Privacy Policy

• Timely Help is a mental health platform connecting clients with licensed psychologists, psychiatrists, and counsellors. We act as the data controller for the personal data described in this policy.
• We recognize the sensitive nature of health information and are committed to protecting your personal data and maintaining strict medical confidentiality. This Privacy Policy explains how we collect, use, store, share, and protect your personal and health information when you interact with our website and services.

This Privacy Policy complies with:

• The Personal Data Protection Act, No. 9 of 2022 (PDPA) of Sri Lanka.
• The Medical Ordinance (Cap. 105) and guidelines issued by the Sri Lanka Medical Council (SLMC) regarding confidentiality and patient records.
• The Computer Crimes Act, No. 24 of 2007 regarding secure electronic handling of data.
• The Electronic Transactions Act, No. 19 of 2006 regarding electronic contracts and communications.

Under the Personal Data Protection Act No. 9 of 2022 (PDPA):

• Data Controller: Timely Help, which determines the purposes and means of processing your personal data.
• Data Subject: You, the user, patient, or visitor accessing our Website.
• Special Categories of Personal Data (Sensitive Data): Under the PDPA, personal data revealing health status, mental health, clinical diagnostic records, therapy notes, or biometric data receives heightened legal protection.

We collect personal information necessary to deliver quality mental health care and operate our platform safely.

• Account data: name, email, phone, province, language preferences, and role.
• Health data (PHI): session notes, secure messages, mood entries, goals, and prescriptions. These fields are encrypted at rest.
• Verification documents: NIC and professional registration certificates (practitioners).
• Usage and security data: audit logs of sensitive actions, login attempts, and device push tokens.

We process your personal data in strict compliance with Section 5 and Section 6 of the PDPA No. 9 of 2022 under the following lawful conditions:

1. Explicit Consent: For processing sensitive health data, therapy records, or sending health advice, we request your explicit written or digital consent.
2. Performance of a Contract: To fulfill our obligations under our Terms of Service (e.g., booking therapy sessions, facilitating appointments).
3. Legal Compliance: To meet legal obligations imposed by Sri Lankan health authorities, court orders, or statutory reporting obligations.
4. Protection of Vital Interests (Emergencies): To respond to life-threatening emergencies, self-harm risks, or severe risks to public safety, especially where consent cannot be obtained.
5. To secure the platform: authentication, two-factor verification, and fraud/abuse prevention.

In accordance with the Sri Lanka Medical Council (SLMC) Code of Conduct, all healthcare professionals (psychiatrists, clinical psychologists, counsellors) providing services through our platform are bound by professional duty and statutory confidentiality.

Permitted Exceptions to Confidentiality:

Under Sri Lankan law and SLMC guidelines, medical confidentiality may only be overridden in the following extreme circumstances:

1. Immediate Risk of Harm: Clear, immediate danger of severe self-harm, suicide, or harm to an identifiable third party.
2. Legal and Court Orders: A binding subpoena, warrant, or court order issued by a competent court of law in Sri Lanka.
3. Statutory Duty: Mandatory reporting requirements under Sri Lankan law (e.g., child protection laws or infectious disease mandates).

We process your data strictly for the following purposes:

• To schedule, facilitate, and conduct mental health consultations and therapy sessions.
• To maintain clinical health records and continuity of care.
• To verify practitioner identities and ensure compliance with SLMC registration requirements.
• To send operational notifications, appointment reminders, and billing receipts.
• To ensure website security, prevent fraud, and enforce our Terms of Use.
• To comply with statutory health regulations and audits in Sri Lanka.

We do not sell, rent, or trade your personal health data to third parties or marketing agencies. Disclosures are limited to:

• Registered Healthcare Practitioners: Licensed mental health clinicians directly involved in your care.
• Third-Party Data Processors: Technology partners providing secure hosting, cloud storage, encrypted video conferencing, or SMS alerts. All processors are contractually bound to maintain equivalent privacy standards under the PDPA.
• Law Enforcement or Judicial Authorities: Only when mandated by Sri Lankan statutory requirements or valid legal process.

If your personal data is transferred or stored on servers located outside Sri Lanka (e.g., cloud services):

• We ensure the transfer complies with Section 26 of the PDPA No. 9 of 2022.
• Transfers occur only to jurisdictions providing an adequate level of data protection, or where appropriate contractual safeguards (e.g., standard data protection clauses) are established.
• For sensitive medical data, explicit consent is obtained prior to cross-border transfer unless processing is necessary to protect your vital health interests.

To protect sensitive health information against unauthorized access, loss, or misuse, we implement robust administrative, technical, and physical safeguards in accordance with Section 10 of the PDPA:

• Encryption: End-to-end encryption for video consultations and SSL/TLS encryption for data in transit and at rest. Health data is encrypted at rest (AES-256-GCM) and in transit (TLS).
• Access Control: Role-based access controls restricting health records strictly to authorized medical professionals.
• System Audits: Regular vulnerability scans, system logging, and data protection impact assessments.
• Anonymization & Pseudonymization: Personal identifiers are decoupled from clinical records where feasible.

• Clinical Records: Retained in accordance with Sri Lankan medical record standards and ministry guidelines (typically a minimum of 6 to 10 years from the date of the last consultation, or longer in cases involving minors).
• General Account & Technical Data: Retained for as long as your account remains active or as needed to provide services.
• Once the retention period expires or consent is withdrawn (and no statutory obligation requires preservation), data is securely erased or permanently anonymized.

Under Part II of the PDPA No. 9 of 2022, you possess the following rights regarding your personal data:

1. Right of Access: Request confirmation of whether we hold your personal data and receive a copy of your personal/medical records.
2. Right to Rectification: Request correction or completion of inaccurate, outdated, or incomplete data.
3. Right to Erasure ("Right to be Forgotten"): Request the erasure of personal data held in violation of PDPA principles, subject to clinical record retention obligations.
4. Right to Withdraw Consent: Withdraw your consent for non-mandatory data processing at any time without affecting the lawfulness of prior processing.
5. Right to Object / Restrict Processing: Object to processing based on legitimate interests or direct marketing.

• Minors (Under 18 Years): Consent for processing data of individuals under 18 years must be provided by a parent, legal guardian, or person holding parental authority.
• Incapacitated Persons: Where a data subject is physically or mentally unfit to provide consent, processing consent may be exercised by a court-appointed guardian or legal administrator in accordance with Section 20 of the PDPA.

We use cookies and analytical tools to optimize user experience:

• Essential Cookies: Necessary for platform navigation and secure login.
• Analytical/Performance Cookies: Help us understand user engagement anonymously.
• You can adjust your browser settings to refuse non-essential cookies. However, disabling essential cookies may impact platform functionality.

We reserve the right to update this Privacy Policy to reflect changes in legal requirements or operational practices. Any updates will be posted on this page with an updated "Effective Date". Material changes will be communicated via email or a prominent banner on the Website.