Privacy Policy

HearMe ("we", "us") runs peer-support circle sessions. This policy explains what personal data we collect, why, and how it is protected under Thailand's Personal Data Protection Act (PDPA).

What we collect

• Account: email, authentication provider (Google or password), password hash if you signed up with email.
• Profile: full name, date of birth, gender, emergency contact name and number.
• Sensitive data (mental health related): your mood score, mood emoji, and any text notes you write on entry or exit of a room.
• Session participation: which rooms you joined, when, your chosen nickname and avatar, and moderation events (mute, hand raise, kick).
• Technical: session tokens, minimal browser/device info needed to keep you signed in.

Why we collect it

• To run and moderate circle sessions.
• To let your assigned coach understand how you're feeling and support you safely.
• To keep the platform safe (emergency contact used only if we're worried about your safety).
• To comply with legal obligations.

Who sees what

• Other participants in a room: only your avatar, chosen nickname, and mood emoji.
• Your assigned coach: the above, plus your mood score and any notes you wrote on entry/exit.
• Admins: all of the above plus your account, profile, and emergency contact — used only for safety and platform administration.
• Nobody else. We do not sell your data. We do not share it with advertisers or third parties beyond the infrastructure providers that host our backend.

Sensitive data & explicit consent

Mood scores, notes about your feelings, and participation in mental-health themed rooms are sensitive personal data under PDPA. We only process this data with your explicit consent, which you give on the onboarding screen when you first join. You can withdraw consent at any time by requesting account deletion (see below).

Data retention

• Entry / exit notes: kept for 90 days, then permanently deleted.
• Session participation metadata (which rooms, when): kept for 12 months, then anonymized.
• Account & profile: kept until you request deletion or your account is inactive for 24 months.

Your rights under PDPA

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and data.
• Withdraw your consent to processing sensitive data at any time.
• Lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.

You can exercise the first three rights directly from your Privacy & Data page after signing in.

Contact

Data protection requests and questions: thetthetwai470@gmail.com