🔒 Privacy Policy

1. Who this covers

This policy covers the Autismmitra web platform. It applies to the caregiver or adult who holds the account, and to the child whose profile that account creates. Autismmitra is a coaching and information platform — it is not a medical device and does not provide diagnosis. See our Terms of Use.

2. What we collect

Account details. Your email address and authentication identity, handled through Google Firebase Authentication. We do not store your password.

Child profile. The name, date of birth and any diagnosis you enter. The name is used to address your child in the app; the date of birth is used to compute age for age-appropriate guidance.

What you log. Behaviour observations, daily check-ins, sensory ratings, therapy-plan feedback, screening results, milestones and daily-living progress.

Conversations. Messages exchanged with Mitra, and short summaries the system derives from them to maintain continuity between sessions.

Technical data. Session identifiers, language preference, and timestamps of activity.

3. What we use it for

• Answering you in context, so guidance reflects your child rather than a generic case.
• Generating your therapy plans, insights, sensory readings and progress views.
• Safety monitoring — messages are screened for crisis signals.
• Keeping the service working, and diagnosing faults.

We do not sell your data. We do not use it for advertising.

4. Automated processing and third parties

OpenAI. Conversation content and derived summaries are sent to OpenAI to generate responses, insights and plan recommendations. Your data is processed on their infrastructure under their terms.

Google Firebase. Handles sign-in and identity.

Hosting. The application and its database run on Railway; the site is served via Netlify.

These providers process data on our behalf in order to deliver the service. Content sent to them may leave your country of residence.

5. Removing identifying details

Before a message is stored or sent for processing, it passes through an automated step that attempts to detect and mask personal identifiers such as names, phone numbers and addresses.

This is a safety net, not a guarantee. Automated detection is imperfect, and if the component is unavailable the original text is used. Please avoid entering identifying details about third parties — teachers, clinicians, other family members — that are not necessary for the guidance you are asking for.

6. Where it is kept, and for how long

Records are held in an access-controlled database, separated by account. Active conversation context is held in fast temporary storage and expires after about fourteen days of inactivity, so a conversation you return to is still there. Older parts of a long conversation are condensed into short summaries so continuity survives without keeping every message in that store indefinitely.

Safety and crisis-screening audit records are kept for up to seven years, because they may be needed to demonstrate that an escalation was handled correctly.

We do not currently delete your other records automatically. Your child's profile, logs and history remain until you ask us to remove them.

7. Your choices

You can ask us to:

• See what we hold about you and your child.
• Correct anything that is wrong — most profile and log data you can also edit directly in the app.
• Delete your account and your child's records.
• Take a copy with you. The clinician report and plan export already let you download much of it yourself.

Depending on where you live, you may have further rights under laws such as the GDPR or India's DPDP Act.

8. Children's data

Accounts are held by adults. A child profile is created and controlled by the caregiver who holds the account, and a child does not sign in themselves.

Because this data concerns a child's health and development, it is treated as sensitive. Access is limited to the account holder and to anyone that account holder has explicitly invited through Family & Care Team, at the level of access they were given. That access can be revoked at any time, and revoking it removes the person's link to the child without affecting the child's records.

9. Changes to this policy

If we change how data is handled in a way that materially affects you, we will update this page and the date at the top. Continued use after a change means you accept the updated policy.