Privacy notice

Who is responsible for your data

Talk is built for students and trainees of Andhra Medical College and is open to them as a pilot that the Principal has approved. The college owns the data and is the Data Fiduciary under the Digital Personal Data Protection Act, 2023.

Talk is run separately from any private company. It does not sell, rent or share your data for advertising.

What Talk keeps, and why

• Your email address, to send you sign-in codes and to keep one account for each person. It is sealed and encrypted, and never shown in the app.
• The college code you used, to check that you study or train at the college. It is sealed with your email address.
• Your code and shape, such as MK‑4821, which is how everyone else sees you.
• What you write: chat messages, messages you leave, wall posts and replies, and reports to a committee with any replies.
• Photos you add to a report. Hidden data such as location, time and phone model is removed before a photo is stored. What can be seen in the photo itself stays.
• For volunteers: course and year, languages, why you want to volunteer, usual hours and up to four topics. For doctors: the public profile you write and approve.
• For volunteers and doctors only: whether you are a woman or a man, if a super admin records it. It is sealed, never shown to anyone, and used only to match a student who asked for a woman or a man.
• If you turn on notifications, an address from your browser maker's push service, so an alert can reach this device. It holds nothing about what you wrote.
• Records the system needs to stay safe: sign-in attempts, moderation records and an audit record of sensitive actions.
• These records include the internet address your device connects from. Talk keeps it only in sign-in and security logs, for about one year, and never shows it to anyone in the app.

Talk does not track your location, and does not collect your contacts, your age, or audio from voice calls. Your app PIN stays on your phone and is never sent to Talk.

Who can see what

• Other students, volunteers, doctors and moderators see only your code and shape.
• A volunteer or doctor sees a chat only if they are in it. A doctor joins a volunteer's chat only if you agree.
• Moderators never read private chats. They see only a single message that the filter held or covered, or that someone reported.
• A committee reads only the reports sent to it. It sees a reference, never your code or your identity.
• No one at Talk can see who you are, except through the unsealing process described below.
• If you volunteer, the team who runs your orientation knows your code, because you show it to them there.

How long it is kept

• Each chat message is destroyed 30 days after it was sent. A chat goes 30 days after its last message.
• Call records (times and a status, never audio), messages you left, requests and notifications are destroyed after 30 days.
• Messages deleted for everyone, reported or removed content, reports to a committee with their photos and replies, registration details and system logs are kept sealed and encrypted for about one year, to meet legal requirements, and are then destroyed.
• The record of each time an identity is opened is kept permanently.
• Answers to “Did this help?” are kept only as anonymous monthly counts once their chat is destroyed.

Records about a person whose identity is in the process of being opened are kept until that process ends.

How it is protected

Sealed records are encrypted in the database with a key that is kept separately in the database's secure store. A sealed copy of the key is held offline by the person responsible for Talk until the college approves it, and then by the college.

This encryption protects backups and copies of the database's disks. It does not stop someone who has full access to the running database, which is why opening an identity also needs two people, a written reason and a permanent record.

The email address used to sign in, which the sign-in service needs to send your code, and report photos are protected by the hosting providers' own encryption of their disks and backups.

The app never sends your internal account number to another person's device, so two codes cannot be matched by reading network traffic.

When your identity can be opened

Your identity can be opened only for confirmed sexual harassment, threats or sharing of intimate images; for a legal order; or, as a last resort, when a psychiatrist judges that your life is in imminent danger and you have refused to share who you are, under a protocol approved by the college.

Opening it needs two different people: the super admin and a committee officer. It needs a written reason and leaves a permanent record. You are told afterwards in the app, unless a legal order requires a delay of up to 30 days.

Services that process data for Talk

• Supabase: the database, sign-in and photo storage, in Mumbai, India.
• Vercel: the website and its server code, run in Mumbai, India.
• Google (Gmail), during the pilot: sends the sign-in code email from a Talk Gmail account, on servers that may be outside India. Your email address passes through it. Gmail keeps a copy of each email it sends, with your email address and the code, until the copy is deleted; Talk deletes these copies every day during sign-ups and after each group of sign-ups. Only the super admin can open the account.
• Your browser maker's push service (such as Google, Apple or Mozilla), from servers outside India, only if you turn on notifications. It passes on an encrypted alert with no name, code or message in it; your phone shows “You have a new message”.
• LiveKit, only if voice calls are turned on. Calls are currently switched off. Calls are not recorded.

Your rights

• To ask for a summary of the personal data Talk keeps about you, and how it is used.
• To ask for it to be corrected or completed.
• To have it erased: use Delete account in Me. Your chats, posts and notifications are removed at once. What the law requires is kept sealed for about one year and then destroyed.
• To have a complaint answered by the Grievance Officer.
• To name another person who may use these rights if you cannot.
• If the Grievance Officer does not resolve your complaint, to complain to the Data Protection Board of India.

To use a right other than erasure, write to the Grievance Officer. Writing by email shows who you are, so say so if you want an answer in the app instead.

If something goes wrong

If personal data is exposed, the people affected are told in the app, in plain words, what happened and what to do, and the Data Protection Board is told as the law requires.

Members under 18

The law has special rules for personal data of anyone under 18. The college and a legal opinion will decide how they apply to Talk before any student uses it. Talk does not ask for or store anyone's age.

Changes to this notice

If the privacy promise or the rules change, you are asked to read them and agree again the next time you open Talk.