Bodhi Privacy Policy

Effective Date: August 14, 2026

Last Updated: August 14, 2026

This Privacy Policy explains how Bodhi, operated by Shyam Hitendra Trambadia, sole proprietor carrying on business under the trade name Neurosynthesis Lab (“Bodhi”, “Neurosynthesis Lab”, “we”, “us”, or “our”), collects, uses, stores, shares, protects, and deletes personal data when users access the Bodhi mobile application, website, subscriptions, student profiles, parent/guardian profiles, teacher tools, school-linked features, Thought Bank, Bro, Dopameter, Karma, support channels, and related services.

Business Address: 404, Silver Cross Building, Satellite Road, Near Shivranjani Char Rasta, Shivranjani Junction, Ahmedabad, Gujarat – 380015, India.

Bodhi is a meditation-led self-regulation, focus, reflection, and wellbeing-practice platform. Bodhi is not a medical, psychiatric, diagnostic, counselling, emergency, or crisis-response service.

Because Bodhi may be used by users aged 8 and above, including students below 18 years of age, we handle children’s data with extra care.

We do not sell personal data. We do not show targeted advertising to children. We do not use screen recording, session replay, heatmap analytics, or hidden surveillance tools in the student-facing mobile app. We do not create psychological diagnoses, mental-health scores, behavioural risk profiles, or disciplinary scores for schools.

This Privacy Policy should be read together with Bodhi’s Terms & Conditions, Child/Parent Consent Notice, Cancellation & Refund terms, and any school-specific agreement.

1. Who We Are

Operator: Shyam Hitendra Trambadia, sole proprietor carrying on business under the trade name “Neurosynthesis Lab”

App Name: Bodhi

Address: 404, Silver Cross Building, Satellite Road, Near Shivranjani Char Rasta, Shivranjani Junction, Ahmedabad, Gujarat – 380015, India

Website: https://bodhi.org.in

Support Email: support@bodhi.org.in

Privacy Email: privacy@bodhi.org.in

Grievance Officer: Shyam Hitendra Trambadia, Founder / Proprietor, Neurosynthesis Lab

Grievance Email: grievance@bodhi.org.in

Customer Care Phone: +91 94088 76061

Account/Data Deletion Webpage: https://bodhi.org.in/delete-account

Parents, guardians, students, teachers, schools, and adult users may contact us for privacy-related requests, consent withdrawal, correction, deletion, access requests, or grievances.

We aim to acknowledge consumer complaints within 48 hours and resolve them within one month from receipt, subject to applicable law and the nature of the complaint.

Privacy and data-protection grievances will be handled within the period required by applicable law.

2. Who This Policy Applies To

This Policy applies to:

• students using Bodhi individually or through a school-linked program;
• parents or guardians using Bodhi through linked family profiles;
• teachers using Bodhi to assign practices or view limited class progress;
• schools, administrators, counsellors, or authorised school representatives using Bodhi;
• adult individual users;
• visitors to Bodhi’s website, payment pages, enquiry forms, consultation forms, or support channels.

Where a user is below 18, references to “you” include the child/student and, where legally required, the child’s parent or lawful guardian.

3. Child Privacy Position

Bodhi is intended for users aged 8 and above. Users below 18 may use Bodhi only with appropriate parent or lawful guardian consent, or through another legally valid consent process.

Bodhi may process student data to provide app features, school-linked access, meditation assignments, League participation, practice progress, subscriptions, parent/guardian consent, safety, support, and limited program operation.

Bodhi does not use children’s personal data for:

• targeted advertising;
• sale of personal data;
• screen recording or session replay in the student-facing mobile app;
• heatmap-based surveillance in the student-facing mobile app;
• cross-app behavioural tracking;
• psychological diagnosis;
• mental-health risk scoring;
• disciplinary scoring;
• ranking students by emotional state;
• advertising profiles.

Where legally required, Bodhi obtains parent or lawful guardian consent before activating a child account. Consent may be collected through parent mobile OTP verification, parent email OTP verification, parent account confirmation, school-facilitated consent, or another appropriate process.

OTP or email verification confirms access to the mobile number or email address used for consent. It does not by itself prove parenthood in every possible situation. Bodhi relies on the accuracy of information provided, the parent/guardian confirmation, consent logs, and school-facilitated processes where applicable.

If we learn that a child’s personal data has been collected without required consent, we will take reasonable steps to restrict, delete, or regularise the account and data according to applicable law.

4. Parent/Guardian Consent Records

For under-18 users, Bodhi may collect and store consent records such as:

• child profile ID;
• child date of birth or age-related information;
• parent or guardian mobile number or email address used for OTP/email verification;
• consent timestamp;
• consent method;
• Terms & Conditions version accepted;
• Privacy Policy version accepted;
• consent notice version accepted;
• consent status, such as active, withdrawn, or expired;
• basic audit metadata reasonably necessary to verify and manage consent.

Users must provide the genuine contact details of their parent or lawful guardian. Parents and guardians are responsible for ensuring that consent given through their mobile number, email address, OTP, account, or verification link is accurate and authorised.

Parents or lawful guardians may contact Bodhi to review, withdraw, or update consent.

5. Data We Collect

We collect data that is reasonably necessary to provide Bodhi, operate school-linked features, support users, maintain security, process subscriptions, improve the product, and meet legal obligations.

5.1 Account and Profile Data

We may collect:

• name;
• mobile number;
• email address;
• login credentials or authentication information;
• date of birth or age-related information;
• profile type, such as student, parent, guardian, teacher, or individual user;
• avatar or profile image if the user chooses to add one;
• linked profile information, such as student, mother, father, or guardian profiles;
• school name, class, section, class code, teacher assignment, and school-linked status;
• subscription status, trial status, access period, and school-paid, website-paid, in-app-paid, or self-paid status.

5.2 Student and Linked Parent/Guardian Profile Data

For child or student accounts, the student profile is the primary Bodhi profile.

Parent, mother, father, or guardian profiles are linked support profiles used for consent, subscription management, account support, linked-profile management, and limited visibility where enabled.

If the primary student profile is deleted, linked parent or guardian profiles associated with that student profile may also be deleted as part of the same account deletion process, subject to legal, payment, tax, security, fraud-prevention, and backup-cycle requirements.

5.3 School-Linked Data

For school-linked users, we may collect and process:

• school name;
• class and section;
• teacher or class group;
• class code;
• school-linked access status;
• assigned practices;
• completion or pending status for assigned activities;
• practice participation and progress;
• school-paid or parent-paid access status;
• student list data provided by the school or entered during onboarding;
• limited Karma-related records where Karma is enabled.

5.4 Practice, Progress and App Activity Data

We may collect limited app activity data to provide features and understand app usage, including:

• meditations started, completed, skipped, replayed, or saved;
• assigned League activities;
• class assignment completion;
• practice streaks;
• practice category usage;
• focus tool usage;
• notification opens;
• subscription screen views or payment status events;
• profile switching events;
• dates and times of relevant app actions;
• in-app milestones, badges, or progress indicators where enabled.

This data is used as practice and progress data. It is not used for targeted advertising, hidden surveillance, psychological diagnosis, or behavioural risk profiling.

5.5 Thought Bank / Journal Data

Bodhi includes or may include a private reflection feature called Thought Bank.

Thought Bank entries are encrypted before storage using AES-256 encryption and stored through Bodhi-managed systems and contracted hosting/database infrastructure. The database stores encrypted entries.

At present, encryption keys are stored through Bodhi-managed systems and not only on the user’s device. Therefore, Thought Bank should not be described as end-to-end encrypted or zero-knowledge encrypted unless the architecture changes.

Bodhi does not provide an admin interface to read Thought Bank entries, and our team is not intended or permitted to access user entries during normal operations.

Bodhi’s privacy position for Thought Bank is:

• Thought Bank entries are private to the user profile;
• teachers and schools do not receive Thought Bank entries;
• parents and guardians do not automatically receive Thought Bank entries;
• Thought Bank entries are not used in school reports;
• Thought Bank entries are not used for advertising;
• Thought Bank entries are not used to create student mental-health labels or behavioural scores;
• Thought Bank entries are not used to train public AI models;
• Thought Bank entries are not reviewed in real time for emergencies.

Limited authorised technical access may be possible only where necessary for lawful security, legal compliance, abuse prevention, backup restoration, or system maintenance.

5.6 Bro Conversation Data

Bodhi may include a rule-based conversational feature called Bro.

Bro is designed to help users express what they are feeling, navigate app features, and receive general Bodhi practice suggestions based on predefined rules and product logic.

Bro is rule-based. Bro does not provide medical, psychological, psychiatric, counselling, academic, legal, disciplinary, emergency, or professional advice.

Bro conversations are processed only to provide the live rule-based response and are not stored by Bodhi after the interaction/session.

Bro conversations are not visible to teachers, schools, parents, guardians, admins, developers, or support staff through any normal product interface.

Bro conversation content is not used for targeted advertising, public AI model training, psychological diagnosis, mental-health scoring, behavioural risk profiling, school reporting, disciplinary scoring, product-improvement review by staff, or emergency monitoring.

Bodhi does not monitor Bro conversations in real time and cannot provide emergency intervention based on Bro messages.

5.7 Dopameter and Self-Reflection Data

Bodhi may include self-check-in features such as Dopameter, mood, energy, focus, habit, practice, or reflection inputs.

This data may be used to:

• show personal insights to the user;
• help the user understand patterns in practice and focus;
• recommend relevant practices inside Bodhi;
• improve the product;
• generate aggregated or limited program-level insights where separately agreed with schools and subject to applicable consent.

Individual Dopameter responses are not visible to teachers or schools.

Bodhi does not use individual Dopameter responses to diagnose, label, rank, discipline, or create mental-health risk scores for students.

5.8 Karma Data

Bodhi may include a Karma feature that allows certain users, teachers, or authorised roles to give or receive recognition within the app.

Karma may be enabled, disabled, limited, or configured depending on product version, user type, school/program requirements, beneficiary settings, and admin controls.

Karma data may include:

• sender;
• recipient;
• amount;
• reason or category;
• timestamp;
• class/program link;
• related notification status;
• moderation or misuse-related records where applicable.

Users may receive notifications about Karma transactions where enabled.

Full Karma history is not visible to users, peers, parents, guardians, or teachers unless Bodhi clearly enables such visibility in a future product version.

Authorised admin access to Karma records may be used for product operation, moderation, support, fraud prevention, misuse investigation, system integrity, and user safety.

Karma is not money, property, academic credit, legal entitlement, or transferable value.

5.9 Payment and Subscription Data

If users purchase a subscription, start a free trial, or access Bodhi through a school-paid, website-paid, in-app-paid, or promotional plan, we may process:

• subscription plan;
• trial status;
• payment status;
• transaction ID;
• invoice or receipt details;
• subscription start and end dates;
• renewal, cancellation, refund, or access status;
• payment gateway or app-store purchase confirmation;
• purchase channel, such as Apple In-App Purchase, website/Razorpay, school invoice, or another authorised channel.

Bodhi may use Razorpay, Apple In-App Purchase, banks, UPI systems, school invoicing, or other payment processors depending on the purchase method.

We do not intentionally store full credit card, debit card, UPI PIN, net-banking credentials, or payment authentication credentials on Bodhi servers.

Payment, invoice, tax, accounting, and transaction records may be retained separately as business/legal records even after account deletion where required or reasonably necessary.

5.10 Device, Technical, Crash and Security Data

To maintain security, prevent misuse, debug crashes, and improve app reliability, we may collect:

• device type;
• operating system;
• app version;
• browser or device information;
• IP address;
• approximate region derived from technical data;
• error logs;
• crash reports;
• performance logs;
• authentication and security logs;
• push notification tokens;
• server logs.

Bodhi uses Sentry for crash and error monitoring. Sentry Session Replay is not used in the student-facing mobile app. Sentry is configured not to capture Thought Bank text, Bro messages, OTPs, PINs, passwords, payment credentials, or personal reflection content.

Crash and technical logs may ordinarily be retained for up to 90 days, unless a longer period is necessary for security investigation, fraud prevention, dispute resolution, or compliance with applicable law.

Certain processing records, associated traffic data, security logs, or system logs may be retained for a longer minimum period where required by applicable law.

5.11 Firebase Analytics and App Analytics Data

Bodhi uses Firebase Analytics for limited app analytics.

Firebase Analytics may collect automatic screen views and structured app events such as onboarding completed, session completed, meditation completed, Dopameter logged, journal entry saved, or similar product events.

Analytics events are used to understand feature adoption, improve app reliability, and support product development.

Analytics events do not include Thought Bank text, Bro message text, OTPs, PINs, passwords, payment credentials, full phone numbers, full emails, or personal reflection content.

Bodhi does not use Firebase Analytics for targeted advertising to children.

5.12 Push Notification Data

Bodhi uses Firebase Cloud Messaging for push notifications.

Notification payloads may include title and body text related to practices, reminders, subscriptions, school-linked features, or account updates.

Bodhi does not include Thought Bank entries, Bro conversation text, Dopameter responses, mood labels, private reflections, OTPs, PINs, or payment credentials inside push notification payloads.

5.13 Website, Cookies and Enquiry Data

When users visit Bodhi’s website, payment pages, support pages, contact forms, school enquiry forms, consultation forms, or landing pages, we may collect:

• name;
• email address;
• phone number;
• school name;
• role or organisation;
• enquiry details;
• support or consultation request details;
• payment-related redirection or transaction status;
• browser, device, IP address, and website usage data;
• cookie and similar technology data.

Bodhi uses cookies and similar technologies for website functionality, security, analytics, payment flow, form submission, performance, and user experience.

Bodhi uses Microsoft Clarity on the website to understand website visits, clicks, scrolls, form interactions, and page performance. Microsoft Clarity is not used inside the student-facing mobile app. Sensitive form fields, payment information, and private user content should not be intentionally captured through website analytics tools.

Where required, users may be provided cookie notice, cookie controls, or a separate Cookie Policy.

5.14 Support and Communication Data

When users, parents, guardians, teachers, or schools contact us, we may collect:

• name;
• email address;
• phone number;
• school name;
• issue description;
• screenshots voluntarily shared by the user;
• support conversation history;
• feedback or complaints.

6. Data We Do Not Intentionally Collect

Unless we clearly disclose it and obtain required consent, Bodhi does not intentionally collect:

• precise GPS location;
• contacts from the device;
• microphone recordings;
• camera data;
• biometric data;
• full payment card details;
• UPI PINs or banking authentication credentials;
• screen recordings in the student-facing mobile app;
• session replays in the student-facing mobile app;
• heatmaps in the student-facing mobile app;
• advertising identifiers for child-directed tracking;
• data from other apps on the user’s device;
• private messages outside Bodhi.

7. Service Providers and Technology Stack

7.1 Providers Currently Used

Bodhi currently uses the following service providers and systems:

• Hosting: Hostinger VPS, Mumbai;
• Database: Supabase, Singapore region;
• Error Monitoring: Sentry;
• Payment Gateway: Razorpay;
• iOS In-App Purchases: Apple In-App Purchase;
• OTP/Auth: Firebase Phone Auth;
• Push Notifications: Firebase Cloud Messaging;
• App Analytics: Firebase Analytics;
• Website Analytics: Microsoft Clarity, website only;
• App Distribution: Apple App Store and Google Play Store;
• Internal Backend Systems: Bodhi-managed systems, APIs, databases, and admin systems.

These providers may process personal data only as necessary to provide services to Bodhi, operate the app, authenticate users, send notifications, process payments, detect errors, maintain security, run analytics, support users, and operate the website.

Service providers may have their own privacy policies and processing locations. Bodhi takes reasonable steps to use providers that meet appropriate security and data protection standards.

7.2 Future Providers

If Bodhi introduces additional service providers that materially change how personal data is collected, used, shared, stored, or processed, Bodhi will update this Privacy Policy where required and provide notice or obtain consent where required by applicable law.

8. How We Use Data

We use personal data for the following purposes.

8.1 To Provide Bodhi

• create and manage accounts;
• enable student, parent, guardian, teacher, and individual profiles;
• provide meditation, focus, reflection, Dopameter, Bro, Karma, League, and other features;
• maintain subscriptions, trials, and access rights;
• allow profile switching within linked family accounts;
• provide school-linked access through class codes or school verification.

8.2 To Obtain and Manage Parent/Guardian Consent

• identify whether a user is below 18;
• request parent or guardian contact details;
• send OTP or email verification;
• record consent status;
• manage consent withdrawal, re-consent, and account restrictions where required.

8.3 To Run School-Linked Features

• connect students to schools and classes;
• allow teachers to assign practices;
• show teachers factual completion or pending status for assigned activities;
• manage school-paid or school-promoted access;
• support class-level participation features;
• support separately agreed institutional services.

8.4 To Provide Personal App Experience

• recommend relevant meditations or focus practices;
• show practice history;
• maintain streaks and milestones;
• display personal progress;
• preserve user settings and preferences;
• show relevant reminders and notifications.

8.5 To Prepare Limited Institutional Insights Where Separately Agreed

Bodhi app subscriptions do not automatically include school reports, consultations, workshops, presentations, reviews, or advisory services.

Where Neurosynthesis Lab separately works with a school, it may prepare aggregated or limited program-level insights using practice and progress data. Such insights are intended to support program understanding and may include adoption, participation, consistency, category-level practice trends, journaling count, class-level completion, and aggregated Dopameter distributions.

Aggregated institutional insights are designed to avoid identifying individual students. Thought Bank content, Bro conversations, journal text, and private reflections are never included.

These insights are not medical reports, psychological assessments, counselling notes, diagnostic reports, behavioural risk profiles, disciplinary reports, or academic performance reports.

Individual Dopameter responses are not visible to teachers or schools.

8.6 To Maintain Safety, Security and Reliability

• detect bugs and crashes;
• protect accounts;
• prevent unauthorised access;
• investigate misuse;
• maintain audit logs for sensitive admin actions where applicable;
• protect student data;
• secure our systems and services;
• detect subscription, Karma, account, or payment misuse.

8.7 To Communicate With Users

• send practice reminders where enabled;
• send League or assignment reminders;
• send subscription, payment, or trial updates;
• send Karma-related notifications where enabled;
• respond to support requests;
• send policy or service updates;
• communicate with parents, guardians, teachers, or schools about school-linked access.

8.8 To Meet Legal and Compliance Requirements

• comply with applicable law;
• respond to lawful requests;
• maintain accounting, tax, audit, invoice, and payment records;
• enforce our Terms & Conditions;
• protect legal rights, safety, and security;
• handle grievances, disputes, and deletion requests.

9. Teacher, Parent, Guardian and School Visibility

9.1 What Teachers May See

For students linked to a class or school program, authorised teachers may see limited program information such as:

• student name or profile identifier;
• class and section;
• assigned meditation or practice;
• completion or pending status for assigned activities;
• basic class-level participation information;
• limited Karma-related information where Karma is enabled and where such visibility is part of the product design or school configuration.

Teachers do not receive Thought Bank entries, Bro conversations, individual Dopameter responses, or private reflections.

9.2 What Schools May See

Schools may receive limited information needed to operate a school-linked program, such as:

• student and class enrollment data;
• class participation;
• assigned practice completion;
• subscription or access status where relevant;
• aggregated or limited program insights where separately agreed.

Schools do not receive private Thought Bank entries, Bro conversations, private journal-style reflections, individual Dopameter responses, diagnostic mental-health profiles, behavioural risk scores, or disciplinary scores.

9.3 What Parents or Guardians May See

Parents or guardians may see information related to linked family profiles depending on the product design and consent settings.

For child or student accounts, parent or guardian profiles are linked to the student’s primary Bodhi profile. Parent access is limited to information made available by Bodhi for consent, subscription management, account support, linked-profile management, account-security information, information legally required or expressly authorised to be disclosed, and limited progress visibility where enabled.

Parent profiles do not automatically receive access to Thought Bank entries, Bro conversations, private reflections, individual Dopameter responses, or other sensitive student information unless clearly disclosed, legally permitted, and consented to where required.

10. How We Share Data

We do not sell personal data.

We may share data only in the following limited cases.

10.1 With Schools and Teachers

Where the student is part of a school-linked program, we may share limited school-program data with authorised school representatives and teachers as described in this Policy.

10.2 With Parents or Guardians

Where legally required, expressly authorised, or product-supported, we may share relevant account, consent, access, subscription, account-security, or limited progress information with a parent or lawful guardian, subject to the privacy boundaries described in this Policy.

10.3 With Service Providers

We may share data with trusted service providers such as Hostinger, Supabase, Sentry, Razorpay, Firebase Phone Auth, Firebase Cloud Messaging, Firebase Analytics, Apple, Google, Microsoft Clarity for website analytics, banks, payment systems, support tools, and infrastructure providers.

These providers process data only as needed to provide services to Bodhi, subject to their own terms and applicable data protection obligations.

10.4 For Legal, Safety or Security Reasons

We may disclose data if reasonably necessary to:

• comply with law;
• respond to lawful government, court, regulatory, or legal requests;
• enforce our Terms;
• investigate fraud, security incidents, or misuse;
• protect the rights, safety, or property of Bodhi, users, students, parents, guardians, teachers, schools, or the public.

10.5 Business Transfers

If Bodhi or Neurosynthesis Lab is involved in a merger, acquisition, restructuring, financing, sale of assets, or transfer of business, user data may be transferred as part of that transaction, subject to appropriate notice and protection.

11. Analytics and Product Improvement

Bodhi uses limited analytics to understand whether the app, website, and school-linked features are working properly.

We may track structured app events such as:

• onboarding completed;
• meditation completed;
• session completed;
• assigned practice completed;
• class code joined;
• notification opened;
• subscription started or renewed;
• practice streak updated;
• Dopameter logged;
• journal entry saved, without storing journal content in the analytics event;
• Karma transaction created, where enabled.

Bodhi does not use Microsoft Clarity or similar screen-recording, session-replay, or heatmap tools in the student-facing mobile app.

Bodhi uses Microsoft Clarity on the website to understand website use, form interactions, clicks, scrolls, and page performance, subject to applicable cookie and privacy controls.

Analytics are used to improve app quality, fix friction points, understand feature adoption, improve the website, and support program-level understanding. Analytics are not used for targeted advertising to children.

12. Notifications

Bodhi may send notifications for:

• practice reminders;
• League reminders;
• assigned activities;
• subscription or trial updates;
• school-linked updates;
• Karma notifications where enabled;
• important account or security information;
• general Bodhi updates.

Users may control certain notification preferences inside the app or through device settings. Some essential service, security, or account notifications may still be sent where necessary.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Our retention approach is:

• account data is retained while the account remains active;
• parent/guardian consent records are retained while needed to verify consent, manage consent withdrawal, and comply with legal obligations;
• student school-linked data is retained during the school-linked program and for a reasonable period after program completion for continuity, support, audit, and compliance;
• Thought Bank entries are retained while the relevant account/profile remains active, unless deleted earlier by the user or through account deletion;
• Bro conversations are not stored by Bodhi after the interaction/session;
• Karma records, where enabled, are retained as needed for product operation, moderation, misuse investigation, support, and system integrity;
• crash and technical logs may ordinarily be retained for up to 90 days, unless a longer period is necessary for security investigation, fraud prevention, dispute resolution, or compliance with applicable law;
• support records may be retained for up to 24 months;
• inactive account data may be retained for up to 36 months unless deletion is requested earlier or law requires retention;
• school-linked program records may be retained for up to 36 months after program end unless a school agreement requires a different period;
• payment, invoice, tax, accounting, audit, and transaction records are retained as required or permitted under applicable law;
• certain processing records, associated traffic data, security logs, or system logs may be retained for a longer minimum period where required by applicable law;
• aggregated or anonymised insights may be retained for product, research, program evaluation, or business purposes, provided they do not identify an individual user.

When personal data is no longer needed, we delete, anonymise, or securely restrict it according to applicable law and internal retention practices.

14. Account and Data Deletion

Users may request account deletion through the in-app deletion option, through the support process, or through the account deletion web mechanism.

In-App Deletion Path: Profile → Privacy & Security → Delete Account

Account/Data Deletion Webpage: https://bodhi.org.in/delete-account

Support Email: support@bodhi.org.in

Privacy Email: privacy@bodhi.org.in

When a deletion request is made, the account may remain recoverable for 7 days. During this 7-day recovery window, the user may be able to restore the account and associated app data.

After the 7-day recovery window expires, the user profile and associated app data are deleted or de-identified from active systems and cannot be restored through normal account recovery.

Deletion may include:

• account profile data;
• linked parent/guardian profile data;
• Thought Bank entries;
• practice history;
• Dopameter data;
• Karma-related user data where applicable;
• personal settings;
• school-linked account data, subject to school-program and legal requirements.

Because Bro conversations are not stored after the interaction/session, they are not part of retained account history.

Some data may be retained separately where necessary for:

• legal compliance;
• payment, invoice, tax, audit, or accounting records;
• dispute resolution;
• fraud prevention;
• security investigations;
• consent records;
• school-program records required under an agreement;
• backup deletion cycles.

Backups and technical copies may retain deleted data for a limited period after active-system deletion. Such backup data is not used for normal account access and is deleted or overwritten according to normal backup cycles, unless retention is required for legal, security, or compliance reasons.

Deleting the app does not automatically delete the account or cancel paid subscriptions. Users must request account deletion and separately cancel active subscriptions through the relevant payment method, Apple account settings, website account process, school arrangement, or support channel.

If a child’s account is deleted by a parent or guardian, Bodhi will take reasonable steps to delete or de-identify the child’s personal data unless retention is legally required or otherwise permitted.

15. User Rights

Subject to applicable law, users, parents, or lawful guardians may request:

• access to personal data;
• correction or update of inaccurate data;
• deletion of personal data;
• withdrawal of consent;
• information about data sharing;
• grievance redressal;
• a copy or summary of personal data processed by Bodhi;
• nomination of another individual to exercise applicable rights in circumstances provided by law.

Requests can be made through the app where available, through the account deletion web mechanism, or by contacting privacy@bodhi.org.in or support@bodhi.org.in.

We may need to verify the identity and authority of the person making the request, especially where the request relates to a child’s data.

Bodhi will handle privacy requests and grievances within the period required by applicable law.

16. Security

We use reasonable technical and organisational measures to protect personal data, including where appropriate:

• encrypted transmission;
• AES-256 encryption for Thought Bank entries before storage;
• secure authentication;
• role-based access controls;
• restricted admin access;
• no admin interface for viewing Thought Bank entries;
• no normal product interface for admins, developers, support staff, teachers, schools, parents, or guardians to view Bro conversations;
• server and database security controls;
• data minimisation;
• access review;
• crash-log scrubbing;
• backup and recovery controls;
• internal confidentiality obligations.

If a personal data breach occurs, Bodhi will investigate the incident, take reasonable containment and remediation measures, and notify affected users and relevant authorities where required by applicable law.

No digital system can be guaranteed to be completely secure. Users should keep login credentials, OTPs, devices, app locks, and PINs secure.

17. International Data Transfers

Bodhi’s API/admin hosting is currently through Hostinger VPS in Mumbai, India. Bodhi’s Supabase database is hosted in the Singapore region.

Certain service providers, such as Supabase, Sentry, Razorpay, Firebase, Apple, Google, Microsoft Clarity, payment providers, analytics providers, support tools, and other infrastructure providers, may process or store data in India or other countries depending on their systems and settings.

Where personal data is transferred or processed outside India, we take reasonable steps to ensure that such processing is lawful and protected through appropriate contractual, technical, and organisational safeguards.

18. AI, Automation and Recommendations

Bodhi may use basic rules, personalization, or recommendation logic to suggest meditations, focus practices, reminders, or program flows.

Bro is rule-based and does not provide medical, psychological, psychiatric, counselling, academic, legal, disciplinary, emergency, or professional advice.

Bodhi does not use private Thought Bank entries or Bro conversations to train public AI models. Bodhi does not use student reflections to create psychological diagnoses, mental-health risk scores, or disciplinary profiles.

If Bodhi later introduces AI-based features that process sensitive user-generated content, we will update this Policy and obtain consent where required.

19. Wellness and Medical Disclaimer

Bodhi provides meditation, self-reflection, focus, emotional wellbeing, and self-regulation practices.

Bodhi is not a substitute for medical care, therapy, psychiatric treatment, counselling, emergency support, or professional diagnosis.

Bodhi does not diagnose, treat, cure, or prevent any medical or mental-health condition.

If a user is experiencing distress, self-harm thoughts, abuse, danger, a medical emergency, or a mental-health crisis, they should immediately contact a parent, guardian, trusted adult, school counsellor, qualified medical professional, local emergency service, or crisis helpline.

20. Marketing and Communications

We may send service-related messages, account messages, school-linked messages, and subscription updates.

We may send promotional or informational messages only where permitted by law and user preferences. Users may opt out of non-essential marketing communications.

Bodhi does not use children’s personal data for targeted advertising.

21. Third-Party Links and Content

Bodhi may contain links to third-party content, such as educational resources, videos, websites, app-store pages, payment providers, school resources, or support resources.

We are not responsible for the privacy practices, content, or security of third-party services. Users should review third-party privacy policies before using them.

Where Bodhi embeds or links to third-party content for students, we aim to use age-appropriate and safe resources.

22. Cookies and Website Controls

Bodhi’s website may use cookies, pixels, scripts, local storage, or similar technologies for:

• website functionality;
• payment flow;
• security;
• analytics;
• performance;
• form submission;
• consultation or enquiry handling;
• user experience improvement.

Where legally required, Bodhi may display a cookie notice, obtain consent, or provide cookie preference controls.

Users may also control cookies through browser settings. Disabling cookies may affect website functionality, payment flow, forms, or user experience.

Bodhi may publish a separate Cookie Policy with more detailed information about website cookies and analytics tools.

23. Changes to This Policy

We may update this Privacy Policy from time to time.

When material changes are made, we may notify users through the app, website, email, school communication, or another appropriate method.

The “Last Updated” date at the top of this Policy shows when it was last revised.

Continued use of Bodhi after an updated Policy becomes effective means the updated Policy applies, subject to applicable consent requirements.

24. Contact and Grievance Redressal

For questions, privacy requests, data deletion, consent withdrawal, complaints, or grievances, contact:

Business / Operator: Shyam Hitendra Trambadia, sole proprietor carrying on business under the trade name “Neurosynthesis Lab”

App: Bodhi

Address: 404, Silver Cross Building, Satellite Road, Near Shivranjani Char Rasta, Shivranjani Junction, Ahmedabad, Gujarat – 380015, India

Website: https://bodhi.org.in

Support Email: support@bodhi.org.in

Privacy Email: privacy@bodhi.org.in

Grievance Officer: Shyam Hitendra Trambadia, Founder / Proprietor, Neurosynthesis Lab

Grievance Email: grievance@bodhi.org.in

Customer Care Phone: +91 94088 76061

Account/Data Deletion Webpage: https://bodhi.org.in/delete-account

We aim to acknowledge consumer complaints within 48 hours and resolve them within one month from receipt, subject to applicable law and the nature of the complaint.

Privacy and data-protection grievances will be handled within the period required by applicable law.

Parents, guardians, students, teachers, and schools may also contact us through the in-app support option where available.