Data Protection & Grievance Redressal
This is our notice under the Digital Personal Data Protection Act, 2023, and the standing procedure for complaining about anything on it.
This notice is written in English, which is what section 5(3) of the Act asks for. We would rather give you one version we have been careful with than several we have not. If a sentence here is hard going, write and say which one, and we will explain it in plainer words for you.
Last updated: 16 September 2026
The Data Fiduciary
| Data Fiduciary | idinsayit |
| Trading as | idinsayit |
| Address | Hyderabad, India |
| Tax | idinsayit is not registered for GST. No GST is charged on anything sold here. |
| General contact | iam@idinsayit.com |
| Phone | +91 92700 86548 |
| Grievances | iam@idinsayit.com |
| Data location | India |
We are the Data Fiduciary. You, whether reader, member or client, are the Data Principal. Our processors (Razorpay for payment, Brevo for email, Hostinger for hosting, for backups and for the network in front of the site) act only on our instructions.
What we collect, and the exact purpose
The Act requires a stated purpose for each category. These are ours. We do not use data collected for one purpose for a different one without asking you again.
| Category | Data | Purpose | Basis |
|---|---|---|---|
| Newsletter subscribers | Email address, optional first name, consent record | To send the letter | Consent |
| Readers | Aggregate page counts, cookieless, self-hosted | To know what is read | Legitimate use: no personal data involved |
| Members | Name, email, username, membership level, dates, invoice history, billing state | To provide the subscription or programme you bought, and to bill you | Consent, given when you pay |
| Members | Payment ID, amount, status, last four digits of card | To reconcile and prove payment | Legal obligation |
| Practice clients | Account credentials, intake answers, health history | To assess and treat | Consent, given at intake |
| Practice clients | Worksheet responses, drafts, files you attach, clinician feedback and notes | To deliver treatment and to keep a clinical record | Consent, given at intake |
| Practice clients | Journal entries you write for yourself | Yours to write; readable by the clinician treating you, so that it can be used in your care, and by the person who runs the practice | Consent, given at intake |
| Practice clients | Messages between you and your clinician | To arrange and discuss your care between sessions | Consent, given at intake |
| Practice clients | Booking requests, appointment times, and the session ledger: what you bought, what has been used, and how each past session was marked | To hold your time and to keep an accurate account of it | Consent, given at intake |
| Everyone | Server logs, correspondence | Security, fault-finding, answering you | Legitimate use |
We do not collect data we have no purpose for. We do not buy personal data from anyone.
Retention schedule
| Data | Kept for | Then |
|---|---|---|
| Server access logs | 30 days | Deleted |
| Newsletter subscription | Until you unsubscribe | The address moves to a suppression list, which exists only so that we cannot write to you again by mistake. Nothing else about you is kept with it. Say the word and that goes too, at the cost that a later sign-up would not be blocked |
| Correspondence (non-clinical) | 2 years | Deleted |
| Membership record | While the membership is live, then 8 years from the end of that financial year for statutory accounting and tax records | Deleted |
| Client account and clinical record, including all written work | 3 years after your last contact with the practice | Deleted |
| Backups | Daily; each backup kept for three years, then deleted by hand | A deletion you ask for takes effect at once in the live system. The copy inside a backup goes when that backup is deleted, within three years. |
Where you ask for erasure sooner, we do it, unless a specific law requires us to keep a specific item. In that case we delete everything else and tell you what remains and under what law.
Your rights, and how to use them
Write to iam@idinsayit.com from the address associated with your account, or by post to the address above.
- Right to access. Ask for a summary of the personal data we hold about you, what we are doing with it, and the processors who have had it. We answer within 30 days.
- Right to correction, completion and updating. Tell us what is wrong. We fix it. For clinical records, factual errors are corrected; a clinical opinion you disagree with is not erased, but your disagreement is added to the record permanently.
- Right to erasure. We delete, unless the law makes us keep it. Deletion is permanent.
- Right to grievance redressal. Below.
- Right to nominate. Below.
- Right to withdraw your consent. At any time, in one line, to the same address, and as easily as you gave it. What stops depends on what you withdraw: the letter simply stops arriving, and a subscription runs to the end of the period you have paid for. Treatment is different, because it cannot lawfully or safely continue without consent, so withdrawing it ends the clinical work. We would want to talk with you once before that, and then we would do it. If you withdraw while you are unwell or at risk, we do not simply stop: we say what we can still do, where else to go and who to call, and we hand over to another clinician where you want that. Withdrawing does not undo what was lawfully done beforehand, and it does not reach the records we are required to keep, which are listed above.
There is no charge for any of this. We may ask you to prove who you are before we act, because handing your record to the wrong person would be the worse failure.
Grievance redressal
The Grievance Officer
idinsayit
Hyderabad, India
Email: iam@idinsayit.com
Phone: +91 92700 86548
How it runs:
- Write, in whatever words you have. You do not need to cite a section of the Act.
- We acknowledge within 48 hours. The Consumer Protection (E-Commerce) Rules, 2020 require that of a consumer complaint, and we would rather hold one deadline for everything than make you work out which kind of complaint you have.
- We answer within 30 days of receiving your complaint, and sooner where we can. If a complaint is complicated we will tell you before day 30 what is taking the time.
- Our answer will say what we found, what we have changed, and what we have not (with the reason).
Complaints about clinical care, as opposed to data, go to the same address and are handled by our clinical team.
Escalation to the Data Protection Board of India
If we do not answer, or you are not satisfied with the answer, you may complain to the Data Protection Board of India, established under the DPDP Act 2023.
- Exhaust our grievance route first. The Act expects you to have raised it with us before the Board.
- Complaints to the Board are made through the process and portal the Board publishes. We will not pretend to know a form number that may change; ask us and we will point you at the current route, and we will hand over whatever record of your complaint you need.
- We will not retaliate. Complaining to the Board changes nothing about your subscription and nothing about your treatment.
Readers in the EU or UK may instead complain to their own supervisory authority, such as the Information Commissioner’s Office in the UK.
Nomination
Section 14 of the Act lets you name someone to exercise your rights for you if you die or become unable to exercise them yourself. This matters most for practice clients, whose records are the most personal thing we hold.
To nominate:
- Write to iam@idinsayit.com with the subject “Nomination”.
- Give the nominee’s full name, their relationship to you, an email address and a phone number for them.
- State exactly what you want them to be able to do. You may nominate for everything, or only for one thing (for example, only to request deletion, and not to read anything).
- We confirm the nomination in writing to you.
How it works in practice:
- A nomination is dormant. It gives your nominee nothing while you are able to act for yourself.
- It takes effect only on death or on incapacity, and only once we have seen reasonable evidence of that.
- A nominee cannot read your clinical writing unless you expressly said, in the nomination, that they may. The default is that they may ask for erasure and for administrative information, and no more. We think that default is the right one.
- You can change or cancel a nomination at any time, in writing. The most recent instruction stands.
- If you nominate nobody, your record simply runs out its retention period and is deleted.
Breach
If a breach of personal data occurs, we will notify the Data Protection Board of India and every affected Data Principal as the Act requires, describing what happened, what data was involved, what we have done, and what you should do. We will not minimise it and we will not delay it to make it read better.