Effective Date: December 5, 2025
Last updated: September 18, 2026
Welcome to MyKaya ("we," "us," or "our"). We operate the website https://mykaya.app (the "Service"). Your privacy is important to us. This Privacy Policy explains how we collect, use, and protect information across our website and the MyKaya product, including the session data practitioners process through the service. By using our Service, you agree to the practices described here.
When you use our Service, we may collect information you provide directly, such as:
When you log in with your Google account, we collect only the information necessary to create and manage your account:
Important: Through Google sign-in, we do not access your Gmail, Google Drive, Calendar, or other Google services beyond the basic profile above.
When a practitioner uses MyKaya to record and document sessions, we process the session audio, transcripts, and notes generated from them on the practitioner's behalf and on their instructions, to provide and operate the service. For this data, MyKaya acts as a Data Processor and the practitioner is the controller. We never sell this data, and we never share clinical session content with advertisers or data marketplaces.
Our commitments as the practitioner's Data Processor are set out in our Data Processing Agreement. The providers that process session data for us — what each one does and where, including outside India — are listed on our Sub-processors page.
We use the information we collect for the following purposes:
We work with trusted third-party providers to deliver our services:
These providers handle website, account and marketing data. Providers that process clinical session data are listed separately on our Sub-processors page.
Beyond the providers listed above and the advertising measurement described in Section 4, we do not share this information with third parties except as required by law.
We use Meta (Facebook) Pixel and Conversions API, and the LinkedIn Insight Tag and Conversions API, to measure the effectiveness of our advertising and improve our services.
Advertising measurement, conversion tracking, and audience targeting.
When you visit our website, Meta automatically collects:
When you create an account, or submit the ROI calculator on our website, we share the following in hashed (encrypted) form:
Note: Hashing is a one-way encryption - Meta receives scrambled versions they can match to their database, but cannot reverse to see your actual email/phone.
We do not share any patient health information, clinical data, or therapy session content with Meta. Specifically:
Meta retains this data according to their Business Tools Terms and Data Policy.
You can:
For more information about how Meta uses this data, please review Meta's Data Policy.
We use the same approach with LinkedIn, for the same purpose — advertising measurement, conversion tracking, and audience targeting.
Automatically collected (browser-side): when you visit our website, the LinkedIn Insight Tag collects page URLs, device and browser information, your IP address, referrer URL, and timestamps. If you arrive by clicking a LinkedIn ad, we store the click identifier LinkedIn adds to the link (li_fat_id) in a cookie so that a later signup can be attributed to that ad.
User information shared: your email address, SHA-256 hashed, along with the click identifier and IP address described above, and whether you identified yourself as a practising therapist or a student. We do notsend your name, job title, or company name to LinkedIn, even though LinkedIn's API accepts them in plain text.
Events tracked:Lead (when you click "Get Started"), Sign Up (when you complete registration), Purchase (when you subscribe to a paid plan), and Login.
What's not shared: the same exclusions listed above for Meta apply in full to LinkedIn — no patient or client data, no session notes, transcripts, or audio, no clinical information, no payment details, and no credentials.
Payments: if you subscribe to a paid plan, the LinkedIn and Meta click identifiers are attached to the payment record held by our payment processor, so the subscription can be attributed to the ad you clicked. No advertising data is shared with the processor beyond those identifiers.
You can manage LinkedIn ad personalisation in your LinkedIn advertising settings. For more information, review LinkedIn's Privacy Policy.
We never sell, rent, or trade your data or your clients' data. The advertising measurement described above uses only limited contact identifiers — a hashed email and phone, your name hashed for Meta only, the random visitor and click identifiers described above, and your practitioner category — and never clinical or session data. If you submit the ROI calculator without creating an account, the hashed email, phone and name from that form are shared on the same basis.
MyKaya implements reasonable security measures to safeguard your personal and confidential information from unauthorized access, disclosure, or misuse. These measures include, but are not limited to, access controls and data storage practices. However, please note that no online platform, server, or transmission over the internet is completely secure. While we strive to protect your information, MyKaya cannot guarantee absolute security of data transmitted or stored through our systems. For additional information regarding user responsibilities, limitations of liability, and general conditions of use, please review our Terms & Conditions.
We log access to session and client records and monitor for attempts to access data across practices. If a personal data breach affects data we hold:
To report a security vulnerability or suspected incident, email security@mykaya.app.
We retain personal data only as long as necessary for the purposes outlined in this policy:
We retain personal data only as long as necessary. You can request deletion of your account and associated data by emailing team@mykaya.app with the subject "Data Deletion Request."
Depending on where you live and the laws that apply (including India's Digital Personal Data Protection Act, 2023), you may have the right to:
Where MyKaya processes session data on a practitioner's behalf as a Data Processor, requests relating to a client's session data are directed to the practitioner, who controls that data; we will assist the practitioner in responding. For account data that we control, you can exercise these rights with us directly.
Grievance Officer: You can reach our Grievance Officer for any question, request, or complaint about your personal data by emailing grievance@mykaya.app with the subject "Data Grievance."
Under India's Digital Personal Data Protection Act, 2023, a child is anyone under 18.
MyKaya reserves the right to modify, update, or change this Privacy Policy at any time at our sole discretion without prior notice. Changes will be posted on this page with an updated effective date. Your continued use of the platform after any such changes constitutes your acceptance of the updated Privacy Policy.
For questions about this policy or your data, email us at team@mykaya.app. To report a security vulnerability, email security@mykaya.app.