Privacy Policy
Inclusive, Affordable, and AI-Powered Mental Wellbeing Support for Every Child
This Privacy Policy explains how XPOLARITY TECHNOLOGIES PRIVATE LIMITED ("Xpolarity", "we", "us", or "our") collects, uses, shares, and protects personal data when you use the Xpolarity platform and related services (collectively, the "Platform"), including app.xpolarity.com.
We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules").
1. Who We Are
XPOLARITY TECHNOLOGIES PRIVATE LIMITED
Flat No.t5-901, Vasavi Srinilayam, Karmanghat,
K.v.rangareddy, Saroornagar, Telangana, India — 500079
CIN: U58200TS2026FTC212301
Data Protection Officer:
dpo@xpolarity.com
General enquiries:
contact@xpolarity.com
2. Scope
This Policy applies to all users of the Platform, including parents and legal guardians, students, school staff, counsellors, and other authorised professionals. It covers personal data collected through the Platform, Parent Portal, school dashboards, AI tools, and related support services.
3. Children's Data
The Platform is designed for children and young persons aged 3 to 18. Under Section 9 of the DPDP Act, we provide additional protections for children's personal data.
- Access by a child under 18 requires verifiable parental or guardian consent.
- We do not process children's data in a manner that causes detrimental effects to their wellbeing.
- We may request government-issued identity documents to verify a guardian's identity and relationship to the child.
- Refusal to provide consent will not result in adverse consequences for the child at school.
A separate parental consent form is used to obtain verifiable consent. These Terms and this Policy provide the general framework; the consent form contains detailed data categories and purposes for signed parental agreement.
4. What We Collect
We collect only the personal data necessary for the purposes described in this Policy. The categories below apply to parents/guardians, children, and school staff as relevant to their role on the Platform.
| Category | Examples | Why we collect it |
|---|---|---|
| Identity | Name, date of birth, age, gender (optional), school name, class/grade, school ID, city and state; guardian relationship to child | Account registration, child profile creation, age-appropriate content, safeguarding identification |
| Contact | Email address, mobile number, emergency contact details | Platform communications, OTP verification, crisis alerts, account recovery |
| Wellbeing & Assessment | Wellbeing scores, screening and assessment responses, mood check-ins, career assessment (XCSI) results | Wellbeing monitoring, early risk detection, educational planning, generating reports for authorised users |
| Behavioural & Educational | Behavioural screening results, IEP records, learning accommodations, special educator notes, Learning DNA profile | IEP planning, referral decisions, safeguarding review, personalised learning recommendations |
| AI Interactions | Wise Turtle conversations, emotional check-ins, AI Career Counsellor interactions | Wellbeing support, crisis language detection, populating wellbeing dashboards, human safety review when flagged |
| Brave Bee Reports | Anonymous report content, concern type, description, timestamps, risk classification | Safeguarding review, crisis escalation, school safety management, mandatory reporting where legally required |
| Crisis & Safety | Safeguarding incident records, AI-flagged excerpts, risk classifications, escalation decisions, notification records | Child protection compliance, mandatory reporting, legal accountability |
| Support & Referral | Referral letters, session summaries, care coordination notes, Dhruva Support Line records (non-recorded by default) | Coordinating care across psychologists, counsellors, special educators, and paediatricians |
| Technical & Usage | Login timestamps, session duration, features accessed, device type, browser/app version, IP address | Platform security, fraud prevention, improving features, usage analytics |
| Payment | Payment method details, transaction records, billing information | Payment verification and transaction records (where applicable) |
| Consent Records | Agreement acceptance date, version agreed to, method of acceptance | Legal compliance under the DPDP Act; audit trail of informed consent |
5. Why We Use Your Data
We process personal data for the following purposes:
- Service delivery — To provide student wellness screening, counselling referrals, AI support tools, and related services facilitated by schools.
- Legal compliance — To comply with applicable laws, including child protection obligations under the POCSO Act 2012, Juvenile Justice Act 2015, Right to Education Act 2009, and the DPDP Act.
- Wellbeing analytics — To generate individual wellbeing summaries for parents and authorised school staff, and anonymised school-level programme reports. No individual child is identified in school-level reports.
- Crisis monitoring and escalation — To monitor platform communications for indicators of suicidal ideation, self-harm, abuse disclosure, threats of violence, or severe psychological distress, and to alert safeguarding leads, parents (where safe to do so), emergency contacts, and emergency services (112) or statutory authorities where required.
- AI support — To deliver age-appropriate psychoeducation, emotional support, guided self-help, and daily wellbeing check-ins through Wise Turtle and the AI Career Counsellor.
- Platform improvement — To improve features and user experience using aggregated, anonymised data.
- AI model training — To train and improve our AI models using de-identified, permanently anonymised interaction data only (see Section 9).
6. Legal Basis for Processing
We process personal data on the following legal bases:
- Explicit consent — As required under Section 6 of the DPDP Act for adult users.
- Verifiable parental consent — As required under Sections 6 and 9 of the DPDP Act for children's data.
- Legal obligation — Where processing is required by applicable Indian law, including mandatory reporting obligations.
- Legitimate uses permitted by law — Including processing necessary for the protection of a child's health or safety, as permitted under Section 9 of the DPDP Act and the DPDP Rules.
7. Who We Share Data With
We share personal data only in the following circumstances:
- Schools — Authorised school wellbeing staff, counsellors, and designated safeguarding leads, to support your child's wellbeing, educational planning, and safeguarding.
- Child Support Hub professionals — Licensed psychologists, counsellors, special educators, and paediatricians to whom your child has been referred, with your prior consent except where legally required for safety.
- Technology sub-processors — Cloud hosting, data storage, encryption, and security providers, contractually bound to process data only on our instructions.
- Regulatory and statutory authorities — Where disclosure is required by law, including the Data Protection Board of India, law enforcement, and child protection authorities under applicable legislation.
- Emergency services — National emergency response (112), CHILDLINE (1098), and other crisis authorities where there is immediate risk to life. This may occur without prior parental consent where urgency requires it.
- Human Safety Proctor and Crisis Escalation Authority — Authorised internal personnel who review AI-flagged communications and approve safeguarding interventions.
- Research and academic bodies — Only permanently de-identified and aggregated data for psychometric validation and programme outcome studies. No individual is identifiable.
- Institutional partners — Educational institutions, impact investors, and grant bodies receiving only anonymised, aggregated programme outcome data.
- Successor entity — In the event of a merger, acquisition, or restructuring, subject to advance notice. You may request deletion of your data at that time.
What we never do
- We do not sell personally identifiable data.
- We do not use identifiable health, mental health, or wellbeing data for targeted advertising, behavioural profiling, or remarketing.
- We do not share children's data with insurers, employers, or financial institutions for independent commercial use.
- We do not permit third parties to monitor or profile children's behaviour for commercial or surveillance purposes.
8. Crisis and Location Data
Real-time location data is accessed only in exceptional circumstances: where the Crisis Escalation Authority has confirmed a severe or critical risk to a child's life or physical safety, and where no less privacy-intrusive means of ensuring safety is available.
Location data is not accessed for routine platform use, wellbeing monitoring, attendance tracking, or any commercial purpose. Data accessed during a crisis is retained only for the duration necessary to resolve the emergency and deleted thereafter, unless retention is required by law.
9. AI Model Training
We may use de-identified, permanently anonymised interaction data from Wise Turtle and the AI Career Counsellor to train and improve our AI models. Before any data is used for this purpose:
- All personal identifiers — including name, date of birth, school ID, and location — are permanently and irreversibly removed.
- Only anonymised conversation patterns and interaction structures are used.
- No personally identifiable health, mental health, or wellbeing data is used for training in identifiable form.
- No individual child is identifiable in data used for this purpose.
10. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
- General account and usage data is retained while your account is active and for a reasonable period thereafter.
- Crisis and safeguarding records may be retained for up to 7 years for legal accountability and evidentiary requirements, or longer if required by law or ongoing legal proceedings.
- Upon withdrawal of consent, we cease processing within 30 days and delete data in accordance with the DPDP Act, except where retention is required by law.
11. Security
We implement reasonable security practices and procedures to protect personal data, including encryption, access controls, and secure cloud infrastructure. Mental health and wellbeing data receive heightened security controls. Access is limited to authorised personnel with a direct and documented need to support a user's wellbeing or safeguarding.
No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take all reasonable and practicable measures to protect your data.
12. Your Rights
Under the DPDP Act, 2023, you have the following rights in respect of your personal data (and your child's data, where you are the parent or legal guardian):
| Right | What it means | Response time |
|---|---|---|
| Access (Section 11) | Request a summary of personal data being processed, processing activities, and identities of other fiduciaries or processors with whom data has been shared. | Within 30 days |
| Correction & Completion (Section 12) | Request correction of inaccurate or misleading data, or completion of incomplete data. | Within 30 days |
| Erasure (Section 12) | Request deletion of data no longer necessary for its purpose, or where consent has been withdrawn and no other legal basis exists. | Within 30 days |
| Withdraw Consent (Section 6) | Withdraw consent at any time, including for specific purposes while retaining consent for others. Withdrawal does not affect prior lawful processing. | Within 30 days |
| Grievance Redressal (Section 13) | File a complaint with our Data Protection Officer regarding data processing or exercise of rights. | Within 30 days |
| Nominate (Section 14) | Nominate another individual to exercise your rights in the event of your death or incapacity. | — |
To exercise any of these rights, contact our Data Protection Officer at dpo@xpolarity.com.
If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India under Section 27 of the DPDP Act, 2023.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated version number and effective date. We encourage you to review this Policy periodically.
14. Contact Us
Data Protection Officer:
dpo@xpolarity.com
General enquiries:
contact@xpolarity.com
XPOLARITY TECHNOLOGIES PRIVATE LIMITED
Flat No.t5-901, Vasavi Srinilayam, Karmanghat,
K.v.rangareddy, Saroornagar, Telangana, India — 500079
CIN: U58200TS2026FTC212301
See also our Terms of Service.