Privacy Policy

This Privacy Policy explains how [Legal Entity Name] ("CareConnect," "we," "us") collects, uses, shares, and protects personal data when you use the CareConnect platform, in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000.

1. Data we collect

• Account data: name, phone number, email, password (stored hashed, never in plain text).
• Patient data: address, gender, household type, emergency contact, profile photo, and — where you choose to provide it — care instructions relevant to a booking. Care instructions can reveal health information; we treat this with the same care as other sensitive personal data under the DPDP Act.
• Professional data: identity documents (Aadhaar, PAN), nursing qualification and State/Indian Nursing Council registration, police verification certificate, experience certificates, bank/UPI details for payouts, and a selfie for identity verification.
• Location data: your address/coordinates for matching, and — only while a booking is actively in progress — a Professional's live location, shared with the matched Patient for that visit only.
• Payment data: transaction records and payment method type (e.g. UPI, card). Full card/UPI credentials are handled by our payment partner(s), not stored by CareConnect.
• Usage and safety data: booking history, ratings, in-app messages between a matched Patient and Professional, and any SOS alerts or support tickets you raise.
• Live face-scan data: at signup, and again when a Patient confirms a Professional's identity on arrival, the Platform may capture short live camera images. Facial images are biometric data — one of the most sensitive categories under the DPDP Act — and are handled accordingly (see "Live face scans" below).

2. Why we collect it

To operate the marketplace (matching Patients with verified Professionals), to verify Professional credentials before they can accept bookings, to process payments and payouts, to provide safety features (SOS, live location during a visit, incident review), to compute Trust Scores used for prioritizing trusted matches, to respond to support requests, and to comply with legal and regulatory obligations.

3. Who we share it with

We share only what's necessary for a booking to work: a Patient's address and instructions are visible to the Professional assigned to that booking; a Professional's name, qualifications, and (while a visit is active) live location are visible to the matched Patient. Phone numbers are never shared between Patients and Professionals — in-app chat is the only direct contact channel. We share data with payment processors to complete transactions, and with law enforcement or regulators where legally required. We do not sell personal data to third parties.

4. Your rights under the DPDP Act

You have the right to:

• Access a summary of the personal data we hold about you.
• Correct or update inaccurate or incomplete personal data.
• Request erasure of your personal data, subject to our legal and regulatory retention obligations (e.g. financial records, verification records for Professionals).
• Withdraw consent for processing at any time, without affecting processing already carried out.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Register a complaint with us, and if unresolved, with the Data Protection Board of India.

To exercise any of these rights, contact our Grievance Officer below or use our support page.

5. Data security and retention

We use industry-standard safeguards including encryption in transit, row-level access controls scoping who can see what data, and role-based restrictions for our own support and safety teams. We retain personal data only as long as necessary for the purposes above, or as required by applicable law (e.g. financial and tax records).

6. Live face scans

With your camera permission, the Platform captures short live images at signup (a liveness check) and, for a Patient confirming a Professional's identity on arrival, a comparison capture. Today, the matching/liveness verdict is produced by a basic, non-certified check built into the Platform — it is not yet a certified biometric-matching service, and its result is informational rather than a guarantee of identity. We plan to integrate a certified vendor before relying on this feature as a hard verification gate. Captured images are stored only for as long as needed for the verification audit trail described above, are never used for any purpose beyond identity/liveness verification, and are not shared outside CareConnect except as required by law.

7. Children

CareConnect accounts are for individuals 18 years or older. Care for a minor may be booked by their parent or legal guardian's account.

8. Grievance Officer

In accordance with the DPDP Act and the Information Technology Act, 2000, our Grievance Officer can be reached at:

[Grievance Officer Name]
[Email address]
[Postal address]

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Platform before they take effect.