Privacy Policy

ZehnOra is Pakistan's first AI-powered mental health platform. Our registered address is in Pakistan. As your data controller, we are responsible for all personal data you provide when using our platform.

Contact: privacy@zehnora.pk · Data Protection Officer: ZehnOra Legal Team

We collect only what is necessary to provide our services:

• Identity data: name, email address, phone number
• Profile data: age, city, country, profile picture (optional)
• Health data: journal entries, mood logs, session notes, homework tasks
• Communication data: therapy chat messages, direct messages with practitioners
• Usage data: login timestamps, IP addresses, audit events
• Payment data: subscription tier, transaction status (card numbers handled by Safepay only — never stored by us)
• Consent records: when and what you consented to, version, IP

We do not sell your data to advertisers or third parties. Ever.

ZehnOra uses its proprietary AI engine (ZehnOra AI) for AI-powered features:

• Journal analysis: entry text is sent to OpenAI's API only when you explicitly consent. OpenAI's enterprise DPA ensures your data is never used to train their models.
• AI Companion (Zara): conversation context is stored in our database, encrypted at rest with AES-256.
• Crisis detection: if AI detects high-risk language, a risk flag is created for admin review. Your safety takes priority.
• All AI features can be disabled in Settings → Privacy & Consent.

• Sensitive fields (journals, session notes, messages) encrypted at rest with AES-256-GCM
• All traffic over TLS 1.3 (HTTPS only)
• Passwords hashed with bcrypt (cost factor 12) — never stored in plaintext
• Session tokens are signed JWTs with revocation support
• Two-factor authentication (TOTP) available for all accounts
• All authentication events logged in an immutable audit trail

• Your assigned therapist: name, mood trends, session data (clinical purpose only)
• Safepay: payment processing only — no health data
• Twilio: video tokens and OTPs — no health data
• Resend: transactional email — name and email only
• OpenAI: journal text only with your explicit consent — enterprise DPA in place
• Law enforcement: only if legally compelled by a valid Pakistani court order

To exercise any right, visit Settings → Privacy & Data in the app, or email us at privacy@zehnora.pk. We respond within 30 days.

• Active account data: retained while your account is active
• Journal entries: until you delete them or close your account
• Session notes: 7 years per Pakistan PMDC guidelines
• Audit logs: 3 years for security and legal compliance
• Consent records: permanently (immutable legal audit trail)
• Deleted accounts: all PII purged within 30 days of deletion request

ZehnOra is not intended for users under 18. If you believe a minor has created an account, contact privacy@zehnora.pk immediately.

• Email: privacy@zehnora.pk
• Response time: within 30 days
• Data Controller: ZehnOra (Pvt) Ltd, Pakistan

You have the right to lodge a complaint with the Pakistan Telecom Authority (PTA) as the designated PDPA supervisory authority.