How CureNexis collects, uses, and protects your personal and health information.
CureNexis (operated by CureNexis Technologies Private Limited, hereinafter "we", "us", or "our") is committed to protecting the privacy and security of your personal data, including sensitive health information. This Privacy Policy applies to all users of our platform, website, and mobile applications in India.
This policy is prepared in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000 and its amendments, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and guidelines issued by the National Health Authority (NHA) under the Ayushman Bharat Digital Mission (ABDM).
We collect the following categories of data to provide our services:
Personal Identification Data:
Health & Medical Data (Sensitive Personal Data):
Usage & Technical Data:
Communication Data:
We use your data only for legitimate purposes directly related to providing our healthcare platform services:
We will never use your health information for advertising or sell it to third parties for commercial purposes.
We do not sell your personal data. We share data only in the following limited circumstances:
All data shared with third parties is governed by data processing agreements that require equivalent levels of data protection.
We implement industry-standard technical and organisational measures to protect your data:
In the event of a data breach that is likely to affect your rights and freedoms, we will notify the Data Protection Board of India and affected users as required under the DPDPA.
Under the Digital Personal Data Protection Act, 2023, you have the following rights:
To exercise any of these rights, please contact our Data Protection Officer at [email protected] with the subject line "Privacy Request".
We retain your personal data for as long as your account is active or as needed to provide services. Health records are retained in accordance with applicable Indian regulations, including the Clinical Establishments Act and guidelines from the Medical Council of India, which generally require a minimum of seven (7) years for medical records. You may request deletion of non-mandatory data at any time.
Our platform may be used for managing health records of minors (persons below 18 years of age) by a parent or legal guardian acting as their representative. We require verifiable parental consent before processing data of minors. We do not knowingly collect data from children without such consent.
We may update this Privacy Policy from time to time to reflect changes in law, our practices, or platform features. We will notify you of material changes via email or a prominent notice on our platform at least 15 days before the change takes effect. Continued use of the platform after that period constitutes acceptance of the revised policy.
If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact:
Data Protection Officer — CureNexis
Email: [email protected]
Response time: Within 30 days of receiving your request
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is constituted under the DPDPA, 2023.