Privacy Policy

Mind & Manas, a drug awareness and prevention programme of the Narcotics Control Bureau, delivered in CBSE schools.
Effective date: 16 August 2026 · Version: 1.0

1. Introduction and scope

This Privacy Policy explains how personal data is collected, used, stored, disclosed and protected in connection with the Mind & Manas mobile application and web application (together, the "Application"), and sets out the rights available to you and the means of exercising them.

The Application is a component of the Mind & Manas programme (the "Programme"), run by the Narcotics Control Bureau ("NCB") in schools affiliated to the Central Board of Secondary Education, under the Memorandum of Understanding executed with that Board on 3 September 2025. The Application is published and distributed on the Google Play Store and the Apple App Store by Vimi Magic, which is the developer named on those listings.

A majority of the individuals who use the Application are children. The Application is accordingly designed to collect the minimum personal data required to deliver the Programme.

This Policy is issued under and is to be read with the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it. By using the Application you acknowledge that you have read this Policy.

2. Definitions

In this Policy, unless the context requires otherwise:

• "Child" means an individual who has not completed eighteen years of age.
• "Data Fiduciary" means the person who alone or with others determines the purpose and means of processing personal data.
• "Data Processor" means a person who processes personal data on behalf of a Data Fiduciary.
• "Data Principal" means the individual to whom the personal data relates and, in the case of a Child, includes the parent or lawful guardian.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure and erasure.
• "Admission Number" means the identifier assigned to a learner by the coordinator of the learner's school for the purposes of the Programme.

3. The parties and their respective roles

Four organisations deliver the Programme. Their responsibilities in relation to Personal Data differ, and are set out below.

4. Personal Data collected

The categories of Personal Data collected depend on the capacity in which an individual uses the Application.

4.1 Students

A student is not required to create an account, to authenticate, or to supply a name. The following data is collected:

• the school code of the school at which the student is enrolled;
• the Admission Number assigned by the school coordinator; and
• records of the chapters and steps of the curriculum completed.

An Admission Number identifies a learner within that learner's own school and for no other purpose. It does not incorporate a name. It nevertheless constitutes Personal Data and is protected accordingly under this Policy.

4.2 Teachers and school coordinators

• email address, used to deliver a single-use access code;
• the school to which the individual is attached, and activation status; and
• records of the professional development chapters completed.

No password is stored in respect of a teacher or coordinator. Authentication is effected by a single-use code sent to the registered address.

4.3 Parents and guardians

• the name supplied by the individual on creating a profile;
• an email address, where supplied;
• the Admission Number of the Child whose progress the individual follows; and
• records of the chapters completed by the individual.

A parent or guardian is the only category of user in respect of whom a name is collected. That name, together with the Child's Admission Number, constitutes the identifier for the individual's own record.

4.4 Officers and administrators

Officers of NCB and administrators who use the web application to administer the Programme authenticate using a Zoho account. In respect of such users the following is collected:

• email address;
• the account identifier assigned by the identity provider;
• the role assigned within the Programme, and account status; and
• an audit record of administrative actions performed, recorded against that account identifier.

An audit record is retained for the purposes of accountability and information security. No password is stored by the Application; authentication is performed by the identity provider.

4.5 Technical data

When a request is made to the Application over a network, the internet protocol address from which the request originates is necessarily received. Such addresses are used solely and transiently, in working memory, to apply rate limits that protect the service from abuse. They are not written to the database, are not recorded against any learner, teacher or parent, and are not retained.

4.6 Personal Data that is not collected

In respect of students, no name, telephone number, postal address, date of birth, photograph or biometric data is collected at any time.

5. Purposes of Processing

Personal Data is Processed solely for the following purposes:

1. delivery of the curriculum, and retention of a learner's progress so that learning may resume at the point at which it was interrupted, including where the device has no network connectivity;
2. preparation of aggregate reporting on the reach of the Programme, including the number of learners in a district or State who have completed a given chapter;
3. enabling a school coordinator to administer the Programme within that coordinator's own school; and
4. maintaining the security, availability and correct functioning of the Application.

Personal Data is not sold, is not disclosed for advertising, and is not used to make any automated decision producing legal or similarly significant effects.

6. Lawful basis and consent

Processing is carried out on the basis of consent obtained by NCB, or on such other lawful basis as is available under the DPDP Act. Notice under section 5 of the DPDP Act is given by NCB through the school at which the learner is enrolled.

Consent may be withdrawn at any time by writing to the Grievance Officer named in clause 13. Withdrawal of consent will result in participation in the Programme ceasing, and does not affect the lawfulness of Processing carried out before withdrawal.

7. Children

Every individual who has not completed eighteen years of age is a Child for the purposes of the DPDP Act. Because the Programme is delivered through schools and reaches students in the course of their education, consent in respect of a Child, including the verifiable consent of a parent or lawful guardian where required, is obtained by NCB through the school.

No tracking or behavioural monitoring of a Child is undertaken, and no advertising is directed at a Child. A parent or lawful guardian may at any time request access to, correction of, or erasure of the Personal Data of the Child, in the manner set out in clauses 12 and 13.

8. Disclosure of Personal Data

Personal Data is disclosed only as follows:

• to the coordinator of a school, in respect of learners at that school only;
• to NCB, in the form of aggregate reporting across districts and States; and
• to Zoho Corporation, in its capacity as Data Processor, for the purpose of operating the Application.

Personal Data is otherwise disclosed only where disclosure is required by law or by the order of a court or competent authority. Personal Data is not disclosed to any advertising network, data broker or marketing service, and no such service is integrated into the Application.

9. Storage, location and security

Personal Data is hosted on Zoho Catalyst infrastructure located in data centres in India, certified to ISO/IEC 27001 and ISO/IEC 27701. Personal Data is encrypted in transit. Access by personnel is restricted by role, such that a coordinator may access records relating only to that coordinator's own school, and an officer of NCB may access aggregate reporting only.

The Application is designed to function without network connectivity. Curriculum content is contained within the installed Application, and a learner's progress is recorded on the device before being transmitted. Where a device is not connected, the learning functions of the Application operate in full and no data is transmitted from the device.

10. Cookies and storage within the browser

This clause applies to the web application only. The mobile application does not use cookies.

The web application uses cookies that are strictly necessary for it to function. No cookie is used for advertising, analytics or tracking, and no third-party cookie is set. The cookies used are:

• a session cookie set when an officer, administrator or coordinator signs in, which maintains that session and is removed on signing out; and
• where the site is operating in a restricted pre-launch state, a cookie recording that access has been granted.

Where the learning chapters are used through a browser rather than through the installed mobile application, a learner's progress is stored within that browser's local storage on the device being used. Such data remains on that device and is not transmitted other than as described in this Policy. It persists until the browser's site data is cleared.

11. Retention and erasure

Personal Data is retained for so long as the Programme is delivered at the relevant school, and thereafter for such period as is necessary for compliance with an applicable legal obligation. Personal Data is erased when it is no longer required for either purpose.

Personal Data relating to an individual learner is erased earlier on request made under clause 13. Uninstalling the Application removes all data stored on that device immediately.

12. Rights of Data Principals

Subject to and in accordance with the DPDP Act, you have the right to:

1. obtain confirmation as to whether Personal Data relating to you is being Processed, and a summary of such Personal Data;
2. obtain correction of inaccurate or misleading Personal Data, and completion or updating of incomplete Personal Data;
3. obtain erasure of Personal Data, save where retention is necessary for a specified purpose or for compliance with law;
4. withdraw consent previously given;
5. nominate another individual to exercise these rights in the event of death or incapacity; and
6. have recourse to a readily available grievance redressal mechanism, and thereafter to register a complaint with the Data Protection Board of India.

A request may ordinarily be made most conveniently through the coordinator of the relevant school, who is able to identify the record from the school code and Admission Number without reference to any name.

13. Grievance redressal

Any question, request or grievance concerning Personal Data or the exercise of the rights described in clause 12 should be addressed to the Grievance Officer.

Enquiries concerning the app store listing, installation or updating of the Application, or Programme activities conducted at a school may additionally be addressed to the publisher, Vimi Magic, at admin@mindandmanas.in. Any such enquiry concerning Personal Data will be referred to the Grievance Officer.

Where you are not satisfied with the response received, you are entitled to register a complaint with the Data Protection Board of India.

14. Amendment of this Policy

This Policy may be amended from time to time. The amended Policy will be published at this address and the effective date and version recorded at the head of this document will be updated. Where an amendment is material, school coordinators will be informed so that parents and guardians may be notified.

15. Governing law

This Policy is governed by the laws of India, and the courts at Chennai, Tamil Nadu shall have jurisdiction in respect of any dispute arising out of or in connection with it.