Privacy Policy

WELCOMEHEΛLTH is operated by WELCOMEHEΛLTH IN PRIVATE LIMITED, a company organised under the laws of India with its registered office at #329, Sector-7, Suketri, Panchkula, Haryana, India, 134109 (“WELCOMEHEΛLTH”, “we”, “us”, or “our”).

WELCOMEHEΛLTH provides health information, family coordination, account support, caregiver support, and operational care facilitation services. We are not a hospital, clinic, pharmacy, diagnostic laboratory, emergency service, or substitute for a qualified healthcare professional.

For privacy matters, contact our authorised privacy contact and Grievance Officer:

This Policy explains how WELCOMEHEΛLTH collects, uses, discloses, stores, and protects personal data when you:

• visit our website or read our content;
• submit an enquiry or callback request;
• create or use an account, profile workspace, or family dashboard;
• communicate with a Care Guide or our team;
• purchase or use a plan or service;
• upload documents or provide family, caregiver, health, or care-related information; or
• otherwise interact with WELCOMEHEΛLTH online or offline.

Additional notices or consent requests may apply when you use a particular feature or provide health related information.

Where applicable, WELCOMEHEΛLTH acts as the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 and as the “controller” under the GDPR, UK GDPR, or similar laws.

This Policy should be read with the Terms of Use.

Depending on how you interact with us, we may collect:

• Identity and contact information: name, age or date of birth, email address, telephone number, city, address, preferred language, and relationship to the beneficiary.
• Family and representative information: family contacts, caregivers, nominees, legal representatives, authority or consent records, and family dashboard permissions.
• Health and care information: health assessments, physical, cognitive, nutritional or functional needs, medication support records, prescriptions, reports, appointment details, visit notes, care plans, provider details, mobility information, caregiver observations, and other information submitted through an authorised care workflow.
• Account and security information: account identifiers, password and OTP status, authentication tokens, login history, device information, security settings, access permissions, and records of suspected misuse.
• Service information: enquiries, callback requests, care coordination records, tasks, communications, support requests, preferences, service status, and feedback.
• Payment and transaction information: selected plan, payment and order identifiers, billing status, subscription or renewal information, invoices, refund records, and related support notes. Payment card information is generally collected directly by the payment processor and is not intended to be stored by WELCOMEHEΛLTH.
• Care Guide information: messages, conversation identifiers, response metadata, source references, intent and safety indicators, redacted excerpts, and technical information needed to operate and secure the feature.
• Website and technical information: IP address, browser and device type, operating system, pages visited, searches, approximate location derived from IP, cookie identifiers, referral information, timestamps, and diagnostic or security logs.

We may receive personal data:

• directly from you or the beneficiary;
• from an authorised family member, caregiver, representative, employer, or organisation;
• from doctors, hospitals, laboratories, pharmacies, caregivers, or other providers where authorised;
• automatically from your device when you use the website;
• from payment, authentication, hosting, communication, and analytics providers;
• from public sources where permitted by law; or
• from social media platforms where you learn about our services.

If you provide information about another person, you confirm that you have the authority or lawful basis required to provide it. We may contact that person, request proof of authority, or restrict access where authority or consent is unclear, disputed, or withdrawn.

The beneficiary’s wishes and legal rights take priority where required by applicable law. Payment for a service does not automatically give a family member unrestricted access to the beneficiary’s information.

We use personal data to:

• respond to enquiries and explain available services;
• create and administer accounts, profiles, dashboards, and access permissions;
• conduct authorised health assessments and coordinate non-emergency care;
• arrange appointments, caregiver support, medication reminders, and provider interactions;
• provide visit notes, updates, and authorised family communications;
• process payments, subscriptions, invoices, renewals, and refunds;
• operate the Care Guide and provide human follow-up;
• verify identity, authority, consent, and family dashboard access;
• protect beneficiaries, users, staff, systems, and service integrity;
• detect fraud, misuse, security incidents, or unauthorised access;
• improve our website, services, and communications;
• comply with legal, regulatory, tax, accounting, and record-keeping obligations;
• establish, exercise, or defend legal claims; and
• any other purpose legally permissible under the applicable law.

Depending on the purpose, we rely on:

• Contract: where processing is necessary to provide a service you requested or take steps before entering a contract.
• Consent: for optional communications, non-essential cookies, and other processing for which consent is required.
• Legitimate interests: for service administration, requested family coordination, customer support, security, fraud prevention, service improvement, and legal claims, after considering the individual’s rights.
• Legal obligation: where processing is necessary to comply with applicable law.
• Vital interests: in exceptional circumstances where processing is necessary to protect someone’s life and another lawful basis is unavailable.

Health information may constitute special category data. Where GDPR or UK GDPR applies, we process it only where an additional lawful condition is available, such as explicit consent, protection of vital interests where the individual cannot consent, legal claims, or a legally permitted health or social-care condition.

You are not generally required by law to provide personal data. However, if information is necessary to verify authority, provide a requested service, process payment, or protect the beneficiary, we may be unable to proceed without it.

Where we rely on consent, we will request it in clear language for specified purposes. Consent must be given through an affirmative action and will not be assumed merely because you browse the website.

You may withdraw consent by contacting support@welcomehealth.life or using an available account or privacy setting. Withdrawal will not affect processing already carried out lawfully, but it may prevent us from continuing the related service.

Marketing consent and non-essential cookie consent will be requested separately from consent needed to provide a service.

We may disclose personal data only where reasonably necessary to:

• authorised family members, caregivers, or representatives;
• doctors, hospitals, laboratories, pharmacies, caregivers, and other service providers involved in the requested coordination;
• hosting, storage, authentication, email, communication, support, security, and technology providers;
• payment providers such as Razorpay;
• AWS services, including hosting, storage, operational infrastructure, and authentication services where configured;
• analytics providers for permitted public-page analytics;
• providers supporting Care Guide or model-assisted functions, where enabled and subject to applicable contractual controls;
• professional advisers, auditors, insurers, and legal representatives;
• regulators, courts, law-enforcement bodies, or government authorities where legally required; or
• a purchaser, investor, or successor in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality protections.

External medical and professional providers may process personal data under their own privacy notices and legal responsibilities. WELCOMEHEΛLTH does not control their independent clinical decisions or record-keeping practices.

We do not disclose health-related text, medical documents, account credentials, or payment information to public-page analytics services.

WELCOMEHEΛLTH operates from India, while users and family members may be located in other countries. Personal data may therefore be accessed or processed in India or other countries where our providers operate.

Where GDPR or UK GDPR transfer restrictions apply, we will use an approved transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or another legally recognised safeguard. You may contact us for information about the applicable safeguard.

Transfers from India will be made subject to restrictions or requirements imposed under applicable Indian law.

We may use essential cookies for security, authentication, session management, and website operation. With consent where required, we may use analytics cookies to understand public page visits and improve the website.

Google Analytics may be used on selected public pages. It is not intended to receive form contents, Care Guide messages, health-related text, account identifiers, payment information, or document metadata.

You may manage non-essential cookies through the available cookie settings or your browser. Rejecting non-essential cookies will not prevent access to essential website functions.

You can change your analytics choice at any time using the “Cookie settings” link in the site footer. We also honour Global Privacy Control signals sent by your browser and treat them as an opt-out from analytics.

The Care Guide may use automated or model assisted technology to understand questions, retrieve information, identify safety concerns, and prepare responses. Messages may be reviewed by authorised personnel for support, safety, and quality assurance.

The Care Guide is not a diagnostic or emergency tool. WELCOMEHEΛLTH does not use it to make solely automated decisions that produce legal or similarly significant effects concerning a person.

Do not submit urgent symptoms, complete medical records, passwords, OTPs, or payment card details through public forms or the Care Guide.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including:

• providing and administering Services;
• maintaining authorised account and family access;
• processing payments, refunds, and renewals;
• protecting security and preventing misuse;
• meeting tax, accounting, audit, and legal obligations; and
• resolving complaints or legal disputes.

When personal data is no longer required, we will delete or anonymise it, subject to legal retention requirements and the normal lifecycle of backups. Security and processing logs may be retained for the minimum period required by applicable law.

Retention periods may differ depending on the nature of the record, whether the account is paid or unpaid, the sensitivity of the information, and whether a dispute or legal hold applies.

We use reasonable administrative, technical, and organisational safeguards designed to protect personal data, including access controls, authentication measures, secure infrastructure, logging, restricted staff access, and vendor controls where appropriate.

No system is completely secure. If a personal data breach occurs, we will investigate and provide notifications to affected individuals or authorities where required by applicable law.

You are responsible for protecting passwords, OTPs, reset links, and devices used to access your account.

Depending on where you live and the law that applies, you may have the right to:

• obtain information about our processing of your personal data;
• request access to or a copy of your personal data;
• correct or complete inaccurate personal data;
• request deletion or erasure;
• withdraw consent;
• restrict certain processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests or direct marketing;
• request review of an automated decision, where applicable;
• nominate another person to exercise rights in the event of death or incapacity, where Indian law provides this right;
• submit a grievance or complaint; and
• receive equal service and treatment for exercising your privacy rights.

Rights are not absolute. We may decline or limit a request where permitted by law, including where retention is necessary for service delivery, legal compliance, security, billing, tax, disputes, or the rights of another person.

To exercise a right, contact support@welcomehealth.life. We may verify your identity, relationship to the beneficiary, and authority to make the request. An authorised representative may submit a request where permitted by law and supported by appropriate proof of authority.

India

Where the Digital Personal Data Protection Act, 2023 applies and the relevant provisions are in force, you may request information about processing, correction, completion, updating or erasure, submit a grievance, withdraw consent, and make a nomination as permitted by law.

Please first submit grievances to our Grievance Officer and we will respond within 48 hours.

WELCOMEHEΛLTH does not sell personal data for money or use sensitive personal data to infer characteristics for unrelated purposes. Where legally required, we will recognise applicable browser-based opt-out signals and provide any additional opt-out method required by law.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

Our website and Services are intended for adults. We do not knowingly permit a child to create an account independently.

If information about a person under 18 is required for an authorised family care service, we will seek verifiable consent from a parent or lawful guardian where required and apply any additional protections required by law.

Contact us if you believe a child’s information was provided without appropriate authority.

We may send service, account, security, billing, appointment, or care coordination communications where necessary to provide the Services.

We will send promotional communications only where permitted by law. You may unsubscribe using the link provided in the communication or by contacting us. Opting out of marketing will not stop essential service communications.

We may update this Policy to reflect changes in our Services, technology, vendors, or legal obligations. We will post the revised Policy with an updated date and provide additional notice where a material change requires it.

If a change requires new consent, we will request that consent before applying the new processing.

For privacy questions, rights requests, consent withdrawal, or grievances, contact:

Please do not include complete medical records, passwords, OTPs, or payment card details in your first message.