G Welle — Compliance & Privacy White Paper

01 Introduction

This document describes the legal, privacy, and compliance frameworks that govern the handling of personal and mental-health information within G Welle.

About G Welle

G Welle is a mobile and web application that provides users with an AI-powered companion for mental wellbeing. The app offers mood tracking, guided journaling, personalised plans, standardised mental-health assessments, guided exercises, calming audio, mini-games designed for healthy distraction, and an AI-powered conversational companion available 24×7.

G Welle is designed as a wellbeing tool — not a medical device. It does not diagnose, treat, or cure any condition, and it is not a substitute for professional mental-health care.

About Gehirnwelle

Gehirnwelle Pvt. Ltd. is a private limited company incorporated in India, focused on building responsible digital tools for mental health. The company operates G Welle as a data fiduciary under India's Digital Personal Data Protection Act, 2023.

Scope of This Document

This document covers compliance with:

• India's Digital Personal Data Protection Act, 2023 (DPDP Act)
• India's Information Technology Act, 2000 and amendments
• Google Play Health Apps Policy and Developer Program Policies
• Relevant provisions of GDPR (EU/UK) where applicable to international users
• HIPAA principles where applicable to US-facing paid consultations (planned)
• Apple App Store's Health & Fitness category requirements

02 Executive Summary

A high-level view of how G Welle handles user data and its compliance posture.

Core Principles

1. Privacy by Design — Data collection is minimised at every layer. No real name, phone number, or email is required to use the core app.
2. Purpose Limitation — Personal data is processed only for explicitly stated purposes for which consent has been obtained.
3. Storage Limitation — Data is retained only for as long as necessary. Deletion is honoured within 30 days.
4. Transparency — Every AI interaction, data transfer, and processing activity is disclosed in plain language.
5. User Control — Users can access, export, correct, and delete their data at any time through the app.
6. Safety First — Crisis language triggers verified helplines and never leaves the user without human-support options.

03 Glossary

Key terms used throughout this document.

04 Regulatory Landscape

G Welle operates under multiple regulatory frameworks because it processes highly sensitive mental-health data and is distributed globally.

4.1 India — Digital Personal Data Protection Act, 2023

The DPDP Act is India's comprehensive data-protection law. Because G Welle processes mental-health information, the app's architecture is designed to comply with the following DPDP obligations:

4.2 Google Play — Health Apps Policy

Google classifies G Welle as a mental and behavioral health app, which triggers the following Google Play requirements:

4.3 India — Information Technology Act, 2000 & Amendments

G Welle complies with the following IT Act obligations:

• Section 43A — Reasonable security practices for sensitive personal data.
• IT (Reasonable Security Practices and Procedures) Rules, 2011 — Implemented ISO/IEC 27001-aligned controls, encryption, and access management.
• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — Grievance Officer appointed and publicly listed.
• Section 66, 66C, 66D, 72 — Measures to prevent unauthorised access, identity theft, and data leakage.
• SPDI Rules — Sensitive Personal Data or Information handling as per rules (health data classified as SPDI).

4.4 International — GDPR & HIPAA

For users in the European Economic Area (EEA) and the United Kingdom, G Welle applies GDPR-compliant practices:

• Lawful basis: explicit consent (Art. 9(2)(a)) for processing health data.
• Right to access, rectification, erasure, restriction, portability, and objection.
• Data Protection Officer contact available.
• Standard Contractual Clauses (SCCs) for cross-border transfers.

For US users engaging in paid human-therapist consultations (planned G Welle Care tier), HIPAA-aligned safeguards will be applied, including a Business Associate Agreement with any therapy-partner entity.

05 Privacy Policy

This is the full-form privacy policy that applies to all users of G Welle. A shorter, user-friendly version is displayed in-app during onboarding.

5.1 Data We Collect

5.1.1 Information You Provide Directly

5.1.2 Information Collected Automatically

• Device & technical data: OS version, app version, language, timezone, coarse region (city-level).
• Usage telemetry: Feature interaction counts, session duration (never linked to content).
• Crash logs: Anonymised stack traces for debugging.

5.1.3 Information We Do NOT Collect

5.2 Purpose & Legal Basis

5.3 Who Receives / Accesses Your Data

G Welle engages a small number of carefully vetted service providers (data processors) to operate the platform. All processors are bound by contractual confidentiality and data-protection obligations.

5.4 Retention Rules

5.5 Your Rights

You have the following rights, exercisable directly in the app or by email:

• Right to Access — view all personal data we hold about you.
• Right to Correction — update or correct inaccurate data.
• Right to Erasure — permanently delete your account and data.
• Right to Data Portability — export all data as JSON / CSV.
• Right to Withdraw Consent — revoke any consent at any time.
• Right to Grievance Redressal — escalate concerns to the Grievance Officer.
• Right to Nominate — nominate a person to exercise rights on your behalf (DPDP).
• Right to Lodge a Complaint — with the Data Protection Board of India.

06 Consent Mechanism

G Welle uses a layered, granular consent model aligned with both DPDP Act and Google Play requirements.

Consent Layers

Consent Dashboard

A dedicated Settings → Consent screen lets users view all consents, the date they were given, and toggle each one on or off. Withdrawal takes effect immediately.

07 Data Deletion Mechanism

G Welle provides a clear, in-app, one-tap deletion path — plus an email-based fallback for users who have uninstalled the app.

In-App Deletion

1. Settings → Account → Delete Account
2. Confirmation modal lists exactly what will be deleted
3. User confirms via typed keyword ("DELETE") or biometric confirmation
4. Deletion begins immediately; user is signed out

What Gets Deleted

Email-Based Deletion

Users who cannot access the app may send a deletion request to privacy@gehirnwelle.com. Requests are verified and processed within 30 days.

08 Security Measures

G Welle applies defence-in-depth security at every layer of the platform.

Encryption

Access Controls

• Row-Level Security (RLS) enabled on every user-scoped database table.
• Role-Based Access Control for internal staff — no engineer has default access to production data.
• Just-in-time access for support staff, logged and time-boxed.
• Service credentials stored only in server-side secrets, never in client code.

Application Security

• Input sanitisation and parameterised queries everywhere (SQL injection prevention).
• Content Security Policy on all web surfaces.
• Rate limiting on auth, chat, and API endpoints.
• No client-side secrets — all credentials server-side or platform-managed.
• Automatic session expiry after 30 days of inactivity.

Operational Security

• Daily automated backups with 30-day retention.
• Quarterly restore drills.
• Security patches applied within 7 days of release for critical vulnerabilities.
• Annual third-party penetration testing.
• Incident response playbook reviewed every 6 months.

09 Third-Party & AI Provider Disclosures

Transparency about every external service that touches user data.

AI Provider Disclosure

G Welle uses an advanced language-model provider to power conversational responses. This disclosure is presented to users at onboarding and repeated in the Privacy Policy and AI Mental Health Policy.

Processor Categories

G Welle engages the following categories of third-party processors. Specific vendors are disclosed to regulators upon request and are bound by strict data-protection agreements:

10 Crisis & Safety Protocol

G Welle's most critical safety feature: detecting and responding to imminent risk.

Detection

• Multi-language keyword detection across English, Hindi, and Hinglish.
• Runs on every chat message, journal entry, and assessment answer.
• Severity scoring: high (imminent), medium (concerning), low (watch).

Response

Helplines Displayed

11 Data Architecture Overview

A high-level view of how data flows and is secured within G Welle, without exposing sensitive internal implementation details.

Security Layers

1. Client Layer: Native mobile and web application with encrypted local storage.
2. Identity Layer: Industry-standard authentication with multi-factor support.
3. Data Layer: Encrypted database with row-level access controls.
4. Intelligence Layer: AI responses generated without transmitting user identifiers.
5. Asset Layer: Encrypted media storage for user content and audio.
6. Payment Layer: PCI-DSS compliant payment processing; no card data touches G Welle servers.
7. Notification Layer: Secure push and email delivery.

12 Data Categories

G Welle stores data in logically separated categories. Every user-scoped category is protected by row-level access controls bound to the user's unique identifier.

Access Control Principle

Every user-scoped data category enforces the following policy at the database level:

A user may only access data where:
    data.user_id = authenticated_user.id

No exceptions. Even internal tooling requires
just-in-time, logged, and time-boxed access.

13 Data Flow Examples

How a typical user action translates into data movement.

Example 1 — User sends an AI chat message

1. User types a message in the chat interface.
2. Message is stored securely in the encrypted database.
3. The AI orchestration layer sends the message content (without any user identifier) to our AI language-model provider.
4. The provider returns a response.
5. The response is stored securely in the encrypted database.
6. The user sees the response in the app.

Example 2 — User completes a mood check-in

1. User submits the check-in form.
2. The check-in is stored in the encrypted database.
3. Progress snapshots are recomputed asynchronously.
4. Home screen widgets refresh to reflect the new data.

Example 3 — Crisis detection

1. User enters text containing crisis indicators.
2. Client-side safety detection runs instantly.
3. The AI call is skipped; a compassionate response with verified helplines is shown.
4. The event is logged in the safety log.
5. No external party is notified.

Example 4 — Account deletion

1. User taps Delete Account in settings.
2. A confirmation modal is shown.
3. The authentication account is deleted.
4. Cascading delete runs across all user-scoped data categories.
5. Storage objects are deleted.
6. The user is signed out.
7. Backups auto-purge within 30 days.

14 Feature Overview

Every major feature of G Welle, at a glance.

15 Compliance Checklist

Consolidated view of every compliance requirement and its status.

16 Change Log

Version history of this document.

17 Contact & Data Protection Officer

For any questions regarding this document, data-protection practices, or to exercise your rights.

Registered Office:
Gehirnwelle Pvt. Ltd.
Delhi, India