Privacy Policy

Last updated: June 2026

1. Who We Are

This Privacy Policy applies to Zap Private Limited ("Zap", "we", "us", "our"), the operator of Prime Care, including our website and mobile app. Zap Private Limited is a company incorporated in India (CIN: U69200KA2026PTC219594) with its registered office at No. 10, 8th B Cross Road, HAL III Stage, Jeevanbhimanagar, Bangalore North, Bengaluru, Karnataka 560075, India. We are committed to protecting your personal information and handling it responsibly in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA) and the Digital Personal Data Protection Rules, 2025.

2. Data We Collect

• Identity data: Full name, date of birth, PAN number (for KYC)
• Contact data: Mobile number, email address, residential address
• Family member data: Name, date of birth, relationship to you and mobile number of each family member you add to a Family plan, including children
• Health data: Plan selections, benefit utilisation records, consultation and prescription details, pharmacy and diagnostic bills, and annual health check-up results, shared with us by our benefits partner, [benefits partner name], and its network partners
• Financial data: Transaction IDs and payment confirmation records. We do not store card numbers, UPI IDs, or bank account details.
• Technical data: IP address, browser type, device information, app version, and pages or screens visited, collected through our website and app using standard analytics tools.

3. How We Use Your Data

• To activate and manage your Prime Care plan
• To verify your identity (KYC)
• To process payments and issue refunds
• To communicate plan updates, benefit reminders, and renewal notices
• To enable our benefits partner and its network partners to honour your benefit claims
• To comply with statutory, regulatory, and legal obligations
• To improve our products and services, using aggregated or de-identified data wherever possible

4. Legal Basis for Processing

We process your personal data only on the grounds permitted under the DPDPA:

• Consent: We ask for your consent when you buy a Prime Care plan, including your explicit consent to process the health data needed to provide your benefits. We also ask for your consent before sending you marketing messages.
• Legitimate uses: We process data you voluntarily give us for a specific purpose, such as activating your plan. We also process data where the law requires it, such as tax and accounting laws.

You may withdraw your consent at any time (see Section 7). Withdrawal does not affect processing carried out before it. If you withdraw consent that we need to deliver your benefits, we may not be able to continue your plan.

5. Data Sharing

We do not sell your personal data. We share data only with:

• Our benefits partner: to activate and manage your benefits
• Razorpay: solely for payment processing
• Network partners (clinics, labs, pharmacies): limited to transaction details required to honour your benefit claim
• Service providers who help us run Prime Care: cloud hosting ([hosting provider]), WhatsApp Business messaging (Meta) for OTPs and support, SMS and email delivery ([provider names]), and analytics (Google Analytics)
• Government and regulatory authorities: such as the Income Tax Department, courts or other statutory bodies, when required by law

All third parties are bound by confidentiality obligations. They may use your data only to provide services to us and are prohibited from using it for their own marketing purposes.

Your data is stored on servers located in [India / country]. Some service providers, such as Google Analytics, may process data outside India. Any such transfer complies with the DPDPA and any restrictions notified by the Government of India.

6. Data Retention

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires. When that period ends, we delete it or irreversibly anonymise it.

7. Your Rights (DPDPA 2023)

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access: request a copy of the personal data we hold about you, how we use it, and the list of parties we have shared it with
• Correction: request correction of inaccurate or incomplete data
• Erasure: request deletion of your data (subject to the retention periods in Section 6)
• Withdraw consent: withdraw any consent you have given us, as easily as you gave it
• Grievance redressal: raise a complaint with our Grievance Officer (see Section 12)
• Nominate: nominate an individual to exercise rights on your behalf in the event of death or incapacity
• Complain to the Data Protection Board: if you are not satisfied with how we resolve your grievance, you can complain to the Data Protection Board of India

To exercise any of these rights, email help@getprime.care with the subject line "Data Rights Request". We may ask you to verify your identity first. We will respond within 30 days.

To delete your account, follow the steps on Delete your account.

8. Data Security

We implement industry-standard security measures including TLS 1.2+ encryption for data in transit, AES-256 encryption for sensitive data at rest, access controls limited to authorised personnel, and regular security audits.

If a personal data breach affects your data, we will inform you without delay. We will explain what happened, the likely impact on you, what we are doing about it, and the steps you can take to protect yourself. We will also report the breach to the Data Protection Board of India and to CERT-In within the timelines set by law.

9. Cookies & Analytics

Our website uses essential cookies for functionality and, with your consent, analytical cookies (Google Analytics) to understand usage patterns. You can accept or reject analytical cookies through our cookie banner and change your choice at any time from [Cookie Settings]. You may also disable cookies in your browser settings. Rejecting non-essential cookies will not affect your ability to purchase or use a Prime Care plan.

10. Children's Privacy and Family Members

Prime Care Family plans may cover children as family members, but the plan holder must be an adult (18+). We do not knowingly collect personal data directly from individuals under 18 years of age. We collect a child's data only from their parent or lawful guardian, who gives verifiable consent on the child's behalf when adding them to the plan. We use a child's data only to provide their Prime Care benefits, and we do not track, profile or target advertising at children.

When you add an adult family member, you confirm that you have their permission to share their details with us. We will send them a notice by [WhatsApp / SMS] explaining how we use their data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website at least 30 days before they take effect.

12. Grievance Officer

If you have any concerns about how we handle your personal data, please contact our Grievance Officer:

[Full name], Grievance Officer
Email: help@getprime.care (subject line "Privacy Grievance")
Phone: +91 98862 73398

We will acknowledge your grievance within 48 hours and respond within 30 days.

13. Contact

Zap Private Limited
CIN: U69200KA2026PTC219594
Registered office: No. 10, 8th B Cross Road, HAL III Stage, Jeevanbhimanagar, Bangalore North, Bengaluru, Karnataka 560075, India
Email: help@getprime.care
Phone: +91 98862 73398

Zap Private Limited · help@getprime.care · Terms & Conditions