Privacy & Data Rights

Data Deletion Policy

Effective Date: September 11, 2026
Last Updated: September 11, 2026

This page explains how you may request deletion of personal information held by Ephatha. Deletion requests are handled by Grace Valookkaran Paul (Grace V Paul), RCI Central Rehabilitation Register (CRR) No. A92329.

You may request deletion subject to information that we are required or permitted to retain by law or that is reasonably necessary for legitimate legal, security, accounting, professional, or dispute-resolution purposes.

1. How to Submit a Deletion Request

Send an email to gracepaulaslp@gmail.com with the subject line “Data deletion request”.

Your request should identify:

• that you are making a personal-data deletion request;
• the appointment, contact interaction, or other information concerned; and
• any other information reasonably necessary to locate the relevant record.

Do not send passwords, payment-card details, or unnecessary medical information with your request.

2. Identity and Authority Verification

We may need to verify your identity or authority before deleting or disclosing personal information. This protects against another person attempting to delete, access, or alter someone else's information.

Verification will be limited to information reasonably necessary for the request. We will not ask you to provide unnecessary sensitive information.

3. What Deletion Means

Where deletion is approved, we will delete, securely destroy, or anonymize the relevant information from active systems where reasonably practicable.

Some information may remain where it is necessary to:

• comply with a legal or professional obligation;
• resolve an ongoing dispute or complaint;
• prevent fraud, abuse, or security incidents;
• establish, exercise, or defend legal claims; or
• maintain records that applicable law requires us to retain.

Retained information remains subject to appropriate protections and will not be used for unrelated purposes. Protected technical backups may also persist for a limited period before being overwritten or securely removed.

4. Appointment and Booking Information

If your deletion request concerns an appointment, we may need to retain a limited record where required for professional, legal, accounting, regulatory, dispute-resolution, or security purposes. Where no such retention requirement applies, the relevant information will be deleted, securely destroyed, or anonymized where reasonably practicable.

5. Google Calendar Data

Ephatha provides an optional Google Calendar integration for the therapist. If the Google Calendar connection is disconnected, Ephatha stops using the authorization for subsequent calendar operations and removes stored OAuth connection credentials according to the application's data lifecycle.

Google may independently retain or process information under Google's own terms, privacy policies, and data-retention practices. Ephatha cannot delete information that is independently controlled by Google; requests concerning Google's own systems may need to be made directly to Google.

6. Google User Data and Deletion Boundaries

Ephatha does not sell Google user data or use Google user data for advertising, unrelated database creation, or generalized AI or machine-learning model training. Google Calendar data is used only for the calendar integration, appointment synchronization, conflict checking, and related user-requested scheduling functionality.

OAuth refresh credentials used by Ephatha are encrypted before storage.

7. Processing Time

We will respond to a valid deletion request within the period required by applicable law. Where additional information or verification is reasonably required, we may need additional time to complete the request.

If we cannot fully comply with a deletion request, we will explain the relevant legal or operational reason where the law permits us to do so.

8. Other Privacy Rights

Depending on your location, you may also have rights to access, correct, restrict, object to, or receive a copy of personal information, and to withdraw consent where applicable. See the Privacy Policyfor further information.

9. Contact

Data deletion and privacy requests should be sent to:

Grace Valookkaran Paul (Grace V Paul)
RCI CRR No. A92329
gracepaulaslp@gmail.com