Last updated 16 August 2026 · Sthiti is currently in a limited private pilot.
Sthiti helps independent wellness practitioners in India run their teaching practice. This policy explains what personal data we handle, why, and what you can ask us to do with it. It is written to India's Digital Personal Data Protection Act, 2023.
Sthiti is operated from India. For any privacy question, or to exercise the rights below, write to hello@sthiti.com. During the pilot this address also reaches our Grievance Officer.
Practitioners sign up for Sthiti directly. We handle their data as the organisation deciding how it is used.
Students and clients do not sign up with us — they have a relationship with their practitioner. For their data, the practitioner decides what is collected and why, and Sthiti acts on the practitioner's instructions. We do not use student data for our own purposes, and we never sell it.
Connecting Zoom is optional and you approve exactly what we may read. We request read-only access and we never create, change or delete anything in your Zoom account. We read:
Zoom access and refresh tokens are encrypted at rest and are never shown in the interface or in logs.
Where a practitioner connects Zoom, we receive the names — and sometimes email addresses — of the people who attended her classes, together with join and leave times. This is used only to build her attendance record and class roster.
We do not use personal data for advertising, and we do not sell it to anyone. We do not use student data to train machine-learning models.
Some practitioners work in counselling, physiotherapy and similar fields. We treat that context as sensitive:
Only service providers we need to run Sthiti — hosting, and messaging providers who deliver reminders — and only what they need. They act on our instructions. We may disclose data where the law requires it.
We never hold your money. Student payments settle directly to the practitioner's own account, so we do not process card or bank credentials.
Data is stored on servers we control. We keep practitioner data for as long as the account is active. Zoom data imported into Sthiti is kept until you disconnect Zoom or ask us to delete it — see below. Logs are kept for a short period for security and debugging.
You can disconnect at any time, either inside Sthiti or from Zoom App Marketplace → Manage → Added Apps → Remove. When you disconnect:
You may ask us to give you a copy of your data, correct it, or delete it, and to withdraw consent you previously gave. Students should raise these requests with their practitioner first, since it is her record; where we hold the data we will act on her instruction. Write to hello@sthiti.com and we will respond within the period the law allows. If you are not satisfied you may complain to the Data Protection Board of India.
Sthiti is not intended for use by children directly. Where a practitioner teaches a minor, the parent or guardian's consent is required and is recorded against that student.
Traffic is encrypted in transit. Third-party access tokens and clinical notes are encrypted at rest. Access is scoped to the practitioner's own records, and every action affecting money, messages or entitlements is recorded in an audit log.
If we change this policy materially we will tell affected practitioners before it takes effect.