Privacy Policy

Passionwave Technologies Pvt Ltd ("Passionwave", "we", "us", or "our"), with its registered office at Mumbai, Maharashtra, India, operates passionwave.health (the "Platform"), a multi-vertical marketplace connecting users with independent healthcare, psychology, legal, and lifestyle professionals.

We are committed to protecting your privacy and handling your personal data responsibly and in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian laws. By using the Platform, you consent to the practices described in this Privacy Policy.

We collect the following categories of personal data, depending on how you use the Platform:

• Account data: your name, email address, mobile number, password (stored in hashed form), profile photo, preferred language, and account preferences.
• KYC verification data: only your verification status and the result of identity checks (e.g. verified / not verified). We do not store your Aadhaar number. Aadhaar-based verification is performed through our KYC provider, and only the verification outcome is returned to and retained by us.
• Health and consultation data: information you share before, during, or after a consultation, including symptoms, appointment details, consultation notes, prescriptions, and uploaded documents. This is sensitive personal data and is treated with heightened safeguards.
• Payment data: transactions are processed by our payment partner, Razorpay. We do not store your full card number, CVV, or banking credentials. We retain transaction identifiers, amounts, status, and invoice records.
• Usage and device data: IP address, browser type, device identifiers, pages visited, and interaction logs, collected to operate and secure the Platform.

We process your personal data for the following purposes:

• To create and manage your account and authenticate you.
• To connect you with independent professionals and facilitate consultations and bookings.
• To verify your identity where required by law or for the safety of the marketplace.
• To process payments, issue invoices, and manage refunds through Razorpay.
• To provide customer support and respond to your queries and grievances.
• To improve, secure, and maintain the Platform and detect fraud or misuse.
• To send service-related and, where you have consented, promotional communications.
• To comply with legal, regulatory, and tax obligations.

Under the DPDP Act, we process your personal data on the basis of the consent you provide when you register and use the Platform, and for certain legitimate uses permitted by law, such as fulfilling a service you have requested, complying with legal obligations, and responding to medical or safety emergencies.

Where processing relies on your consent, you may withdraw that consent at any time, subject to legal and contractual restrictions. Withdrawing consent may limit your ability to use certain features.

Your personal data is stored on Amazon Web Services (AWS) infrastructure located in the Mumbai region (ap-south-1), within India. We use database-level safeguards including row-level security (RLS) to enforce tenant isolation and restrict access to authorised parties only.

We do not transfer your personal data outside India except where strictly necessary and permitted under applicable law, and subject to appropriate safeguards.

We share personal data only as necessary to deliver our services, and with the following categories of recipients (Data Processors), who are bound by contractual confidentiality and security obligations:

• Razorpay — for processing payments, refunds, and settlement.
• SurePass — for KYC and identity verification (Aadhaar OTP, PAN, face match, professional licence checks) and for Aadhaar e-Sign / multi-party consent artefacts.
• Healthcare and other professionals — the independent professionals you choose to consult, who receive only the information necessary to provide their services to you.
• Cloud and infrastructure providers (AWS) — for hosting and storage within India.
• Government, regulatory, or law-enforcement authorities — where required by applicable law or valid legal process.

We do not sell your personal data to third parties.

We use cookies and similar technologies to keep you signed in, remember your preferences, secure your session, and understand how the Platform is used. Essential cookies are required for the Platform to function. You can manage non-essential cookies through your browser settings; disabling certain cookies may affect functionality.

As a Data Principal under the DPDP Act, 2023, you have the right to:

• Access — obtain a summary of the personal data we process about you.
• Correction — request correction or updating of inaccurate or incomplete data.
• Erasure — request deletion of your personal data where it is no longer required and there is no legal obligation to retain it.
• Grievance redressal — raise a complaint about how your data is handled (see our Grievance Officer details below).
• Nominate — nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, contact our Data Protection Officer using the details in the Contact section.

We retain your personal data only for as long as your account is active or as needed to provide our services, and thereafter only as required to comply with legal, accounting, tax, and regulatory obligations or to resolve disputes. Consultation and health records may be retained for the period mandated by applicable medical and record-keeping regulations. When data is no longer required, it is securely deleted or anonymised.

We implement industry-standard technical and organisational measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest.
• Row-level security (RLS) in our databases to enforce strict tenant and user isolation.
• Role-based access controls and the principle of least privilege.
• Append-only audit logging of sensitive operations.
• Regular security reviews and monitoring for unauthorised access.

While we take reasonable steps to protect your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Platform is intended for users aged 18 years and above. We do not knowingly collect personal data from children without verifiable parental or guardian consent as required under the DPDP Act. If we learn that we have collected a child's data without the required consent, we will take steps to delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the revised policy on this page with an updated "Last updated" date, and where required, notify you of material changes.

For any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact our Data Protection / Grievance Officer:

• Data Protection / Grievance Officer: Mr. Rajesh Kumar
• Email: grievance@passionwave.health
• Postal address: Passionwave Technologies Pvt Ltd, Mumbai, Maharashtra, India

We will acknowledge your request within 48 hours and respond within the timelines prescribed under applicable law.