Privacy Policy

1. Who we are

EmpowerStudents.in ("we", "us", "the platform") is operated by Dr. P. K. Jha (Neurosurgeon, AIIMS-trained) with support from the Neuro Care India and Institute of Brain and Spine teams. Our registered contact:

2. Scope of this policy

This policy explains what personal information we collect when you use empowerstudents.in, how we use it, whom we share it with, and the choices you have. This policy is written to comply with the Indian Digital Personal Data Protection Act, 2023 (DPDP Act).

3. What we collect

3.1 From parents / adult users

• Name, WhatsApp number, email address (only what you enter during signup)
• Answers you give during self-assessment or your child's assessment
• Voice recordings (if you use the voice reflection feature)
• Payment details are handled by Cashfree — we do not store your card or bank details
• Basic technical logs: IP address, browser type, pages visited (for security and improvement)

3.2 From children (via parent)

• Child's name, date of birth, gender, mother tongue
• Any special needs or medical context the parent chooses to share
• The child's answers to age-appropriate evaluation questions
• Voice recordings only if the parent uses a voice-based evaluation module

3.3 What we do NOT collect

• We do not collect your card number, CVV, or bank credentials at any time
• We do not collect location data beyond what your browser provides for basic analytics
• We do not track you across other websites
• We do not use third-party advertising trackers

4. How we use your information

• To create your account and let you log in
• To generate evaluations, reports, and personalised recommendations
• To provide the paid services you have purchased
• To send you WhatsApp messages related to your account (OTPs, reminders, report links) — we do not send marketing spam
• To improve our platform (aggregated, non-identifying analysis only)
• To meet legal obligations if required by law

5. Who we share it with

Your data is not sold. We share limited information only with these service providers, each under a data processing agreement:

• Anthropic (Claude AI) — for generating your report content. Your responses are sent for processing; we do not permit long-term storage or model training on your data.
• Twilio — for sending you WhatsApp OTPs during login.
• Google Cloud (Text-to-Speech) — for voice playback in some modules.
• Cashfree — for processing your payments (they handle card data directly).
• GoDaddy (hosting) — for storing the website and database.

If you were referred by one of our partner clinics, that partner may see aggregate information about the parents they have referred (name, WhatsApp, evaluation count, wallet activity) for the purpose of clinical follow-up. Partners do NOT see the content of your reports unless you explicitly share them.

6. Where your data is stored

Your data is stored on servers located in India (via GoDaddy). Third-party services listed above may process data outside India briefly during service delivery (for example, an AI API call), but all persistent storage is in India.

7. How long we keep it

• Account data: as long as your account is active, plus 12 months after you deactivate
• Evaluation reports: retained for 5 years to enable comparison over time (you may delete on request)
• Voice recordings: deleted within 90 days of report generation unless you explicitly ask us to retain them
• Payment records: retained for 7 years to meet Indian tax and accounting requirements
• Technical logs: deleted after 90 days

8. Your rights under the DPDP Act

You have the right to:

• Access — request a copy of the data we hold about you or your child
• Correct — ask us to fix inaccurate data
• Erase — request deletion of your data (subject to legal retention rules)
• Withdraw consent — at any time, for any specific purpose you consented to
• Grievance redressal — contact our data protection officer using the details below

To exercise any of these rights, email care@empowerstudents.in with the subject line "DPDP Request". We will respond within 30 days.

9. Security

We use standard security practices: HTTPS for all traffic, hashed passwords (bcrypt), access controls on our admin systems, and encrypted database backups. No system is perfectly secure. If we ever suffer a breach that affects your data, we will notify you and the Data Protection Board of India within 72 hours as required.

10. Cookies

We use minimal cookies: a session cookie to keep you logged in, and one flag to remember that you have seen the welcome splash. We do not use advertising cookies or third-party tracking cookies.

11. Changes to this policy

If we materially change this policy, we will notify you by email or WhatsApp before the change takes effect and post the new version here. Small clarifications (grammar, typo fixes) may be made without notice.

12. Grievance officer

See also: Terms of Use · About us