Wysa Privacy Policy

This Policy applies to all visitors, data subjects, and others who access our Apps and Services ("User(s)" or “You/r”) including persons buying for teams (“Subscribers”). Touchkin eServices Private Limited (“Touchkin”, “Wysa”, “We”, “Us”, or “Our”) operates the website (wysa.com and domains), the Wysa mobile, web-based widget, Wysa SDK and web-based applications (“Wysa App” or “App/s” or “Mobile Software/s”).

You may use our Apps to access one or more of our services and offerings (collectively the "Service(s)" or “Wysa Service”).

AI chatbot (“AI Coach”).
Digital selfcare tool-packs.
Emotional well-being professional.
Guided-group meditations.
Services offered over WhatsApp (available in select geographies only).
Services purchased from our website and webpages.
Digital front door or e-triage.
Multi-lingual offerings (available in select geographies only).
Online controlled and real-world research studies
Validated preventative guided programs for Institutional users.

We may also provide these and additional services on behalf of your Institution (“Institutional Services”). An Institution could be an enterprise, university, hospital, research institution and other public or private organisations. Institutional Services may involve processing information on behalf of the Institution. Where applicable, you must agree to the Terms of Services and Privacy Policies of both Wysa and your Institution in order to proceed with using the Institutional Service.

This page informs you of our policies regarding the collection, use, and disclosure of your personal information when you use our App and service. This Privacy Policy aims to fulfil our obligation towards your Right to be Informed. We use your data to provide and improve the service. We will not use or share your data with anyone except as described in this Privacy Policy. We align our data protection practices to the key principles prescribed by General Data Protection Regulation (GDPR) and other Data Protection Laws (as defined below).

By using our Apps and services, you agree to the use of information as per this privacy policy and cookie policy. Unless otherwise, the terms used in this Privacy Policy have the same meanings as in our Terms of Service.

Where not specifically called out, use of uppercase / lowercase and bold / not bold would carry the same meaning in this document.

Updates

We may amend this privacy notice from time to time to keep it up to date. We will notify you via in-app notifications and on our policy webpage when we make any changes to the Privacy Policy. Please regularly check these pages for the latest version of this notice.

Initial Effective Date: June 30, 2017 (GMT)
Latest Revised Date: Dec 18, 2023 (GMT)
Version: 5.5.0

Content

What personal data do we process and how do we use it?

What data do we process when you use the Wysa Digital Front Door Service?

What personal data do we process and handle as a Processor or Sub-processor?

What additional personal data do we process when you use our WhatsApp-based business service?

What additional personal data do we process when you participate in the online controlled or real-world studies?

What Non-Personal data is processed when using Wysa emotional wellbeing professional service?

Do we use passive sensing or location data?

How do we share your data with third parties

How do we handle your App password?

What data do we process after taking your Consent?

How do we handle user incidents and requests?

How do we handle data provided during promotions and surveys?

How do we handle your payment data when you subscribe to our services?

What do we process when you follow us on Instagram or our other social media pages?

What do we process when you use the android speech-to-text feature?

Additional information when you use the audio-video emotional wellbeing professional service.

How do we handle your data when used for research purposes?

What data do we process as part of Gift Card purchase?

Additional information when you apply for employment or internship opportunities at Wysa.

Your use of third party weblinks

What additional processing is performed?

How do we secure your data?

How does the Artificial Intelligence chatbot work and is it safe to use?

How do we use Generative AI technology?

How long do we retain your data including personal data?

International transfer of personal data outside of the country you reside in or are currently located

What are Your data protection rights?

Other important information

Do California residents have specific privacy rights?

What are the controls for Do-Not-Track features?

Can Children under 13 use Wysa App?

Who can You contact for additional questions, comments or concerns?

Can Non-English speaking users use the Wysa App?

What are some Best Practices to follow to keep Your devices secure?

Changes to this Privacy Policy

Severability and Exclusion

Changes Log

Do Note :

If in a crisis or emergency, please call the relevant emergency number in your country or the approved helplines provided by Your Institution.
The App and service is not to be used by children under 13 years. Wysa does not take responsibility for any misrepresentation of age and use.
If you are between 13 and 18 years, read the Privacy Policy and Terms of Service with your parents or legal guardian and agree before use. Where requested by us, ask them to provide their consent to use the services at [email protected].
We do not require any personal identifiers or sensitive data hence we do not ask for it. We may collect personal data where your Institution asks us to do so. You have the option to not share your personal data, your medical data and any other sensitive data when you use the Wysa App and Services.
Your interaction with the AI Coach is with an Artificial Intelligence system and not a human. Hence, AI Coach is restricted in the means of response.
Your interaction with Wysa emotional well-being professionals is with a human. They are highly trained and qualified emotional health and well-being professionals.
Wysa emotional well-being professional services do not replace face-to-face psychotherapy. It is meant to empower and support you and not to treat any illness or a health condition.
The Wysa emotional well-being professional assigned to work with you will be online and remote. They may not be located in your country or state of residence.
The intended use for providing evidence-based tools and techniques is to manage emotions and encourage mental well-being in a self-help and self-monitoring context.
The App is not intended to provide a diagnosis, prognosis, treatment or cure of a condition or disease.
The App will not offer medical or clinical advice and only suggest that you seek medical help. Wysa App is designed to offer general mental health advice and support and cannot offer condition specific advice for complex medical conditions such as complex long term illness, cancer, infertility or genetic disorders among others.
Your data is stored in databases maintained by us and third parties located in countries other than your country of residence. Some of them may have data protection laws that may be less stringent than those in your country.
The App and its services are primarily in the English language. We also provide Hindi and Spanish version apps for users in certain geographies. Some of the AI Coach modules, Wysa emotional well-being professional services and tools are enabled for Hindi and Spanish language users and are available only in certain geographies.

Changes in v5.5.0 | Dec 18, 2023

Additions

Included “Validated preventative guided programs” in Wysa’s list of Services for Institutional users.
Wysa emotional well-being professional service is included in Hindi and Spanish language Apps.
Use of 3rd party tools to detect and replace any inadvertent personal identifiers within your text messages for better privacy protection.
Details about user level data sharing with Institutional users and about processing health data as a business associate within What personal data do we process and handle as a Processor or Sub-processor?
New service provider Turn.io (as a Business Solution Provider for our whatsapp service)
New service provider private AI (to redact inadvertent personal identifiers in text messages)
New section that provides details on “How do we use Generative AI technology?”
Additional privacy and security messages from USA FTC and the Department of Health and Human Services (HHS) about how to protect your information when using digital technologies.

Updates

Updated data protection law definition to include India’s DPDP Act 2023
Capture pronouns as other information processed on behalf of Institutions
The list of Service Providers section to provide clarity on data type, purpose and storage involved in the data processing.
Moved the Cloud Service Provider details in the “How do we share your data with third parties?” to the list of Service Providers section.
Promotional event data and Business (B2B) data details within the “What data do we process after taking your Consent?” section.
Data protection rights to inform our obligation where we require to process rights on behalf of your Institution.

You can read the full list of changes in the Changes Log

Definitions

AI Coach is the text-based AI service provided in a conversational messaging mode by Wysa Apps.

Anonymization is the process of removing personal identifiers from data sets so that the person can no longer be identified.

Cookie is a small amount of data stored on your device (computer or mobile device).

Data or Information under this Privacy Policy means both personal and non-personal data or information.

Data Controller or Controller has meaning as defined in applicable data protection laws. It is a natural or legal body which, alone or jointly with others, determines the purposes of the processing of personal data.

Data Processor or Processor or Service Providers or Business Associate has meaning as defined in applicable data protection laws. It is a natural or legal body which processes personal data on behalf of the data controller.

Data Protection Laws here means in accordance with the Indian Information Technology Act, Reasonable security practices and procedures and sensitive personal data or data rules and the Digital Personal Data Protection Act, 2023, including but not limited to requirements of EU General Data Protection Regulation 2016/679 (GDPR), the UK Data Protection Act 2018 (UK GDPR), California Consumer Privacy Act (“CCPA”), California Privacy Rights Act (“CPRA”) and other USA privacy laws. Where applicable USA’s Health Insurance Portability and Accountability Act (HIPAA) and applicable Legal and Statutory requirements.

Data Subject (or User/You) means any living individual who is using our service and is the subject of Personal Data

Encryption is the process of transforming data into unreadable text so that it is only legible to those possessing an encryption key.

Personal data or Personal Information has meaning as defined in applicable data protection laws. It is data about a living person who can be identified from the data and/or other information either in our possession or likely to come into our possession.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data and as defined in applicable data protection laws.

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific user without the use of additional information.

Non-Personal data or Non-Personal Information means any data that is made anonymous and does not reveal user specific identity.

Sub-Processor/s is a data processor who is sub-contracted some of the personal data processing.

Special Category data or Sensitive data has meaning as defined in applicable data protection laws. It includes personal data revealing or concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex-life or a person's sexual orientation.

Who are we?

Touchkin is a private limited company having its registered offices in India (Touchkin eServices Pvt. Ltd.), UK (Wysa Ltd.) and USA (Wysa Inc.). We are registered with the UK ICO. Our data protection registration number is ZA845530. Where we decide the purposes of our services and personal data processing, Wysa will be the Controller. For all services and data processing done at the direction of and on behalf of a Controller or a Processor, Wysa would either be a Processor or a Sub-Processor.

What personal data do we process and how do we use it?

We only use your personal data for the purposes for which we collected it. We will use it for another reason, only if compatible with the original purpose. We may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. We may process your personal data without your knowledge and consent, where this is required or permitted by law.

The table lists the data processing that we perform when you use the AI Coach, Digital self-care tools, human well-being professional service, services purchased from our website or multi-lingual offerings.

Data Types	Source	Processing Purpose	Lawful Basis
Android or Apple identifier (app-device identifier)	Collected from your device	To recognize you as a new or existing user. To create a random user identifier. Perform deletion of identifier before sharing data for analytic purposes. To associate users to their provided data to provide uninterrupted App and services. To migrate your data to a new device. To process subscription-related requests. To administer your account. To process for addressing your data rights. To comply with applicable law or regulation.	To perform our contract with you (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy)
Random user identifier	Created by Wysa	To recognize you as a new or existing user. To provide App and services. To create a random truncated identifier to provide minimal data for internal analytics. To provide additional security during data transfers. To administer your account. To process your data rights.	To perform our contract with you. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy)
Access or referral code	Created by Wysa and entered by you.	To send deep links to directly access the App and Institutional Services. To register you as an Institution user. To authorise access to Institution-agreed services. To provide customized App and services for referred and Institution users. To aggregate data at Institution or cohort or user level for analytics purposes. To administer your account. To process your data rights.	To perform our contract with you and with your Institution. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy)
Nickname	Provided by you.	To personalise content on the App and services. To administer your account.	To perform our contract with you. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy)
Device data (Operating system, OS version, device make and model, time-zone)	Collected from your device	To detect and prevent fraudulent use of or abuse of the service. To resolve issues. To improve App experience and use. To provide service-related information. To remind users of upcoming sessions and events.	To perform our contract with you. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy) Legitimate Interest to troubleshoot, ensure security and user experience.
Conversation data (free text messages, accidental identifiers submitted, Clinical questionnaires/assessment and scores, wellness data, voluntary SOS data) (Clinical questionnaires are a proven way to track progress of your mental well-being. You have the option to not respond to these assessments) (Wellness data include voluntarily provided special category health data. You have the option to not share any sensitive physical or mental health-related data.)	Voluntarily provided by you.	To apply our AI algorithms to wellness data to derive new data to indicate mood and emotional state. To detect context and ensure continuity in conversation. To detect medical or emergency terms to ensure safe conversations. To provide the right tool, technique and content. To provide and process the CBT Programs, the preventative programs and send program use reports back to your Institution. To detect any SOS or self-harm triggers in messages and to signpost to safety resources. To improve AI algorithm safety. To improve product and service quality and customer experience. To anonymise reports. To anonymise research and analytics data. To share app use reports back to your Institution.	To perform our contract with you. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy) Additional Condition for any Special Category data: Reasons of substantial public interest. For safeguarding of children and individuals at risk.
Conversation data (Hindi or Spanish language free-text messages with AI Coach, wellness information)	Voluntarily provided by you.	To use 3rd party translation APIs to chat with Hindi or Spanish language AI Coach modules and tools. To apply our AI algorithms to derive new data to indicate mood and emotional state. To ensure continuity in conversation. To provide the right tool, technique and content. To improve the safety of our algorithms. To improve product and service quality and customer experience. To provide aggregated and anonymous analytics reporting. To perform anonymous research and analytics. To share app use reports back to your Institution.	To perform our contract with you and in our legitimate interest. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy) Additional Condition for any Special Category data: Reasons of substantial public interest. For safeguarding of children and individuals at risk.
Conversation data (text-based or audio-video based messages with a human emotional well-being professional- inadvertent submitted personal identifiers, mental well-being information, video profile and background, consent-full name, emergency contact information- phone numbers). Applicable within English, Spanish and Hindi language Apps and Services.	Voluntarily provided by you.	To provide Wysa emotional well-being professional service. To recommend tools and techniques. To support and encourage self-care. To provide safety related support. To collect explicit consent. To reach out to emergency contacts for your safety. To perform consent-based research and analytics. To improve product and service quality and customer experience. (Audio-video sessions are not recorded and stored by Wysa)	To perform our contract with you. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy) Your consent to emotional well-being professional service. Additional Condition for Special Category data: Reasons of substantial public interest. For safeguarding of children and individuals at risk.
Inadvertent submitted personal identifiers (names, location, contacts, email identifiers)	Voluntarily provided by you.	To take reasonable steps using third party tools, to detect and anonymise personal identifiers in end-user text messages in English, Spanish and Hindi language Apps.	Legitimate Interests
Institution or Subscriber provided data (Institution or subscriber name, inquiry messages, email identifiers, names, phone number, Institution or subscriber user personal data)	provided by your Institution or subscriber and on your behalf.	To respond to the Institution or subscriber raised business and operational inquiries. For sending you an SMS or email on order confirmation and with access to our App. To inform you about our campaigns, product and services or Institution informed messages.	To perform our contract with your Institution or subscriber. To perform our contract with you (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy)
Event Data (text button events, app screen events, tool events)	Events created during your use of App	To share anonymised event data with 3rd party providers for analytics purposes. To obscure the event data to not reveal sensitive information. To analyse app event data for improving product and service quality.	Legitimate Interests
Communication Information (name, email Identifier, email messages, subscription receipts, feedback messages)	Voluntarily provided by you.	To respond to your inquiries, requests and feedback. To troubleshoot your issues. To provide and improve customer support services. To improve App and Services quality, safety and performance based on your feedback.	Legitimate Interests
Safety Plan Information (life anchors, safe places, support networks, warning signs, calming activities)	Voluntarily provided by you.	To allow end-users to create their own safety plan. To ensure availability of safety and support resources in time of need.	To perform our contract with you. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy) Additional Condition for Special Category data:Reasons of substantial public interest. For safeguarding of children and individuals at risk.
Other personal information (age-range, gender, pronouns)	Voluntarily provided by you.	To provide age, gender-appropriate content, tools and techniques. To analyse and understand age, gender/pronoun specific trends, challenges to provide appropriate support and services. To deliver content with proper pronoun endings. Where applicable, to provide gendered languages. To identify children entering the system. To inform children to read and agree to Wysa Terms and Privacy Policy with their parents or legal guardian	To perform our contract with you. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy) Legitimate Interest to identify children in the system. Additional Condition where any Special Category processing with gender: Reasons of substantial public interest. For safeguarding of children and individuals at risk.
Network Data (Internet protocol address)	Collected from your device by Wysa’s Content Delivery Networks (CDN)	To store in the CDN database and network logs. To enable access to all images, media and tools provided within the App during use. To enable secured access to both the app and website.	To perform our contract with you. As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy Legitimate Interest to maintain security (IP address is not linked to the app user identifier and not stored in the App database)

What data do we process when you use the Wysa Digital Front Door Service?

Wysa Digital front door application allows your Institution to triage you and your dependents to authorised care and support resources. The service redirects you to authorised support resources based on your pronouns, country, service group, language choice, support choice and self-reported mood assessments. Support resources include the Institution’s EAP, the Wysa App and other Institution provided services. Access to the Wysa front door service will be via your Institution provided Single Sign-on (SSO) mechanism. Where required and on behalf of your Institution, we may integrate our App and Services with your Institution’s authentication mechanism such as Single Sign On (SSO). SSO enables you to use your Institution credentials to sign-in and access authorised Wysa App and Services and other third-party services. Wysa App will redirect you to your Institution’s SSO web page during your first access. The SSO processing is done by your Institution to verify your identity and direct you to the Wysa App. Your personal information, submitted during sign-in, is not transferred or stored in the Wysa system. Wysa will receive a one-time unique and encrypted identifier, which will be used to generate a random user identifier to associate you to the App and Services. Wysa will keep track of your login status and inform your Institution of any change to allow your Institution to manage future SSO requests. If you have any questions about your use of SSO please contact your Institution directly. No personal data is collected or processed during your use of the Wysa digital front door application and service. Wysa shall share population-level and aggregated analytics on App engagement and use with your Institution. You can delete your data at any time by selecting the “Reset my data” option available within the App.

What personal data do we process and handle as a Processor or Sub-processor?

Wysa may be a Processor where we are asked to process your data on behalf of the Institution. We will collect, transfer, store and use your data to provide the Institutional Services. Where required, Wysa will integrate with your Institution authorised information systems to process and transfer contracted data. We will maintain appropriate agreements with your Institution before any data processing or sharing.

We will also generate reports for your Institution. Only aggregated and anonymised data, at a population or cohort level, will be used for the Institution’s reporting needs. These reports will be generated and shared with your Institution as downloadable files via secure analytic dashboards. Your individual insights will never be shared with your Institution without your consent.

We may provide anonymised or agreed upon minimal user level data with some of our Institutions. This would be for provisioning of Services and/or where it helps the Institutions provide better care for you. We clearly inform the Institution and within our contracts with them about their responsibility to protect your rights and freedom at all times.

We may process additional health data (such as substance abuse, gender among others) on behalf of healthcare Institutions as a Business Associate. We adhere to privacy by design principles and minimize and limit processing of any personal identifiers. We ensure compliance to US HIPAA by enforcing administrative, organisational and technical controls to safeguard the privacy and security of any health data that we may process

Where required by your Institution, we may guide you to appropriate support and crisis resources. These would be both within and external to the App including Institution provided helplines, EAP, offline care services and therapist support. This processing is not intended to be an emergency response and is performed to safeguard individuals at-risk.

What additional personal data do we process when you use our WhatsApp-based business service?

Wysa’s AI Coach service delivered over WhatsApp business app is currently available as a pilot and only in the India geography. Wysa’s AI Coach on WhatsApp business is limited to improving sleep efficiency. The service does not offer medical or clinical advice and only suggests that you seek medical help.

We may place ads online to test take-up of a specific Service or to market a specific Service using only authorised ad managers. Alternatively, you may obtain access to this service through your Institution. No personal identifiers will be collected and stored by us when you interact with these ads. When we run ads to test service take-up, we may provide access to limited tools or techniques on a standalone web-view. Your engagement on the web-view will be collected and shared with google analytics to identify level of usage. No personal data will be collected or processed from such web-views. Please read our Cookie Policy. We will not share your identifiable usage data with ad platforms for profiling or re-targeting by a third-party.

You will need to initiate this service from your WhatsApp account. Wysa will never use your messages to contact you for marketing purposes. Wysa processes the following data when you use this service.

Data Types	Source	Processing Purpose	Lawful Basis
Mobile phone number, WhatsApp profile name	Provided by the user during service initiation	To recognize you as a new or existing user on WhatsApp. To associate users to their provided data to provide uninterrupted services. Use WhatsApp profile name to personalize the communication with you. To process data for addressing your data rights. To respond to your inquiries, requests and feedback. To troubleshoot your issues. To provide and improve customer support services. To process To comply with applicable law or regulation.	To perform our contract with you (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy) Legitimate Interest to troubleshoot, ensure security and user experience.
Random user identifier	Created by Wysa	To provide additional security by pseudonymization of personal identifiers. To associate users to their provided data to provide uninterrupted services. To administer your account. To create a random truncated identifier to provide minimal data for internal analytics. To process your data rights.	To perform our contract with you. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy)
Conversation data (free text messages, accidental identifiers, sleep-related assessment, wellness data, voluntary SOS data)	Voluntarily provided by the user.	To apply our AI algorithms to wellness data to derive new data to indicate mood and emotional state. To detect context and ensure continuity in conversation. To detect medical or emergency terms to ensure safe conversations. To provide the right tool, technique and content. To provide and process the sleep or CBT programs, preventative programs and send program use reports back to your Institution. To set reminders and notifications. To detect any SOS or self-harm triggers in messages and to signpost to safety resources. To improve AI algorithm safety. To improve product and service quality and customer experience. To anonymise reports. To anonymise research and analytics data.	To perform our contract with you. (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy) Additional Condition for any Special Category data: Reasons of substantial public interest. For safeguarding of children and individuals at risk.
Engagement data (use of service features)	Captured during use of service	To group users as cohorts for cohort-level analysis. To analyse user engagement to help improve the services.	Legitimate Interests
Demographic data (age-range, city, interests, language)	Collected from user’s click on ads	Use Meta Ads manager to create ad campaigns, send ads about the service, analyze and improve the ad campaigns. To group users as cohorts for anonymous and aggregated cohort-level analysis.	Legitimate Interests
Inadvertent submitted personal identifiers	Voluntarily provided by the user	To take reasonable steps to detect and anonymise personal data within Wysa servers.	Legitimate Interests

Your messages on WhatsApp business are always end-to-end encrypted. As per WhatsApp Privacy Policy, your messages are typically stored on your device(s) and not on WhatsApp global servers. WhatsApp will temporarily store your messages in encrypted form while they are being delivered. Once your messages are delivered, they are deleted from WhatsApp global servers. We do not share the random user identifier with Whatsapp.

We use Twilio’s or Turn.io’s secure services, a Business Solution Provider of whatsapp, to establish communication between our AI Coach service and WhatsApp business. Twilio or Turn.io APIs assist transfer of encrypted messages between WhatsApp business and Wysa. Your messages are deleted from Twilio immediately after successful transfer to our servers. Your messages may be retained longer by Turn.io as per their terms . Your phone number and profile name are however retained in Twilio or Turn.io as long as connectivity of service is required. Read more about Twilio or Turn.io in the third-party service provider section.

Note: WhatsApp allows you to send attachments or voice messages. This is not required by us to provide our service. Please avoid sharing such information with us. Any inadvertent attachment and voice messages submitted by you gets deleted immediately from our servers.

You can change your WhatsApp profile name at any time from your WhatsApp account. Clearing the WhatsApp messages will only delete your conversations on WhatsApp and as per WhatsApp data retention policies. To delete your data from Wysa servers please send us a request on [email protected]. Once deleted the data cannot be restored. Please read WhatsApp Privacy Policy and Terms of Service to understand what information WhatsApp collects and processes from you. You can block or delete our business service from your contact list at any time from your WhatsApp account. You can also mute notifications from your chat settings. You can always safeguard your information on WhatsApp using the privacy and security features provided by WhatsApp. Learn more about WhatsApp’s end-to-end encryption and Privacy and Security for business messages.

What additional personal data do we process when you participate in the online controlled or real-world studies?

You may voluntarily register or opt-in to participate in any of our online controlled or real-world studies from our web pages or social media posts. You will be asked to verify your contact to access our web-based widget App. We will provide you with study related information and seek your informed consent.

We will collect and process the following personal data from you at the time of study selections (enrollment data). This enrollment data will be used for the purpose of shortlisting participants for the study.

Data Types	Source	Processing Purpose	Lawful Basis
Email ID	voluntarily provided by you.	To authenticate and authorize you via OTP. To recognize you as a new or existing user on the App. To associate users to their provided data to provide uninterrupted services. To communicate study qualification. To communicate about the study prior to and during study period. To process data for addressing your data rights. To respond to your inquiries, requests and feedback. To troubleshoot your issues. To provide and improve customer support services.	To perform our contract with you (As an end-user, our contract is your agreement to Terms of Service and this Privacy Policy) Legitimate Interest to troubleshoot, ensure security and user experience.
Demographic data (country, gender, socio-economic status, age-range)	provided by you.	To apply study inclusion and exclusion criteria to qualify and recruit study participants.	Your Informed Consent for study participation
Health and wellness data (ethnicity, alcohol/substance use concerns, use of medication, any mental disorder diagnosis or treatment, about hallucination, validated assessment responses like PHQ-9, GAD 7, WSAS)	provided by you.	To apply study inclusion and exclusion criteria to qualify and recruit study participants.	Your explicit consent for study participation Additional Condition: Article 9 (j) archiving, research and statistics

You will be notified about your study qualification. If not selected or on drop out, your enrollment data will be permanently deleted from our systems within 60 (sixty) days. If selected for the study, your enrollment data will be retained by us for upto 1 year after study completion, after which they will be permanently deleted. You will receive a link or study referral code to access our mobile App for the study.

Data Types	Source	Processing Purpose	Lawful Basis
Study Referral Code	created by Wysa and assessed or entered by you.	To send deep links to directly access the App to qualified participants. To randomly authorise access to the control or intervention versions of the App. To aggregate data at Institution or cohort or user level for research and analytics purposes. To administer your account. To process your data rights.	Your explicit consent for study participation Legitimate Interest to support and process data rights.

We will collect and process your personal data when you use our mobile App as outlined here. At the end of the study period all users will be automatically considered as regular (non-study) users of our App. Only anonymised data (non-personal data) will be used for research, analysis and publication purposes. Your non-personal data will be retained as per our retention and deletion policy mentioned here.

Data Types	Source	Processing Purpose	Lawful Basis
Non-personal data (enrollment, engagement, resource utilization, safety triggers, assessment scores, feedback)	derived by Wysa for your provided study data	Derive and process non-identifiable data and assessment scores for research and study analysis. Process insights for the purpose of research publication.	Your explicit consent for study participation

You have the right to opt-out of research at any time after the study begins. You can either choose to opt-out from the app settings or write to us at [email protected] with the subject “opt-out of Wysa’s online controlled or real-data study”. On successful opt-out, we will delete your enrollment data within 1 (one) year of opt-out. Your data provided during use of mobile App will be retained as per our retention policy mentioned here.

Your data provided during the study will always be kept secure. Read more about our organisational and technical security safeguards here.

What Non-Personal data is processed when using Wysa emotional well-being professional service?

When you schedule a session with our Wysa emotional well-being professional, we collect your date and time preferences to confirm your booking. Your device time zone is collected to calculate your local date and time and schedule a session. It also allows us to send appropriate session reminders. Sometimes, Wysa App may get your local time wrong which could affect the session scheduling. Always verify your local time in the scheduling screen before booking a session. If you notice an error in your local time displayed, go to the AI Coach messaging interface and type #time to change your time. If You face any challenge changing Your local time or booking a session, kindly write to us at the contact provided here.

After you book a session, you have the option to save the booking in your device calendar. This is for your added convenience.

Only minimal messages provided to your emotional well-being professional get used for analysis and audit purposes. Your messages are anonymised before use. This is for improving our emotional well-being professional service quality.

The Institution Version of Wysa App may carry a link to the institution EAP or health provider instead of or in addition to the Wysa emotional wellbeing professional. The EAP provider’s terms and privacy policy will apply to use such services.

Do we use passive sensing or location data?

The App does not process any data from your mobile device sensors, including accelerometer, ambient light readings, screen on/off readings and call logs. The App does not process your geolocation at a level that makes your data identifiable. The App may infer your country or state based on your time zone to provide you appropriate resources, such as scheduled reminders.

How do we share your data with third parties?

To provide you with our services, we use third-party service providers to help store and process your data. We assess the service provider’s security and privacy practices. We strictly require that they comply with confidentiality and non-disclosure obligations and applicable laws and regulations including relevant Data Protection Laws. We also require that they or their providers (fourth parties) access your data only to the extent necessary to perform tasks on our behalf. We use the following third-party service providers.

Service Providers

We use Wysa authorized third-party service providers to provide our services. List of our service providers include:

Service Providers	Purpose
Amazon web Services (AWS)	Data Types: All data types submitted and collected from you during Wysa App use. Purpose: To provide Infrastructure as a Service. Provide compute, monitoring and support services. Provide tools and applications for support, monitoring, analytics. Storage: Your App data gets encrypted, transferred and stored in the USA region. You can find more on their GDPR, HIPAA and security practices here- GDPR, HIPAA, Security and Data centre controls . We maintain a Data Processing Agreement (DPA) with UK IDTA and Standard Contractual Clauses (SCCs) and Business Associate Agreement (BAA).
MongoDB ATLAS on AWS	Data Types: All data types submitted and collected from you during Wysa App use. Purpose: Provide Database as a Service. To provide the service, we collect, transfer and store your data in secure AWS provided servers. Storage: Your App data gets encrypted and stored in the USA region. You can find more on their GDPR, HIPAA and security practices here- GDPR, HIPAA and Security. We maintain a Data Processing Agreement (DPA) with UK IDTA and Standard Contractual Clauses (SCCs) and Business Associate Agreement (BAA).
Firebase, Google Analytics	Data Types: Only anonymised event data. Purpose: To analyse App event data to understand user engagement and experience. No user conversation or personal data gets shared. Only a de-identified user identifier is shared along with the event data. All event data is made cryptic so that no medical or psychological profile gets created at the hands of the analytics provider. Storage: Anonymised app event data gets transferred and stored in the USA region. No direct advertising or direct marketing is performed. However, to measure the effectiveness of our social media or other marketing campaigns, we may use these tools to help us make improvements to our service. The third-party tool APIs may automatically collect some non-personal events. Google Analytics automatically collected events can be found here. The use of Google Analytics is governed by Google Data Policy and Data Safeguards. Firebase automatically collected events can be found here. The use of Firebase is governed by Firebase Terms of Service, Use Policy and Crashlytics Terms of Service. We maintain Data Processing Agreements (DPA) with SCCs with these service providers
Strikingly	Data Types: Information collected when you visit our website including cookie consents. Purpose: Our website is hosted on Strikingly. Strikingly uses your visit data to perform and provide views on our website usage analytics. Processing of any cookies is governed by our Cookie Policy. The use of Strikingly is governed by Strikingly’s Terms of Service, Privacy and Cookie Policy and GDPR Compliance Statement.
Branch.io	Data types: Communication data (Institution provided email ID). Purpose: No user conversation or personal data gets shared. Only aggregated data is logged to improve user experience. Storage: Minimal data gets stored in the USA region. We use Branch.io to provide deeplink service for our Institution users that helps provide direct access to the App and services and is governed by branch.io’s Terms of Service, Privacy Policy and Security & GDPR Compliance. We maintain Data Processing Agreement (DPA) with UK IDTA and Standard Contractual Clauses (SCCs)
Mailgun (Sinch)	Data types: Communication data (Institution provided email ID). Purpose: No user conversation or personal data gets shared. Only aggregated data is logged to improve user experience. Storage: Minimal data gets stored in the USA region. We use Mailgun to send confirmation messages to new users who subscribe to our services based on our promotions on Facebook/Meta, Google, Instagram or the App. We may request your personal name and institutional email ID and transmit this to Mailgun for the sole purpose of sending you the customized link to access the App basis agreement with your Institution. Your name and email ID will not be stored in our servers and will not be used for any other purposes. The services provided by Mailgun are based on their Terms of Service, Privacy Policy and Security & GDPR Compliance. We maintain Data Processing Agreement (DPA) with UK IDTA and Standard Contractual Clauses (SCCs)
Zoom	Data types: Conversation data (audio-video sessions only). Purpose: We use Zoom healthcare (HIPAA compliant) to provide audio-video sessions by our emotional well-being professional both within and outside the App. For Wysa emotional well-being professionals to conduct webinars and group sessions for our Institutional users. Storage: Data gets stored in the USA region. We do not record or store any Zoom sessions unless required by our Institutions. Zoom may collect additional personal information from you to provide their services. Please read their Terms of Service and Privacy Policy. You can read about Zoom security compliance here including HIPAA Security, Compliance certifications. We maintain Data Processing Agreement (DPA) with UK IDTA and Standard Contractual Clauses (SCCs) and a Business Associate Agreement (BAA).
Google Workspace	Data types: Only limited, aggregated and anonymised data types, communication data (contact details over email). Purpose: For improving quality, performance and safety of App and Services. Your email ID when you write to us with inquiry will remain in our Gmail servers. Storage: Data region set to Europe region. We use Google Workspace to provide our corporate email service, to store Information received from our clients and end-users in google drive and google docs. We have a signed DPA with SCCs and BAA with Google Workspace. We maintain Data Processing Agreement (DPA) with UK IDTA and Standard Contractual Clauses (SCCs) and a Business Associate Agreement (BAA).
3rd party Taggers and Translators	Data types: Only minimal anonymised conversation data. Purpose: We may use third-party providers to tag, translate and test content in English and other languages. This helps us improve the AI Coach algorithm performance. We maintain confidentiality agreements with these contractors.
3rd party background verification consultants	Data types: Recruitment data (candidate information). Purpose: We use consultants to perform background checks for shortlisted candidates. This includes reference checks and academic checks as part of hiring. We maintain confidentiality agreement with the consultants.
3rd party payment gateway providers	We use payment providers such as Stripe, PayPal, Razorpay and those provided by app stores to process payment when you purchase from us. Use of the Payment providers is governed by their terms of use and privacy policy. Wysa does not collect and store your credit card related information. We may collect your name, email Id to send you confirmations and for operational purposes.
DeepL	Data types: Conversation data provided by you when you use the App. Purpose: We use the DeepL translation API when you use our Spanish language AI Coach modules and tools. No data is stored within DeepL servers. All data is deleted immediately after the translation has been completed. The connection to DeepL servers is always encrypted. Your data is not used for any purposes other than for translation, nor can they be accessed by third parties. Use of DeepL is based on their Terms of Service. DeepL adheres to EU GDPR requirements. Read their Privacy Policy to understand how they handle your data. Read here about the data security provided. We have a DPA with UK IDTA and SCCs.
Twilio	Data: Information provided by you when you use our App or Services. Purpose: We use Twilio in our app to programmatically make calls to emergency contact numbers shared by you for your safety during use of the emotional well-being professional services. We also use Twilio as a Business Solution Provider (BSP) to integrate Wysa’s AI Coach with WhatsApp business. This is done using their web service APIs. Storage: Data is transferred and stored in Twilio servers in the USA region. Twilio encrypts all communication. For WhatsApp messages, Twilio sends additional parameters. Read here for how Twilio manages Personally Identifiable Information. Here, you can read more on their privacy, terms of service and security. We have a DPA with UK IDTA and SCCs and BAA.
CloudFlare	Data: Network Data (Internet protocol address). Purpose: No user conversation or personal data gets shared. Your IP address is never mapped to your conversation messages. Hence your conversations remain secure and private. Storage: Cloudflare stores data in edge locations close to the end-user and also in the USA. We use Cloudflare for its CDN and DDoS protection. Cloudflare helps us to efficiently secure and provide our Services for you. Cloudflare has access to your IP address to provide the services. Wysa does not store or process your IP address beyond the CDN. Your IP address is never mapped to your conversation messages. Hence your conversations remain secure and private. Cloudflare may process your browser and operating system related information for logging and abuse prevention purposes. You can read Cloudflare’s terms of service, privacy policy and GDPR Compliance to know more about how they handle your data. We have a signed DPA with SCCs with Cloudflare.
Meta Ads Manager	Data: Demographic data. Purpose: We use Meta Ads Manager to create ad campaigns to spread awareness, generate interest and aid conversions of our product and services. These ad campaigns will be India region focussed and for defined categories of users. These campaigns will run on facebook and Instagram. Analytics will be performed on aggregated data in order to measure the performance and reach of advertising campaigns. You can read about Meta ads here including how to manage your ad preferences. You can read Meta’s Data Policy, GDPR to know more about how they handle your data. We do not collect and store any user specific personal identifiers from Meta.
Business Development and Marketing Tools	Data: Business data, promotional data and communication information (business user and client provided contacts). Purpose: We use marketing tools for lead identification, lead generation and business operations, for communications in marketing campaigns, affiliate marketing, customer insights and other marketing activities. To communicate with our existing or prospective business clients or users. We do not associate you with your App data. We do not share your App data with these tools. We ensure appropriate consent and opt-outs are provided when we reach out to prospects. We perform vendor and tool security assessment and vulnerability checks before we onboard a tool. We sign required agreements along with appropriate data protection clauses with tool suppliers.
Salesforce / Pardot	Data: Business data and communication information (business user and client provided contacts). Purpose: We use Pardot on our website to process data that you or your Institution provide via our online web-forms. We collect consent and provide opt-out for the data processing. Storage: Zendesk stores data in the USA. The Salesforce / Pardot published compliance statement can be read here. We have a DPA with SCCs with the service provider.
Zendesk	Data: Your requests and inquiries (including institution emails). Purpose: We use Zendesk for the purpose of collecting customer support requests and inquiries. Read about Zendesk security and privacy compliance here. Storage: Zendesk stores data in the USA. We have a DPA, CCPA and BAA with the service provider.
Iterable	Data: Business and communication information (business user and client provided contacts). Purpose: We use Iterable for the purpose of sending SMS and email to you on how to download the Wysa app based on information shared by your Institution. We may also inform you about upcoming campaigns or about our product and services. Where applicable we collect opt-in and provide an option to opt-out or unsubscribe. Storage: Iterable stores data in the USA. Read about Iterable compliance and trust here. We have a DPA and BAA with the service provider.
6Sense (Slintel)	Data: Business Data (Prospective business contacts). Purpose: 6Sense sources business data from public websites and provides this data for lead generation and marketing purposes. We use 6sense for the purpose of driving sales and marketing alignment by giving sales reps access to the Institution's account data and insights. The services use anonymous buying signals to accurately predict potential sales and marketing campaigns to organizations. Wysa takes appropriate consents or opt-outs when we make such reach outs. Use of 6Sense is based on their Terms of Use. Read their Privacy Policy to understand how they handle your data. We sign required agreements along with appropriate data protection clauses with the service providers.
Turn.io (India based end-users only)	Data: Information provided by you when you use our App or Services over whatsapp. Purpose: We use Turn.io as a Business Solution Provider (BSP) to integrate Wysa’s AI Coach with Whatsapp business for only the India region. This is done using their web service APIs. Turn.io encrypts all to and fro communication from whatsapp to Turn.io to Wysa. Read more on their privacy, terms of service and security. We have a BSP agreement with DPA with the service provider.
Private AI	Data: Accidental personal identifiers provided by you within conversation text messages with the AI or Wysa emotional well-being professionals. Purpose: To detect, anonymize, and replace entities of personal information accidentally shared by end users in English Hindi and Spanish languages. The Service runs on Wysa’s cloud servers, and hence your text messages are never transferred to Private AI. Read more about Private AI Privacy Policy, Terms of Service and GDPR support.

Disclosure to Institutions

You may need an access code or link provided by us, or your Institution, to use the Institution version of Wysa App. Your Institution may also get access to app usage data for their analytic and research purposes based on the consent given by you to your Institution and to us. We may collect your country, division and in some cases your city information to provide aggregated analytics. We do not share your messages with the Institution. Any inadvertent identifiers get removed prior to the aggregated analysis.

If the App is integrated with your Institution system, your Institution may additionally share your assessment scores with us and likewise, we may share aggregated user data with them. Such assessment scores may be processed by us for providing services to your Institution. Your assessment responses will never be processed for diagnostic purposes or for giving clinical advice.

Processing of any of your personal data as per our Legitimate Interests

We may be required to process your personal data in our legitimate interests.. We will always weigh your rights and freedom before we process any such requests for purposes of legitimate interest. This processing includes:

For enforcing our policies or contractual obligations with your Institution;
For uses and disclosures required by law;
For disclosures for judicial and administrative proceedings such as court order or subpoena;
For disclosures for law enforcement purposes or national security requests;
For disclosure and assistance with an investigation or prosecution of suspected or actual illegal activity;
For disclosure and use of a litigation hold. To freeze specific data relating to imminent, pending or current legal action, thereby preventing potential evidence alteration or deletion.
For uses and disclosures for public health reporting purposes;
For uses and disclosures to prevent serious threat to health or safety;
For uses and disclosures for minimal research and analytics purposes to study how users use our products and services;
For any service communications relating to your use of App and services;
To prevent, detect and repair problems related to the security and the operations of the App;
For uses and disclosures to prevent fraudulent use of or abuse of the service;
For uses and disclosures to take adequate security and privacy safeguards;
For uses and disclosures to ensure App and service availability, accessibility and quality;
For uses and disclosures to protect your data protection rights;
For uses and disclosures to protect your, our and others data protection rights, property and safety;
To use anonymized, non-identifiable, non-confidential user data for benchmarking and marketing;
To develop new services, technologies and products;
To respond to your enquiries and requests.

Wysa will never share your conversation data without your explicit consent provided either to us or your Institution.

In the future, if we are involved in any merger, acquisition, sale of assets, business reorganization, bankruptcy, we may transfer or otherwise share some or all of our assets which may include your data. We will take reasonable steps to inform you about this using the following modes.

Public notice on our website and/or
Inform your Institution and/or
Where applicable, send in-app notification and/or
Changes to this privacy policy and in-app notice.

You can always email us at [email protected] to exercise your data protection rights.

However, in such an event of sale or transfer, we shall reasonably ensure that your data with us is stored and used by the transferee in a manner that is consistent with this Privacy Policy and applicable Data Protection Laws. Any such third-party to whom we transfer shall have the right to continue to use the data that you provide us immediately prior to such transfer or sale. On completion of the sale or transfer, the Privacy Policy of the third-party shall apply with respect to your data.

How do we handle your App password?

For your privacy and security, you are advised to set your own App PIN to protect unauthorized access of your conversation messages. Your mobile device screen password is your PIN. To extend your device password, use the "Set Lock " feature under the App settings. You can also remove your PIN using the "Remove Lock” option under settings. The PIN that you use is personal to you, and you are responsible for maintaining the confidentiality and security of your PIN. Please keep your PIN safe and do not share it with anyone. The PIN you set remains in your device and is not collected, transferred and stored in our servers.

What data do we process after taking your Consent?

We take your consent to perform the following processing.

Data types	Purpose	Lawful Basis
Website Cookies, web-based AI Coach widget or web beacon Data (browser type, browser language, operating System, language settings, web page views and the link clicks, campaign clicks, IP address)	To understand website visits and engagement analytics. Use of AWS operational cookies. To share anonymised event data with 3rd party providers for analytics purposes.	Your consent to our Cookie Policy (We do not sell your provided data to any third-party)
Wysa Website Contact Form (Name, Email ID, inadvertent identifiers in messages)	To respond and provide support for your inquiries.	Your consent during form submission
App usage data and reports (derived using clinical questionnaires data, wellness data, app event data)	To process and share aggregated and anonymized analytics reports with your institution. To prepare and share custom analytics dashboard views.	Your informed consent with us and/or with your Institution (Agreements are signed with the researcher or Institution)
In-app push notifications	To notify you for reminders you have set. To remind you about upcoming sessions and events.	Opt-in and Opt-out in App settings or mobile device settings.
Session conversations with emotional well-being professional	To collect minimal anonymised data for research purposes.	Consent taken by emotional well-being professional from you.
AI Coach activity and well-being assessment data	To share the data with your Wysa emotional well-being professional for your safety and support.	Authorize / unauthorize in app settings
Your conversation messages with the AI Coach	To share your AI Coach conversations with your Wysa emotional well-being professional.	Your consent given within the AI Coach (opt-in and opt-out by typing #sharechat)
Recruitment data (name, contact, address, email id, resume, references, credentials, transcripts, government provided identification, compensation information, race or ethnic origin, opinions and beliefs, physical or mental health or condition, sexual orientation, memberships, social media handles)	To source, collect, store and process recruitment data from 3rd party recruitment portals. To evaluate your application. To make job offers. To enter into an employment agreement. To perform background checks. To perform reference checks. To convey application status. To consider you for other opportunities. To improve our hiring process.	Your consent. In our legitimate interest (to comply with laws, to protect your rights)
Promotion event data (email ID, name, phone number)	To process campaigns and surveys. To contact participants regarding campaign and promotions. To send programme related information, send newsletters, webinar invites, set reminders. To enrol and onboard you to the programme or campaign. To correspond on programme or campaign matters. To monitor, enforce and comply with unsolicited communication laws prior to any marketing and business development reach outs.	Your consent given within the AI Coach and campaign/survey/digital report enrollment forms.
Business (B2B) data (business customer name, business email ID, business contact details)	To collect, store and use business data received from multiple public sources and data aggregators based on rules and safeguards enforced. To monitor, enforce and comply with unsolicited communication laws prior to any marketing and business development reach outs. To communicate with business customers for lead generation, business development, business operations, account management or marketing purposes.	Communication is undertaken with appropriate expectation setting, consents or opt outs. No unsolicited calls or emails are sent to personal contact identifiers.
Insight and Involvement data (Contact Data: Name, email, phone, age-group, area of country, country, living experience with a medical condition. Demographic data: gender, sexual orientation, ethnicity, disability)	To contact you regarding Involvement opportunities, such as enrollment, attending meetings, sharing your opinion and experiences on our product or testing our product and services. To analyze your feedback and derive insight to improve safety, effectiveness of our product and services. Your Demographic data will be used to ensure our involvement remains fair and equitable. To ensure product testing is targeted to appropriate demographic groups.	Your Consent given during insight and involvement enrolment

How do we handle user incidents and requests?

There may be occasions where you wish to contact us to seek support or make inquiries. If you contact us directly over email, we will collect minimal personal information to service your request. Your communication data is securely stored in our Google Workspace account with access to only authorized users. We have signed agreements with Google Workspace. We will only use your data to investigate the issue or request asked. Your email will be retained within our system for a maximum of 10 years since last correspondence. We will not spam you or contact you for any direct marketing. We will not share or sell your personal data with any third-party disclosure.

Your issues or complaints or requests about the App and services are taken very seriously. You will need to send an email request from your Google or Apple email ID to [email protected]. We will respond to your complaints within 3 business days. Some of your complaints may take longer to resolve. We will continuously provide you with an update until your complaints are satisfactorily resolved.

How do we handle data provided during promotions, campaigns and surveys?

We do not promote third-party offers as a part of the App experience. Your promotion, campaigns and survey submissions will never be linked to your Wysa App account. Your promotion, campaign, survey submission will reside in our secure Google Workspace or marketing tool accounts. The Google Workspace and marketing tool account is protected by two step verification. You can opt out at any time from the programme by sending us an email request from your Google or Apple email ID to [email protected]. We will respond to your request within 3 business days. Your submissions will never be shared with a third-party.

How do we handle your payment data when you subscribe to our services?

[The Institution Version of Wysa App may carry a link to the institution EAP or health provider instead of or in addition to the Wysa emotional well-being professional. The EAP provider’s terms and privacy policy will apply to use such services.]

We do not collect, retain and store your personal and card information. Your card processing is handled by third-party payment agencies. We do not collect any personal data from the play stores post-purchase or from any of our third-party payment gateway providers. We may capture the enterprise name for business and operational purposes. Please read their terms and privacy policy before making a payment. The payment confirmation and subscription details are received and processed by us. This is to support you for your subscription-based requests.

What do we process when you follow us on Instagram or our other social media pages?

You have the option to follow us on Instagram using your Instagram account from the Wysa App settings. You can set up an Instagram account, if you do not own one and follow us at @wysa_buddy. We do not associate your instagram account with your Wysa App account.

What do we process when you use the android speech-to-text feature?

During use of our voice AI Coach, you may get an opportunity to talk with the AI Coach apart from typing. For android phone users, you will need to give permission to activate your device microphone to speak to the AI Coach. On microphone activation, the Google Android provided Speech Software Development Kit (SDK)/API within your device gets initiated. The Android SDK/API converts your speech to text and displays the text in your chat. The converted text data is securely transferred to our servers. We do not access nor collect nor store your voice data on our servers. No Personal data gets asked during use of this service. Please do not share your personal or sensitive information at any time during use of this service. The microphone is deactivated when you stop speaking and will not be always listening. The lawful basis for processing of your transcribed text is governed by this agreement. The processing of your voice for the purpose of converting to text is performed by Android SDK/API which is governed by Google’s Terms and Condition and Privacy Policy. Google may collect some identifiers and Information from you to provide their service. You can read Google’s Privacy Policy here. We do not access, receive or collect any identifiers and information that is collected by Google. Please speak close to the device microphone for improved translation. If you accidentally submitted any personal information, please write to us for any rectification at the contact provided here.

The same Android SDK/API plays back the AI Coach response to you. Please ensure your mobile device volume is kept in optimal listening mode. Please note that you may experience some performance issues if you have low internet speeds.

Additional information when you use the audio-video emotional well-being professional service.

You will need to give permission to activate your device's microphone and camera. We have enabled Zoom’s healthcare product for this service. To enable video call connection, we only send anonymized identifiers to Zoom. Your call is never recorded and maintained at our or at Zoom’s end. End-to-End encryption is enabled along with other privacy and security controls. This ensures that your conversation remains secure and private. We may collect anonymous feedback from you at the end of the call. This will help us improve the quality and performance of our service.

We will be unable to provide access to playbacks or call transcripts as calls are not recorded. Your assigned Wysa emotional well-being professional will explain the benefits and risks of using the service. Please ensure your device volume is kept in optimal listening mode. Please note that you may experience some performance issues if you have low internet speeds. Please read the Wysa emotional well-being professional Service section in our Terms of Service to understand the terms for use.

How do we handle your data when used for research and analytics purposes?

We use minimal and only the required data for research purposes including aggregated data for any publications, to explore new technologies or to build new features or products. This data is completely anonymized using irreversible redaction of user identifiers prior to use. This helps us to improve our product and services and contribute to user-centered mental well-being best practices globally.

We never use your longitudinal conversation messages for research purposes and analysis. If at all, only limited messages get selected from specific AI Coach endpoints and used.

You can always write to us at [email protected] to restrict processing and opt-out of your data for research purposes.

What data do we process as part of Gift Card purchase?

When you purchase a “Gift Card” you will need to create an account with the payment gateway. Payment Processing and verification is based on payment gateway’s Terms of Service and Privacy policy. The security practices followed by the payment gateway are outlined here and here. On successful payment, we will issue the Gift codes on the payment completion screen. You can then send the codes to the recipients to avail Gift Card services as per Wysa Terms of Service. Your payment card details will not be collected or stored at our end. Only the payment confirmation, such as order identifier and receipts get collected from the Payment Gateway provider and processed by us. Processing of this data is in our legitimate Interest to support you for any payment related requests, issues or clarifications. If You have any questions regarding your Gift Card, please write to us at [email protected]

Additional information when you apply for employment or internship opportunities at Wysa.

We do not sell your Information to unauthorized third parties. Your data is stored in databases maintained by us or third parties located within India or globally. Where, privacy rules may differ and may be less stringent than those in your country. If you are successful in your application, we retain the information as part of your employee records. If you do not want us to retain your information or want us to update it, please contact us at [email protected]. Please note, that we may retain some information if required by law or as necessary to protect ourselves from legal claims.

Please read here on your Privacy rights.

Your use of third-party weblinks

The App may carry links to third-party websites and resources. When you click on those links, you may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy policies. We encourage you to read the privacy policy and Terms of use of every external link you visit.

What additional processing is performed?

We do not combine and process your personal data with any other third-party available data. Your data, messages or usage is not used for direct marketing nor is it sold to advertisers. We will always take your consent before using your name for social proof purposes.

We will update this Privacy Policy and inform you if we perform any additional processing.

How do we secure your data?

The security of your data is very important to us, and we work hard to secure it. We have implemented adequate technical and organizational safeguards to protect your data. Some of the steps we have taken to secure your data include:

Privacy by Design and Default

There is no user registration required. We don’t need it hence we don’t ask for it.
Only a nickname is sufficient to help us personalize our conversation with you.
We use pseudonymised identifiers to protect your data and identity.
No human eavesdrops during your conversation with the AI coach.
The AI Coach will always check if it has understood you correctly before progressing.
We use algorithms that irreversibly redact any inadvertent personal identifiers entered in English.
You can opt-out at any time using the “reset my data” feature available in the App settings.
We adhere to the 7 key principles set out by GDPR (see here).
We perform Data Protection Impact Assessment (DPIA) for personal data processing.

Security by Design

We use TLS and SSL encryption during transfer and AES-256 protocol at rest.
Random identifiers are used for all data transactions between AI Coach and our servers.
Our systems are secured with role-based access, strong passwords and two-step verification.
We enable endpoint security in all staff systems.
We review and maintain data processing agreements with our service providers.
We have a strict hiring and background verification process in place.
We provide regular awareness and training to our staff.
We conduct annual 3rd party compliance audits and data protection certifications.
We perform regular penetration tests of our Apps and Infrastructure.
We conduct regular checks to ensure compliance to our policies.

Certifications and Registrations

Wysa is registered with the UK Information Commissioner’s office (ICO)
Certified for Cyber Essentials
Wysa meets standards of the NHS Digital Data Security and Protection Toolkit (DSP Toolkit).
Wysa mobile App is registered with UK MHRA as a CE/UKCA Class I medical device.
Wysa's Information Security Management System (ISMS) and Privacy Information Management System (PIMS) is certified for ISO 27001:2013 and 27701: 2019.

No method of electronic transmission or method of data storage is perfect or impenetrable. While we try our best to implement controls to protect your personal data, we cannot guarantee its absolute security. To ensure your data is secure, we require your cooperation as well. Please do not copy and share your conversations with unknown people.

How does the Artificial Intelligence chatbot work and is it safe to use?

At Wysa, we use proprietary Artificial Intelligence and Natural Language Processing/Understanding (NLP/NLU) algorithms (“AI”) to understand your messages. NLP/NLU algorithms are classification techniques that are used to understand what you write. This allows the AI to maintain a conversation with you and guide you to appropriate resources. Our values require that our AI used within the App is transparent, trusted, safe and privacy protecting. All the AI used in our Apps are “FIXED” or “CLOSED”, and all chatbot responses to the user are created with clinical input and subjected to detailed safety testing before being deployed. There are no generative (those that 'create' the response to the user on the fly) or adaptive models (i.e. those that continually adapt or learn every time on their own) in use. The algorithms run at conversational nodes within a decision-tree structure.

The primary purpose of the AI-based processing is

to provide an interactive safe-by-design approach to converse and journal via text with the chatbot.
to detect and retain limited context from your messages to personalize and provide empathetic and safe conversations.
to detect at-risk situations, such as any SOS, self-harm and abuse triggers, so as to signpost users to clinically validated supportive resources and helplines.

Wysa complies with UK NHS Digital’s DCB 0129 clinical risk management standards to ensure a safe-by-design approach to our AI-based services.

How do we use Generative AI technology?

We use third-party Generative AI technology services for generating static, quality and clinically verified content scripts that provide a high performing, safe and improved user experience with our AI based Services. No personal data gets shared with these third-party services.

Generated content needs to pass our safety and quality guardrails before being accepted for use. All generated content scripts are rigorously quality checked for copyright and plagiarism, clinically validated using a therapist-in-the-loop for safety, privacy, quality and performance. Only validated content gets released within our App and Services. We will transparently inform you when we use Generative AI based features within the App.

Where applicable, We will provide additional Terms of Use and Privacy notices to transparently keep you informed about any generative AI based data processing.

How long do we retain your data including personal data?

We have built proprietary algorithms that detect personal identifiers, that you may voluntarily submit in English during your conversation with AI Coach. These detected identifiers get irreversibly removed within 24 hours within our system.

We may retain one copy of your data even after your subscription ends or Institution contract ends if it is reasonably necessary. This could be in any of the following situations:

to comply with applicable legal and statutory requirements;
at the request of a returning subscriber;
to respond to your requests
based on contractual obligations with your Institution;
in our backup for a time-bound period;
to fulfill processing that is in our legitimate interest.

Where not specified we retain your data for a maximum of 10 years since the last update and as per our internal information retention policies.

Your emergency contact information, if any provided, will be deleted after fifteen (15) days at the end of the Wysa emotional well-being professional subscription. If you renew the subscription within those fifteen (15) days, the emergency contact information will not be deleted.

You can also, at any point of time, delete all your conversation data and any emergency contact information provided by using the “reset my data” feature available in the App settings. Refer here in our policy for more details.

International transfer of personal data outside of the country you reside in or are currently located

You understand and agree that we may transfer, store and process your submitted data to a third-party processor. These processors may be based in countries other than the country where you reside. These could be countries where data protection laws may be less stringent than those from the originating country. We take additional steps in an effort to ensure our international transfer of data is consistent with applicable data protection laws.

Where we transfer data from the European Economic Area (EEA), Switzerland, and/or the United Kingdom we use appropriate safeguards. This includes use of EU / UK Standard Contractual Clauses and UK International Data Transfer Agreement (IDTA) within the Data Processing Agreements.

Minimal data may be transferred across Wysa company locations to provide our Services. We use appropriate technical and organisational measures to protect such transfers.

If you have additional questions about our international transfers of personal data, please contact us at [email protected].

What are your data protection rights?

You have certain rights under the Data Protection Laws in relation to your Personal data. To exercise any of your rights, you will need to send an email request to the contact information provided here. Please note that we may need to verify you before responding to any requests. After verifying you and examining your request, we will respond to you on the action taken within one calendar month from verification. We may at times be unable to address your request, if we are unable to correctly identify you.

Your individual rights requests may be limited, where:

denial of access is required or authorized by law;
grant of access would have a negative impact on other's privacy;
required to protect your, our or other’s rights property or safety;
the request is unjustified or excessive.

Where Wysa is a Processor or Sub-Processor performing data processing on behalf of your Institution, Wysa may redirect your rights-related requests to your Institution for a resolution. We will respond to your request as directed by your Institution.

We handle your rights-related request as detailed below.

Right to be informed

This privacy policy explains and informs you about how we handle your data when you use our apps and services.

Right of access

You have the right to exercise a data access request to know what personal data we hold about you.

You have access to view your latest conversations or view your older conversation messages within the Journey tab of the App. You have access to your text-based messages with a Wysa emotional well-being professional in the Coach or Therapist tab of the App. If you exercise your right to delete and reset your data, you will lose the right to access your data as it will be permanently deleted in our system.

You can write to us at [email protected] for any clarifications or make subject access requests. On receipt, we will review your request, make reasonable efforts to find and retrieve the requested information and respond to you within one month of your request.

Where Users have subscribed to a Service, you have the right to obtain your personal data that you provided as per our Agreement or where you consented to give us. After verifying, we will provide access to your personal data in a machine-readable format. We may at times be unable to address your request, if we are unable to correctly identify you or are limited due to one of the reasons mentioned earlier or any of the exemptions set out by the data protection laws.

Right to rectification

If your personal data is inaccurate or incomplete, you can write to us to correct or complete it. If we share your personal data with third parties, we will inform them about the correction where possible.

Right to restrict processing

You can write to us to restrict processing of your personal data, where you contest the accuracy of the data or object to our processing it. If we share your personal data with third parties, we will inform them about the restrictions where possible.

Right to object

You may write to us and object to the processing of your personal data where we apply our legitimate interest. We may stop unless we can demonstrate compelling legitimate grounds for the processing.

Right to data portability

If you are a paid subscriber of our services, you can place a request to transfer your data from your older device to your replaced mobile device. You can also request a copy of your messages to Wysa coach or therapist for your own purposes. If you are not a paid subscriber, we will need to accurately verify you, before we can process your request. We may at times be unable to address your request, if we are unable to correctly identify you.

Right to Erasure

When you use the service, you have the option to reset your data by using the “Reset my data” feature in the App settings. Reset my data deletes all your submitted data including your identifiers, past conversations, reminders, assessment responses and enabled settings. Post reset, you will not be able to recover your past data and you will be considered as a new user of the App. Hence, this feature is to be used at your discretion. If you are a paid subscriber, your transactional data and messages will be deleted on reset. However your active subscription, purchased through third parties like google play, iTunes, etc., will continue to exist post reset of data.

You can also write to us to delete or remove your personal data, such as when you withdraw your consent.

Right in relation to automated decision-making and profiling

You have the right to be free from decisions based solely on automated processing of your personal data, including profiling, which may have a significant effect on your rights and freedom, unless such profiling is necessary for entering into, or the performance of our Agreement or with your explicit consent. You have a right to ask us to stop any automated decision making that may affect your rights and freedom. We do not intentionally carry out such activities, but if you do have any questions or concerns, we would be happy to discuss them with you. You can contact us at [email protected].

Right to non-discrimination

You have the right to not be discriminated against for exercising your CCPA (CPRA) rights or as required by other data protection laws. Use of our app and services is anonymous and hence We will never knowingly discriminate against you and your rights. You can also write to us for any clarification at [email protected].

Right to opt-out of sale

You have the right to opt-out of the sale or restrict sharing of personal data with third-parties who intend to license or sell your personal data. For purposes of the CCPA (CPRA) and other applicable data protection laws, We do not sell any personal data, nor do we have actual knowledge of any sale of personal data of minors under the age of 16 years. You can also write to us for any clarification at [email protected].

Other important information

Withdraw Consent

To the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent at any time. This will not affect the lawfulness of processing of your data before we received notice that you wished to withdraw your consent.

Breach notification

If the data breach is likely to result in a high risk of adversely affecting your rights and freedom, we will notify you as required by Data Protection Laws.

Concerns and Complaints

If you have any concerns or grievances about this Privacy Policy you will need to send an email to [email protected] with Attn. to the Data Protection Officer (DPO) and Grievance Officer. We will respond to you within 36 hours and help resolve your concerns or complaints. We assure you a time-bound resolution not exceeding one month from the date of your complaint.

If you are not satisfied with our resolution, you have the right to complain to a Data Protection supervisory authority in your country or state of residence. We will fully cooperate with the supervisory authority. You can raise a complaint with the UK ICO by following the process outlined here. Contact details for Data Protection Authorities in the EU are available here.

Do California residents have specific privacy rights?

There are certain disclosures required by the California Consumer Privacy Act (or “CCPA”) and California Privacy Rights Act (“CPRA”). This section supplements this Privacy Policy and applies to users who reside in the State of California.

Much of the Personal Information that We collect when you use our Services is not subject to the CCPA (CPRA). Personal Information for the purposes of the CCPA (CPRA) does not include protected health information (PHI or electronic PHI) that is subject to the HIPAA or medical information as defined in the California Confidentiality of Medical Information Act (CMIA), clinical trial data, or publicly available information from government records. Personal Information also does not include de-identified or aggregated user data.

The following is the list of personal Information types which may have been collected from you within the twelve (12) months prior to the last updated date of this Privacy Policy.

Identifiers: such as android or apple identifier, nick name or any remaining identifiers voluntarily shared with us.
Conversation data: any residual identifiers remaining in your text messages post our adequate removal measures.
Communication data: such as name, email identifiers when you write to us.
Network data: such as IP address or information about your interactions with our website or Apps
Recruitment data: such as your current or past company name, dates of employment, and information that you may provide in a job application
Promotion event data: such as any email identifiers when you enrolled.
App Usage data: such as inferences and reports drawn from the above data types about you reflecting your preferences, characteristics, trends, or behaviour
Safety Plan data: any inadvertent identifiers shared within the safety resources when you build or maintain a safety plan for your use in time of need
Institution or Subscriber provided data: identifiers (such as email identifiers, phone numbers) shared when you subscribe on behalf of your institution or group to our campaigns, promotions, product and services.
Business data: such as name, email identifiers and contact information shared and processed for lead generation, business development, account management and marketing.

We obtain the personal information types listed above from the following sources- when you use our App and Services, directly provided by you, as received from your Institution (where required), when you visit our website, from social networks where you participate, other third-party sources such as partners or recruiters. We will use your data for the processing purposes outlined in earlier sections of this Privacy Policy. We will not collect additional personal data types or use them for any materially different, unrelated, or incompatible purposes without providing you a privacy notice.

During the twelve (12) month period prior to the last updated date of this Privacy Policy, we may have shared your Personal Information with the following categories of third-parties- Wysa affiliates and subsidiaries, service providers under adequate data protection contracts.

Your data provided during use of the App will be retained as per our retention policy mentioned here.

Your data provided during the study will always be kept secure. Read more about our organisational and technical security safeguards here.

You can request a list of third parties with whom we share personal data for direct marketing purposes. Please note that Wysa does not share or sell your personal data with third parties as a matter of policy. Subject to certain exceptions, you can write to us to know about the personal information you shared and also exercise your data protection rights mentioned here. You can request to delete your personal information, to opt out of any “sales”, or to not be discriminated against by writing to us at [email protected].

We will respond to your request within 45 calendar days of verification. We may at times be unable to address your request, if we are unable to correctly identify you. We may be unable to address your request due to any of the limitations and exceptions provided within CCPA.

What are the controls for Do-Not-Track features?

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We do not respond to DNT signals transmitted by web browsers.

Can children under 13 use Wysa App?

The App is intended for a general audience and is not directed to or intended to be used by children under the age of thirteen years. Wysa does not take responsibility for any misrepresentation of age and use.

There is a special necessity to protect children's privacy on the App. We do not knowingly collect any personal data from children.

Write to us if you think we have collected any personal data of your child. We will respond to you within one calendar month from verification. We may at times be unable to address your request, if we are unable to correctly identify the user. We will deactivate the child’s account, if we find we have been collecting personal data from your child. Upon identification we will take reasonable measures to promptly delete such personal data from our records.

We encourage parents and legal guardians to monitor their children’s Internet usage. To help enforce our Privacy Policy by instructing their children to not provide any personal data without their permission. Do not share your credit/debit card or other payment instrument with your child to make any in-app purchase.

How to contact for additional questions, comments or concerns?

For any product, services, subscription, technical or payment-related issues, please contact us from your Google or Apple email ID to [email protected] with your questions.

Our mail address for all communication is:

India Office:
Touchkin eServices Private Limited
1st Floor, Manjusha, No 532
16th Cross, 2nd Main Road, 2nd Stage
Indiranagar, Bengaluru, 560038
Karnataka, India

UK Office:
WYSA LTD
Plus X Innovation Hub,
Lewes Rd, Brighton BN2 4GL
UK

USA Office:
Wysa Inc.
Industrious Boston,
3rd floor, 111 Dartmouth St,
Boston 21116

Can Non-English speaking users use the Wysa App?

The App has been built and is currently provided only for English language users. We have also built a Hindi language App for India users. We also provide Hindi and Spanish version apps for users in certain geographies.

Our digital front door application is available for Institution users in multiple languages.

To ensure wider reach, Wysa will, in the near future, launch the App in other international languages. We will keep you updated on this development.

What are some Best Practices to follow to keep your devices secure?

You are also responsible for helping to protect the security of your personal data. You are responsible for maintaining the security of any personal computing device on which you utilize the Services.

The NCSC GOV.UK provides guidance on how You can improve Your online security. The UK ICO provides practical advice for protecting Your personal data online and when using computers and other devices. These can be found at the links below.

Cyber Aware - NCSC.GOV.UK

Online and electronic devices | ICO

The US Federal Trade Commission (FTC) and the Department of Health and Human Services (HHS) who govern HIPAA, publishes information for users on how to secure your personal data and devices. These can be found at the following public links.

How To Protect Your Privacy on Apps | FTC Consumer Information

Online Security | FTC Consumer Information

FTC - How to Keep Your Personal Information Secure

How to Recognize and Avoid Phishing Scams

Telehealth Privacy Tips

Wysa strongly believes in security and safety of data in your mobile device. As a responsible Service provider, we like to share important device-based security information for your attention. These have been sourced from US FTC best practices and guidelines. Always refer back to the US FTC links provided above for more details and future security updates.

Always lock your mobile screen by setting a password. Use strong passwords and keep passwords private. Never leave your device unattended.
Always extend your mobile screen password to set an App PIN to keep your conversations with the App private.
Always keep your mobile operating system up-to-date.
Enable remote access of your devices to enable you to locate and control your devices remotely in the event your device gets stolen.
Install anti-virus software to protect against virus attacks and infections
Avoid phishing emails. Do not open files, click on links or download programs from an unknown source.
Be wise about using Wi-Fi. Before you send personal and sensitive data over your laptop or mobile device on a public wireless network in a coffee shop, library, airport, hotel, or other public place, see if your data will be protected.

Changes to this Privacy Policy

We may modify our Privacy Policy from time to time for various reasons including to improve our privacy practices, to ensure our users right to be Informed, to reflect changes to our service, and to comply with relevant laws. If and when this policy is changed, we will post the new notice on our Website and the App and notify you through an in-app notification or as otherwise required by relevant law. It is your responsibility to check our Website and our App periodically for updates or changes to the policy. We encourage you to review changes carefully. If the changes to the Privacy Policy include changes to the collection, storing or processing your personal information in a way that infringe into your privacy, we will notify you clearly about the same where required by the applicable laws and regulations. If you agree to the changes, then please continue to use our service. If you, however, do not agree to any of the changes and you no longer wish to use our service, you may choose to unsubscribe or uninstall our App. Continuing to use our App and services after a notice of change has been communicated to you or published constitutes your acceptance of changes and consent to the modified Privacy Policy.

Severability and Exclusion

We have taken every effort to ensure that this Privacy Policy adheres with the applicable Data Protection Laws. The invalidity or unenforceability of any part of this Privacy Policy shall not prejudice or affect the validity or enforceability of the remainder of this Privacy Policy. This Privacy Policy does not apply to any data other than the data collected by Wysa while providing the services.

Changes Log

v5.5.0 | Dec 18, 2023

Additions

Included “Validated preventative guided programs” in Wysa’s list of Services for Institutional users.
Wysa emotional well-being professional service is included in Hindi and Spanish language Apps.
Use of 3rd party tools to detect and replace any inadvertent personal identifiers within your text messages for better privacy protection.
Details about user level data sharing with Institutional users and about processing health data as a business associate within What personal data do we process and handle as a Processor or Sub-processor?
New service provider Turn.io (as a Business Solution Provider for our whatsapp service)
New service provider private AI (to redact inadvertent personal identifiers in text messages)
New section that provides details on “How do we use Generative AI technology?”
Additional privacy and security messages from USA FTC and the Department of Health and Human Services (HHS) about how to protect your information when using digital technologies.

Updates

Updated data protection law definition to include India’s DPDP Act 2023
Capture pronouns as other information processed on behalf of Institutions
The list of Service Providers section to provide clarity on data type, purpose and storage involved in the data processing.
Moved the Cloud Service Provider details in the “How do we share your data with third parties?” to the list of Service Providers section.
Promotional event data and Business (B2B) data details within the “What data do we process after taking your Consent?” section.
Data protection rights to inform our obligation where we require to process rights on behalf of your Institution.

v5.4.0 | June 13, 2023

Additions

Wysa App is designed to offer general mental health advice and support and cannot offer condition specific advice for complex medical conditions
Data processing when user participates and consents to Wysa commissioned controlled and real-world online research studies. Data processing details provided in “What additional personal data do we process when you participate in the online controlled or real-world studies?”.

Updates

Lawful basis of processing has been updated to reflect the most appropriate that applies to the processing.
We also provide Hindi and Spanish version apps for users in certain geographies.
Event Data processing- to analyse app event data for improving product and service quality.
Made minor grammatical corrections.
In addition to CCPA also updated for CCPA related privacy requirements
Updated the Insights & Involvement data in “What data do we process after taking your Consent?”

v5.3.0 | May 5, 2023

Additions

Wysa does not take responsibility for any misrepresentation of age and use by the user.
Included Institution data processing in “What personal data do we process and how do we use it?”.
Processing of age-range to identify children entering the system and to safeguard in “What personal data do we process and how do we use it?”.
Added new processors in “Other Service Providers”
1. Salesforce / Pardot
2. Zendesk
3. Iterable
4. 6Sense
We may capture the Institution name for operational purposes from payment gateways.
A copy of user data might be retained in our backup for a definite period of time.

Updates

Clearly identify all Services governed by the Privacy policy.
Wysa email ID to [email protected].
Corrected for grammatical constructs and errors across all sections.
Reworded across all sections to ensure readability for younger audiences.
Safety Plan data processing in “What personal data do we process and how do we use it?”.
Provided additional information about our NLP/NLU algorithm in “How does the Artificial Intelligence chatbot work and is it safe to use?”.
Updated data retention section in “How long do we retain your data including personal data?”.
Additional information to cover for multilingual apps.
Removed two sections “What is Wysa App?” and “Who can use the service?” as already covered in TOS.
Kubit.ai has been discontinued as our data processor.

v5.2.0 | January 18, 2023

Additions

Added a new section on “What data do we process when you use the Wysa Digital Front Door Service?”

Updates

Fix for grammar in “What data do we process after taking your Consent?”

v5.1.0 | December 21, 2022

Updates

Included a para on Right to be Informed and deleted a redundant bullet “required to protect our rights and properties” in the “What are your data protection rights?” section.
Included Cookie Policy to the line “By using our Apps and services, you agree to the collection and use of information in accordance with this privacy policy and cookie policy”.

v5.0.0 | December 06, 2022

Additions

New section "What personal data do we process and handle as a Processor or Sub-processor?" to reflect data processing when Wysa is a data processor.
Add details around use of marketing tools in "How do we share your data with third parties?".
New additions, bullet 5 and 6, within "Processing of any of your personal data as per our Legitimate Interests".
Addition of business data processing within "What data do we process after taking your Consent?".
New section to organise details around "International transfer of personal data outside of the country you reside in or are currently located".
Include Hindi as a language in use within the app in select geographies.
Included details on retention of emergency contact information after the end of subscription in “How long do we retain your data including personal data?” Section.

Updates

Reorganisation and reframing of sections to provide clarity, grammatical correctness and improved alignment to our current intent and purposes.
Updates made to “Do Note” Section.
Our Coach or therapist services are provided by global human well-being professionals. Changes made to reflect this across the policy.
Updated paragraph on "Institution version of Wysa App".
Minor updates to the table within "What personal data do we process and how do we use it?".
Update on our use of ads in "What additional personal data do we process when you use our WhatsApp-based business service?".
Replace an archived AWS Security link with the latest, within "How do we share your data with third parties?".
Update, bullets 3, 4 and 14, within "Processing of any of your personal data as per our Legitimate Interests"
Updates to the row on processing of app usage data and promotion data in "What data do we process after taking your Consent?"
Updates made to "How do we secure your data?" section
Update to paragraphs of “Right of Access” and “Right in relation to automated decision-making and profiling” within "What is your data protection rights?"
Group the “withdraw consent”, “breach notification“ and “concerns and complaints” sections within a separate section "Other important information".
Additional information provided within "Do California residents have specific privacy rights?"

v4.1.1 | July 5, 2022

Additions

Addition of Wysa AI coach over WhatsApp to the list of services.
New section “What additional personal data do we process when you use the WhatsApp service?”
Addition of new sub-processor, Meta Ads Manager.

Updates

Updated Twilio services to include Business Service Provider service to integrate Wysa's AI coach with WhatsApp.
Minor grammatical corrections.

v4.1.0 | May 26, 2022

Additions

Include Cloudflare among our service providers
Include Web-based apps along with website cookies in “What data do we process after taking your Consent?”
Update to Disclosure to other third parties with details on reasonable steps
Separately call out “Processing as per our Legitimate Interests”
Added new definition for AI coach and Special Category data

Updates

Definitions: Service provider and Data Processor are interchangeable terms.
“What personal data do we process and how do we use it?” updates for clarity and appropriateness.
1. Integrate wellness information as part of Conversation Data
2. Conversation data by way of audio-video sessions separately outlined
3. Included processing related to network data separately
4. Carved out event data separately
Mention DPA with Standard Contractual Clauses (SCCs) with every service provider
Update the purpose for Google Workspace and 3rd party payment gateway providers for more clarity.
Remove [email protected] email ID
Update Privacy by Design measures
Updates to point on data stored in databases in the Important Notes section.
Update the Privacy by Design section
Update purpose of processing in “What personal data do we process and how do we use it” section
Updated the “How do we secure your data?” section for certifications and details
Clear messaging about Wysa human professional well-being service

v4.1.0 | May 26, 2022

Additions

Include Cloudflare among our service providers
Include Web-based apps along with website cookies in “What data do we process after taking your Consent?”
Update to Disclosure to other third parties with details on reasonable steps
Separately call out “Processing as per our Legitimate Interests”
Added new definition for AI coach and Special Category data

Updates

Definitions: Service provider and Data Processor are interchangeable terms.
“What personal data do we process and how do we use it?” updates for clarity and appropriateness.
1. Integrate wellness information as part of Conversation Data
2. Conversation data by way of audio-video sessions separately outlined
3. Included processing related to network data separately
4. Carved out event data separately
Mention DPA with Standard Contractual Clauses (SCCs) with every service provider
Update the purpose for Google Workspace and 3rd party payment gateway providers for more clarity.
Remove [email protected] email ID
Update Privacy by Design measures
Updates to point on data stored in databases in the Important Notes section.
Update the Privacy by Design section
Update purpose of processing in “What personal data do we process and how do we use it” section
Updated the “How do we secure your data?” section for certifications and details
Clear messaging about Wysa human professional well-being service

v4.0.0 | November 10, 2021

Additions

Complete revamp to improve the readability of the Privacy Policy.
Include information about the Audio-Video Service provided by Coach or Therapist.
Introduction of AI Coach modules and tools for Spanish language users.
Included our other applications including Ascension Wysa app in scope of this policy. This Privacy Policy replaces the existing Ascension Wysa's privacy policy.

v3.3.1 | July 16, 2021

Removed

Review and remove Suicide helpline link from Important Notice.

v3.3.0 | July 01, 2021

Additions

Included our other applications including Sleep by Wysa App in scope of this policy. This Privacy Policy replaces the existing Sleep by Wysa's privacy policy. Updated Important notice for key information about Sleep by Wysa.
Add information on transfer of Your Data to regions other than Your resident country/state in the Important Notice section.
Added section on data processed from candidates applying to Wysa's open job positions.
Added processing of candidates information for current and future employment opportunities as our legitimate interest
Added processing of information when using Wysa's video-based service with the Well-being Coach or Therapist
Added FTC security and privacy guidance in What are some best practices to follow to keep your device secure?
Explicitly added Right to withdraw Consent
Provided details to our UK ICO registration

Updates

Mention about ISO 27001 (ISMS) and ISO 27701 (PIMS) certifications and adhering to GDPR 7 Principles
Minor updates in "What does this Privacy policy apply to?"
Renamed GSuite to Google Workspace
Mention of Wysa Well-being Coach or Wysa Therapist Services provided outside of the Wysa App for Institutional Users
Energy questionnaire included in "How do we handle your responses to screening assessments?"
More clarity about your data transmitted and stored
Payment gateway related updates in how do we handle your payment data?
Updated “Can children under 13 Use Wysa App?” with note of advice to parents and legal guardian.

Removed

FB analytics has been discontinued. Added use of 3rd party analytics provided by Kubit AI whose details have been provided in “How do We use any Third Party Analytics tools and softwares?”

v3.2.0 | Apr 16, 2021

Updates

Additional clarity on handling data where Wysa App is integrated with Your Institution system
Additional clarity on use of minimal and anonymous conversation messages for improving performance of Bot algorithms
Additional information around security controls and alignment to ISO 27001: 2013 and ISO 27701: 2019 global standards
Additional clarity on anonymized and minimal data shared with third parties

Removed

Video Call- based experimental Coach/therapist Service has been currently discontinued. Section “What do we process when You use the Video Call Service?” removed

v3.1.0 | Feb 10, 2021

Updates

Additional clarity on the retention of data;
Additional data processed from Institution users in section “What additional data do We collect from Institution Users?”

v3.0.0 | Feb 03, 2021

Overall

An overall review and necessary updates were made to align Privacy Policy to ISO/IEC 27001:2013 (Information Security Management System) and ISO/IEC 27701:2019 (Privacy Information Management System);

Additions

Included “For purposes of servicing You towards Wysa’s Gift Card program” as a Legitimate Interest basis;
Three new subsections added at the end of “What Data do We collect and how do We Use it?”
1. What do we process when You use the Video Call Service? (experimental service for android users only)
2. How do We handle Your data when used for Research purposes?
3. What data do we process as part of Gift Card purchase?

Updates

Included details on use of branch.io and mailgun third party analytics software services;
UK GDPR mentioned as another regulation requirement for this Privacy Policy;
Additional items included in “Definition” Section;
Additional clarity on need for parental consent for those between 13 and 18 years in “Who can use the Service” Section;
Updated link to Wysa Cookie Policy in “Do we use Cookies?” Section;
Additional clarity on the retention of data
Additional clarity on “Do California residents have specific privacy rights?”
Additional clarity on “What are the controls for Do-Not-Track features?”
Additional clarity on changes to privacy policy

Removed

Section “Governing Law and Dispute Resolution” to align with EU GDPR laws