Privacy Policy

1. Introduction and scope

This policy explains what information the Psychology Platform ("we") collects from you, how we use and protect it, and what rights you have. Your privacy and confidentiality matter fundamentally to us, especially because we handle sensitive mental-health data.

Your use of this platform means you are aware of this policy. Please read it carefully.

2. Information we collect

We collect only the information needed to provide the service, including:

• Account information: your mobile number and authentication details.
• Profile information: name, gender, and date of birth.
• Sensitive mental-health data: test answers, psychometric results, and your clinical record content (special-category, highly sensitive data).
• Technical information: security logs and data needed for the platform's operation and security.
• Payment information: if you use paid services, the information needed for the transaction.

3. Legal basis and consent

Under Article 58 of Iran's E-Commerce Law, processing data about a person's psychological condition is permitted only with their explicit consent. We obtain and record your explicit consent before processing your mental-health data.

You may withdraw your consent at any time; this does not affect processing carried out before the withdrawal.

4. How we use information

We use your information for these purposes:

• Providing psychometric assessment and care services.
• Connecting you with the psychologist or clinic you consent to.
• Securely maintaining your record and care history.
• Maintaining security, preventing misuse, and meeting legal obligations.

5. Sharing of information

We never share your mental-health data with third parties for advertising or marketing purposes.

Sharing happens only in these cases:

• With the care team (psychologist or clinic) you have explicitly consented to.
• With technical service providers acting on our behalf under confidentiality obligations.
• Where required by law or a competent judicial order.

6. Data retention and deletion

We retain your data only as long as needed to provide the service or meet legal obligations.

Your clinical content is stored encrypted with a dedicated key. On an erasure request, the decryption key is destroyed and the data becomes effectively unrecoverable (true erasure).

7. Data security

We apply appropriate technical and organizational measures to protect your data, including encryption of clinical content, access control, and hosting on domestic infrastructure. However, no system is absolutely secure, and we cannot guarantee perfect security.

8. Your rights

Under Article 59 of the E-Commerce Law and data-protection principles, you have the right to:

• Access your data and know how it is processed.
• Correct inaccurate or incomplete data.
• Request deletion of your data (right to be forgotten).
• Receive a copy of your data in a machine-readable format to transfer to another service (data portability).
• Withdraw consent at any time.
• Lodge a complaint if your rights are violated.

9. Children and minors

Use of this platform by minors is subject to the consent and supervision of a parent or legal guardian. We do not knowingly collect children's data without valid consent.

10. Cookies and similar technologies

We use only strictly necessary cookies for the platform's operation and security (such as keeping your login session) and do not use advertising or tracking cookies. See the Cookie Policy for more detail.

Anonymous page-view statistics are collected with a self-hosted, cookieless tool on our own servers: no IP address or name is stored, visits are counted under a salted hash that changes monthly, your browser's Do Not Track setting is honoured, and on logged-in screens only the type of screen is recorded, never the record you opened.

11. Hosting and data transfer

Your data is kept on domestic infrastructure. For any data transfer, appropriate security measures are applied and your consent obtained where needed.

12. Changes to this policy

We may update this policy. We will notify you of significant changes and show the last-updated date at the top of the page.

13. Automated scoring and algorithmic processing

Psychometric test responses are scored automatically by an algorithm. A score is not itself a clinical diagnosis; interpreting it requires review by a qualified psychologist.

If a result signals serious risk, immediate support resources are shown to you right away. You may request an explanation of the logic of this processing.

14. Limits of confidentiality

Confidentiality is not absolute. In the limited cases where the law permits or requires it, disclosure may be necessary — including an imminent risk of serious harm to you or others, abuse of a child or vulnerable person, or an order from a competent judicial authority. In such cases, only the minimum necessary information is disclosed. (Exact legal triggers are to be finalized in legal review.)

15. Data breach notification

If an incident exposes your personal data to risk, we will notify affected users without undue delay — including the nature of the incident, the data affected, remediation steps, and contact channels.

16. Contact us

To ask about this policy or exercise your rights (access, correction, deletion, or portability), reach us through the "Contact" page. We aim to respond to your request within 30 days. If you are not satisfied, you may pursue the matter through legal channels and the Psychology and Counseling Organization.