Privacy Policy

At Summit, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mental health platform. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last Updated" date of this Privacy Policy.

1. Information We Collect

Personal Data

We may collect personally identifiable information that you voluntarily provide to us when you:

• Register for an account
• Book an appointment with a therapist
• Participate in community discussions
• Subscribe to our newsletter
• Contact us for support

This information may include:

• Name and contact information (email address, phone number)
• Account credentials (username, password)
• Profile information (age, location, preferences)
• Payment information (processed securely through third-party payment processors)
• Communication data (messages, posts, appointment notes)

Protected Health Information (PHI)

When you use our therapy services, we may collect Protected Health Information as defined under HIPAA, including:

• Mental health history and treatment information
• Session notes and treatment plans
• Medical records shared with your consent
• Insurance information for billing purposes

Automatically Collected Information

When you access our platform, we may automatically collect certain information:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, time spent, click patterns)
• Cookies and tracking technologies
• Location data (with your permission)

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our platform and services
• Process your appointments and facilitate communication with therapists
• Send you important updates, security alerts, and administrative messages
• Respond to your inquiries and provide customer support
• Improve and personalize your experience on our platform
• Conduct research and analytics to improve our services
• Detect, prevent, and address technical issues and fraudulent activity
• Comply with legal obligations and enforce our Terms of Service

3. Disclosure of Your Information

We may share your information in the following situations:

With Your Consent

We will share your information with your explicit consent, such as when you authorize us to share information with your therapist or healthcare provider.

Service Providers

We may share information with third-party service providers who perform services on our behalf, including:

• Payment processing companies
• Cloud hosting providers
• Analytics services
• Email delivery services
• Customer support platforms

Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

Emergency Situations

We may disclose information if we believe it is necessary to protect the safety of you or others, including situations involving imminent risk of harm or suicide.

4. Security of Your Information

We use administrative, technical, and physical security measures to protect your personal information. These measures include:

• Encryption of data in transit and at rest (SSL/TLS)
• Secure authentication and access controls
• Regular security audits and vulnerability assessments
• HIPAA-compliant data handling procedures
• Limited employee access to personal information
• Secure data backup and disaster recovery systems

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

5. Data Retention

We retain your personal information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations (e.g., HIPAA requires medical records be retained for at least 6 years)
• Resolve disputes and enforce our agreements
• Maintain business records for tax and accounting purposes

When we no longer need your information, we will securely delete or anonymize it.

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal obligations)
• Portability: Request transfer of your data to another service provider
• Objection: Object to processing of your personal information for certain purposes
• Restriction: Request restriction of processing in certain circumstances
• Withdraw Consent: Withdraw consent for data processing where consent was the basis

To exercise these rights, please contact us at privacy@summit.com

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your use of our platform. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our platform.

Types of cookies we use:

• Essential Cookies: Required for the platform to function properly
• Analytics Cookies: Help us understand how users interact with our platform
• Preference Cookies: Remember your settings and preferences
• Marketing Cookies: Used to deliver relevant advertisements (with your consent)

8. Third-Party Services

Our platform may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information to them.

9. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@summit.com

10. Your Rights Under Indian Law

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000, you have the following rights regarding your personal data:

• Right to Access: Request information about what personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Data Portability: Request transfer of your data to another service provider
• Right to Withdraw Consent: Withdraw your consent for data processing at any time
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer if you believe your rights have been violated

Grievance Officer:
Name: [Appoint a Grievance Officer as required by IT Act]
Email: grievance@summit.com
Response Time: We will respond to your grievance within 24 hours as mandated by law.

To exercise any of these rights, contact us at privacy@summit.com

11. Data Protection and Indian Law Compliance

Summit complies with the Information Technology Act, 2000 (IT Act) and the Digital Personal Data Protection Act, 2023 (DPDP Act) for all personal and health data collected through our platform.

Your health information is classified as Sensitive Personal Data or Information (SPDI) under Indian law and is handled with the highest level of security:

• All data is stored on servers located in India, ensuring compliance with data localization requirements
• Therapy session data is encrypted end-to-end and accessible only by you and your therapist
• We do not share your health information with third parties without explicit consent, except as required by law
• You have the right to access, correct, or delete your personal data at any time

Our telemedicine services comply with the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 and Telemedicine Practice Guidelines issued by the Ministry of Health and Family Welfare.

12. Data Storage and Security

All personal data collected through Summit is stored on secure servers located in India, ensuring compliance with Indian data localization requirements under the DPDP Act, 2023.

We implement industry-standard security measures to protect your data:

• 256-bit SSL/TLS encryption for data in transit
• AES-256 encryption for data at rest
• Regular security audits and penetration testing
• Access controls and multi-factor authentication for our team
• Secure backup systems with geographic redundancy within India

If you are accessing our services from outside India, please note that your data will be transferred to and processed in India in accordance with Indian data protection laws.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: