Legal

Privacy Policy

Last updated: 26 October 2026

1. About this Policy

1.1

This Policy explains how CureZo collects and uses personal data and how you can control it. It covers the website at curezo.in (the Website) and the CureZo service offered through the Website, the CureZo app at app.curezo.in, our mobile apps and WhatsApp (the Service).

1.2

This Policy has two parts. Part A covers your visits to the Website. Part B covers the Service, including your account in the CureZo app.

1.3

We publish this Policy under section 43A of the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (the SPDI Rules). It is also written to meet the Digital Personal Data Protection Act 2023 (the DPDP Act) and the Digital Personal Data Protection Rules 2025 (the DPDP Rules) as their provisions come into force.

1.4

You can ask us for this Policy in English or in any language listed in the Eighth Schedule to the Constitution of India. Write to the contact in clause 21.

2. Who we are

2.1

CureZo is a brand of CureZo Health Private Limited, a company incorporated in India with CIN U62020TS2025PTC206778 and its registered office at 13th Floor, Building No. 9, Raheja Mindspace, Madhapur, Hyderabad, Telangana 500081 (CureZo, we, us or our).

2.2

For the personal data described in this Policy we act as the data fiduciary under the DPDP Act. This means we decide why and how the data is processed and we are responsible for it.

3. Key terms

In this Policy:

Member means the person whose health records are kept on the Service. This is usually an elderly parent.
Family User means a person the Member allows to see or add to the Member's records. This is usually a son or daughter.
Subscriber means the Family User who pays for the Service for a Member.
Health Records means prescriptions, lab reports, discharge summaries, scans, bills and any other medical documents given to us for a Member. It also means the values and dates we read from them.
Clinician means a registered medical practitioner who works with CureZo.
Processor means a company that processes personal data for us under a written contract and only on our instructions.

Part A: The Website

4. What we collect

4.1

No forms. The Website does not ask you for personal data. When you sign up or sign in you move to the CureZo app, and Part B of this Policy applies.

4.2

Technical data. When you visit the Website our hosting provider may record your IP address, browser type, the page you asked for and the time of the request in server logs. We use these logs only to run and secure the Website.

4.3

Cookies. The Website does not set cookies and does not use analytics, advertising or tracking tools. If we add any of these later we will update this Policy first and ask for your consent where the law requires it.

5. Why we use it

5.1

We use server logs only to run the Website, keep it secure and stop misuse.

5.2

We do not sell this data and we do not share it with anyone except our hosting Processor described in clause 12.3.

6. How long we keep it

6.1

We keep server logs only as long as we need them to run and secure the Website.

6.2

Early access list. Until 26 October 2026 the Website had an early access list. If you joined it, we will use your details once to tell you that CureZo is now available, and then delete them within 30 days of that message. You can ask us to delete them sooner by writing to the contact in clause 21.

Part B: The CureZo Service

7.1

Health Records are sensitive personal data under the SPDI Rules. Under the DPDP Act the person who gives consent for their personal data is the person the data is about. For the Service that person is the Member, not the Subscriber or any other Family User.

7.2

We will not collect or process any Member's Health Records until the Member has given consent. A Subscriber may start the process by inviting the Member. The Member then receives a notice from us, in a language they choose, that explains what we will collect and why. The Member gives consent by a clear action such as confirming a one-time password sent to their own phone. We keep a record of each consent.

7.3

Under the law in force today an adult child cannot give consent on behalf of an adult parent. If a Member cannot give consent because of a disability, consent may be given only by a lawful guardian appointed by a court, by a designated authority under section 15 of the Rights of Persons with Disabilities Act 2016 or by a local level committee under the National Trust Act 1999. We will ask for proof of that appointment.

7.4

The Member decides which Family Users can see their records and what each of them can do. The Member can change these choices or withdraw consent at any time. Withdrawing consent is as easy as giving it.

8. What we collect

8.1

About Family Users: name, phone number, email address, relationship to the Member and city and country of residence. We also keep account and login details.

8.2

About the Member: name, age or date of birth, sex, phone number, city, preferred language and any known health conditions the Family User or Member chooses to tell us. We also keep the consent record described in clause 7.2.

8.3

Health Records given to us by the Member or by a Family User with the Member's consent.

8.4

Information we create from Health Records: test names, values, units, reference ranges, dates, the name of the lab, hospital or doctor and the link between each value and the page it came from.

8.5

Messages and calls: messages you send us on WhatsApp, by email or in the app and notes of support calls.

8.6

Payment information: the plan you choose, payment status and invoices. Card, UPI and bank details are collected by our payment gateway. We do not see or store your full card number.

8.7

App and device data: device type, operating system, app version, crash reports and the camera and file access you allow so that you can scan or upload documents.

8.8

Activity logs: who opened, added, changed or shared a record and when.

9. How we collect it

9.1

We collect Health Records when:

you scan or upload documents in the app or on the Website;
you forward documents to the CureZo WhatsApp number +91 8099 840 840; or
you ask us to collect paper files and our staff pick them up from the Member's home.

9.2

Paper files. When our staff collect paper files they give a receipt that lists the documents taken. We scan the documents and return the originals to the Member within 7 days. We do not keep paper originals.

9.3

WhatsApp. Messages you send to our WhatsApp number pass through WhatsApp, which is run by Meta Platforms, and through our WhatsApp business messaging provider. WhatsApp's own terms and privacy policy also apply to those messages.

9.4

We will not collect Health Records from any other source, such as a hospital, a lab or a government health records system, unless the Member has first given consent for that source.

10. Why we use it

10.1

We use personal data only for these purposes:

to set up and run accounts for Members and Family Users;
to record and manage the Member's consent and access choices;
to read Health Records, check the values against the original documents and build the Member's timeline and trend charts;
to show Family Users the records and charts the Member allows them to see;
to prepare visit summaries and share them with a doctor when the Member allows it;
to send service messages such as "new report added" or "we need a clearer photo";
to collect payments and issue invoices;
to answer questions and complaints;
to improve the accuracy of our software using records from which identifying details have been removed, only if the Member has agreed to this, as set out in clauses 11.5 and 11.6;
to keep the Service secure, prevent misuse and fix faults; and
to meet our legal obligations.

10.2

We will ask for fresh consent before we use personal data for any purpose not listed above.

11. How Health Records are read and checked

11.1

Software reads first. We use software, including optical character recognition and AI models, to read documents and pick out dates, tests, values, medicines and providers.

11.2

People check every value. Trained CureZo staff compare what the software read with the original document and correct mistakes. Staff can see a record only when they need to check it. Every member of staff signs a confidentiality agreement and every access is logged.

11.3

Clinicians when needed. Where a record needs medical judgment, for example an unclear medical term, a Clinician may review it. The Clinician is bound by professional confidentiality.

11.4

No automated decisions about care. The Service does not diagnose, predict illness or recommend treatment. Software does not make any decision that affects the Member's care.

11.5

Improving our software. If the Member agrees, we use their Health Records to improve the accuracy of the software that reads documents. Before we use any record for this we remove the Member's name, contact details and other details that identify the Member. Only CureZo staff and our Processors bound by contract work on this data. We do not sell it or let any other company use it to train its own models.

11.6

Your choice. We ask the Member separately, with a box that is not ticked in advance, when they approve sharing. Saying no does not affect the Service. The Member can turn this on later by confirming a one-time password sent to their own phone, and can turn it off at any time without one, from the link we sent them or by writing to privacy@curezo.in. If the Member stops sharing their records, this ends too. After it is turned off we do not use that Member's records for this purpose again. As clause 17.4 says, turning it off does not undo use made lawfully before.

11.7

AI providers. Where an outside AI or OCR provider reads documents for us, it acts as our Processor. Our contract with it does not allow it to keep the documents or use them to train its own models.

12.1

Family Users the Member chooses. Each Family User sees only what the Member has allowed.

12.2

Doctors the Member chooses. We share a visit summary or records with a doctor only when the Member approves that sharing.

12.3

Processors. We host the Website and the Service on Amazon Web Services in Mumbai, India. We also use Processors for email delivery, WhatsApp business messaging, reading documents and payments. We will tell you the name of any Processor if you ask.

Each Processor works under a written contract that requires it to keep data secure, use it only on our instructions and delete it when the contract ends.

12.4

Authorities. We disclose personal data to a court, government agency or law enforcement authority only when the law requires it or a valid order directs it. Where the law allows we will tell the Member first.

12.5

Change of ownership. If CureZo is merged with or sold to another company, personal data may pass to that company. It will remain bound by this Policy and we will tell you before the transfer.

12.6

What we never do. We do not sell personal data. We do not show advertisements. We do not share Health Records with insurers, employers, pharmaceutical companies or data brokers.

13. Where data is stored

13.1

We store personal data on Amazon Web Services servers in Mumbai, India.

13.2

Family Users who live outside India can see the Member's records from where they live. Some Processors may process data outside India. Any transfer outside India will follow the DPDP Act and any restriction notified by the Government of India.

14. How we protect data

14.1

We protect personal data with technical and organisational measures that include:

encryption of data in transit and at rest;
access controls so that staff and Processors can see only what they need;
logs of who accessed what and when, which we monitor and review;
regular backups; and
security terms in every Processor contract.

14.2

No system is completely secure. If a breach happens we will act as described in clause 16.

15. How long we keep data

15.1

We keep a Member's Health Records while the Member's account is active.

15.2

If the Member withdraws consent or asks us to delete their data, we will delete it and tell our Processors to delete it within 30 days, except what the law requires us to keep.

15.3

The law requires us to keep some data for set periods even after deletion:

the record of consent and its withdrawal, so that we can show we acted lawfully;
access and processing logs for at least one year, as the DPDP Rules require; and
invoices and payment records for the period required by tax law.

15.4

If an account stays inactive for 3 years we will write to the Member and the Subscriber. If neither replies within 30 days we will delete the account.

16. Data breaches

16.1

If a personal data breach happens we will:

tell each affected person without delay, with what happened, the likely effect, what we are doing and what they can do to protect themselves;
report it to the Data Protection Board of India and send the Board a detailed report within 72 hours, as the DPDP Rules require; and
report cyber security incidents to CERT-In within six hours of noticing them, as its directions of 28 April 2022 require.

17. Your rights and how to use them

17.1

Members have the right to:

get a summary of the personal data we hold about them and how we use it;
know which Family Users, doctors and Processors we have shared it with;
correct, complete or update their data;
have their data erased;
withdraw consent;
nominate one or more people to use these rights on their behalf if they die or become unable to act; and
raise a grievance with us and, after that, complain to the Data Protection Board of India.

17.2

Family Users have the same rights over their own personal data, such as their name and contact details.

17.3

To use any right, go to the privacy settings in the app or write to privacy@curezo.in from the phone number or email address linked to the account. We may ask for proof of identity before we act. We will reply within 30 days.

17.4

Withdrawing consent does not affect anything we did lawfully before the withdrawal. After withdrawal we will stop processing the Member's data and the Member's records will no longer be available to Family Users.

18. Children

The Service is for adults. We do not knowingly collect personal data of anyone under 18. If we learn that we have done so we will delete it.

19. Your duties

Under section 15 of the DPDP Act you must not impersonate another person, give us false information or file false or frivolous complaints. Please make sure that the documents you send for a Member are that Member's own.

20. Changes to this Policy

We may change this Policy. We will post the new version on the Website with a new "Last updated" date. If a change affects how we use Health Records we will tell Members and Family Users by email, WhatsApp or in the app before it takes effect. Where the change needs fresh consent we will ask for it.

21. Grievance Officer and contact

21.1

If you have a question or complaint about your personal data, contact our Grievance Officer:

Name:: Sandeep G, Founder and Director
Email:: grievance@curezo.in
Phone and WhatsApp:: +91 8099 840 840
Address:: CureZo Health Private Limited, 13th Floor, Building No. 9, Raheja Mindspace, Madhapur, Hyderabad, Telangana 500081

21.2

We will acknowledge your complaint within 48 hours and resolve it within 30 days.

21.3

If you are not satisfied with our answer, you may complain to the Data Protection Board of India once the relevant provisions of the DPDP Act are in force.

22. Governing law

This Policy is governed by the laws of India.