Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Thrive Well Circle (referred to as "we", "our", or "us") handles your personal information when you access our website (thrivewellcircle.com), use our Stress Monitor Scorecard, read our interactive workbooks, listen to audiobooks, or converse with our AI Wellbeing Companion.

We are committed to processing your personal data with transparency, discretion, and care. This policy has been drafted in compliance with applicable Indian data protection and information technology laws, including the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Information We Collect

The categories of personal data we collect depend on how you interact with our website:

• Account and Profile Information: When you register on Thrive Well Circle, we collect your email address, full name, and authentication credentials through our identity provider, Clerk. If you choose to sign in with Google, we receive your verified Google account email, full name, and profile picture.
• Stress Monitor Scorecard Data: When you complete the Stress Monitor self-assessment, you provide your first name, last name, email address, phone number, and answers to the 25 scorecard questions. These questions relate to your physical exhaustion, bodily tension, sleep patterns, workplace pressure, interpersonal boundaries, emotional overwhelm, and financial worries. Please note that assessment responses reflect personal wellbeing and emotional states. If you are signed into an account, these assessment responses and calculated scores are directly linked to your account profile and are not anonymous.
• AI Wellbeing Companion Interactions: If you use our conversational reflection tool, we process the text prompts and questions you submit in order to generate conversational responses. When logged in, your conversation history is stored to allow you to review previous reflections.
• Transactions and Order Records: When you purchase our workbook or audiobook, our payment gateway partner, Razorpay, collects payment details. We receive and store confirmation records including your payment ID, email address, customer name, customer phone number, purchase amount, currency (INR), and order timestamps. We do not store complete debit or credit card numbers, CVVs, or net banking passwords on our servers.
• Support and Inquiries: When you reach out via our contact forms, email, or WhatsApp, we receive your name, contact information, and message contents.
• Technical and Device Data: Our web servers receive standard server logs including your IP address, browser type, operating system, and request timestamps to monitor system performance and detect abusive traffic.

3. How and Why We Use Your Information

We process your personal information for specific, legitimate operational purposes:

• To create, authenticate, and administer your personal member account.
• To calculate your 5-domain Stress Monitor score and generate your personalized summary and practical recommendations.
• To grant access to purchased digital materials, including reader access and chapter audio narration.
• To power the AI Wellbeing Companion and provide conversational reflective responses.
• To verify transactions, provide invoices, and maintain statutory accounting and tax compliance records under Indian financial regulations.
• To provide customer assistance and respond to your questions.
• To maintain system stability, enforce our Terms and Conditions, and safeguard our services against spam or security intrusions.

4. How Stress Monitor Responses Are Processed and Stored

The Stress Monitor Scorecard uses a transparent, deterministic mathematical scoring model to evaluate responses across five domains: Physical / Mental Stress, Emotional Regulation, Work Stress, Relationship Stress, and Financial Stress.

Scoring calculations are executed server-side. When you submit your assessment:

• Your answers are validated against our question definitions.
• Domain percentages and overall tension metrics are calculated.
• If you are signed in, the assessment record is associated with your unique account identifier in our database.
• If you complete the assessment as a guest, the record is stored with the contact email you provided, allowing you to access your summary in your current browser session.
• We do not share individual assessment responses with advertisers, employer groups, or insurance companies.

5. Account Authentication via Clerk

We use Clerk (Clerk, Inc.) to provide secure user registration, email verification, password management, and OAuth authentication.

When you sign up or log in, Clerk processes your email address, encrypted password credentials, and session tokens. Clerk sets strictly necessary session cookies to maintain your login status across pages. For details on Clerk's security and data handling practices, please refer to Clerk's Privacy Policy.

6. Database and Cloud Infrastructure via Supabase

Our primary application database and private media storage are hosted with Supabase (Supabase, Inc.).

Supabase hosts our PostgreSQL database, which stores user profiles, AI conversation messages, stress assessment score records, and verified order data. We enforce Row Level Security (RLS) policies within our database tables so that authenticated users can only query their own records. Purchased eBook PDFs and chapter audio files are stored in private cloud storage buckets that require valid session verification to access.

7. AI Wellbeing Companion and Automated Features

Our AI Wellbeing Companion feature uses Google Gemini APIs (Google LLC) to generate empathetic self-reflection responses.

When you send a message in the chat companion, your message text and recent conversation context are transmitted to the API endpoint to generate a relevant reply. Our companion includes safety filters designed to detect crisis situations and share verified Indian helpline contact details (such as Tele-MANAS, Vandrevala Foundation, or AASRA).

Important Notice on AI Limitations: The AI Wellbeing Companion is an automated informational and reflective tool. It is not a qualified mental health clinician, medical professional, therapist, or counselor, and it cannot provide psychiatric care, clinical therapy, or medical diagnosis. We do not use your private conversation logs to train public machine learning models without your explicit consent.

8. Third-Party Service Providers

We partner with select third-party service providers who assist us in operating our website:

• Razorpay (Razorpay Software Private Limited): Processes digital payments for paid materials. Razorpay is an authorized payment aggregator regulated by the Reserve Bank of India (RBI). When making a payment, you interact directly with Razorpay's secure payment interface.
• Resend (Resend, Inc.): Transactional email service provider used to send purchase confirmations, digital delivery links, and service notifications from support@thrivewellcircle.com.
• WhatsApp (Meta Platforms, Inc.): We offer a voluntary "Talk with an Expert" feature that opens a prefilled WhatsApp chat with our dedicated number (+91 99005 18054). Opening the link generates a draft message in your WhatsApp application containing your entered name and scorecard percentages. Clicking this button does not automatically send any data to us; the message is only transmitted if you choose to press send in your WhatsApp application.

9. Data Sharing and Disclosures

We do not sell, rent, or trade your personal data. We disclose personal information only under the following limited circumstances:

• Service Providers: To trusted technology infrastructure vendors (Clerk, Supabase, Razorpay, Resend, Google) who process data strictly on our behalf to provide core website functionality.
• Legal Compliance: If required to do so by applicable Indian court orders, law enforcement requests, or regulatory authorities under statutory investigative procedures.
• Protection of Rights: When necessary to investigate fraud, enforce our Terms and Conditions, or protect the vital safety of our users or the public.

10. Data Security and Safeguards

We implement reasonable technical and organizational security measures to protect your personal data, including:

• HTTPS transport layer encryption for all website communications.
• Restricted database access using database Row Level Security and server-side authentication checks.
• Confidential server environments for API keys and secret service tokens.
• Separation of public assets from private, token-gated digital downloads.

While we take diligent steps to safeguard your personal data, please recognize that no method of electronic storage or transmission over the Internet can be guaranteed as completely impenetrable. We encourage you to use a strong, unique password for your account.

11. Data Retention and Account Deletion

We retain personal information for the period necessary to fulfill the purposes described in this policy, unless a longer retention period is mandated by Indian law:

• How to Request Account Deletion: Authenticated users can execute an immediate self-service account deletion directly in their My Account settings within the dedicated Danger Zone section, or via our Data Deletion Center. Alternatively, users may email our privacy team at support@thrivewellcircle.com to request manual erasure.
• What Information is Deleted: When account deletion is confirmed, our automated workflow permanently erases your Clerk authentication identity, Supabase profile record, all Stress Monitor scorecard responses and domain scores, all AI Wellbeing Companion conversation threads and message logs, and any user-associated storage objects.
• Statutory Retention and Anonymization: In accordance with Section 128 of the Companies Act, 2013, the Central Goods and Services Tax Act, 2017, and the Income Tax Act, 1961, completed purchase invoices and transaction ledger entries must be retained for a mandatory statutory period (up to 8 years). When an account is deleted, these financial records are detached from your identity and anonymized (personal names and phone numbers are cleared), preserving only the transaction ID and tax amounts required for statutory audits.
• Processing Timelines and Technical Backups: Self-service deletion initiated through your account is processed immediately across active production systems. Manual deletion requests submitted by email are verified and fulfilled within 30 days, in alignment with the Digital Personal Data Protection Act, 2023. Encrypted system backups are retained on a standard rolling schedule [Site Owner to Confirm Backup Retention Cycle, e.g., 30 days] before being permanently purged.
• Assistance for Failed Deletion Requests: If a network interruption or partial failure prevents complete deletion, our server does not mark the deletion as successful. In the event of an issue, users are provided with support contact information and can reach our team at support@thrivewellcircle.com or via WhatsApp at +91 99005 18054 for priority resolution.

12. Your Rights Under Indian Law

Under the Digital Personal Data Protection Act, 2023 (DPDPA), you possess specific rights regarding your personal information:

• Right to Access: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction: You may update or correct inaccurate or incomplete profile details directly in your account or by contacting us.
• Right to Erasure: You may request the permanent deletion of your account and personal records using our Data Deletion Center.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Grievance Redressal: You have the right to register concerns or grievances with our designated Grievance Officer, as described below.

13. Children and Age Restrictions

Thrive Well Circle is designed for individuals who are at least 18 years of age. We do not knowingly collect personal information from minors under 18 without verifiable parental or guardian consent. If you believe a minor has provided us with personal information without parental approval, please notify us immediately, and we will promptly take steps to delete that information.

14. Cookies and Session Storage

Our website uses strictly essential session cookies and local browser storage to manage your logged-in session, remember your assessment progress between screens, and prevent unauthorized account access.

We do not deploy third-party advertising cookies, cross-site trackers, or commercial profiling cookies. Because we only use strictly necessary session mechanisms required for the website to function, a marketing cookie consent banner is not required or displayed.

15. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect modifications in our features, operational practices, or applicable legal standards. When revisions occur, we will update the "Last Updated" date at the top of this document. We encourage you to review this page periodically. Continued use of our website after modifications indicates your acknowledgment of the updated policy.

16. Grievance Officer and Contact Details

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, you may address privacy inquiries, exercise data rights, or submit grievances to our designated contact point: