Employee Data & DPDP: What your company can and cannot see
Employee data · DPDP Act 2023
What your company can and cannot see
Nobody uses a wellbeing programme they do not trust. So rather than tell you the data is safe, here is what we actually hold, who touches it, how long we keep it, and what lands on your desk.
The short answer. The Thought Co. holds employee session data as a clinical practice, not as an extension of your HR system. Your company receives aggregate usage, broad themes at a minimum group size of eight, and recommendations. It never receives a name, a booking, a session note, or a count small enough to identify one person.
The two lists
What you receive
- Total hours drawn from the bank
- Utilisation, as a share of covered employees
- Return rate across the quarter
- Broad themes, never below eight people
- Measured change in anxiety, leadership, wellbeing and burnout scores among users
- Recommendations you can act on
What you never receive
- Who booked
- Who did not book
- What anyone said
- Session notes, in any form
- Diagnoses, scores or risk flags by name
- Any cut of the data small enough to guess from
there is no dashboard. that is the point.
The questions your employees actually ask
Not the ones HR asks. These are the ones that decide whether somebody books.
Will my manager know I booked?
NoBooking goes to us directly, seven days a week. It does not pass through HR, your manager, or a company portal. Your name sits in our scheduling records and nowhere your employer can reach.
Can HR see what I talked about?
NoSession notes are written by your psychologist and stay in our clinical records. They are not shared with your employer in summary, in paraphrase, or on request. If your HR team asks us, the answer is the same one we are giving you here.
What if I am the only person from my team using it?
Then nothing about your team is reportedNo theme, no number, no slice is reported below eight people. A group of three does not get rounded, anonymised or described. It is left out.
Who at The Thought Co. can read my file?
Your psychologistClinical work is discussed in supervision without identifying details. Administrative staff see what they need to book and bill you, not what you said.
What happens if I leave the company?
Your file stays yoursThe cover ends when your employment does, and we will tell you before your last covered session. If you want to continue privately, you keep the same psychologist and the same record. Nothing transfers to your employer either way.
Can I ask to see my own notes?
Yes, as a summaryWrite to priyanka@thethoughtco.in and we will give you a written summary of your notes rather than the raw clinical record. Raw notes carry a psychologist's working hypotheses, which read badly out of the room and help nobody.
tap a question →
Where the data goes, one booking at a time
- The bookingName, email, phone and a preferred time, entered by your employee into our scheduling system. Your company does not see this form and is not copied on it.
- The moneyBilled against your retainer, not per employee. There is no per person invoice line for you to read a name off.
- The sessionNotes written by the psychologist who ran it, held in our own clinical records. Not a shared drive your account manager can open.
- The quarterUsage counted, themes grouped, outcome change measured among users. Anything below eight people is dropped before the report is written, not redacted afterwards.
- The endClinical records are kept for two years after a client's last session, then deleted. Intake details for people who enquired and never booked are held under the same rule.
The three numbers that matter
Adults only. We do not see clients under 18, so no children's data enters the programme. no asterisk on any of these.
Where the DPDP Act sits in this
India's Digital Personal Data Protection Act 2023 became operational when the DPDP Rules 2025 were notified on 13 November 2025. It commences in phases, which matters because your procurement questionnaire is already asking about it while the obligations themselves are still arriving.
- 13 Nov 2025Rules notified. Definitions apply and the Data Protection Board of India is constituted.
- 13 Nov 2026The Board can inquire and levy penalties. Consent Manager registration opens.
- 13 May 2027Notice, consent, data principal rights, retention, transfer and breach obligations apply in full.
swipe →
We are not going to tell you we are DPDP compliant. Nobody can certify themselves against a law whose substantive obligations commence in May 2027, and a badge is not a safeguard. What we can tell you is what we hold, why, for how long, and who can reach it. That list is above, and it is the list your legal team actually needs.
Questions your legal team will ask
Who do we contact about a data request or a complaint?
Priyanka Kartari, at priyanka@thethoughtco.in. Requests from employees go to the same address and are handled by us, not routed through your HR team.
What happens to the data if the programme ends?
Aggregate reporting stops. Clinical records follow the two year rule from each client's last session regardless of whether the retainer is still running, because the record belongs to the clinical relationship rather than to your contract.
Send this page to your legal team before the call.it answers most of the questionnaire.
Written and reviewed by a psychologist at The Thought Co. Last reviewed 27 September 2026.
The Thought Co. is a psychologist led mental health service. Booking and enquiries run seven days a week, 9 am to 8 pm IST. Sessions are in person at Lower Parel, Mumbai, or online. We are not a helpline or a crisis service. In an emergency, call Tele-MANAS 14416 (24 hours) or 112.
Worth thirty minutes to talk this through?
Book a thirty minute call with PriyankaOr drop us a message on WhatsApp. We reply during booking hours, seven days a week, 9 am to 8 pm IST.