Privacy Policy & Children’s Data Protection Notice

This notice is issued under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), and, to the extent applicable, the Information Technology Act, 2000 and the rules made under it. It applies to TeenCare.in, the TeenCare Parent App and the TeenCare Student App (together, the “Service”).

1. Who we are (Data Fiduciary)

The Data Fiduciary for the Service is The BrightFamily Labs Pte. Ltd., a company incorporated in Singapore (UEN 202532951Z) with its registered office at 20A Tanjong Pagar Road, Singapore 088443. Although we are established outside India, the DPDP Act applies to us under Section 3(b) because we offer the Service to Data Principals in India, and we comply with it in full. Our address for service in India is C8 Chirag Enclave, Greater Kailash Part 1, New Delhi 110048, India. Questions about this notice and requests to exercise your rights go to our Grievance Officer: Bob Silva, grievance@teencare.in, +91 95609 33456.

2. Whom this notice covers

The Service has two kinds of Data Principal:

• Parent User — an adult (18 or older) who is the parent or lawful guardian of a teenager, holds the TeenCare account, and pays for the Service.
• Child User — a person under 18 who uses the Student App. Under Section 9(1) of the DPDP Act, we process a Child User’s personal data only with the verifiable consent of their parent or lawful guardian, obtained as described in Section 3.

A user aged 18 or 19 may hold their own Student App account and consent for themselves; in that case the provisions for Parent Users apply to them directly and Section 3 does not apply.

3. Verifiable Parental Consent (VPC)

Before any Child User account is created or any Child User data is processed, the Parent User must:

1. create their own TeenCare account and declare their relationship to the child;
2. verify that they are an adult and are who they say they are, using a method permitted under Rule 10 of the DPDP Rules — currently one of: (a) a virtual token issued through DigiLocker or another Central Government–recognised digital-locker service; (b) reference to a government-issued identity document verified by one-time password on the registered mobile number; or (c) identity and age details already held by TeenCare and verified at an earlier point;
3. read this notice and confirm consent to the specific purposes listed in Section 5.

We record each consent with a timestamp, the verification method used, the purposes consented to, and the version of this notice in force, and retain that record for the life of the account plus any statutory retention period. Consent is granular: a Parent User may consent to mentoring sessions without consenting to the AI Developmental Insight Engine (Section 6), in which case no Progress Map is generated. Consent may be withdrawn at any time from the Parent App or by email; withdrawal stops all further processing of the Child User’s data and triggers deletion under Section 9, without affecting the lawfulness of processing already carried out.

4. What we collect

5. Why we process it and on what basis

6. The AI Developmental Insight Engine — what it is and is not

The Engine processes session content solely to identify developmental themes — for example confidence, emotional regulation, communication and motivation — and to synthesise them into a Developmental Progress Map for the Parent User and the assigned mentor. Its outputs are reviewed by the mentor before release to the Parent User.

7. The Confidentiality Rule

Session content between a Child User and their mentor is not disclosed to the Parent User. The Child User is informed of this rule, and of its exceptions, at onboarding in age-appropriate language. The exceptions are:

1. where the mentor reasonably believes the Child User or another person is at risk of serious harm, in which case the Parent User is contacted immediately and only the information necessary to address the risk is shared;
2. where disclosure is required by law, by a court order, or by a lawful request of a competent authority.

8. Sharing and Data Processors

We do not sell personal data and we do not share any personal data with advertisers. We share data only with Data Processors engaged under written contract in accordance with Section 8(2) of the DPDP Act, in the following categories: video-call infrastructure; cloud hosting; payment processor (Stripe); transactional email and SMS; the AI model provider used by the Engine, which is contractually prohibited from using Child User data to train its models; and our WhatsApp communications, which are carried over Meta’s WhatsApp Business Platform and may be handled through an Indian business-solution provider engaged as our processor to send and receive those messages. TeenCare itself is located in Singapore, so your data is transferred to Singapore for processing by us; this and any transfer to a processor outside India are made only to countries not restricted by the Central Government under Section 16, with contractual safeguards. A current list of processors is available on request from the Grievance Officer.

9. Retention and deletion

Child User data is retained only for as long as the account is active and the purpose for which it was collected is being served. It is deleted, and our processors are instructed to delete it, within 30 days of the earliest of: withdrawal of parental consent; closure of the account; or the Child User attaining 18 without re-consenting as an adult. Parent User data is deleted within 30 days of account closure. Call notes from the Discovery Call and any mentor consultation, and the Developmental Progress Map, are retained for the duration of your TeenCare Plan plus 12 months, unless you ask us to delete them sooner. Payment and invoice records are retained for the period required by Indian tax and company law, and consent records for the period required by the DPDP Rules.

10. Your rights (Sections 11–14 of the DPDP Act)

• Access — a summary of the personal data we hold and the processing we carry out;
• Correction and erasure — correction of inaccurate data, completion of incomplete data, and erasure where no longer necessary;
• Grievance redressal — see Section 13;
• Nomination — nominate another person to exercise these rights in the event of death or incapacity;
• Withdrawal of consent — at any time, with the same ease as it was given.

The Parent User exercises these rights on behalf of the Child User. Requests are made from the Parent App or to grievance@teencare.in and answered within the timelines prescribed by the DPDP Rules.

11. Security and breach notification

We use encryption in transit and at rest, role-based access controls, mandatory confidentiality undertakings for every mentor and staff member, logging of access to Child User data, and an annual independent security review. In the event of a personal-data breach we notify the Data Protection Board of India and each affected Data Principal in the manner and within the time required under Section 8(6) of the DPDP Act and the DPDP Rules.

12. Cookies and website measurement (parent-facing website only)

TeenCare.in uses strictly necessary cookies to run the site and, only after you accept the consent banner, a Meta (Facebook) pixel, the LinkedIn Insight Tag and analytics cookies to measure the effectiveness of our advertising to parents. Meta Platforms Ireland Ltd. and LinkedIn Ireland Unlimited Company act as independent controllers of the data their tags collect; their respective privacy policies apply. You may reject these with no effect on the Service, and change your choice at any time by clearing your browser data. No marketing or analytics pixel is deployed inside the Student App or applied to any Child User data.

13. Grievance redressal

Grievance Officer: Bob Silva, Chief Trust Officer, grievance@teencare.in, +91 95609 33456, C8 Chirag Enclave, Greater Kailash Part 1, New Delhi 110048, India. We acknowledge grievances within 48 hours and resolve them within one month. If you are not satisfied with our response you may approach the Data Protection Board of India. See our Grievance Redressal page for the full process.

14. Changes to this notice

We may update this notice from time to time. Material changes to how we process a Child User’s personal data will not take effect for an existing Child User until the Parent User has given fresh consent. The effective date at the top of this page tells you when it was last changed.