Privacy Policy

How Unlock: Mind and Wellness collects, uses, stores, shares and protects personal data, under the DPDP Act 2023 and DPDP Rules 2025.

Last updated: October 2026

Unlock: Mind and Wellness respects your privacy and is committed to handling personal data responsibly, transparently, and securely.

This Privacy Policy explains how Unlock: Mind and Wellness, operated by Fareeha Naik, MA Counselling Psychology ("we", "us", or "our"), collects, uses, stores, shares, and protects personal data when you visit this website, contact us, enquire about our services, or request an appointment.

We handle personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), as and when their relevant provisions apply.

1. Who We Are

Unlock: Mind and Wellness Fareeha Naik, MA Counselling Psychology Santacruz, Mumbai, India · Online sessions only

For the purposes of applicable data protection law, Unlock: Mind and Wellness is responsible for determining why and how personal data submitted through this website is processed.

2. Personal Data We Collect

Information you provide to us

When you use our contact or appointment enquiry form, contact us by email or telephone, or otherwise communicate with us, we may collect:

  • First name, and last name if you provide it
  • Email address
  • Telephone number, where provided — required only if you ask to be contacted by phone or WhatsApp
  • Preferred method of contact
  • Reason for your appointment or enquiry
  • The type of enquiry you select, such as individual counselling, a workplace programme or The Reading Room
  • Your organisation's name, if you provide it for a workplace or corporate enquiry
  • The contents of the message you send us
  • Any other information you voluntarily provide

You are encouraged to provide only the information reasonably necessary for us to respond to your enquiry.

Health and counselling information

Because this website relates to counselling and mental-wellness services, information you voluntarily provide may reveal information concerning your physical or mental health, emotional wellbeing, personal circumstances, relationships, or other private matters.

Please do not use the website contact form to submit medical records, diagnostic reports, prescriptions, detailed clinical histories, or other information that is not necessary for an initial enquiry.

The contact form is intended primarily for appointment and service enquiries and is not intended to function as a clinical records system.

Information shared during an actual counselling relationship may be subject to additional professional, ethical, contractual, and legal confidentiality obligations separate from this website Privacy Policy.

3. Information Collected Automatically

When you visit the website, certain technical information may be processed automatically as part of operating and securing the website:

  • Internet Protocol (IP) address
  • Browser type and version
  • Device or operating system information
  • Date and time of a request
  • Requested page or URL
  • Referring page or website
  • Request and response information
  • Security-related information
  • Technical information necessary to identify errors, abuse, or malicious traffic

This information is used primarily for website delivery, security, troubleshooting, reliability, and prevention of abuse.

We do not use this information to create advertising profiles about visitors.

4. How We Use Personal Data

Responding to you

  • Respond to enquiries
  • Contact you regarding an appointment
  • Provide information about available services
  • Determine the appropriate type of appointment or service requested
  • Respond to administrative questions

Providing services

Where you proceed with our services, information may be used as reasonably necessary to:

  • Arrange and administer appointments
  • Communicate regarding sessions
  • Provide counselling or related services
  • Maintain appropriate administrative records
  • Manage payments or related service administration

Website operation and security

  • Operate and deliver the website
  • Detect spam, abuse, malicious activity, and security threats
  • Maintain website availability
  • Troubleshoot technical problems
  • Enforce website security measures
  • Protect the website, its users, and our systems
  • Comply with applicable law
  • Respond to a lawful request from a competent authority
  • Establish, exercise, or defend legal claims
  • Comply with applicable professional obligations
  • Protect the rights, safety, or legitimate interests of individuals where permitted by law

Where our processing of personal data is based on your consent, we seek consent for a specific and lawful purpose.

Submitting information through the contact or appointment form indicates that you are voluntarily providing the information so that we may process it for the purposes described at or before the point of collection.

You may withdraw consent where processing is based on consent by contacting [email protected].

Withdrawing consent will not affect processing lawfully undertaken before the withdrawal.

If the requested service cannot reasonably be provided without processing particular information, withdrawing consent may mean that we are unable to continue that particular service or request.

Withdrawal of consent will be made reasonably accessible and, where required by applicable law, as easy as giving consent.

6. Data Minimisation

We aim to collect only the personal data that is reasonably necessary for the purpose for which it is requested.

The website contact form specifically asks visitors not to provide unnecessary sensitive medical records or diagnostic information.

Please avoid including information about yourself or another person that is not necessary for us to understand and respond to your enquiry.

7. Cookies and Tracking Technologies

This website does not intentionally use advertising cookies, tracking pixels, behavioural advertising technologies, Google Analytics, or Meta Pixel.

We do not use cookies to build advertising profiles or track visitors across unrelated websites.

The website or its infrastructure providers may use cookies or similar technical mechanisms that are strictly necessary for website functionality, security, prevention of abuse, session management, or other essential technical purposes.

If we introduce non-essential analytics, advertising, or similar tracking technologies in the future, this Privacy Policy will be updated and consent will be obtained where required by applicable law.

8. Cloudflare and Website Infrastructure

This website is hosted by our web hosting provider, FastComet, which also processes contact-form submissions and the emails they generate. Cloudflare's network sits in front of the website to deliver and protect it.

As part of providing these services, Cloudflare may process technical information relating to website visitors, such as IP addresses, request and traffic-routing information, browser and network information, security information, and other technical information necessary to deliver, secure, and operate the website.

Cloudflare may act as a service provider or processor in relation to certain information transmitted through its services and may independently process certain network and security information in accordance with its own privacy terms.

We use infrastructure providers only for legitimate operational, technical, and security purposes.

9. Website Logs and Analytics

We do not intentionally use website traffic information for targeted advertising or behavioural profiling.

Our website infrastructure may generate limited technical or security logs required to detect attacks or abuse, diagnose errors, monitor website reliability, enforce rate limits, investigate security incidents, and maintain the operation of the website.

Where logs contain personal data, access should be limited to persons who require access for legitimate technical, security, legal, or administrative purposes.

We aim to avoid logging the contents of counselling enquiries or other sensitive form submissions unnecessarily.

10. Contact Form Submissions

Information submitted through the website contact form is used to respond to the enquiry and, where appropriate, arrange an appointment or requested service.

The form is not intended to be a medical-record submission mechanism. Please do not include:

  • Medical records
  • Diagnostic reports
  • Prescriptions
  • Detailed psychiatric or medical histories
  • Identification documents
  • Other information that is unnecessary for the initial enquiry

Information provided after a professional counselling relationship begins may be handled separately from general website enquiries and may be subject to additional confidentiality and record-retention requirements.

11. Sharing of Personal Data

We do not sell or rent your personal data.

We do not provide your personal data to advertisers for targeted advertising.

Personal data may nevertheless be processed or disclosed where reasonably necessary, as follows.

Service providers

Trusted technology or service providers may process information on our behalf to provide services such as website hosting and content delivery, cybersecurity and abuse prevention, email and communications, appointment administration, secure video communication, or other operational services used by the practice.

Such providers should receive only the information reasonably necessary to perform their function and are expected to handle it subject to appropriate contractual, security, and confidentiality safeguards where required.

Information may be disclosed where required or permitted by applicable law, including in response to a valid order or lawful request from a court, regulatory body, law-enforcement authority, or other competent authority.

Protection from harm or abuse

Where permitted or required by applicable law or applicable professional obligations, information may be disclosed where reasonably necessary to respond to a serious threat to safety, investigate fraud or abuse, protect legal rights, or address a security incident.

12. International Processing and Data Transfers

Some technology providers involved in operating this website or related communications may operate infrastructure in multiple countries.

As a result, personal data or technical information may, where necessary, be processed or transmitted through infrastructure located outside India.

Any such processing or transfer will be subject to applicable Indian law, including any restrictions or requirements imposed under the DPDP Act, DPDP Rules, or other applicable law.

We do not intentionally transfer personal data internationally for advertising or sale.

13. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, professional, administrative, or dispute-resolution requirements.

General enquiries. Where you contact us but do not subsequently book or receive a service, we generally aim to delete or anonymise the enquiry when it is no longer reasonably required. As a general operational guideline, non-client contact-form enquiries may be retained for up to 90 days, unless there is a legitimate reason or legal obligation requiring longer retention.

Appointments and services. Where an enquiry results in an appointment or ongoing service, relevant administrative communications may need to be retained for longer as part of the appropriate records relating to that service. Clinical or professional records, where applicable, may have retention periods different from ordinary website enquiries.

Technical and security information. Technical logs may be retained for periods reasonably necessary for website security, fraud prevention, troubleshooting, and legal compliance.

When personal data is no longer required and no lawful reason exists for retaining it, we aim to securely erase it or make it no longer identifiable.

14. Security

We take reasonable technical and organisational measures designed to protect personal data from unauthorised access, unauthorised disclosure, alteration, misuse, loss, destruction, and personal data breaches.

Measures used in connection with the website may include, where appropriate:

  • HTTPS encryption for information transmitted between your browser and the website
  • Restricted administrative access
  • Cloudflare security protections
  • Spam and automated-abuse controls
  • Rate limiting
  • Secure authentication
  • System and software updates
  • Access controls
  • Appropriate management of technical logs

However, no website, communication channel, or electronic storage system can be guaranteed to be completely secure.

For this reason, please avoid sending unnecessary medical or highly confidential information through the general website contact form.

15. Personal Data Breaches

If we become aware of a personal data breach involving information for which we are responsible, we will assess the incident and take reasonable steps to contain, investigate, and remediate it.

Where required by applicable law, affected individuals and the Data Protection Board of India will be notified in the manner and within the period prescribed by applicable law.

We may also provide affected individuals with appropriate information about steps they can take to reduce potential harm arising from the incident.

16. Your Rights

Subject to the applicability of the DPDP Act, the DPDP Rules, and other applicable law, you may have rights concerning your personal data.

Access information about processing. Request information concerning personal data being processed about you and the manner in which it has been processed or shared, where applicable.

Correction and updating. Ask us to correct inaccurate or misleading personal data, complete incomplete personal data, or update personal data that is no longer accurate.

Erasure. Request deletion of personal data that is no longer required for the purpose for which it was collected, subject to circumstances where retention remains necessary or permitted by law.

Withdraw consent. Withdraw consent where processing is based on consent.

Grievance redressal. Raise a grievance concerning our handling of your personal data or the exercise of your data-protection rights.

Nomination. Where the applicable provisions of the DPDP Act are in force, nominate another individual to exercise applicable rights on your behalf in the event of death or incapacity, in accordance with applicable law.

To exercise an applicable privacy right, submit your request to [email protected], using the subject line "Privacy / Data Request" where possible.

We may take reasonable steps to verify that a request relates to the person making the request before disclosing, correcting, or deleting personal data.

Certain requests may be limited where retaining or processing information is required by law or otherwise permitted under applicable law.

Please do not send therapy notes, medical records, diagnostic reports, or other unnecessary sensitive information to the privacy mailbox unless specifically requested as part of verifying or processing your request.

17. Grievance Redressal

If you have a concern about the collection, use, storage, disclosure, security, correction, deletion, or other processing of your personal data, please contact our privacy channel so that the matter can be reviewed.

Privacy and Data Requests Unlock: Mind and Wellness Santacruz, Mumbai, India [email protected]

Please provide sufficient information for us to identify the relevant issue and respond appropriately, but do not include unnecessary confidential, medical, or counselling information in your initial grievance.

We will endeavour to acknowledge and resolve legitimate privacy grievances within the period required by applicable law.

Where the applicable provisions of the DPDP Act are in force, you may have the right to approach the Data Protection Board of India after first using the grievance-redressal mechanism available to you through us, as prescribed by applicable law.

For therapy enquiries, appointments, scheduling, or service-related communication, please continue to use [email protected].

18. Children

For purposes of the DPDP Act, a child is an individual who has not completed eighteen years of age.

Where we knowingly process the personal data of a child in circumstances requiring parental consent, appropriate steps will be taken to obtain verifiable consent from the child's parent or lawful guardian as required by applicable law.

Children should not independently provide personal information through this website where parental or guardian consent is legally required.

We do not knowingly use children's personal data for targeted advertising, behavioural monitoring, or processing that is detrimental to their wellbeing.

If you believe a child has submitted personal information through this website without the required consent, please contact [email protected].

19. Third-Party Websites and Services

This website may contain links to third-party websites, resources, communication services, or other external platforms.

Their privacy practices are governed by their own privacy policies and terms.

We are not responsible for the privacy, security, accuracy, availability, or content of an independent third-party website merely because this website links to it.

We encourage you to review the privacy practices of any third-party service before providing it with personal information.

20. Emergency Communications

This website and its contact form are not monitored continuously and must not be used for emergencies or crisis intervention.

If you are experiencing immediate distress or there is a risk of harm to yourself or another person, please contact appropriate emergency services or seek immediate professional assistance.

In India, Tele-MANAS can be reached at 14416 for mental-health support, or you may attend the nearest appropriate hospital or emergency facility.

Do not rely on a website contact-form submission or the privacy mailbox to obtain urgent assistance.

21. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, our services, the website, technology providers, or how personal data is processed.

When the Policy is updated, the "Last updated" date at the top of this page will be revised.

Material changes affecting the processing of personal data may be brought to users' attention in an appropriate manner where required by applicable law.

22. Contact Us

Therapy, appointments and service enquiries

Unlock: Mind and Wellness Fareeha Naik, MA Counselling Psychology Santacruz, Mumbai, India · Online sessions only [email protected] +91 96532 03903

Privacy, DPDP and personal data requests

For privacy questions, withdrawal of consent, requests to access, correct, update or erase personal data, or grievances regarding the handling of personal data:

Privacy and Data Requests Unlock: Mind and Wellness [email protected]

Please avoid sending therapy notes, medical records, diagnostic reports, or unnecessary sensitive information to the privacy mailbox unless specifically requested.