Privacy Policy

1Who we are and what this covers

Umesh Vegda Private Limited ("Eldrly", "we", "us") operates eldrly.in and the Eldrly platform, which connects families in India with verified doctors, nurses and caregivers, and rents medical equipment for use at home.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have. It is issued under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

By using the platform you confirm you have read this policy. Where the law requires your consent, we ask for it separately and you may withdraw it at any time.

2Data we collect

We collect only what we need to deliver care safely. This falls into four groups.

• Identity and contact data: your name, mobile number, email address, and the service address including building details, pincode, city and state.
• Location data: approximate coordinates, only when you choose to share your location to check service availability. You can decline; the platform still works.
• Health-related data: any patient condition, care requirement or clinical note you provide when booking, and information our care professionals record while delivering care. Under the SPDI Rules this is sensitive personal data and receives stricter handling.
• Care-partner data: for applicants joining as doctors, nurses or elder-care workers: name, age, sex, PAN, professional registration number, uploaded degree and registration certificates, and the language selected in the Partner app. Identity is proved through DigiLocker using Cashfree. If an authorised onboarding administrator requests a consented Aadhaar or PAN record for review, Cashfree may return identity fields to our server for that request; we mask the identifier before display, do not save the retrieved number or original card image, and restrict the preview to authorised administrators. The current Cashfree response provides verified fields, not a card image. We do not ask partners to type an Aadhaar number.
• Transaction data: bookings, orders, amounts, and payment status. We do not store your card number, UPI PIN, CVV or bank credentials at any point.

3Why we process your data

We process personal data for the purposes below, and no other purpose without asking you first.

• To create and secure your account, and verify your mobile number by OTP.
• To arrange, schedule and deliver the care or equipment you have booked, including assigning a suitable care professional.
• To process payments through our payment gateway and issue invoices.
• To verify the credentials and background of care professionals before they are approved, a safety measure we consider non-negotiable.
• To respond to your requests, complaints and grievances.
• To meet legal, tax and regulatory obligations, and to establish or defend legal claims.

4Sensitive personal data and health information

Health information is treated as sensitive personal data. We collect it only where it is necessary to deliver care safely, we share it only with the care professional assigned to you and authorised personnel who arrange and support that care, and we do not use it for advertising or profiling of any kind.

We do not sell personal data. We do not sell, rent or trade health information under any circumstance.

5Care partner location while on duty

This clause is about our care professionals rather than our customers, and it is stated plainly because location data about a working person is among the most sensitive data we hold.

When a care partner goes on duty in the Eldrly Partner app, the app records their approximate position so that we can offer them work near where they are and so that a family can be told a partner is on the way. Position is recorded only while they are on duty. Going off duty stops it.

A partner can see their own duty state at all times and controls it themselves. We do not track a partner who is off duty, we do not use location to monitor how a partner spends time away from work, and location is never shared with customers as a live position, a customer is told an estimated arrival, not where a person is standing.

Location history is retained for the period stated in the retention table below and is visible internally only to staff whose role includes dispatch. It is not used for any purpose other than matching work, supporting a visit in progress, and investigating a safety or billing dispute.

6Our mobile applications

Eldrly publishes the Eldrly Partner app for care professionals. This policy covers it in full, alongside the website. The app asks for the permissions below, each of which can be refused or later withdrawn in your device settings.

• Location, including background location: used only while you are on duty, to offer you nearby work and to tell a family you are on the way. Refusing it means you can still use the app but will not be offered location-matched work.
• Camera: used to take the attendance photograph at check-in, and to take a profile picture if you choose to. Photographs are taken only when you press the button; the app never opens the camera on its own.
• Photos and media: used only when you pick an existing picture as your profile photo, through the system picker, which hands the app the single file you chose and nothing else.
• Notifications: used to alert you to a job offer, a visit reminder or a payment. Job offers are time-critical, so an alert may show on your lock screen.
• We do not use advertising identifiers, we include no advertising or analytics SDK that profiles you, and we do not sell or share app data with data brokers.

7Deleting your account and your data

You may ask us to delete your account and the personal data held with it at any time, whether you signed up on the website or in the app.

Care partners can delete an account from inside the Eldrly Partner app: Profile, then Delete account. Anyone can instead write to contact@eldrly.in from their registered email address, quoting the mobile number the account uses. We verify the request is genuinely yours before acting on it, then delete the account within 30 days and confirm when it is done.

The full process, including exactly what is erased at once and what is retained, is set out at eldrly.in/delete-account.

• Deleted on request: your name, contact details, addresses, profile picture, saved preferences, device and notification tokens, and any location history held about you.
• Retained after deletion, because the law requires it: booking, invoice, payment and completed-visit records, and the records behind a care professional’s verification. These are kept for the periods set out in the retention section below and are not used for any other purpose.
• Deleting your account does not cancel an active booking or an outstanding payment. Cancel the booking first, so the refund rules apply and you are not left out of pocket.

8Who we share data with

We share personal data only with the following categories of recipient, and only as far as each needs it.

• The care professional assigned to your booking, your name, contact number, service address and relevant care requirements.
• Cashfree Payments, which processes the partner’s consented DigiLocker identity verification and, when an authorised administrator requests it, returns document fields for a masked onboarding preview.
• Razorpay Software Private Limited, our payment gateway, which processes payment instruments under its own privacy policy and RBI authorisation.
• Google Firebase, which delivers the OTP used to verify your mobile number.
• Our hosting provider, which stores the platform and its database on servers located in India.
• Government authorities, courts or law-enforcement agencies where we are legally required to disclose.

9Data storage, retention and security

Your data is stored on servers located in India. Access is restricted to authorised personnel, administrative accounts are individually credentialed, passwords are stored using industry-standard hashing, and identity documents uploaded by care professionals are kept outside the public web root and served only to authenticated administrators.

How long we keep each kind of record is set out below. "A reasonable period" is not a retention period, so these are stated as durations. Where a longer period is required by tax, accounting or limitation law, that longer period applies and we delete at the end of it.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

• Account and profile data: while the account is open, then 90 days after you close it.
• Booking and visit records, including care notes, 8 years from the end of the booking, the period Indian tax and limitation law requires for a service record that may be disputed.
• Payment records held by us (we never hold your card or bank credentials), 8 years, for the same reason.
• Care-partner verification records: while the partner is engaged with Eldrly and 3 years afterwards, so that a question about who attended a visit can still be answered.
• Care-partner location history: 12 months, then deleted.
• Check-in photographs: 12 months, then deleted.
• Support conversations: 3 years from the last message.
• Web server and access logs: 180 days.

10Your rights

Under the DPDP Act you have the following rights, which you may exercise by writing to us.

• The right to access a summary of the personal data we hold about you and how it is processed.
• The right to correction of inaccurate data, and completion or updating of incomplete data.
• The right to erasure of personal data where it is no longer needed for the purpose it was collected.
• The right to withdraw consent at any time, without affecting processing already carried out.
• The right to nominate another individual to exercise your rights in the event of death or incapacity.
• The right to grievance redressal, described in the final section.

11Children

The platform is intended for adults. We do not knowingly create accounts for individuals under 18. Where care is arranged for an elderly person by a family member, the account holder is the family member, who confirms they are authorised to share the patient’s information.

12Cookies and similar technologies

We use strictly necessary cookies to keep you signed in, to remember your cart, and to protect forms against cross-site request forgery. We do not use advertising or cross-site tracking cookies. Blocking necessary cookies will prevent sign-in and checkout from working.

13The lawful basis on which we process, and how to withdraw consent

Under the DPDP Act we are a Data Fiduciary and you are a Data Principal. We process your personal data on one of two bases only: the consent you give us, or a "legitimate use" that the Act itself permits.

Where we rely on consent, the notice we give you at the point of collection states what is being collected and for what purpose, and consent is asked for that purpose alone. You may withdraw it at any time, from your account, or by writing to the grievance address below, and withdrawing it is as easy as giving it was. Withdrawal is not retrospective: it does not make lawful processing that already happened unlawful, and it does not affect records we are required by law to keep.

If you withdraw consent, we stop processing for that purpose and erase the data unless another law requires us to retain it. Where the data is needed to complete a booking that is already under way, we will tell you what withdrawal will mean for that booking before it takes effect.

• Section 7(a): data you voluntarily give us for a purpose you have not objected to, such as the address you type to receive a visit.
• Section 7(f) and 7(g): a medical emergency involving a threat to life or immediate health, and the provision of medical treatment or health services during an epidemic or other threat to public health.
• Section 7(i): employment purposes, in relation to our own staff.
• Compliance with a judgment, decree, or an obligation under any Indian law, including tax, accounting and law-enforcement requests made through lawful process.

14Nominating someone to act for you

Section 14 of the DPDP Act gives you the right to nominate another individual to exercise your rights under the Act if you die or become incapable of exercising them yourself. Given who this service is for, we consider this right practically important rather than theoretical.

To record a nomination, write to grievance@eldrly.in with the nominee’s name and contact details. We will confirm the nomination in writing, and you may change or revoke it at any time.

15If personal data is breached

If a personal data breach occurs, we will inform the Data Protection Board of India and every affected Data Principal, in the form and within the time the DPDP Act and the rules under it require. We will tell you what happened, what data was involved, what we have done about it, and what you can do to protect yourself.

We also report cyber security incidents to CERT-In within six hours of noticing them, as directed under section 70B(6) of the Information Technology Act, 2000, and we retain the logs those directions require.

We will not delay telling you in order to complete an investigation first. A notice that says "we do not yet know the full extent" is more useful to you than a complete notice that arrives a month late.

16Processors and service providers

Where we engage another company to process personal data on our behalf; hosting, messaging, payments, mapping, push notification; we do so under a contract that limits them to our instructions, requires security measures at least equal to our own, and forbids them from using the data for their own purposes. Section 8(2) of the DPDP Act makes us answerable for what they do, and we do not treat that as transferable.

We do not sell personal data. We do not share it with data brokers, and we do not permit any processor to do so.

17Transfers outside India

We store personal data on servers located in India. Some of our processors, for example the providers of push notification and error monitoring, may process limited technical data outside India.

Where that happens, the transfer is made only to a country not restricted by the Central Government under section 16 of the DPDP Act, and under contractual safeguards. If the Government restricts a country we currently use, we will move the processing rather than seek an exception.

18Your duties as a Data Principal

Section 15 of the DPDP Act places duties on you as well, and we set them out because a penalty attaches to them.

• Do not impersonate another person when giving us personal data.
• Do not suppress material information when providing data for a document, identifier or proof of identity.
• Do not register a false or frivolous grievance or complaint with us or with the Board.
• Furnish only information that is verifiably authentic when exercising a right of correction or erasure.

19Grievances, and the right to escalate

Section 13 of the DPDP Act gives you the right to a readily available means of grievance redressal. Ours is the Grievance Officer named at the foot of this page. Write to grievance@eldrly.in; we acknowledge within 24 hours and respond within 15 days.

You must exhaust that route before approaching the Board, and we would rather you did; most complaints are a misunderstanding about what a screen showed. If we do not resolve it to your satisfaction, you may complain to the Data Protection Board of India, and appeal a decision of the Board to the Telecom Disputes Settlement and Appellate Tribunal.

None of this limits any separate right you have as a consumer, including the right to approach a District, State or National Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019.

20Changes to this policy

We may update this policy as the service or the law changes. The effective date at the top of this page will change, and material changes will be notified on the platform. This version is effective from 23 August 2026.