Privacy Policy
Who We Are
Kikstart Rehabilitation (“Kikstart”, “we”, “us”, “our”) is an online therapy platform providing occupational therapy, speech therapy, special education, counselling and mental-health support, and caregiver and parent training, delivered online across India and abroad. Kikstart is a brand of Kikstart Rehabilitation LLP. We are the Data Fiduciary responsible for your personal data under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
Contact about your data: admin@kikstart.rehab
What Data We Collect
Contact & identity: your name (and your child’s name, if you book for a child); email; phone; WhatsApp number (only if you use WhatsApp); age/date of birth (for scheduling and age-appropriate services); gender and educational background where relevant to the service; and the content of your communications with us (enquiries, messages, intake forms).
Health & therapy information (our most protected category): the concern you tell us about (for example autism, ADHD, learning difficulties, anxiety); relevant history you share; session notes and progress records; intake-form and introductory-call information.
Booking & payment: appointment times; payment confirmation and invoices (we do not store your card or bank details; a secure third-party service handles payment).
Website usage: IP address, browser/device information and pages visited.
Where information that does not by itself identify you is combined with information that does, we treat the combined data as your personal data.
Why We Collect It, and Our Legal Basis
Under the DPDP Act we tell you each purpose and our lawful basis: your consent (Section 6) or, in limited cases, certain legitimate uses (Section 7).
| Purpose | Data | Basis |
|---|---|---|
| Booking & managing appointments | Name, contact, appointment times | Consent (s.6) |
| Delivering therapy | Health & therapy information, session notes | Consent (s.6) |
| Confirmations & reminders | Name, email, phone/WhatsApp | Consent (s.6) |
| Payments & invoices | Booking reference, payment confirmation | Consent (s.6) |
| Responding to enquiries | Contact, message content | Consent (s.6) |
| Inviting you (never your child) to give optional feedback or a review | Name, contact, milestone | Consent (s.6) |
| Publishing a testimonial you expressly agree to | Only what you approve, in writing | Separate written consent (s.6) |
| Improving our services and quality | Service-usage and feedback data | Consent (s.6) |
| Keeping the platform secure | IP, device data | Consent (s.6) |
| Meeting Indian legal obligations (tax/accounting) | As required by law | Legitimate use (Section 7(d)) |
Any market research, personalisation of your experience, or new-feature development beyond delivering and improving your service is done only with your separate, specific consent.
Service Messages
To deliver your therapy we send essential administrative messages, such as booking confirmations and reminders, payment receipts and invoices, and important service updates. These are part of the service you signed up for and are different from marketing: we do not send marketing without your separate consent, you can decline marketing at any time, and we never target advertising at children. Essential service messages continue for as long as you use the service.
Your Health and Therapy Data: Extra Protection
Your session notes and therapy records are never shared with third parties without your explicit written consent. Access is limited to your therapist and the staff who support your service. We do not use your health data for research, marketing or insurance. Video sessions are not recorded without your explicit prior written consent, and any personal copy is shared only with you.
Children’s Data (Under 18): Section 9
We obtain verifiable consent from a parent or lawful guardian before processing any of a child’s personal data (Section 9(1)), and we take reasonable steps to confirm that the person giving consent is an identifiable adult. The parent or guardian is the primary account holder, responsible for booking and paying for services, for decisions about sharing the child’s information, and for monitoring what the child shares.
We will never track or behaviourally monitor a child, direct targeted advertising at a child (Section 9(3)), or process a child’s data in any way likely to harm the child’s well-being (Section 9(2)). If we ever collect a child’s data without verifiable parental consent, we delete it promptly and tell the parent.
Adults Who Have a Lawful Guardian
Where an adult we support has a lawful guardian, we obtain the guardian’s verifiable consent before processing their data and verify the guardianship in line with applicable law (Section 9(1)), applying the same protections we apply to children’s data. The person’s own voice stays central to their therapy.
Who Else Handles Your Data
To run Kikstart we use a small number of service providers: for scheduling, payments, website hosting, online sessions, email, protecting our forms from spam, and displaying our reviews. They process your data only on our instructions and under written contract, and only for the purpose they serve. Our payment provider acts as an independent party for payment processing and compliance and operates under its own privacy policy.
We do not sell your data, and we do not share therapy notes or health records with any of them.
If you would like to know which providers we use, just ask us at admin@kikstart.rehab. Under Section 11 of the DPDP Act you also have the right to request the identities of the processors with whom we share your personal data.
How Long We Keep Your Data
We keep your personal data only for as long as it is needed for the purpose you gave it for, or for as long as the law requires us to keep it (for example, tax and accounting records). We then delete it securely. You can ask us to delete it earlier: see Your Rights.
Your Rights Under the DPDP Act
- Access (Section 11): a summary of the data we hold about you, and the identities of processors we have shared it with.
- Correction and erasure (Section 12).
- Grievance redressal (Section 13): contact our Grievance Officer.
- Nominate (Section 14): nominate someone to exercise your rights if you are unable to.
To exercise any right, email admin@kikstart.rehab with “Data Rights Request” in the subject and tell us what you need. We respond within 30 days in most cases, and in any event within 90 days.
Withdrawing Consent
You can withdraw any consent at any time, as easily as you gave it (Section 6(4)). Email admin@kikstart.rehab with “Withdraw Consent” and tell us which activity. We then stop that processing and delete the relevant data unless the law requires us to keep it. Withdrawal does not affect processing we did beforehand; if it affects your therapy, we will tell you clearly.
If you contact us on WhatsApp, or agree to receive reminders there, you consent to that channel for those purposes, separately from your consent to therapy. Reply STOP or email us to withdraw; it will not affect your appointments.
How We Keep Your Data Safe
We take reasonable technical and organisational security measures to protect your personal data, as required under Section 8(5) of the DPDP Act, and our providers are bound to do the same under written contract.
No system is completely secure. If a personal data breach affects your personal data, we will inform you without undue delay, telling you what happened, the likely impact, the steps we are taking, and how to reach us. We will also notify the Data Protection Board of India as required (Section 8(6)).
Cookies
We use essential cookies to run the site, and we do not use advertising, tracking or web-analytics cookies. Some third-party services we use may set their own cookies in order to function. You can control cookies through your browser settings. If we introduce analytics in future, we will ask for your agreement first.
Legal Disclosures and Business Transfers
We may disclose your data where the law requires it, for example in response to a court order, legal process, or a lawful request from a tax or regulatory authority. If our business (or part of it) is ever transferred, merged or reorganised, your data may transfer to the successor, which will remain bound to protect it under this policy or an equivalent one.
Grievance Officer
For any concern about how we handle your data, contact our Grievance Officer at admin@kikstart.rehab. We acknowledge within 48 hours and resolve within the period set out above. You may also raise a complaint with the Data Protection Board of India through its official channels.
Changes to This Policy
If a change affects a purpose you consented to, we will ask for your consent again, and continued use is never treated as consent to a new purpose (Section 6). We will tell you about significant changes.
Version 2.0 · effective 21 July 2026