify, add, or delete portions of the terms of this Privacy Policy, at our sole discretion, at any time, and any continued use of the Platform, following any such amendments to the Privacy Policy, will be deemed as an implicit acceptance of the Privacy Policy in its amended form. You are requested to review the Privacy Policy from time to time to keep yourself updated with any changes or modifications made to the terms hereof.
If you are accessing or using this Platform from an overseas location, you do so at your own risk and shall be solely liable for compliance with any applicable local laws.
If you do not agree with any of the terms and conditions of this Privacy Policy, please do not proceed further to use this Platform. This Privacy Policy is subject to change at any time without notice. To make sure you are aware of any changes, please review this policy on this Platform periodically.
If you object to your information being transferred or used in accordance with this Privacy Policy, please do not use the Platform.
All capitalized terms used but not defined herein shall have the meaning ascribed to them in the Terms of Use.
Personal Data we process and why
Identity and contact data: name, mobile number, email where provided, photograph, address, date of birth where necessary, account identifiers and OTP/authentication records. Purposes: account creation, authentication, communication and engagement administration.
Verification and professional data: government identity details/documents, PAN, address proof, qualifications, degrees, registration/licence details, experience certificates, references, background-check results, training, SOP completion and eligibility status. Purposes: verify identity, qualifications and eligibility, protect customers and comply with applicable legal/professional requirements.
Engagement and financial data: employment or engagement agreement, role, service category, service area, availability, salary/commission, bank details, payment history, PAN, GSTIN where applicable, tax deductions and invoices. Purposes: administer the engagement, make payments, comply with tax/accounting requirements and resolve disputes.
Operational and platform data: assigned bookings, session status, attendance, OTP verification events, service reports, ratings, complaints, incidents, performance records, support messages, device identifiers, IP/login/security logs, audit records and diagnostics. Purposes: allocate bookings, verify service completion, maintain quality and safety, secure the platform and investigate complaints.
Location and communications data: service-area location, visit address access, location at check-in/check-out or en-route if enabled, and masked-call metadata such as duration/status. Call recordings will be processed only if recording is actually enabled and a suitable notice and lawful basis are in place. Purposes: dispatch, attendance, service coordination, safety and dispute handling.
Notice, Consent, and other lawful grounds
We will provide a clear notice in plain language before or when seeking consent for processing that relies on consent. The notice should itemise the personal data, specify the purpose and service enabled, and explain how to withdraw consent, exercise rights and make a complaint. Where required, it will be available in English and an applicable language specified in the Eighth Schedule to the Constitution. Where consent is the basis of processing, it must be freely given, specific, informed, unconditional and unambiguous through clear affirmative action and limited to data necessary for the stated purpose. Soulthing will maintain records sufficient to demonstrate the notice and consent obtained. You may withdraw consent using a method designed to be as easy as the method by which it was given; withdrawal does not retrospectively invalidate lawful processing carried out before withdrawal. Some processing may be necessary to enter into or perform an employment/engagement arrangement, comply with tax or other legal obligations, protect customers and practitioners, investigate safety incidents, or establish, exercise or defend legal claims, where permitted by applicable law. Optional processing will be identified where practicable. If required onboarding information is not provided, we may be unable to verify or engage you or allocate bookings.
Verification, Sharing, and Recipients
Personal data may be shared on a need-to-know basis with authorised onboarding, operations, clinical/quality, finance, support, security and management personnel; qualification issuers or verification agencies; banks and payment providers; tax/accounting advisers; hosting, app, authentication and messaging providers; mapping and communications providers; insurers if applicable; legal advisers; and regulators or law-enforcement authorities where lawfully required. Customer information shown to you should be limited to the assigned booking and legitimate service needs, such as customer name or limited profile details, service and appointment information, visit address/map location released for dispatch, and relevant health information. You must not use customer data for personal purposes, off-platform solicitation, marketing, independent records or any purpose unrelated to the assigned service. Third-party technology providers may process data to operate hosting, authentication, notifications, mapping, masked calls, analytics, payment and AI-assisted functions, where enabled.
Accuracy, Security, and Confidentiality
You should provide accurate, complete and up-to-date identity, qualification, registration, payment and contact information, and promptly notify Soulthing of material changes. We may request supporting information to verify accuracy or eligibility. We will implement reasonable technical and organisational safeguards appropriate to the nature of the data, including access controls, authentication, restricted document access, logging, vendor controls and security reviews, as applicable to the production system. Access to identity documents, bank details, professional records, session reports and customer data will be restricted to authorised personnel with a legitimate need. No system can be guaranteed completely secure. If a personal data breach occurs, Soulthing will assess and respond to it, take steps to contain and mitigate harm, and provide notices to affected individuals and the competent authority where and as required by applicable law and rules. You must keep your login credentials and devices secure, access only records authorised for your assigned work, maintain customer confidentiality, and promptly report suspected loss, unauthorised access, disclosure, device theft or misuse through the designated incident channel.
App Permission, Cookies, and Device Information
Depending on the features used and the permissions enabled on your device, the Platform may access device functions or information such as location, camera, files, notifications, device identifiers and diagnostic data. These permissions will be requested where required for the relevant feature and should be enabled only where necessary. You may manage permissions through your device settings; disabling a permission may limit the corresponding feature. The Platform or its service providers may use cookies, software development kits (SDKs), or similar technologies on the website or within the app for authentication, security, preferences, analytics and performance, where implemented and appropriately disclosed. The actual permissions and technologies used will depend on the production version of the Platform.
Handling of Customer and Patient Information
When providing services through Soulthing, you may receive access to customer or patient information, including appointment details, contact information, visit address, relevant health information, session notes and reports. You may access and use such information only to the extent necessary for the specific booking and authorised professional or operational purpose. You must not copy, download, photograph, screenshot, print, retain, disclose or store such information on a personal device, personal account or external system except where expressly authorised by Soulthing, required for the service, and permitted by applicable law and professional obligations. You must not contact customers outside authorised Platform channels or use their information for personal purposes, solicitation, marketing or any unrelated activity. These requirements are in addition to, and do not replace, your professional confidentiality and record-keeping duties.
Location and Performance Monitoring
The Platform may collect and process the Your location information, including real-time or approximate location data, where necessary for appointment coordination, navigation, attendance verification, and confirmation of service delivery. Such information may be collected through device permissions and location-based features of the Platform, subject to applicable laws and the permissions granted by you. Soulthing may monitor your service-related performance, including appointment acceptance and completion, punctuality, cancellations, response times, Customer feedback, ratings, complaints, and compliance with Platform policies. Such monitoring shall be undertaken for service quality assurance, operational management, customer satisfaction, prevention of misuse, and verification of contractual obligations. The location and performance information collected shall be accessed only by authorised persons for legitimate operational, security, compliance, or dispute-resolution purposes and shall be retained only for as long as reasonably necessary, subject to applicable legal requirements. You shall provide accurate service-related information and shall not manipulate or misuse location-tracking, attendance, or performance-monitoring features of the Platform.
Retention, Deletion, and Deactivation
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy or for a longer period where required or permitted by applicable law, tax/accounting requirements, a dispute, a safety investigation or the establishment, exercise or defence of legal claims. Retention periods may differ by category. Indicative criteria are:
identity and qualification records for verification and engagement-related legal/safety needs;
payment and tax records for statutory/accounting periods;
booking and service records for quality, safety and disputes;
security logs for incident investigation; and
location records for dispatch, attendance and related disputes.
Account deactivation, termination of engagement and erasure of personal data are distinct. Access may be disabled promptly when engagement ends, while only records that must lawfully be retained may be kept. Personal data no longer required should be securely deleted or anonymised under a documented process. A deletion request will be handled subject to applicable legal retention exceptions and other lawful grounds.
Requests, Complaints, and Co-Operation
You must promptly notify Soulthing through its designated support or incident-reporting channel if you receive a request from a customer or patient concerning their personal data, identify an inaccurate or improperly disclosed record, or become aware of suspected unauthorised access, loss, disclosure or misuse of personal data. Unless authorised or legally required to do so, you must not independently respond to a data-rights request on Soulthing’s behalf, disclose records, or promise deletion or correction. You shall reasonably cooperate with Soulthing in verifying, investigating and responding to such requests or incidents, subject to applicable law and your professional obligations.
Automated Tools and Analytics
Where enabled and appropriately disclosed, Soulthing or its service providers may use analytics, automated systems or AI-assisted tools to support platform security, service quality, operational administration, support and performance analysis. Such tools should receive only the data reasonably necessary for the stated function. Sensitive therapist identity documents, bank details, qualification records, precise location data or customer/patient health information will not be provided to an AI provider except where strictly necessary, appropriately notified, lawfully authorised and protected by suitable safeguards. Where applicable law requires additional notice, consent, human review or other safeguards for a particular use, Soulthing will implement those requirements before undertaking that processing.
Your Rights and Requests
Subject to the applicable provisions and commencement of the DPDP Act, 2023, you may have the right to obtain information about your personal data and processing, request correction/completion/updating, request erasure where legally available, withdraw consent, use the grievance process and nominate another individual to exercise rights in the event of death or incapacity, in accordance with law. Submit a request by emailing info@soulthingcompany.com or through the privacy/request feature in this app when available. Include your registered mobile number or another account identifier, the request type and enough information to locate the relevant record. We may reasonably verify your identity before disclosing or changing personal data. We will publish the available request methods and grievance response period in the app or website and respond within the period required by applicable law and our published grievance process. If a record must be retained for legal, tax, safety or dispute purposes, we will explain this to the extent permitted and restrict its use to the necessary purpose. You may make a complaint to the Data Protection Board of India in accordance with applicable law and the Board’s procedures once the relevant provisions and process are operative.
Children’s and Other Sensitive Information
If a booking involves a child or another person who may require a legally authorised representative, you must access and process that person’s information only for the authorised service and in accordance with applicable law, professional standards and Soulthing’s instructions. You must not collect additional information or use it for an unrelated purpose. Any processing of personal data of children or other specially protected categories of individuals will be subject to the safeguards and authorisations required by applicable law.
International Processing and Third-Party Services
Some service providers may process data in India or another jurisdiction. We will assess provider locations and cross-border transfers and comply with restrictions or conditions notified by the Government of India and other applicable legal requirements. Provider access will be limited through appropriate contractual and technical safeguards. Therapist identity documents, bank details, qualification records and location information will not be sent to an AI provider unless strictly necessary, appropriately notified, lawfully authorised and protected by suitable safeguards.
Grievance Officer
If you have any grievance with respect to the Platform or the Services, including any discrepancies, consent withdrawal, and grievances with respect to the processing of information, you can contact our Grievance Officer at:
Name: Vaibhav Gupta
Email: info@soulthingcompany.com
Contact Number: +91 8796193853
The Grievance Officer shall redress your grievances expeditiously, within 1 (one) month from the date of receipt of the grievance. Except where required by law, the Company cannot ensure a response to questions or comments regarding topics unrelated to this policy or the Company’s privacy practices.
Contact person in data protection matters
If you have any questions regarding the processing of your personal data, please contact us via the following: Data Protection Officer: Mr. Yuvraj Raghuvanshi E-mail: support@soulthingcompany.com
Changes to this Policy
We may update this Policy to reflect changes in services, data practices, technology, providers or applicable law. We will display the current version and effective date and communicate material changes through the app, website, email or another appropriate channel. Where a change requires fresh consent or a new notice, we will provide it before the relevant processing begins.
Miscellaneous
Indemnity: You agree and undertake to indemnify us in any suit or dispute by any third party arising out of the disclosure of information by you to third parties, either through our Platform or otherwise, and your use and access of websites, applications, and resources of third parties. We assume no liability for any actions of third parties with regard to your personal information, which you may have disclosed to such third parties.
Severability: Each clause of this Privacy Policy shall be and remain separate from and independent of and severable from all and any other clauses herein except where otherwise expressly indicated or indicated by the context of the Privacy Policy. The decision or declaration that one or more clauses are null and void shall have no effect on the remaining clauses of this Privacy Policy.
You have read this Privacy Policy and agree to all of the provisions contained above.