Privacy Policy

How CareStep collects, uses, stores, shares and protects personal and business information, and the rights of data principals under India's DPDP framework.

Status: Draft for professional legal review — not yet in force. Version: 1.0-draft · Effective date: [To be set at publication] Aligned with the framework of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). [Legal review note: confirm compliance details with counsel before publication.]

1. Purpose

This Privacy Policy explains how CareStep ("we", "[us]", "[our]") collects, uses, stores, shares and protects personal data and business information when you use the CareStep platform ("Platform"). It also sets out your rights as a data principal and how to exercise them.

2. Definitions

• Personal data — any data about an individual who is identifiable by or in relation to such data.
• Data principal — the individual to whom personal data relates.
• Data fiduciary — the entity that determines the purpose and means of processing personal data. CareStep is the data fiduciary for personal data collected through the Platform.
• Consent — a clear, affirmative, informed and freely given agreement to process personal data for specified purposes.
• Other capitalised terms (e.g. Customer, Business Network Member, Content) have the meanings given in the Terms & Conditions.

2.1 Scope

This Privacy Policy applies to all personal data and business information processed by CareStep through the Platform, including data provided by Customers, Business Network Members and visitors. It supplements the Terms & Conditions and the DPDP Compliance Draft.

3. Information we collect

3.1 Personal information

• Name, contact details (phone number, email address), and profile information you provide at registration.
• Business-owner identity and verification information provided during registration or KYC (e.g. business name, category, service areas).
• Government or business identification details where provided for verification (e.g. business registration numbers).
• Consent records, including timestamps and consent scope, in line with DPDP consent requirements.

3.2 Business information

• Business profile data, services, pricing, service areas, ratings, reviews and listings posted by Business Network Members.
• Subscription, payment and invoice history (see the Subscription Terms).

3.3 Usage information

• Device information (device type, operating system, browser, IP address, approximate location).
• Usage analytics (pages visited, features used, search queries, lead views).
• Logs and security information needed to protect the Platform.

3.4 Cookies & similar technologies

We and our analytics providers use cookies and similar technologies as described in the Cookie Policy.

4. Purpose of collection

We process personal data for the following purposes:

• Operating and improving the Platform (registration, verification, lead distribution, CRM, networking, AI recommendations).
• Processing payments and issuing invoices.
• Sending service notifications, trial reminders and upgrade recommendations (see Trial Terms).
• Fraud prevention, security, and compliance with legal obligations.
• Customer support and grievance handling (see the Grievance Policy).
• Analytics and research to improve our services, where lawful.

5. Lawful use

We process personal data where we have a lawful basis, including:

• Consent — where you have given clear, affirmative consent (e.g. for marketing communications or for sharing your requirement with members).
• Performance of a contract — where processing is necessary to provide the Platform services you have requested.
• Legal obligation — where processing is required to comply with law.
• Legitimate interests — for security, fraud prevention and service improvement, balanced against your rights and interests.

[Legal review note: confirm the complete consent/legitimate-interest positions and the DPDP notice requirements with counsel.]

6. Storage & retention

• Personal data is stored on secure servers, in India or with processors that meet appropriate safeguards.
• We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law.
• Retention periods are defined per data category; details are available on request. Specific timelines are set out in the Cancellation Policy for account closure.

7. Sharing & third-party integrations

We share personal data only for legitimate operational purposes and only to the extent necessary:

• With users — a Customer's requirement is shared with eligible Business Network Members to enable lead distribution; Members' business profiles are visible to Customers.
• With service providers — payment gateways (currently Cashfree), SMS/email providers, analytics and hosting providers, subject to contractual confidentiality and security obligations.
• With authorities — where required by law, court order or government authority.
• In business transfers — in connection with a merger, acquisition or restructuring, subject to applicable law.

We do not sell personal data.

8. Security measures

We implement reasonable organisational and technical measures to protect personal data, including encryption in transit and at rest, access controls, monitoring, and staff confidentiality obligations. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. Your rights

Subject to applicable law, you have rights to:

• Access your personal data.
• Correct inaccurate personal data.
• Erase personal data, subject to legal retention requirements.
• Withdraw consent at any time (see the DPDP Compliance Draft).
• Restrict or object to certain processing, where applicable.
• Portability, where applicable.

To exercise these rights, contact us using the details in Clause 13. See the DPDP Compliance Draft for the full consent and request framework.

10. Account deletion

You may request deletion of your account and associated personal data as described in the Cancellation Policy. Some data may be retained where required by law (e.g. financial records, audit trails).

11. Children's privacy

The Platform is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it where required.

12. International transfers

If personal data is transferred outside India (for example to a cloud or support provider), we ensure appropriate safeguards are in place in accordance with the DPDP Act. [Legal review note: document the specific transfer mechanisms (e.g. contract clauses) with counsel.]

13. Contact details

• CareStep — [Legal entity name & registered address to be confirmed]
• Data protection / privacy contact: [privacy@carestep.in — placeholder]
• Grievances: see the Grievance Policy

14. Revision & version control

• Version: 1.0-draft
• Last reviewed: [To be confirmed]
• Next review due: within 12 months of the effective date, or sooner if required by changes in law or the Platform.
• This is a draft for professional legal review. Do not publish or rely on it in production until reviewed and issued.