DPDP Act Compliance

1. Notice and Explicit Consent

Under the DPDP Act, personal data cannot be processed without free, specific, informed, unconditional, and unambiguous consent. We do not rely on pre-ticked boxes or assumed consent.

• Itemized Notice: Before you create an account or take a deeper assessment, you are provided with a clear notice detailing exactly what personal data is being collected and the specified purpose for its processing.
• Affirmative Action: Consent is obtained via a clear affirmative action (such as manually ticking a consent box) strictly unbundled from other unrelated terms.
• Right to Withdraw Consent: You possess the absolute right to withdraw your consent at any time. This can be done instantly via the "You" tab in the app. Withdrawal of consent restricts any further processing of your data and initiates our data erasure protocols.

2. Purpose Limitation & Data Minimization

We process only the absolute minimum amount of personal data necessary to provide the Cognize service. Your personal data is processed exclusively for delivering AI-guided reflections, tracking your personal wellness journey, and facilitating pseudonymous community interactions.

3. Statutory Rights of the Data Principal

As a user ("Data Principal") under the DPDP Act, you are guaranteed robust rights. We have integrated features directly into the Cognize app interface so you can exercise these rights without administrative friction:

• Right to Information (Access): You have the right to obtain a summary of the personal data being processed by us and a list of all third-party Data Processors we share it with. You can view and export this via the "You" tab.
• Right to Correction: You have the right to request the correction of inaccurate data, the completion of incomplete data, and the updating of your information at any time.
• Right to Erasure: You have the right to request the deletion of your personal data. You can utilize the one-tap "Delete Account & Data" button in the "You" tab. Pressing this permanently and irreversibly destroys your identifiable data from our active servers within 30 days.
• Right of Nomination: You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights under the Act. To register a nominee, please email our Grievance Officer.

4. Duties of the Data Principal

The DPDP Act imposes statutory duties on users to maintain the integrity of the digital ecosystem. By using Cognize, you are legally bound to:

• Comply with the provisions of all applicable laws while exercising your rights.
• Provide verifiably authentic and accurate information while exercising the right to correction or erasure.
• Not impersonate another person while providing your personal data.
• Not register a false or frivolous grievance or complaint with our Grievance Officer or the Data Protection Board of India.

5. Obligations of the Data Fiduciary

As your Data Fiduciary, Eunoia Ventures Private Limited executes the following binding obligations:

• Reasonable Security Safeguards: We protect your data to prevent personal data breaches using industry-standard technical measures, including Transport Layer Security (TLS) for data in transit, AES-256 encryption for data at rest, and strict Row Level Security (RLS) within our databases.
• Data Processor Contracts: We utilize third-party infrastructure (such as Supabase for database hosting). These entities act as Data Processors and are bound by valid, written contracts ensuring they adhere to the same strict DPDP compliance standards.
• Data Erasure: We will erase personal data when the specified purpose is no longer being served or upon your withdrawal of consent, unless retention is strictly required for compliance with other laws.

6. Personal Data Breach Protocol

While we deploy rigorous security measures, in the highly unlikely event of a personal data breach affecting your information, we are legally committed to a strict notification protocol. We will formally notify both you (the Data Principal) and the Data Protection Board of India in the specific format and timeframe prescribed by the Government of India, detailing the nature of the breach and the mitigation steps taken.

7. Protection of Children’s Data

Cognize is currently restricted to users who are 18 years of age or older. We do not knowingly collect or process the personal data of children. If we discover that a user is under 18, their account and data will be immediately purged.

In future iterations, should Cognize open to younger students, we will deploy verifiable parental consent mechanisms as mandated by Section 9 of the DPDP Act. We strictly prohibit any tracking, behavioral monitoring, or targeted advertising directed at children.