Privacy Policy

1. Who We Are

Crown Ventures is the legal entity operating the Poornam™ platform at poornam.health. Crown Ventures is registered in Faridabad, Haryana, India as an MSME with a valid GST registration. In this Privacy Policy, "Poornam," "we," "us," and "our" refer to Crown Ventures operating under the Poornam brand.

Crown Ventures is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDPA), India, and is responsible for your personal data collected through the Poornam platform.

2. Scope of This Policy

This Privacy Policy applies to all personal data collected through:

• The Poornam website at poornam.health
• The Poornam mobile application (iOS and Android)
• The Poornam client portal and treatment plan dashboard
• Assessment and healing sessions booked through the platform
• Email, WhatsApp, or other communications with Poornam

3. What Personal Data We Collect

3.1 Information you provide directly

• Full name, email address, and phone number (for account registration and communication)
• Country, city, and timezone (for scheduling and therapist matching)
• Health and wellbeing information shared voluntarily in assessment sessions or intake forms — including physical conditions, emotional concerns, and personal history
• Payment information (processed by our authorised payment gateway — we do not store card details)
• Correspondence sent to us via email or messaging platforms
• Where a therapist connects their Google Calendar to the platform, we access only free/busy time intervals to prevent scheduling conflicts. We never access event titles, descriptions, attendees, or any calendar content. Free/busy information is checked at the time of scheduling and is not stored.
• Sessions conducted through the platform are recorded via our video conferencing provider. Audio transcripts of session recordings are generated and processed — including with the assistance of AI systems — to produce session summaries that are reviewed by your practitioner before any part is shared with you. Recordings, transcripts, and summaries are stored encrypted and are covered by the retention and deletion terms in Section 7.

3.2 Information collected automatically

• Device type, browser, and operating system
• IP address and approximate geographic location
• Pages visited, session duration, and navigation behaviour on poornam.health
• Media content accessed and viewing duration (for subscription management)

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• To create and manage your Poornam client account
• To conduct the assessment session and facilitate therapist matching
• To deliver your personalised treatment plan through the client portal
• To provide access to subscribed media content
• To process payments and issue GST-compliant invoices
• To communicate with you about bookings, sessions, and your healing journey
• To improve the Poornam platform and the quality of our services
• To comply with applicable Indian laws and regulations

We do not use your personal data for unsolicited marketing without your explicit consent. We do not sell your personal data to any third party under any circumstances.

5. Sharing of Personal Data

Your personal data is shared only in the following limited circumstances:

• Matched therapist: Relevant details from your assessment are shared with your matched Poornam therapist to enable effective healing sessions. Therapists are bound by a confidentiality agreement.
• Payment processors: Payment data is shared with our authorised payment gateway (Razorpay for Indian transactions; Apple/Google for mobile in-app purchases) solely for transaction processing.
• Cloud and service providers: We use secure infrastructure and services to operate the platform: Supabase and Cloudflare (data storage and delivery), Zoom (session conferencing and recordings), Google (sign-in and calendar free/busy access), Resend (transactional email delivery), and Anthropic (AI-assisted processing of session transcripts and website enquiries). These providers are bound by data processing agreements and access only the data necessary for their function.
• Legal requirements: We may disclose personal data if required to do so by Indian law, court order, or regulatory authority.

We never share your health information with insurers, employers, government bodies (except as legally required), or any marketing or advertising platform.

6. International Data Transfers

If you are accessing Poornam from outside India — for example from the UAE, Singapore, the United Kingdom, or elsewhere — your personal data may be transferred to and processed in India, where Crown Ventures is headquartered. By using the platform, you consent to this transfer.

We ensure that any international transfers of personal data are conducted in compliance with applicable data protection laws and with appropriate safeguards in place.

7. Data Retention

We retain your personal data for as long as your Poornam account is active and for a period of five years thereafter, or as required by applicable Indian law (including for GST and accounting purposes). Health information shared in sessions is retained for the duration of your engagement with Poornam and for three years thereafter.

You may request deletion of your account and personal data at any time by contacting reach@poornam.health. Certain data may be retained beyond deletion requests where required by law.

8. Cookies

The Poornam website uses essential cookies required for the platform to function (such as session management and authentication). We do not use advertising or tracking cookies. Analytics data, where collected, is aggregated and anonymised.

You may configure your browser to refuse cookies, though this may affect the functionality of certain features of the platform.

9. Your Rights Under the DPDPA 2023

Under India's Digital Personal Data Protection Act, 2023, you have the following rights in relation to your personal data:

• Right to access: You may request a summary of the personal data we hold about you
• Right to correction: You may request correction of inaccurate or incomplete personal data
• Right to erasure: You may request deletion of your personal data, subject to legal retention obligations
• Right to grievance redressal: You may raise a grievance with us and receive a response within a reasonable time
• Right to nominate: You may nominate another individual to exercise your rights in the event of your incapacity or death

To exercise any of these rights, please contact us at reach@poornam.health. We will respond within 30 days of receiving your request.

10. Data Security

Crown Ventures implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include encrypted data storage, access controls, and secure data transmission via HTTPS.

No method of electronic storage or transmission is completely secure. Whilst we take every reasonable precaution, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify you and the appropriate authorities as required by the DPDPA 2023.

11. Children's Privacy

The Poornam platform is intended for users aged 18 and above. We do not knowingly collect personal data from individuals under 18 without the consent of a parent or legal guardian. If you believe a minor has provided personal data through our platform without appropriate consent, please contact us immediately at reach@poornam.health.

12. Changes to This Policy

Crown Ventures may update this Privacy Policy from time to time. Material changes will be communicated to registered users via email and by a prominent notice on the platform. The effective date at the top of this page will be updated accordingly. Continued use of the platform after notification of changes constitutes acceptance of the updated policy.

13. Grievance Officer

In accordance with the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000, Crown Ventures has designated the following contact for data-related grievances: