CareSaathi Privacy and DPDP Notice

1. Who we are

In this notice, “CareSaathi”, “we”, “our” and “us” mean CareSaathi Health Corp. CareSaathi supports care continuity, education, coordination and doctor-governed follow-up. It does not replace the treating doctor or an emergency service.

2. Scope of this notice

This notice applies when you use or participate in CareSaathi services through WhatsApp, telephone, our website, care-team interactions, uploaded documents, or connected care operations. It should be read with any programme-specific consent, hospital or doctor notice, and service terms that apply to your care.

3. Personal data we may process

• Identity and contact details, including name, age or date of birth, sex, telephone number, address, preferred language, and patient or enrolment identifiers.
• Health and care information, including diagnoses, symptoms, allergies, medicines, prescriptions, care plans, diet and activity guidance, vital signs, laboratory or imaging results, discharge and follow-up information, and clinical risk or escalation context.
• Documents and media you or an authorised care participant provide, such as prescriptions, reports, photographs, audio, video or other evidence.
• WhatsApp messages, replies, button choices, call or support records, adherence responses, questions, grievances and consent history.
• Care-team, caregiver and provider details needed to coordinate the authorised service.
• Operational and technical records such as timestamps, delivery status, audit events, security logs, document hashes, device or browser information, and website usage information where collected.

We ask you not to send information that is unrelated to your authorised CareSaathi service.

4. Why we process personal data

• To verify identity, enrolment and the approved care-plan authority.
• To deliver the signed or doctor-approved care plan, reminders, education and continuity support.
• To record choices, replies, adherence information and evidence supplied by you.
• To answer evidence-bound questions, organise documents, and support authorised care-team review.
• To identify configured safety signals and route matters for clarification, operational follow-up or human clinical review.
• To provide caregiver participation where authorised, maintain service continuity, and respond to support requests or grievances.
• To secure, operate, troubleshoot and improve the service; prevent misuse; and maintain required clinical, contractual, legal and audit records.

5. Consent and other permitted processing

Where consent is the basis for processing, CareSaathi asks for a clear affirmative choice before consent-dependent routine messaging and document processing begins. You may decline without being forced to consent. We may also process data where another use is specifically authorised or required by applicable law, but we do not use that statement to expand the purposes described in this notice.

Consent for CareSaathi does not authorise autonomous diagnosis, prescribing, medicine changes, treatment changes or replacement of your treating clinician.

6. How data is collected and shared

We may receive data directly from you, from an authorised caregiver, treating professional or participating organisation, or from records and documents provided for the service.

Only as needed for the stated purposes, data may be handled by:

• your authorised doctors, care team, caregivers, hospitals or programme operators;
• WhatsApp/Meta and Interakt for the messaging channel;
• configured private application, database, document-storage, security and hosting providers; and
• a configured document-extraction or model provider when a report-dependent question requires evidence processing.

Service providers act under applicable contracts, access restrictions and confidentiality or security requirements. We may disclose data where law requires it or where necessary to address a serious safety or security event. We do not sell patient personal data.

7. Your choices and withdrawal

You may choose “Not now” before enrolment consent, or later ask us to withdraw consent by contacting the Privacy Contact below or using an available consent-control option in the CareSaathi conversation. Withdrawal stops future consent-dependent routine messaging and document processing at the next safe operational boundary. It does not make prior lawful processing invalid and does not require deletion of records that must be kept for clinical safety, legal, contractual, fraud-prevention or audit purposes.

8. Access, correction, erasure and other rights

Subject to identity verification and applicable law, you may ask for:

• a summary of personal data being processed and relevant processing information;
• correction of inaccurate or misleading data, completion of incomplete data, or updating of data;
• erasure where the data is no longer required and retention is not otherwise necessary or required;
• withdrawal of consent;
• grievance review; and
• nomination or other rights when and as provided by applicable law.

Send the request from your registered contact where possible and describe what you want us to review. We may ask for reasonable information to verify your identity and protect the patient record.

9. Retention and deletion

We keep personal data only for as long as reasonably needed for the care or programme purpose, follow-up, safety, service operations, grievance handling, audit, dispute resolution, or a legal or professional record requirement. When continued identifiable retention is not needed, data is deleted, securely disposed of, or de-identified according to the applicable system and retention process. Limited copies may remain temporarily in protected backups until their normal expiry cycle.

10. Security

CareSaathi uses reasonable administrative, technical and organisational safeguards appropriate to the service, including access controls, role restrictions, audit records, protected storage and transmission, credential controls, backups, and incident handling. No digital service can promise absolute security. If you believe data or an account has been exposed, contact us promptly.

11. Children and authorised representatives

Where a service involves a child or a person acting through a lawful guardian or authorised representative, we require the appropriate authority and consent before consent-dependent processing. A caregiver’s access is limited to the role and scope authorised for that person.

12. Healthcare and emergency limits

CareSaathi does not independently diagnose, prescribe, stop or change medicines, or override the treating doctor. Automated or model-assisted processing is bounded by configured evidence, routing and human-review controls.

13. Privacy contact and grievance procedure

For a privacy request, consent withdrawal, correction, access request, suspected data issue, or grievance, contact:

We will acknowledge, investigate and respond through the registered or otherwise verified contact within the period applicable to the request. Please give us a reasonable opportunity to resolve the grievance internally before approaching the competent authority available under applicable law.

14. Updates and legal status

We may update this notice when the service, processing or applicable law changes. A material update will receive a new version or effective date and will be published at this canonical address.

This notice is an operational privacy disclosure. It does not claim government certification, accreditation or unconditional legal compliance.

Effective date: 1 September 2026 · Version 1.0 · Document ID: DPDP-NOTICE-V1-2026-09-01-EN