Privacy Policy & Digital Personal Data Protection (DPDP) Notice
iHealthCard ("we", "us", or "our") is dedicated to safeguarding your personal health information. This Privacy Policy serves as the statutory notice required under Section 5 of the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) and applicable rules under the Information Technology Act, 2000.
1. Data Fiduciary Information
Under the DPDP Act 2023, iHealthCard acts as the Data Fiduciary responsible for determining the purpose and means of processing your personal data.
Customer Support Desk: support@ihealthcard.in
Website: https://ihealthcard.in
2. Personal Data We Collect & The Specific Purpose of Processing
In strict adherence to the principles of purpose limitation and data minimization (Section 6, DPDP Act 2023), we only collect data necessary to provide rapid emergency identification and first-responder notification:
| Category of Data | Data Items Collected | Lawful Purpose (DPDP Sec 6) |
|---|---|---|
| Account Identity | Name, Mobile Number (E.164), Email, Hashed Password | Authentication, account management, SMS OTP login verification. |
| Emergency Medical Profile | Blood group, birth year, self-reported allergies, medical conditions, medications, emergency summary | Display on public QR emergency profile for first responders upon physical scan. |
| Emergency Contacts | Contact person name, relationship, phone number | Direct dial and automated SMS emergency alerting during incident response. |
| Emergency Scan Location | GPS coordinates (opt-in only), Device IP digest, User Agent | Transmitted exclusively to emergency contacts to locate the cardholder during crisis; abuse prevention. |
| Financial & Payment Data | Transaction Reference, Amount Paid, Order ID (Raw card & UPI details processed exclusively by Cashfree) | Processing subscription memberships and PVC physical card issuance. |
3. Technical & Organizational Safeguards (Section 8(5))
We implement industry-grade technical and cryptographic security measures to prevent unauthorized access, accidental alteration, or disclosure:
- Field-Level Encryption: Sensitive medical details and contact numbers are encrypted in our database using AES-256 cipher suites.
- Cryptographic Blind Indexing: Phone numbers are hashed using irreversible HMAC blind indices to prevent plain-text enumeration and database exposure.
- Granular Disclosure Toggles: Cardholders have complete control over what is visible during an emergency scan (e.g., hiding or showing allergies, conditions, or specific phone numbers).
- Zero Commercial Data Sale: We never sell, monetize, or rent personal health data to pharmaceutical companies, insurance providers, or advertisers.
4. Authorized Third-Party Processors & Payment Gateway
We partner only with vetted, compliant third-party data processors acting under strict contractual terms:
- Cashfree Payments India Pvt. Ltd.: As an RBI-authorized Payment Aggregator, Cashfree processes card, UPI, and net-banking transactions in a PCI-DSS certified environment. iHealthCard does not receive or store full card numbers, CVVs, or bank credentials.
- SMS Gateway Providers (TRAI Compliant): Used solely to deliver OTPs and urgent emergency alerts to family contacts.
- Logistics & Couriers: Name and delivery address are shared with national courier partners (e.g., India Post, Delhivery, Bluedart) solely for PVC card dispatch.
5. Rights of the Data Principal (Section 11, 12 & 13)
Under the DPDP Act 2023, you (the Data Principal) possess enforceable statutory rights:
6. Processing Data of Children & Persons with Disabilities (Section 9)
In compliance with Section 9 of the DPDP Act 2023, iHealthCard does not knowingly allow minors under 18 years of age to register independent accounts. Cards for children or dependent family members must be created and managed by an adult parent or lawful guardian who provides verifiable consent on their behalf. We do not engage in behavioral tracking or targeted advertising directed at children.
7. Designated Grievance Officer (Section 13, DPDP Act 2023)
If you have any questions, privacy concerns, or wish to exercise your rights under the DPDP Act 2023, you can write directly to our designated Grievance Officer:
Designation: Data Protection & Compliance Lead
Email: grievance@ihealthcard.in (cc: support@ihealthcard.in)
Response Timeline: Acknowledgement within 48 hours; resolution within 30 days.
Appellate Authority: If unresolved, you may file a complaint with the Data Protection Board of India.