Effective date: 30 October 2026
This policy explains how information is handled when you use the HRA Overseas website, request counselling or use a client workspace. HRA Overseas is the service brand referred to as “we”, “us” and “our”. For privacy questions and requests, contact enquiry@hraoverseas.com with the subject “Privacy request”.
1. Information you choose to provide
Enquiries: your name, phone number, email, preferred country, service interest and the notes or answers you submit.
Accounts: your name, email, phone, password credentials and profile details. Passwords are stored as password hashes rather than readable passwords.
Cases: application goals, education and employment information, travel and family information you supply, supporting documents, checklist responses, messages, appointments and counsellor feedback. Documents may contain identity, financial, health or other sensitive details; provide only what is necessary for your case.
Other requests: saved courses or institutions, service requests, referrals, event registrations, newsletter subscriptions and the consent choices you make. Share another person's details only when you have their permission or other lawful authority.
2. Technical information and browser storage
The website uses a session cookie named hra_session to keep account sessions, protect submitted forms and associate guest activity with a browser session. Blocking essential cookies can prevent sign-in and forms from working. The application also uses a hashed network-address identifier to limit abusive requests. Hosting systems may keep access, security and error logs containing network addresses, request times, browser information and requested pages.
Browser features and interactive pages may keep temporary state or preferences. You can clear site data in your browser, but doing so may sign you out or remove access to guest assistant history. Following an external link subjects your visit to that provider's own cookie and privacy practices.
3. Why information is used
We use the information relevant to your request to respond to enquiries, assess service fit, arrange counselling, manage accounts and cases, review documents, maintain checklists, coordinate appointments, support referrals or events, and communicate requested next steps. We also use necessary records to keep the service secure, resolve support issues, prevent misuse, maintain transaction and case history, and meet applicable legal obligations.
Submitting an enquiry does not enrol you in the email newsletter. Marketing email uses a separate subscription choice. We do not sell personal information or use uploaded case documents for public advertising. Publishing a client's testimonial, photograph or case story requires separate permission.
4. Who can access information
Authorised administrators and counsellors assigned to a case can access the information needed for their work. Administrators can manage enquiries, accounts, assignments and service records. Website hosting, database, backup and email providers process information needed to operate those services.
When you ask HRA to assist with an application, relevant information may need to be provided to an institution, employer, examining body, authorised adviser or public authority. Confirm the recipient and scope with your counsellor before authorising submission. A website enquiry alone does not authorise an application to every partner or country. Information may also be disclosed where required by law or necessary to respond to a lawful request or protect legal rights.
5. Email, phone and WhatsApp
Customer form notifications are directed to enquiry@hraoverseas.com. Account verification, password reset, case and appointment emails are sent to the relevant account holder when email delivery is configured. A message may contain enquiry details or a link to the protected workspace. Private uploaded documents are accessed through permission-checked downloads rather than public document links.
WhatsApp contact links open WhatsApp. Information you then send is handled under WhatsApp's own terms and privacy policy as well as HRA's handling of the conversation. This website does not provide SMS messaging or online payment collection. Do not send passwords, one-time codes or unnecessary identity documents through an ordinary enquiry or chat message.
6. Assistant, document review and voice
The built-in route assistant uses the messages and profile facts you enter to provide planning guidance. Conversation history is saved in the website database when you choose to save it. You can delete a saved conversation through the assistant; information already shared into a counselling case remains part of that case.
If an external AI provider is enabled, assistant messages, relevant conversation history and profile facts are sent to that provider to generate a reply, even if you do not choose to save the conversation on this website. Ask the HRA desk which provider is enabled before entering confidential information. The separate document-review option sends extracted document text to a configured external provider only when you choose that option. Ordinary document-readiness checks can run within the website.
Browser dictation, speech playback and optional provider voice depend on the browser or selected provider. Audio or transcripts may be processed by those services after you enable microphone or voice features. You can decline microphone permission and use text instead. Assistant output is not an eligibility decision or a substitute for an authorised professional review.
7. Where processing takes place
The website, email, backup and any enabled external providers may operate in different countries. A destination-country application may also require information to be sent there. Ask enquiry@hraoverseas.com for the providers, locations and recipients relevant to your case. We consider applicable restrictions before arranging a transfer and do not promise that all processing stays in India.
8. Retention and deletion
Records are kept for the purposes described above and for applicable legal, accounting, security or dispute requirements. The necessary period differs for an unanswered enquiry, an active application, a completed case, consent records and security logs. The website does not promise automatic deletion after a fixed number of days.
You may request a review of retention or deletion at any time. Information no longer needed for a lawful purpose should be deleted or anonymised. If some information must be retained, we will explain the reason when responding to your request. A deletion from active systems may remain in restricted backups until those backups are replaced under the operator's backup schedule. Retained backups must not be used to restart marketing to someone who has unsubscribed.
9. Your choices and privacy requests
You can ask to access or obtain a copy of your information, correct inaccuracies, withdraw consent, request deletion, or raise a concern about a disclosure. Applicable law determines the rights available to you. Email enquiry@hraoverseas.com with “Privacy request”, identify the account or case concerned, and describe the action you want. We may need proportionate identity verification to protect your records; do not attach a full passport or other identity document unless a secure verification method has been agreed.
Use the unsubscribe link in a marketing email and confirm the request to stop newsletter emails. You can also email us to withdraw marketing or counselling follow-up permission. Essential communications needed to complete a service you still request or meet a legal obligation may continue. Withdrawing information needed for a service may prevent us from continuing that service; we will explain the consequences. You can use any competent regulator or complaint process available under applicable law if a concern is unresolved.
10. Children and family applications
Independent account registration and counselling requests are intended for adults aged 18 or over. A parent or lawful guardian should contact HRA before providing a child's information or arranging support for a child. Provide family information only where needed, and make sure you have the authority required to share it. Contact us if you believe a child has provided information without appropriate authority so it can be reviewed.
11. Security and incident concerns
The application uses account access controls, password hashing, protected document downloads, form protections and administrator audit records. HTTPS and the hosting operator's access and backup controls are also necessary for safe operation. No website or email system can guarantee absolute security. Keep account credentials private and report suspected misuse to enquiry@hraoverseas.com without including your password. Security incidents and required notifications will be handled under applicable law.
12. Changes and contact
We may update this policy when the website or information-handling practices change. The effective date appears at the top. Material changes that require a new notice or consent will be handled accordingly; this policy does not remove any mandatory privacy or consumer rights. For a privacy concern or a request to reach the person responsible for handling it, email enquiry@hraoverseas.com. Read the Terms of Use at /terms for the conditions of using the website.