PRIVACY POLICY

CrossCheckHealth — operated by Meintourje Educorp LLP

Last updated: 01/10/2026 Effective date: 01/10/2026 Version: 1.0

1. Introduction and Scope

1.1 This Privacy Policy ("Policy") describes how Meintourje Educorp LLP, a limited liability partnership incorporated under the Limited Liability Partnership Act, 2008, having its registered office at Plot No. 86 (Old No. 36), 1st Floor, Block-F, Pocket-4, Sector-16, Rohini, Delhi – 110085 (hereinafter "CrossCheckHealth", "Company", "we", "us", or "our"), collects, uses, stores, discloses, transfers, and protects personal data of users ("you", "User", "Data Principal") in connection with:

(a) the website https://crosscheckhealth.in; (b) any sub-domain, microsite, API, or service operated by the Company; and (c) any offline interaction linked to the foregoing (collectively, the "Platform").

1.2 This Policy is issued in compliance with:

(a) The Digital Personal Data Protection Act, 2023 ("DPDP Act"); (b) The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"); (c) The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("Intermediary Rules"); and (d) The Consumer Protection (E-Commerce) Rules, 2020.

1.3 By accessing or using the Platform, you confirm that you have read, understood, and consented to this Policy. If you do not agree, please do not use the Platform.

2. Data Fiduciary and Contact Details

2.1 The Company is the Data Fiduciary under Section 2(i) of the DPDP Act in respect of personal data processed through the Platform.

2.2 Grievance Officer / Data Protection Contact:

2.3 If the Company is notified as a Significant Data Fiduciary under Section 10 of the DPDP Act, we will appoint a Data Protection Officer ("DPO") and an Independent Data Auditor in accordance with the Act.

3. Categories of Personal Data Collected

3.1 Identification and contact data: name, email address, mobile number, password (stored as a salted hash), date of birth.

3.2 Health-related data ("Health Data"): age, sex, height, weight, body measurements, lifestyle responses (diet, sleep, activity, smoking, alcohol), self-reported family history, self-reported symptoms, assessment responses across heart, body composition, BMI, and other awareness tools, and the outputs generated.

3.3 Parent / Parivar Family Profile data: identification, contact, and Health Data of the adult family member submitted by you, subject to independent consent from that family member (see Clause 6).

3.4 Transaction data: subscription plan selected, payment status, invoice records, masked instrument metadata. We do not store full card or bank credentials; payments are processed by PCI-DSS compliant gateways.

3.5 Device and usage data: IP address, device identifier, browser type, operating system, referring URLs, pages viewed, clickstream, and cookie identifiers.

3.6 User-generated content: support messages, feedback, reviews, comments, images of product labels uploaded to the scanner.

3.7 Communications data: records of WhatsApp / SMS / email exchanges initiated by you with our support or grievance teams.

3.8 The Platform is intended for users aged 18 years and above. We do not knowingly collect personal data of children below 18 years. If we discover such collection, the data will be deleted and the account will be terminated.

4. Purposes of Processing and Legal Basis

4.1 We process personal data only for the following specified, lawful purposes (Section 4, DPDP Act):

(a) Account creation, authentication, and Platform access; (b) Generating personalised health-awareness insights, risk profiles, and reports; (c) Operating the ingredient/product scanner and product comparison tools; (d) Operating Parent and Family profiles (Parivar Health); (e) Subscription management, payment processing, and invoicing; (f) Customer support and grievance redressal; (g) Product improvement, algorithm validation, and research, using de-identified or aggregated data only; (h) Service-related communication (e.g., feature updates, security advisories) and, with separate opt-in, marketing communications; (i) Compliance with applicable law, court orders, and regulatory directions; (j) Detection, investigation, and prevention of fraud, abuse, and security incidents.

4.2 Legal basis for processing. All processing is based on the User's free, specific, informed, unconditional, and unambiguous consent obtained through an affirmative action (Section 6, DPDP Act), unless processing falls under "legitimate uses" enumerated in Section 7 of the DPDP Act (e.g., compliance with a court order, medical emergency, employment-related obligations).

4.3 Consent withdrawal. You may withdraw consent at any time through your account settings or by writing to admin@crosscheckhealth.in. Withdrawal will not affect the lawfulness of processing prior to withdrawal. Withdrawal may, however, render certain Platform features unusable.

5. Notice at the Time of Consent

5.1 Before or at the time of seeking your consent, we provide a separate, plain-language notice in English and, where available, in your selected Indian language, setting out:

(a) the personal data sought and the purpose of processing; (b) the manner of exercising your rights under Sections 11–14 of the DPDP Act; (c) the manner of making a complaint to the Data Protection Board of India.

5.2 A copy of every consent record is retained for audit and is available to you on request.

6. Parent and Parivar Family Profiles — Special Consent Architecture

6.1 When you add a Parent or Family profile, you confirm and warrant that:

(a) The profile is of an adult (≥18 years) and is not a child or a person with a disability requiring a lawful guardian; (b) You have a genuine relationship and a lawful basis to invite that person; (c) You will share the verifiable consent link with that person; and (d) You will not impersonate, coerce, or mislead the invitee.

6.2 No Health Data is processed for a Parent or Family profile until the invitee has independently and affirmatively consented through the secure verification link sent by the Company.

6.3 The invited family member is treated as an independent Data Principal. They may:

(a) access, correct, and erase their data; (b) withdraw consent; (c) make a grievance directly with the Company; (d) raise a complaint with the Data Protection Board of India; all by writing to admin@crosscheckhealth.in.

6.4 The Company maintains a verifiable consent ledger for each Parent and Family profile.

7. Sharing and Disclosure of Personal Data

7.1 We do not sell personal data.

7.2 We share personal data only with the following categories of recipients, under written contracts containing confidentiality, security, and data-protection obligations consistent with the DPDP Act:

7.3 Cross-border transfer. Personal data may be stored or processed outside India, except in countries that the Central Government may notify as restricted under Section 16 of the DPDP Act. We require contractual safeguards equivalent to Indian standards from overseas processors.

7.4 We maintain a current list of processors and sub-processors on request to admin@crosscheckhealth.in.

8. Data Retention

8.1 Personal data is retained only as long as necessary for the purposes specified in Clause 4 and any longer period required by law.

8.2 Indicative retention periods:

8.3 On account deletion, personal data is erased or anonymised within 30 days, except where retention is mandated by law. Aggregated or de-identified data may be retained indefinitely.

9. Your Rights as a Data Principal

9.1 Under Sections 11–14 of the DPDP Act, you have the right to:

(a) Access a summary of personal data being processed and the processing activities; (b) Correction, completion, updating, and erasure of personal data; (c) Grievance redressal by approaching the Grievance Officer; (d) Nominate another individual to exercise your rights in the event of death or incapacity; (e) Withdraw consent at any time, as easily as it was given.

9.2 To exercise these rights, write to admin@crosscheckhealth.in from the email registered with your account, or use the self-service option in your account settings.

9.3 We will respond within the timelines prescribed under the DPDP Act and Intermediary Rules.

9.4 User duties (Section 15, DPDP Act). You must not (i) furnish false or misleading information; (ii) impersonate another person; (iii) suppress material information; or (iv) register frivolous or false grievances. Violation may attract penalty under the DPDP Act.

10. Security Safeguards

10.1 We implement reasonable security practices and procedures, including:

(a) Encryption of Health Data at rest and in transit (TLS 1.2+ / AES-256); (b) Role-based access controls, least-privilege principle, and audit logging; (c) Multi-factor authentication for privileged personnel; (d) Periodic vulnerability assessments and penetration testing; (e) Secure software development lifecycle and code review; (f) Vendor and processor risk assessments; (g) Incident response plan, business continuity plan, and trained personnel.

10.2 Breach notification. In the event of a personal data breach, we will notify you and the Data Protection Board of India in accordance with Section 8(6) of the DPDP Act and any rules made thereunder.

11. Cookies and Tracking Technologies

11.1 We use cookies and similar technologies for purposes such as maintaining sessions, remembering preferences, security, and understanding Platform usage.

11.2 You may manage cookies through your browser settings and, where a cookie consent or preferences tool is provided on the Platform, through that tool. Disabling essential cookies may impair Platform functionality.

11.3 We do not engage in behavioural advertising or cross-site tracking on the Platform without your affirmative opt-in.

12. Affiliate and Sponsored Content

12.1 Certain product links and comparison results may be affiliate links, in which case we may earn a referral fee at no additional cost to you. Where applicable, the affiliate nature of such links or placements will be disclosed clearly to the User.

12.2 Affiliate placements do not influence our scoring methodology.

13. Children

13.1 The Platform is not directed at, and is not intended to be used by, individuals below 18 years of age. We do not knowingly process the personal data of children. If we become aware of inadvertent collection of a child's data, we will delete it and terminate the related account.

13.2 If you believe we may have collected a child's personal data, please contact admin@crosscheckhealth.in.

14. Google API Services and Gmail Integration

14.1 CrossCheckHealth may connect an authorised Google account using OAuth 2.0 for operational email functionality.

14.2 Where Gmail integration is enabled, CrossCheckHealth requests the https://www.googleapis.com/auth/gmail.send permission solely to send email messages on behalf of the authorised CrossCheckHealth Google account through the Gmail API.

14.3 CrossCheckHealth does not use this permission to read the authorised account's inbox, email history, contacts, or other unrelated Google Account data.

14.4 OAuth access tokens and refresh tokens may be securely stored and used only to maintain the authorised connection and perform the requested email-sending functionality. Google user data and OAuth credentials are not sold, used for advertising, or used to train generalized artificial intelligence or machine-learning models.

14.5 CrossCheckHealth's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

14.6 Access may be revoked at any time through the authorised user's Google Account security settings.

15. Changes to this Policy

15.1 We may update this Policy from time to time. Material changes will be notified by email and through a prominent notice on the Platform at least 15 days before they take effect.

15.2 Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

15.3 Prior versions are archived and available on request.

16. Governing Law and Jurisdiction

16.1 This Policy is governed by the laws of India.

16.2 Subject to the dispute-resolution clause in the Terms of Use, courts at Delhi shall have exclusive jurisdiction.

17. Contact Us

For privacy-related questions, requests, or complaints:

• Grievance Officer: Mohd Zaid Usmani — admin@crosscheckhealth.in
• Phone: +919540023300
• Postal: Meintourje Educorp LLP, Plot No. 86, 1st Floor, Block-F, Pocket-4, Sector-16, Rohini, Delhi – 110085, India

You also have the right to lodge a complaint with the Data Protection Board of India once operational.

This Privacy Policy should be read together with the Terms of Use. Additional policies may be published from time to time.