Protection of Personal and Health-Related Information

This Personal & Health Data Protection Policy explains how Prajeeva Healthcare Private Limited, operating under the brand name Prajeeva Healthcare Private Limited, approaches the protection of personal and health-related information processed through its preventive healthcare, wellness, digital health and related services.

Health-related information can be particularly private and consequential for individuals. Prajeeva Healthcare Private Limited therefore seeks to process such information for defined purposes, restrict access according to legitimate operational requirements, maintain appropriate safeguards, and respect rights available under applicable law.

This Policy supplements the Privacy Policy and should be read together with any service-specific privacy notice, consent form, programme terms or healthcare information notice presented to the individual.

This Policy applies where Prajeeva Healthcare Private Limited processes personal or health-related information in connection with its website, digital services, preventive healthcare programmes, wellness assessments, corporate wellness arrangements and other services through which such information is legitimately collected.

Depending on the relevant service, this may concern:

• Individual users and clients.
• Participants in preventive healthcare programmes.
• Participants in corporate wellness programmes.
• Individuals using health or lifestyle assessment features.
• Individuals accessing services facilitated through healthcare or diagnostic partners.
• Authorised representatives of users.
• Other individuals whose personal information is lawfully processed through a Prajeeva Healthcare Private Limited service.

The precise information collected and processing undertaken will depend on the service actually requested or used.

For the purposes of this Policy, personal data means information relating to an identifiable individual where that information falls within the scope of applicable data protection law.

Personal data processed by Prajeeva Healthcare Private Limited may include identity, contact, account, communication, transaction, technical or service-related information, depending on the nature of the interaction.

Prajeeva Healthcare Private Limited seeks to collect only information reasonably relevant to a defined service, operational requirement or lawful purpose.

Depending on the service requested, Prajeeva Healthcare Private Limited may process information relating to an individual's health, wellness, lifestyle or preventive healthcare requirements.

Such information may include, where genuinely required for the relevant service:

• Health and wellness information provided by the individual.
• Lifestyle and wellness assessment responses.
• Preventive health assessment information.
• Information associated with a health screening or diagnostic service.
• Reports or results shared by the individual or an authorised provider.
• Health-related preferences or programme information.
• Information required to facilitate an authorised healthcare service.

This list does not mean that Prajeeva Healthcare Private Limited collects every category described above from every user. Information is collected according to the particular service and its requirements.

Prajeeva Healthcare Private Limited seeks to apply the following principles when processing personal and health-related information:

Defined Purpose: Information should be collected and used for a clear and legitimate purpose.

Data Relevance: The information requested should be reasonably connected with the service or processing purpose.

Transparency: Individuals should receive appropriate information about how their personal data will be used.

Consent Where Required: Where processing depends on consent, an appropriate consent mechanism should be provided.

Access Control: Personal and health-related information should be accessible only to authorised persons and systems with a legitimate requirement.

Security: Reasonable technical and organisational safeguards should be maintained according to the nature and risks of the processing.

Retention Control: Personal data should not be retained indefinitely without a legitimate purpose or applicable retention requirement.

Accountability: Processing arrangements should be capable of appropriate internal oversight and compliance review.

Prajeeva Healthcare Private Limited processes digital personal data in accordance with applicable Indian law.

The principal framework is the Digital Personal Data Protection Act, 2023, which governs the processing of digital personal data for lawful purposes and establishes obligations for Data Fiduciaries and rights for Data Principals.

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. The Act and Rules follow phased commencement, meaning that different provisions become legally operative at different times. Prajeeva Healthcare Private Limited applies the requirements that are in force and applicable to the relevant processing activity at the relevant time.

Other Indian laws, regulatory requirements and professional obligations may apply depending on the particular healthcare service, technology, contractual relationship or processing activity involved.

Prajeeva Healthcare Private Limited may receive health-related information directly from an individual or, where appropriate, through an authorised representative, corporate programme, healthcare professional, diagnostic provider or other service provider.

Where information is obtained from another organisation, its use should remain consistent with the purpose for which it was lawfully provided and with the respective responsibilities of the organisations involved.

Prajeeva Healthcare Private Limited does not assume that participation in a general website interaction constitutes permission to process unrelated health information.

Where applicable to a requested service, personal and health-related information may be processed to:

• Administer preventive healthcare or wellness programmes.
• Support lifestyle or health risk assessments.
• Facilitate health screening or related services.
• Provide relevant programme information.
• Maintain service continuity and user records.
• Facilitate authorised interaction with healthcare or diagnostic partners.
• Respond to user enquiries or support requests.
• Manage corporate wellness participation.
• Maintain platform and information security.
• Meet applicable legal, regulatory or contractual requirements.
• Establish, exercise or defend legal rights where permitted.

Health-related information will not be treated as available for unrestricted use merely because it has been provided to Prajeeva Healthcare Private Limited for a particular service.

Where consent is the appropriate basis for processing, Prajeeva Healthcare Private Limited will seek consent relevant to the information and purpose involved.

A request for consent should identify the processing purpose sufficiently for the individual to make an informed choice. Consent obtained for a preventive healthcare service should not automatically be interpreted as consent for an unrelated purpose.

Where separate permission is appropriate for optional communications, cookies, third-party services or other distinct activities, separate choices may be provided.

Where legally available, consent may be withdrawn through the applicable process. The consequences of withdrawal may depend on whether the information remains necessary for another lawful purpose or retention requirement.

Prajeeva Healthcare Private Limited seeks to limit the collection of personal and health-related information to what is reasonably necessary for the relevant service or purpose.

Information collected for one purpose should not be repurposed for an unrelated activity without an appropriate legal basis and, where required, further notice or consent.

Users should avoid submitting medical records, diagnostic reports or other sensitive health-related information through general enquiry forms unless the form or service specifically requests that information.

The quality of a preventive healthcare or wellness service may depend on the accuracy and completeness of information supplied by the individual.

Users should provide information that is accurate to the best of their knowledge and update material information where the relevant service allows or requires this.

Prajeeva Healthcare Private Limited may provide mechanisms for correction or updating where appropriate and legally required. Prajeeva Healthcare Private Limited cannot independently guarantee the accuracy of information originally supplied by a user, healthcare provider, diagnostic provider or another authorised source.

Access to personal and health-related information should be restricted according to legitimate operational requirements.

Depending on the service, access may be provided to authorised Prajeeva Healthcare Private Limited personnel, technical service providers or healthcare-related service providers where reasonably necessary to perform their respective functions.

Access permissions should be appropriate to the nature of the information and the responsibilities of the person or organisation receiving access.

Personnel or providers should not access health-related information merely because they have general access to Prajeeva Healthcare Private Limited systems.

Certain Prajeeva Healthcare Private Limited services may involve independent healthcare professionals, diagnostic providers, laboratories, wellness providers or other healthcare-related organisations.

Where information must be shared to provide a service requested by the individual, Prajeeva Healthcare Private Limited will seek to limit disclosure to information reasonably necessary for that service.

An independent healthcare provider may have separate professional, statutory and privacy responsibilities concerning information processed within its own systems or services.

Users should review any separate privacy or consent notice provided by an independent provider where applicable.

Where Prajeeva Healthcare Private Limited provides a programme through an employer, institution or corporate client, participation in the programme does not by itself mean that the organisation is entitled to unrestricted access to an individual's health information.

Individual health-related information should be disclosed to an employer or institutional client only where there is an appropriate legal basis, valid authorisation or another lawful justification.

Where programme reporting is required, Prajeeva Healthcare Private Limited may use aggregated or appropriately de-identified information where suitable and legally permitted.

The information made available to a corporate client will depend on the programme structure, contractual arrangements, user permissions and applicable legal requirements.

Prajeeva Healthcare Private Limited may use service providers for technology infrastructure, hosting, communications, security, analytics, customer support, payment processing or other functions required to provide its services.

Where a service provider processes personal data on behalf of Prajeeva Healthcare Private Limited, appropriate contractual and security requirements should apply according to the nature of the processing.

Information provided to a service provider should be limited to what is reasonably required for its assigned function.

Where a third party independently determines how personal data is processed, its own privacy obligations and notices may also apply.

Prajeeva Healthcare Private Limited takes reasonable measures designed to protect personal and health-related information from unauthorised access, disclosure, misuse, alteration, loss or destruction.

Depending on the nature of the processing, safeguards may include:

• Access restrictions.
• Authentication controls.
• Role-based permissions where appropriate.
• Secure transmission and storage measures where technically applicable.
• System monitoring and logging.
• Security review and incident management procedures.
• Restrictions on internal access.
• Appropriate contractual requirements for service providers.
• Staff confidentiality and data-handling requirements.

Security measures are reviewed according to the nature of the information, available technology, operational requirements and risks associated with the processing.

No electronic system can be represented as entirely free from security risk.

Where Prajeeva Healthcare Private Limited identifies a suspected or confirmed personal data breach, the matter will be assessed according to its nature, scope and potential consequences.

Prajeeva Healthcare Private Limited may take steps to contain the incident, protect affected systems, investigate the cause, preserve relevant records and reduce the likelihood of recurrence.

Notifications to affected individuals, the Data Protection Board of India or another competent authority will be made where and when required by the applicable provisions of Indian law.

Personal and health-related information is retained for periods reasonably necessary for the purpose for which it was processed, subject to applicable legal, contractual, regulatory, accounting, security and dispute-resolution requirements.

Retention periods may differ according to the category of information and the service involved.

Where information is no longer required for the relevant purpose and no lawful retention requirement remains, Prajeeva Healthcare Private Limited may delete, anonymise or otherwise appropriately dispose of the information in accordance with applicable requirements.

Where an individual has a legally available right to request erasure, Prajeeva Healthcare Private Limited will assess the request according to applicable Indian law and the circumstances of the processing.

An erasure request may not require deletion where continued retention is required or permitted for legal compliance, establishment or defence of legal claims, security, fraud prevention, contractual records or another lawful purpose.

Where deletion is appropriate, reasonable measures will be taken to remove eligible information from applicable active systems in accordance with Prajeeva Healthcare Private Limited's data-management procedures.

Health-related information concerning children requires particular care.

Where Prajeeva Healthcare Private Limited knowingly provides a service involving a child, applicable age verification, parental or lawful guardian consent, and other safeguards will be applied where required by Indian law.

Prajeeva Healthcare Private Limited will not intentionally undertake processing involving children that is prohibited by applicable data protection requirements.

The specific controls applied may depend on the service and the legal provisions in force at the relevant time.

Ordinary website cookies should not be understood as automatically storing medical records, diagnostic reports or health assessments.

Prajeeva Healthcare Private Limited maintains separate cookie controls for necessary, functional, analytics and other optional technologies where applicable.

Advertising, analytics or targeting technologies should be assessed with particular care on pages or services involving health-related information. Cookie consent does not by itself authorise unrelated processing of personal health information.

Further information is available in the Cookie Policy and Cookie Settings & Consent Preferences.

Prajeeva Healthcare Private Limited does not treat consent to receive a healthcare or wellness service as automatic consent to use health-related information for unrelated marketing.

Where optional marketing communications require consent, the relevant preference or consent mechanism will apply.

Health-related information should not be used to create inappropriate advertising profiles or targeting criteria unless such processing is lawful, transparent and supported by the permissions and safeguards required under applicable law.

Prajeeva Healthcare Private Limited may use technology or service providers whose infrastructure involves processing outside India.

Where personal or health-related information is transferred or processed outside India, Prajeeva Healthcare Private Limited will consider applicable Indian requirements concerning cross-border processing and any restrictions or conditions legally applicable at the relevant time.

Appropriate contractual, privacy and security considerations will be applied according to the nature of the service provider and processing arrangement.

Where the relevant provisions are in force and applicable, individuals may have rights concerning their digital personal data under Indian law.

These may include rights relating to:

• Access to information concerning personal data processing.
• Correction of inaccurate or misleading personal data.
• Completion of incomplete personal data.
• Updating personal data.
• Erasure where legally available.
• Withdrawal of consent where processing relies on consent.
• Grievance redressal.
• Nomination in circumstances recognised by applicable law.
• Other rights available under applicable legislation.

The DPDP Act establishes a chapter dealing with rights and duties of Data Principals, subject to the statutory commencement schedule.

Individuals may submit eligible requests relating to their personal data through:

Email: enquiries@prajeeva.com

Prajeeva Healthcare Private Limited may request reasonable information to verify the identity of the individual and identify the relevant data or service before acting on a request.

Requests will be assessed in accordance with applicable Indian law, legitimate retention requirements and the circumstances of the processing.

Questions or concerns concerning the handling of personal or health-related information may be submitted to Prajeeva Healthcare Private Limited using the contact information below.

Prajeeva Healthcare Private Limited will review legitimate concerns and take appropriate action according to the nature of the matter and applicable legal requirements.

Nothing in this Policy prevents an individual from exercising a right to approach a competent authority where such a right is available under applicable Indian law.

Prajeeva Healthcare Private Limited may revise this Personal & Health Data Protection Policy to reflect changes in its services, technology, data-processing practices, healthcare arrangements or applicable legal requirements.

Where a change materially affects the purpose or basis of processing, Prajeeva Healthcare Private Limited will provide an appropriate notice or seek renewed consent where legally required.

The current version of this Policy will be published on the Prajeeva Healthcare Private Limited website.

This Policy is intended to operate consistently with applicable laws of India, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, to the extent their relevant provisions are in force and applicable. The Rules were notified on 13 November 2025 and contain phased commencement periods, including provisions scheduled one year and eighteen months after notification.

Nothing in this Policy is intended to waive, exclude or restrict a statutory right, protection or obligation that cannot lawfully be excluded.

This Policy should be read together with:

• Privacy Policy
• Data Protection & User Rights
• Terms & Conditions
• Medical Disclaimer & Health Advice Warning
• Cookie Policy
• Cookie Settings & Consent Preferences
• Diagnostic & Third-Party Healthcare Services Policy

For personal data, health information, privacy, consent or data protection enquiries:

Prajeeva Healthcare Private Limited

Email: enquiries@prajeeva.com
Phone: +91-95913-21052
Website: https://prajeeva.com
Office: Prajeeva Healthcare Private Limited, Units B-403 & B-404, 4th Floor, Garden of Eden by UKN, Pattandur Agrahara, Whitefield, Bengaluru – 560066, India.

If you have questions about this page or how your information is handled, reach out to our team directly.