Privacy Policy

1. Introduction

The Nasha Mukt Bihar Campaign (“Campaign”, “we”, “us”, or “our”) is committed to protecting the privacy and security of individuals who visit or use nashamuktbihar.in (“Website”) and related digital services.

The Website is intended to provide information, enable citizens to participate in the Nasha Mukt Bihar movement, facilitate voluntary membership and activity participation, publish verified campaign information, provide access to rehabilitation and helpline information, and support campaign administration.

This Privacy Policy explains:

• what information we collect;
• why we collect it;
• how we use it;
• when information may be shared;
• how we protect it;
• how long we retain it;
• what information may become publicly visible;
• how sensitive information is handled;
• your rights and choices; and
• how you can contact us regarding privacy matters.

By using the Website or voluntarily submitting information, you acknowledge that you have read this Privacy Policy and understand how your information may be processed as described below.

Where consent is legally required, we will obtain the applicable consent before processing the relevant information.

2. Scope

This Policy applies to information collected through:

• nashamuktbihar.in;
• membership registration;
• digital Sankalp/pledge forms;
• event registration;
• activity submissions;
• Campus Ambassador applications;
• volunteer applications;
• NGO enrolment;
• doctor or professional participation;
• rehabilitation-centre information submissions;
• help or contact forms;
• certificate verification;
• campaign communications;
• administrative dashboards; and
• other digital services operated as part of the Campaign.

This Policy does not automatically apply to third-party websites, applications, rehabilitation centres, government websites, payment providers, social-media platforms, or other external services linked from the Website.

Those services operate under their own terms and privacy policies.

3. Information We Collect

We follow a data-minimisation principle: we seek to collect information that is reasonably necessary for the specific purpose for which it is requested.

3.1 Membership Information

When you join the Campaign, we may collect:

• full name;
• mobile number;
• email address;
• age group;
• gender, where voluntarily provided;
• district;
• block;
• panchayat;
• occupation;
• organisation, college, institution or workplace;
• designation;
• selected contribution categories;
• contribution description;
• consent records;
• membership status;
• membership ID;
• verification information;
• account and authentication information.

We do not require a full residential address merely for campaign membership unless there is a specific operational or legal requirement.

4. Contribution and Participation Information

If you voluntarily participate in Campaign activities, we may collect:

• activity type;
• event or programme information;
• date of participation;
• district, block and panchayat;
• location information submitted by you;
• description of the activity;
• approximate number of people reached;
• photographs or videos;
• attendance information;
• verification status;
• activity-related administrative notes.

Only verified activity information should be used for official Campaign statistics. Unverified submissions are not treated as confirmed public impact.

5. Sankalp / Pledge Information

When you take a digital Sankalp, we may record:

• name, where provided;
• membership or participation reference;
• date and time of pledge;
• selected pledge;
• district or location information where applicable;
• consent information;
• technical information necessary to prevent abuse.

The Campaign may display aggregate Sankalp statistics. Individual pledge information will not be publicly displayed unless you have specifically consented to such publication or the information has otherwise been lawfully made public.

6. Event Information

When you register for an event, we may collect:

• name;
• contact information;
• membership ID, where applicable;
• district/block/panchayat;
• event registration information;
• registration ID;
• QR ticket information;
• attendance information;
• participation status.

Event attendance may be used to issue participation certificates.

7. Certificate Information

If you receive a Campaign certificate, the certificate system may generate and store:

• certificate ID;
• membership ID or participation ID;
• certificate type;
• name;
• category;
• district;
• issue date;
• issue timestamp;
• certificate template/version;
• verification status;
• cryptographic hash or digital integrity information;
• QR verification reference;
• certificate file.

Certificates are generated through server-side systems. The Campaign does not intentionally expose the underlying private certificate file through the public verification page.

8. Public Certificate Verification

A certificate may contain a QR code or verification link. The public verification page is intentionally limited to information necessary to establish certificate authenticity.

Depending on the certificate type, the verification page may display:

• validity status;
• name;
• certificate type;
• membership/participation ID;
• category;
• district;
• issue date;
• certificate status.

The verification page will not intentionally display:

• mobile number;
• email address;
• residential address;
• date of birth;
• authentication credentials;
• internal administrative notes;
• help-request information;
• medical information;
• security information.

Certificate verification does not provide public access to the underlying member record.

9. Rehabilitation Centre Directory

The Website may provide a directory of government, private and NGO-operated rehabilitation/de-addiction centres. This directory contains institutional information such as:

• centre name;
• centre type;
• registration/licensing status;
• licence number where available;
• licensing authority;
• district and block;
• address;
• contact numbers;
• email or website;
• services offered;
• admission category;
• approximate bed capacity where available;
• cost category;
• location coordinates where appropriate;
• source of information;
• verification status;
• date of last verification.

The rehabilitation directory is not a database of individuals receiving treatment. We do not intentionally publish information identifying patients, residents, family members, counselling clients or people seeking treatment.

Only centres meeting the Campaign’s applicable verification requirements should appear in the public verified directory. A listing of a private or NGO-operated centre does not by itself constitute government endorsement.

10. Help Requests and Sensitive Information

Some Website features may allow individuals to request assistance or submit information relating to addiction, recovery, counselling, family support or other health-related matters.

Such information may be highly sensitive. We therefore apply stricter access controls to help requests and related records. Access is limited to authorised personnel who require the information for a defined operational purpose.

We will not intentionally publish:

• a person’s addiction or recovery history;
• treatment information;
• counselling information;
• medical information;
• family counselling information;
• private help requests;
• personal contact information submitted for assistance.

Users should avoid submitting unnecessary medical details, identity documents, passwords, financial information or other information that is not required by the relevant form.

The Website is not a substitute for emergency medical care or professional clinical treatment. Where an emergency is involved, users should contact the appropriate emergency service or qualified medical professional.

11. Doctor, NGO and Professional Information

Professionals, doctors, NGOs, social workers, educators and other participants may voluntarily provide information for Campaign participation or public profiles. Information intended for public display may include:

• name;
• professional category;
• organisation;
• designation;
• district;
• professional biography;
• approved profile photograph;
• publicly relevant expertise;
• Campaign activities.

A person’s private contact details will not be made public merely because they participate in the Campaign. Where public-profile consent is required, publication will be based on that consent and the applicable approval process.

12. Government Data and Public Information

The Campaign may publish or reference:

• government circulars;
• government notifications;
• official health information;
• NCRB or other government statistics;
• public reports;
• public health resources;
• government helpline information;
• links to official government websites.

Where possible, information will identify the originating government department, authority, report or publication and the relevant date. Government information may change over time. Users should verify time-sensitive information against the relevant official source where appropriate.

13. Articles, Stories, Media and Gallery

The Website may publish:

• articles;
• educational material;
• recovery stories;
• doctor opinions;
• interviews;
• photographs;
• videos;
• programme reports;
• campaign activities;
• event galleries.

Personal information contained in publicly published material will be handled according to the applicable consent and publication process. Where a person’s photograph, story, testimonial or other identifiable material is intended for public publication, the Campaign may obtain a separate consent where appropriate.

Users should not upload photographs or videos containing identifiable individuals without having the necessary permission or lawful basis to submit that material.

14. Information We Collect Automatically

When you visit the Website, certain technical information may be processed automatically, including:

• IP address;
• browser type;
• operating system;
• device information;
• approximate location derived from technical information;
• pages requested;
• referring page;
• date and time of access;
• error and performance information;
• security and abuse-prevention signals.

Technical information may be used for:

• security;
• fraud prevention;
• rate limiting;
• troubleshooting;
• performance monitoring;
• service reliability;
• aggregate analytics.

We do not retain technical logs indefinitely without a defined operational, security or legal purpose.

15. Cookies and Similar Technologies

The Website may use cookies or similar technologies for:

• authentication;
• maintaining secure sessions;
• remembering preferences;
• security;
• performance;
• analytics where enabled.

Essential cookies may be necessary for the Website to function correctly. Where non-essential cookies require consent under applicable law, we will provide an appropriate consent mechanism.

16. Why We Use Your Information

We may process information for the following purposes:

Membership

To:

• create and manage membership;
• assign a unique membership ID;
• verify membership;
• maintain membership status;
• provide a member dashboard;
• issue certificates.

Campaign participation

To:

• record Sankalps;
• register participants;
• manage events;
• verify activities;
• coordinate volunteers;
• administer programmes.

Communications

Where you have opted in or where otherwise legally permitted, we may send:

• membership confirmations;
• certificate notifications;
• event confirmations;
• important service notifications;
• campaign communications;
• programme updates.

Security

To:

• prevent abuse;
• detect automated submissions;
• investigate suspicious activity;
• protect accounts;
• enforce rate limits;
• maintain audit logs;
• protect the integrity of the Website.

Public information

To publish appropriately approved:

• verified activities;
• events;
• articles;
• campaign statistics;
• public profiles;
• recovery stories;
• educational material;
• rehabilitation-centre information.

Compliance

To:

• comply with applicable law;
• respond to lawful requests;
• protect the Campaign, users and public systems;
• investigate security incidents.

17. Consent

We distinguish between different types of consent.

Required consent

Membership and certain services may require acceptance of:

• Terms of Use;
• Privacy Policy;
• applicable service-specific conditions.

Optional communications consent

Users may separately choose whether to receive campaign communications through available channels.

Optional public-profile consent

Users may separately choose whether their approved public profile information may appear publicly.

Optional media/story consent

Where applicable, separate consent may be requested for publication of:

• photographs;
• videos;
• testimonials;
• recovery stories;
• interviews;
• other identifiable material.

Consent records may include:

• consent type;
• whether consent was granted;
• date and time;
• relevant policy/version;
• account or submission reference.

Where technically and legally applicable, users may withdraw optional consent through available mechanisms. Withdrawal does not necessarily invalidate processing that was lawfully completed before withdrawal.

18. Data Sharing

We do not sell personal information to advertisers. Information may be shared with authorised service providers where necessary to operate the Website. Depending on the feature, service providers may include:

• hosting infrastructure;
• database/authentication infrastructure;
• email delivery providers;
• SMS providers;
• WhatsApp messaging providers;
• storage/CDN providers;
• security and anti-bot services;
• monitoring and technical infrastructure providers.

Service providers should receive only the information reasonably necessary for their assigned function and should be subject to appropriate contractual, technical or organisational safeguards where applicable.

19. Public Disclosure

Certain information may be intentionally made public when the relevant feature requires it. Examples include:

• verified campaign statistics;
• public events;
• approved articles;
• approved public profiles;
• verified activities;
• verified rehabilitation-centre directory information;
• certificate verification information.

Private membership information is not automatically public merely because someone joins the Campaign. Public display must follow the applicable consent, verification and publication rules.

20. Administrative Access

Campaign administrators and coordinators receive access according to their role and geographic or operational scope. The Campaign may use roles such as:

• State Administrator;
• District Administrator;
• Block Coordinator;
• Panchayat Coordinator;
• Campus Ambassador;
• Volunteer;
• specialist roles.

Administrative access is governed by authentication, role-based authorization and database-level access controls. A user interface showing an administrative option does not itself grant permission to perform that operation. Sensitive information is restricted to authorised personnel with a legitimate operational need.

21. Security Measures

We use reasonable technical and organisational safeguards appropriate to the nature of the information processed. These may include:

• encrypted HTTPS connections;
• secure authentication;
• role-based access control;
• database Row Level Security (RLS);
• server-side authorization;
• multi-factor authentication for privileged administrators;
• rate limiting;
• Cloudflare Turnstile or equivalent anti-bot protection;
• secure environment variables;
• audit logs;
• security event monitoring;
• restricted storage buckets;
• short-lived signed URLs;
• input validation;
• output encoding;
• protection against common web vulnerabilities;
• access logging;
• backup and recovery procedures.

Privileged credentials and service-role database keys are not intended to be exposed to the public browser. No security system can guarantee absolute security. If a security incident occurs, the Campaign will follow its incident-response procedures and applicable legal obligations.

22. File and Media Security

Uploaded media may be subject to technical validation before storage or publication. Depending on the file type and purpose, controls may include:

• file-size limits;
• MIME validation;
• file-signature/magic-byte validation;
• image-dimension validation;
• malware scanning;
• compression/resizing;
• metadata/EXIF removal;
• moderation;
• restricted storage.

Private documents and certificates are not intended to be publicly accessible by default.

23. Data Retention

We retain information only for as long as reasonably necessary for:

• the purpose for which it was collected;
• campaign administration;
• certificate verification;
• legal obligations;
• dispute resolution;
• security;
• fraud prevention;
• legitimate archival requirements.

Retention periods may differ by data type. For example:

• membership records may be retained while membership remains relevant to Campaign administration;
• certificate verification records may be retained for the period necessary to establish certificate authenticity;
• security logs may be retained for a defined security period;
• sensitive help-request information should have a shorter retention period where operationally possible;
• obsolete or unnecessary information should be deleted, anonymised or securely disposed of.

The Campaign may establish and periodically review specific retention schedules.

24. Deletion and Anonymisation

Where legally and operationally appropriate, users may request deletion or correction of their personal information. Deletion may be subject to limitations where information must be retained for:

• legal compliance;
• fraud prevention;
• security;
• certificate verification;
• dispute resolution;
• legitimate archival purposes.

Where complete deletion is not appropriate, information may instead be anonymised or restricted. Deleting a personal account may not automatically erase public records that have been lawfully published independently, although reasonable steps may be taken where appropriate.

25. Data Accuracy

Users are responsible for providing accurate information. If your information changes, you should update it through the available account or support mechanism. The Campaign may correct or verify information where necessary. For rehabilitation-centre information, the Campaign may mark records as:

• Pending;
• Verified;
• Stale;
• Rejected.

Unverified or stale centre information should not be presented as verified information.

26. Children’s Privacy

The Campaign may contain educational programmes involving students and young people. Where a service is directed toward or may involve minors, appropriate age-related safeguards and consent mechanisms will be applied as required by applicable law.

We do not knowingly seek unnecessary personal information from children. Where participation involves minors, information should be submitted by an authorised parent, guardian, educational institution or other legally appropriate representative where required.

27. Third-Party Links

The Website may link to:

• government websites;
• health resources;
• rehabilitation centres;
• NGOs;
• social-media platforms;
• external publications;
• other third-party services.

We do not control the privacy practices of external websites. Users should review the privacy policy of any external service before submitting personal information to it.

28. International Service Providers

Some infrastructure or service providers used to operate the Website may process information from locations outside India. Where such processing occurs, the Campaign will seek to use appropriate contractual, technical and organisational safeguards and comply with applicable legal requirements.

29. No Sale of Personal Information

The Campaign does not sell personal information to advertisers or data brokers. Personal information is not intended to be provided to third parties for unrelated advertising or commercial profiling.

30. Communications and Opt-Out

Where campaign communications are optional, users may opt out through the available unsubscribe or preference mechanism. Certain operational communications may still be sent when necessary to provide a service requested by the user, such as:

• membership confirmation;
• certificate availability;
• event registration;
• account/security notifications.

A user who withdraws optional campaign communication consent may continue to receive essential service-related communications where legally permitted and operationally necessary.

31. Data Breach and Security Incidents

If we become aware of a security incident involving personal information, we will assess:

• what information was affected;
• the nature and scope of the incident;
• potential risks;
• whether containment is required;
• whether credentials must be revoked;
• whether affected systems must be isolated;
• whether users or authorities must be notified under applicable law.

Incident handling follows the general process: Detect → Contain → Investigate → Remediate → Recover → Document → Notify where required.

32. Changes to This Privacy Policy

This Policy may be updated when:

• Website features change;
• laws or regulatory requirements change;
• new data-processing activities are introduced;
• security practices are improved;
• retention practices change.

The latest version will be published on this page with the applicable “Last Updated” date. Where a material change requires renewed consent under applicable law, the Campaign will provide an appropriate mechanism.

33. Contact and Grievance Mechanism

For privacy questions, correction requests, deletion requests, consent questions, complaints or grievances, contact:

Nasha Mukt Bihar Campaign
Website: https://nashamuktbihar.in
Email: [INSERT OFFICIAL PRIVACY/GRIEVANCE EMAIL]
Phone: [INSERT OFFICIAL CONTACT NUMBER]
Postal Address: [INSERT OFFICIAL REGISTERED/CORRESPONDENCE ADDRESS]

Please do not send passwords, OTPs, payment-card information or unnecessary medical information when contacting us. For a privacy request, we may need sufficient information to verify the requester’s identity and protect the account or information involved.

34. Important Health and Rehabilitation Disclaimer

Nasha Mukt Bihar is intended to provide campaign information, awareness resources, participation facilities and access to verified information about available support.

Information about doctors, rehabilitation centres, NGOs, health resources, articles or treatment options is provided for informational and connectivity purposes and does not by itself constitute medical advice, diagnosis, treatment or a government endorsement.

The Campaign does not guarantee the outcome, quality, availability, admission decision, treatment, fees or conduct of any independently operated rehabilitation centre or healthcare provider.

For urgent medical or safety situations, contact an appropriate emergency service or qualified healthcare professional.

35. Governing Framework

This Privacy Policy is intended to operate in accordance with applicable laws and regulations of India, including applicable data-protection, information-technology, consumer-protection and other relevant legal requirements. Where applicable law provides stronger privacy rights or imposes additional obligations, those requirements will prevail to the extent required.

36. User Privacy Principles

The Campaign follows these core principles:

• Collect less. We avoid collecting information that is unnecessary for the stated purpose.
• Use it for a reason. Information should be used for the purpose for which it was collected or another legally permitted purpose.
• Keep sensitive information private. Health, addiction, recovery and help-request information receives stricter protection.
• Make public information deliberate. Joining the Campaign does not automatically make a person’s private profile public.
• Verify before publishing. Campaign statistics and rehabilitation-centre information should be verified before being presented as official or verified information.
• Secure by design. Authentication, authorization and database-level controls are part of the security model rather than relying solely on the website interface.
• Respect consent. Required legal/service consent is kept separate from optional communications and public-profile consent.