Privacy Policy

Cadupius Healthassist Pvt. Ltd. ("Cadupius", "we", "us" or "our") respects the privacy of patients, attendants, representatives, Medical Tourism Agencies and other individuals or organisations that contact us or submit information in connection with healthcare and medical tourism enquiries.

Cadupius is a medical tourism and healthcare facilitation organisation. We assist patients with healthcare enquiries, treatment evaluation, hospital and doctor coordination, cost estimates, medical travel planning and related facilitation services. Cadupius is not itself a hospital and does not independently provide medical diagnosis or treatment.

This Privacy Policy explains how we collect, use, store, share and protect personal information and personal data provided through our website, enquiry forms, WhatsApp-assisted enquiry channels, email, telephone or other authorised communication channels, including information submitted by Medical Tourism Agencies and other authorised representatives.

Where consent or another affirmative privacy confirmation is required, Cadupius may provide a separate channel-specific Privacy Notice or consent request. This Privacy Policy supplements such notice and should not be treated as a substitute for any specific notice or consent mechanism required by applicable law.

This Policy is intended to operate in accordance with applicable Indian data-protection and information-technology law as in force from time to time. References to "personal information" or "personal data" are intended to cover the relevant statutory terminology where applicable.

1. Information We Collect

Depending upon the nature of your enquiry, Cadupius may collect the following categories of information:

Personal and Contact Information

• Full name;
• Mobile or WhatsApp number;
• Country of residence;
• Email address, where voluntarily provided;
• Preferred communication details; and
• Other information necessary to identify or communicate with you.

Healthcare Enquiry Information

We may collect information relating to the healthcare assistance requested by you, including:

• Treatment or specialty required;
• Description of the medical condition or treatment requirement;
• Relevant medical history voluntarily provided;
• Preferred hospital, doctor or location, where applicable; and
• Information necessary for treatment evaluation, quotation or medical travel coordination.

Medical Documents

Where medical-document attachment functionality is enabled, you may choose to provide medical documents such as medical reports, prescriptions, investigation reports, discharge summaries or other healthcare-related records. Health-related information and medical records may constitute sensitive personal data or information under applicable law.

Cadupius will process such documents only for purposes connected with the relevant healthcare enquiry and related facilitation services, or for another lawful purpose permitted or required by applicable law.

Communication Records

We may maintain records of communications made through our website, telephone, WhatsApp, email or other communication channels for purposes such as enquiry management, patient coordination, quality assurance, security, audit and responding to requests.

Information Submitted by Medical Tourism Agencies and Authorised Representatives

Cadupius may receive patient information and medical documents from Medical Tourism Agencies, medical tourism facilitators, attendants, family members, representatives or other persons acting in connection with a patient's healthcare or medical tourism enquiry.

Where information is submitted by a Medical Tourism Agency or other representative, the submitting party confirms, through the applicable Agency Authorisation and Privacy Confirmation or other applicable mechanism, that it is authorised to provide the relevant information to Cadupius for the healthcare and medical tourism facilitation purposes described in this Privacy Policy and the applicable Privacy Notice.

An Agency Authorisation and Privacy Confirmation establishes the submitting party's representation concerning its authority to submit information. It does not, by itself, replace any patient-specific consent, notice, parental consent, guardian authorisation or other requirement that applicable law requires Cadupius or the submitting party to satisfy.

Where Cadupius relies upon the consent of a patient or other Data Principal as a basis for processing, Cadupius may require that the patient has received the applicable Cadupius Privacy Notice and given the required affirmative consent either directly to Cadupius or through a documented process that Cadupius is entitled to rely upon. Cadupius may request evidence of such notice, consent or authority where reasonably necessary or legally required.

Where information relates to a child or minor, additional requirements described in Section 8 apply.

Consent, Authorisation and Privacy Records

We may maintain records demonstrating:

• The consent, authorisation, confirmation or other affirmative action provided;
• Authorisation to submit, process or share medical information;
• Where applicable, a Medical Tourism Agency's confirmation that it is authorised to submit patient information;
• Where applicable, evidence or confirmation relating to required parent or lawful-guardian consent for child/minor information;
• The version of the Privacy Notice or consent/confirmation text presented;
• The date and time of the consent, authorisation or confirmation;
• The channel or source through which it was provided, such as WhatsApp or the website;
• Relevant message, transaction, submission or enquiry reference information where available;
• Withdrawal, modification, supersession or reconfirmation of consent or authorisation; and
• Privacy or data-rights requests submitted.

We seek to collect only information that is reasonably necessary for the purpose for which it is requested.

2. How We Use Your Information

Cadupius may process personal information for one or more of the following purposes, subject to the consent, authorisation or other lawful ground applicable to the circumstances:

Healthcare Enquiry Management

To receive, review, register and respond to healthcare or medical tourism enquiries, including enquiries submitted by Medical Tourism Agencies and authorised representatives.

Treatment Evaluation and Cost Estimation

To facilitate treatment evaluation, obtain preliminary medical opinions, treatment plans, expected treatment costs or quotations from suitable healthcare providers where requested and authorised.

Hospital and Doctor Coordination

To identify and coordinate with appropriate hospitals, doctors or healthcare providers based upon the relevant healthcare requirements.

Patient and Representative Communication

To contact the patient, Medical Tourism Agency or authorised representative regarding an enquiry, clarify information, provide updates and coordinate the next steps in the healthcare journey.

Medical Travel Facilitation

Where requested, to assist with services connected with medical travel, which may include medical visa support, hospital appointments, travel planning, airport transfers, accommodation coordination and related facilitation.

Privacy, Consent and Authorisation Management

To present Privacy Notices, obtain and record consent, Agency Authorisation and Privacy Confirmations or other affirmative confirmations through authorised digital or communication channels, maintain versioned evidence, process withdrawal requests and respond to privacy, correction, access, erasure, nomination or grievance requests.

Where a Medical Tourism Agency has provided an active Agency Authorisation and Privacy Confirmation for the stated healthcare and medical tourism facilitation purposes, Cadupius may rely upon that confirmation as evidence of the Agency's represented authority for subsequent submissions made by that Agency for the same stated purposes. This does not remove any patient-specific notice, consent or other legal requirement that applies to a particular submission.

A fresh or renewed Agency confirmation may be requested where the Agency withdraws its confirmation, the relevant purpose materially changes, the applicable Privacy Notice is materially updated, Cadupius changes the authorised submission process, or applicable law otherwise requires reconfirmation.

Security, Audit and Fraud Prevention

To protect our website, systems, records and communication channels from unauthorised access, misuse, fraud, cyber incidents or other security threats, and to maintain records reasonably necessary for security, audit and accountability.

Legal and Regulatory Requirements

Where necessary, information may be processed, disclosed or retained to comply with applicable laws, regulatory requirements, lawful governmental requests, court or tribunal orders, or for the establishment, exercise or defence of legal rights or claims.

Cadupius will not use medical information submitted for a healthcare enquiry for an unrelated purpose without an appropriate lawful basis or authorisation where required.

3. Sharing With Hospitals, Doctors and Healthcare Providers

Medical tourism facilitation may require relevant patient information to be communicated to hospitals, doctors or other healthcare providers for purposes such as:

• Reviewing the patient's medical condition;
• Evaluating treatment options;
• Obtaining a medical opinion;
• Preparing an estimated treatment plan;
• Providing a treatment quotation;
• Scheduling consultations or admission; and
• Coordinating the patient's healthcare journey.

Cadupius will share such information only where the necessary consent, authority or other lawful basis has been established for the relevant purpose, and only to the extent reasonably necessary for that purpose.

Where information is submitted through a Medical Tourism Agency, Cadupius may rely upon the Agency's recorded representation concerning its authority to submit the information, but may require additional patient-specific evidence or confirmation before onward sharing where required by law, by Cadupius' process, or by the receiving healthcare provider.

We endeavour to avoid sharing information that is unrelated or unnecessary for the requested treatment evaluation or healthcare facilitation.

Hospitals, doctors, diagnostic centres and other independent healthcare providers receiving patient information may act as independent recipients and may process that information in accordance with their own professional, statutory and privacy obligations.

Providing information to Cadupius does not create a doctor-patient relationship between the patient and Cadupius. Medical opinions, diagnosis, treatment decisions and clinical advice remain the responsibility of appropriately qualified healthcare professionals.

4. Service Providers and Data Processors

Cadupius may use technology, hosting, communication, cloud, messaging, IT support or other service providers to support the operation of our website, systems and healthcare facilitation services.

Where a service provider acts as a Data Processor or otherwise processes personal information on behalf of Cadupius, Cadupius will engage that provider under a valid contract where required by applicable law and will include or seek appropriate provisions relating to authorised processing, confidentiality and reasonable security safeguards.

Service providers are expected to process personal information only for authorised purposes and in accordance with the services they provide, applicable contractual terms and applicable law.

Cadupius remains responsible for obligations imposed upon it by applicable law in respect of processing carried out on its behalf. Nothing in this Privacy Policy should be interpreted as Cadupius guaranteeing the independent systems, operations or conduct of a third-party service provider beyond obligations applicable to Cadupius and the contractual arrangements reasonably available to it.

5. Retention and Deletion

Cadupius follows a limited-retention approach and does not intend to retain patient medical-enquiry information indefinitely.

Standard Three-Year Outer Retention Period

As an administrative outer limit, Cadupius ordinarily intends that identifiable records connected with a healthcare or medical tourism enquiry will not be retained for more than three years from the date the enquiry is closed or from the last meaningful interaction recorded in Cadupius' systems in relation to that enquiry, whichever is later, unless a longer period is permitted or required for a lawful reason.

The three-year period is not an automatic minimum retention period for every medical document or item of personal data. Where the specified purpose has been completed earlier, consent is validly withdrawn, or the information is otherwise no longer required, eligible personal data will be erased or anonymised earlier unless retention remains necessary or permitted for compliance with law, security, audit, grievance handling, prevention or investigation of misuse, or establishment, exercise or defence of legal rights or claims.

For purposes of administering retention, Cadupius may rely upon dates and activity recorded within its authorised systems. Communications or interactions occurring outside Cadupius' systems that are not communicated to or recorded by Cadupius may not alter the system-calculated retention period.

Earlier Deletion

Information may be deleted earlier where:

• The purpose for which it was collected has been completed and no lawful retention ground remains;
• The relevant consent is withdrawn and no other lawful basis permits or requires continued processing;
• A valid erasure request is approved; or
• Cadupius otherwise determines that continued retention is unnecessary.

Information That May Be Retained for Longer

Certain limited information may need to be retained beyond the standard period where reasonably necessary or required for:

• Compliance with applicable law or a lawful direction;
• Security monitoring and cybersecurity records;
• Audit and system logs;
• Establishing that valid consent, confirmation or authorisation was obtained;
• Maintaining records of consent withdrawal, reconfirmation or supersession;
• Processing and evidencing privacy requests or grievances;
• Prevention, investigation or remediation of security incidents or misuse;
• Establishment, exercise or defence of legal rights or claims; or
• Compliance with lawful requests from competent authorities.

Where a statutory minimum retention requirement applies to particular logs, processing records or personal data, Cadupius will retain the relevant information for at least that period. Where a longer period is legally required or otherwise lawfully necessary, Cadupius will retain only the information reasonably necessary for that purpose and dispose of it when the requirement ends.

Backups

Personal information may temporarily remain within secured backup or recovery systems after deletion from active systems where such functionality exists within the relevant technology architecture. Such information will not ordinarily be restored for routine business use and will be removed through the applicable backup-retention or deletion cycle, subject to technological limitations and applicable legal and security requirements.

6. Security of Personal and Medical Information

Cadupius recognises that healthcare-related information requires careful handling. We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, loss, misuse, alteration, destruction and other forms of unauthorised processing.

Depending upon the system, technology architecture and nature of the information involved, safeguards may include:

• Role-based or otherwise restricted system access;
• Authentication and administrative access controls;
• Secure server, hosting and network configurations;
• Encryption, masking, tokenisation or other appropriate protection for information in transit or storage, where appropriate;
• Logging, monitoring and review of system access;
• Security patching, configuration review and vulnerability management, where applicable;
• Controlled access to uploaded medical documents;
• Business-continuity, backup or recovery measures appropriate to the relevant system;
• Confidentiality requirements for personnel; and
• Appropriate security obligations for service providers and Data Processors.

Access to patient information should be limited to authorised personnel who require such access for legitimate business purposes.

No electronic transmission or storage system can be guaranteed to be completely secure. Cadupius will nevertheless take reasonable measures appropriate to the nature of the information processed and will respond to suspected personal-data breaches and security incidents in accordance with applicable law.

7. Your Privacy Choices and Data Rights

Cadupius provides mechanisms to manage personal information and permissions previously provided to us. Rights may differ depending upon the law applicable to the individual and the processing activity.

Through Manage Consent & Data Rights, or through the privacy contact identified below, you may request one or more of the following actions where applicable:

Withdraw Processing Consent

You may request withdrawal of consent previously provided for processing your personal information. Withdrawal does not invalidate processing that lawfully occurred before the withdrawal became effective. Following withdrawal, Cadupius will cease consent-based processing within a reasonable period, except where continued processing is permitted or required by applicable law. Withdrawal may affect our ability to continue services that necessarily require the relevant information.

Revoke Hospital / Doctor Sharing Authorisation

You may request that Cadupius cease further sharing of your medical information with hospitals, doctors or other healthcare providers under a previously provided authorisation. Revocation applies prospectively and cannot reverse information lawfully shared before the revocation was received and processed.

Access Information About Processing

You may request information regarding personal data relating to you that is being processed by Cadupius. Subject to applicable law and verification, this may include a summary of the personal data and processing activities and, where legally required, the identities of Data Fiduciaries or Data Processors with whom the personal data has been shared together with the relevant description of the data shared.

Correct, Complete or Update Your Information

You may request correction of inaccurate or misleading personal information, completion of incomplete information or updating of information that has changed. Cadupius may take reasonable steps to verify the requested correction before updating the relevant record.

Request Deletion or Erasure

You may request deletion of eligible personal information. Where the information is no longer required for the applicable purpose and no lawful basis requires or permits continued retention, Cadupius will take reasonable steps to erase the relevant information. Certain limited information may be retained where necessary for legal compliance, security, audit, record keeping, grievance handling or legal rights or claims.

Privacy Concern or Grievance

You may submit a privacy grievance concerning the collection, use, disclosure, storage, security or handling of your personal information. Cadupius will record and review privacy grievances and will respond within the period required by the law in force at the relevant time. Where the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply, the designated Grievance Officer will address such grievances expeditiously and within one month from receipt, as required by those Rules. Once the corresponding grievance provisions under the Digital Personal Data Protection framework become applicable, Cadupius will publish and follow the applicable grievance-response period, which under the Digital Personal Data Protection Rules, 2025 may not exceed ninety days unless amended or otherwise provided by law.

Nomination

Where applicable law provides a right of nomination, an individual may nominate one or more eligible individuals to exercise the relevant privacy rights in the event of the individual's death or incapacity, subject to the applicable procedure and verification requirements.

Cadupius may request reasonable information necessary to verify the identity and authority of a person making a privacy or data-rights request.

8. Children and Minor Patients

Cadupius may receive enquiries relating to children and minor patients because medical tourism and healthcare facilitation services can include paediatric healthcare.

For the purposes of Indian data-protection law, where applicable, a child means an individual who has not completed eighteen years of age.

Personal information relating to a child may be submitted by the child's parent or lawful guardian, or through a Medical Tourism Agency, attendant, representative or other person appropriately authorised to act in connection with the child's healthcare enquiry.

Where a Medical Tourism Agency or other representative submits information relating to a child, the submitting party must confirm that the required parent or lawful-guardian consent or authorisation has been obtained and must follow any child-verification process prescribed by Cadupius.

Where applicable law requires verifiable parental or lawful-guardian consent before Cadupius processes the child's personal data, Cadupius will take appropriate technical and organisational measures to obtain or verify such consent before substantive processing of known child data, unless a lawful exemption applies. A general Agency confirmation alone will not be treated as sufficient where the law requires Cadupius to establish verifiable parental or guardian consent.

Cadupius may therefore require the Agency, parent, guardian or representative to provide or facilitate additional identity, age, authority or verification information. Pending completion of a legally required verification, Cadupius may restrict, quarantine or refrain from further processing or onward disclosure of the relevant child information.

Cadupius does not intend to use children's personal information for behavioural monitoring, targeted advertising or unrelated marketing activities. Healthcare-related information concerning a child will be processed only to the extent reasonably necessary for the relevant healthcare enquiry, treatment facilitation, hospital or doctor coordination, medical travel support and associated requested services, subject to applicable law.

9. International Patients and Cross-Border Processing

Cadupius provides medical tourism facilitation services to patients located both within and outside India. Accordingly, personal information may be received from another country and processed in India.

Where appropriate and authorised, information may also be communicated to hospitals, doctors, technology providers or other relevant recipients located in India or another country where this is necessary to support the requested service.

Cross-border processing or transfer will be subject to applicable legal requirements in force at the relevant time, including any requirement concerning permitted destinations, recipient safeguards, contractual necessity, consent or governmental restrictions. Where applicable law requires a recipient to maintain an equivalent or prescribed level of protection, Cadupius will seek to use recipients or arrangements that satisfy that requirement.

Cadupius will seek to limit international sharing to information reasonably necessary for the particular healthcare or facilitation purpose.

10. Website and Technical Information

When you access the Cadupius website, certain technical information may be generated automatically by the website, hosting environment or security systems. This may include:

• IP address;
• Browser or device information;
• Date and time of access;
• Requested website pages;
• System and security logs; and
• Information necessary for website functionality, security and troubleshooting.

Such information may be processed for website operation, cybersecurity, performance monitoring, troubleshooting and prevention of misuse.

If Cadupius introduces non-essential analytics, advertising or marketing cookies or similar technologies in the future, this Privacy Policy and the appropriate notice or consent mechanism will be reviewed and updated before such technologies are activated where required by applicable law.

11. Privacy Requests and Identity Verification

To protect patient information from unauthorised disclosure or alteration, Cadupius may verify the identity of an individual before responding to a privacy request.

Depending upon the circumstances, verification may involve information such as:

• Enquiry reference number;
• Registered mobile or WhatsApp number;
• Registered email address; or
• Other reasonable information relating to the original enquiry or necessary to verify identity or authority.

Cadupius will not intentionally request more information than reasonably necessary for the verification purpose.

Requests submitted by an attendant, family member, Medical Tourism Agency, representative or other person on behalf of a patient may require evidence or confirmation that the person or organisation is authorised to act for the patient.

12. Personal Data Breach

If Cadupius becomes aware of a personal-data breach affecting patient or other personal information, we will investigate the incident and take reasonable measures to contain, remediate and reduce the risk of recurrence.

Cadupius will notify affected individuals, the Data Protection Board of India, CERT-In or other competent authorities where and to the extent notification is required by the law applicable at the relevant time.

Where notification to an affected individual is required, Cadupius will seek to communicate relevant information concerning the nature of the incident, likely consequences, measures taken or proposed, appropriate safety measures and a business contact for relevant queries, in accordance with applicable law.

13. Privacy Contact and Grievance Redressal

Questions concerning this Privacy Policy or the processing of personal information may be directed to the person designated by Cadupius to handle privacy-related communications.

Privacy / Data Protection Contact

Cadupius Healthassist Pvt. Ltd.

Registered Office: 3/2, 75C Park Street, 3rd Floor, Kamdhenu Building, Kolkata, West Bengal 700016, India.

Email: support@cadupiushealthassist.com

Website: cadupiushealthassist.com

For privacy requests, consent withdrawal, access, correction, erasure, nomination or grievances, individuals may also use Manage Consent & Data Rights where that facility is available through the Cadupius website.

Cadupius will designate a Grievance Officer where required by applicable law and will publish the officer's name and contact details on its website. The published Grievance Officer particulars, together with the privacy contact channel above, form part of Cadupius's grievance-redressal mechanism.

Cadupius may require reasonable identity or authority verification before disclosing, correcting or deleting personal information.

14. Changes to This Privacy Policy

Cadupius may update this Privacy Policy where necessary to reflect changes in applicable law or regulatory requirements, our services, personal-information processing practices, technology or security arrangements, healthcare facilitation processes or the recipients with whom information is shared.

Where changes materially affect the manner in which personal information is processed, the specified purpose of processing, or a consent or confirmation previously relied upon, Cadupius will take appropriate steps to provide updated information and obtain fresh or renewed consent or confirmation where required.

For versioned digital consent or Agency confirmation mechanisms, Cadupius may mark an earlier record as requiring reconfirmation where a material change is introduced. A non-material administrative, formatting or contact-detail update need not automatically invalidate an otherwise applicable consent or confirmation unless required by law or the nature of the change.

The current version and effective date will be displayed on the applicable Privacy Policy or Privacy Notice page.

Important Notice

This Privacy Policy relates to the processing of personal information by Cadupius Healthassist in connection with medical tourism and healthcare facilitation services. It does not replace the privacy policies, consent procedures, clinical documentation or statutory record-retention obligations maintained independently by hospitals, doctors, diagnostic centres or other healthcare providers.

Healthcare providers receiving patient information may act independently in relation to their own medical, professional, statutory and record-retention obligations.