HealAssist Privacy Notice

1. Who is responsible for your data

HealAssist Healthtech Private Limited, Innov8, 9th Floor, Tower D, Unitech Cyber Park, Sector 39, Gurugram, Haryana 122001. CIN U86900HR2026PTC140418.
Grievance Officer: Robin Singh, Director · robin.singh@healassist.in · +91 95181 89197 · same address.
Contact for anything in this notice: care@healassist.in · WhatsApp +91 93108 17792 · Calls +91 95181 89197.

2. Whose data this notice is about

- The Patient: the adult whose care we help with. Their health information belongs to them, even when a family member books, pays or talks to us.
- You, the person who books a call, pays or uses the family login.
- Family members you name so we can contact them.
- Visitors to the public website (section 12).
- If the Patient cannot decide for themselves, a lawful guardian acts for them.

3. What we collect

| Data | Examples | When |
||||
| Contact | Your name, mobile, email (optional), language, relation to the Patient, billing state | Booking, checkout |
| Booking and consent record | Your ticks, the exact text you agreed to, its version and language, the time, your mobile, how you heard about us, any code | Booking, checkout |
| What you tell us on calls and chats | Hospital, doctors, treatment plan and dates, who pays for treatment, money worries, hospital trips, who helps at home, the help you want | Free call, WhatsApp, website chat, later calls |
| Health documents | Reports, scans, prescriptions, bills, estimates, insurer letters you upload or send | After you join |
| Care plan, savings and outcome records | The plan, each saving with its proof, treatment steps and dates, urgent events and what happened | During the service |
| Payment records | Amount, date, Razorpay transaction ID and status, invoices and credit notes. Card and bank details stay with Razorpay; we never see or store them | Checkout, renewals |
| Account and technical | Mobile, password (stored hashed), login times, documents opened, consent changes, IP address and device type in security logs | While you use the website |
| Website chat and cookies | Chat messages on the public website (these may contain health details you type); cookies and analytics listed in section 12 | Public website |

We do not ask for Aadhaar, PAN or any government ID number on the website (P). We do not record video calls (P). We do not ask about the diagnosis when you book.

4. Why we use it, and on what basis

| Purpose | Basis | Can you refuse? |
||||
| Run the free call and write your care plan | Your consent tick at booking | Yes, but then we cannot hold the call |
| Run the subscription: Heal Assistant work, family website, reports, support | Your consent ticks at checkout | Yes, but then we cannot provide the service |
| Ask for and receive records from hospitals, doctors, insurers and TPAs named by the Patient | The Patient's signed authority letter | Yes; we then cannot do that part |
| Send booking, care plan, payment and service messages | Needed for the service you asked for; WhatsApp only with your separate WhatsApp tick | WhatsApp: yes, messages then come by SMS |
| Follow up once or twice after your care plan if you have not joined (P) | Part of the call you booked | Yes: reply STOP or tell us |
| Measure visits to the public website and the results of our ads (section 12) | Your choice in the cookie banner | Yes: "Essential only" |
| Invoices, tax records, accounts | Legal duty (GST, Companies Act) | No |
| Security, fraud prevention, incident reporting | Legal duty (IT Act, CERT-In) | No |
| In an emergency, share what is necessary with a hospital or emergency service | Medical emergency (DPDP s.7(f); SPDI Rules) | — |
| Improve the service using data with all names and identifiers removed (anonymised counts, never a person) | Not personal data once truly anonymised | — |

We never sell your data. We never share it with advertisers. We never give it to any hospital, insurer, employer or doctor unless the Patient has authorised that or the law requires it. Nothing from your account, calls, chats or documents is ever sent to an analytics or advertising tool.

5. Who sees your data

- Your named Heal Assistant, the Heal Assistant on duty when yours is not available, and HealAssist staff who work on your case or on payments.
- Everyone who uses your family login. One login is shared by the family: anyone with the password sees everything in the account.
- Companies that process data for us, on our instructions and under contract:

6. Where your data is stored

Our database, files, backups and case records are stored in India. Live video and WhatsApp delivery run on Google's and Meta's systems as described above. Public-website analytics (section 12) go to Google, Microsoft and Meta outside India, and only if you accept those cookies.

7. Messages

Our SMS, WhatsApp and email messages never name the Patient's illness or treatment. WhatsApp messages from us go only to numbers that ticked the WhatsApp box (or, for a family member, replied YES to our opt-in question). Reply STOP (or बंद) to any WhatsApp message to stop WhatsApp updates; service messages then come by SMS, and by email if you gave one. Reply START to get WhatsApp updates again.

8. Your rights and choices

You (and the Patient) can:
- see a summary of the data we hold and who it was shared with;
- correct or update it;
- ask us to erase it (some records must be kept for tax or legal reasons; we tell you which and for how long);
- withdraw any consent as easily as you gave it; withdrawing the consent the service runs on means we cannot continue the service, and the Refund Policy applies;
- nominate a person to exercise these rights if the Patient dies or cannot act;
- complain (section 11).
How: Account → Privacy, or email care@healassist.in, or WhatsApp +91 93108 17792. We confirm your identity by a one-time code to the registered mobile. We respond within 30 days. Withdrawal takes effect within 48 hours.

9. How long we keep data

| Data | Kept until | Note |
||||
| Booking details and consent record, if you do not join | 2 years after our last contact with you | Lead retention |
| Care plan, call notes, chats, documents, savings and outcome records | End of the subscription + 8 years | Legal disputes |
| Account | While active + 8 years | |
| Invoices, credit notes, payment records | 8 years | Tax law (GST, Companies Act) |
| Security and access logs | At least 180 days (CERT-In) | |
| Consent and processing logs | At least 1 year (DPDP Rules) | |
| After the Patient passes away | Account read-only for 90 days for downloads (P), then closed; records kept per the rows above | |
After these periods we erase the data or make it anonymous.

10. Security and breaches

Data is encrypted in transit and at rest. Access is limited to assigned staff and logged. Staff use two-factor login. If a cyber incident happens we report it to CERT-In within 6 hours. If a breach affects you, we tell you without delay: what happened, the likely impact, what we did, and what you can do. We inform the Data Protection Board of India as the law requires.

11. Complaints

First write to our Grievance Officer (section 1). We acknowledge within 48 hours and resolve within one month. If you are not satisfied after that, you may complain to the Data Protection Board of India, through its official website. The law asks you to use our grievance process first.

12. Cookies and website chat

This section is the one list of cookies and tracking tools on healassist.in. When we add or remove a tool, we update it here with the date.

The banner offers "Accept all" and "Essential only" with equal weight, and "Cookie settings" in the footer lets you change your choice any time. We use no analytics or advertising tool on logged-in pages, and we do not run session recording there (P). Google Search Console verifies that we own the site; it places nothing on your device.
The chat window on the public website is run by Zoho SalesIQ; anything you type there, including health details, is stored with your chat.

13. Children

We work only with adult patients. If we learn we hold data about a person under 18 as a patient, we delete it.

14. Changes to this notice

We give at least 30 days' notice of any material change, by WhatsApp, SMS or email, and show the new version here with its date.

15. Record of your consent

Every consent you give is saved with the exact text, its version, the language, the time and your mobile number. You can ask for a copy.

16. Language

This notice is available in English and Hindi. If they differ, the English text applies.