Privacy Policy

Version 1.0 · Effective date: [DD Month 2026] · Applies to: Customers · Care Professionals · Partner Agencies

1. Who we are

Kare Reach is an online platform operated by Kare Reach Private Limited (CIN U88900RJ2026PTC117628), with its registered office at Bazar No. 5, Ramganj Mandi, Kota, Rajasthan 326519, India ("Kare Reach", "we", "us", "our"). We connect families and individuals with verified nursing, physiotherapy, elder care, child care, psychotherapy and wellness professionals and with partner care agencies, and we provide the booking, scheduling, payment, invoicing and support layer around those services.

Kare Reach is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") in respect of the personal data we determine the purpose and means of processing for, and the "body corporate" under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

This Policy is published in accordance with Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and applies to www.karereach.com, our mobile and web applications, our customer, professional and agency panels, and all communications connected to them (together, the "Platform").

2. Scope and the three audiences this Policy covers

The Platform serves three distinct groups, and the data we handle differs for each:

A Care Recipient is the person who actually receives care. Where that is not the customer (for example, an elderly parent or a child), the customer provides the Care Recipient's details to us and must be legally entitled to do so — see section 11.

3. The legal basis on which we process your data

Under the DPDP Act we process personal data either on the basis of your consent, given through a clear affirmative action such as ticking a consent box, signing a consent form or confirming a booking, or for certain legitimate uses recognised by the Act — for example where you voluntarily provide data for a purpose and have not indicated that you object to its use for that purpose, or where processing is needed to comply with a law or a court order, or to respond to a medical emergency or a threat to life or health.

Health data, biometric information, financial information and official identifiers are sensitive personal data or information under the SPDI Rules, and we obtain specific written consent before collecting them, disclose them only as described in this Policy, and apply the heightened safeguards in section 12.

Where we rely on consent, you may withdraw it at any time — see section 13. Withdrawal does not affect anything we lawfully did before you withdrew, and in some cases it will mean we can no longer provide the service.

4. Personal data we collect from customers

4.1 Data you give us

Account and identity data — name, mobile number, email address, password (stored only as a hash), city, preferred language and profile photograph if you upload one.

Service address data — the full address where care is to be delivered, landmarks, floor and lift access, entry instructions and parking notes.

Care Recipient data — name, age, sex, relationship to you, and the details in 4.2 below.

Booking data — service selected, date, time, frequency, session duration, preferences such as gender of the professional or language spoken, coupon codes and special instructions.

Payment data — the payment method chosen, the last four digits and network of a card, UPI handle, transaction references, wallet balance, invoices and credit notes. Full card numbers, CVV and UPI PINs are never collected, seen or stored by Kare Reach — they are handled directly by our PCI-DSS compliant payment gateway partner.

Support and feedback data — support tickets, chat transcripts with the care desk, call recordings where we tell you a call is being recorded, ratings, reviews and complaint records.

4.2 Health and care data

To assign a safe and suitable professional, we collect the health information you choose to share, which may include the medical condition or reason for care, mobility level, diagnosis and treating doctor's instructions, post-operative or wound-care details, current medication, allergies, infection risk, dietary needs, cognitive status, prescriptions or discharge summaries you upload, and the professional's session notes and vitals recorded during a visit.

You are never obliged to upload a clinical record to use the Platform. Share only what the professional genuinely needs in order to deliver the booked service safely.

4.3 Data we collect automatically

Device and technical data — IP address, device model, operating system, browser, app version, device identifiers and crash logs.

Usage data — pages and services viewed, searches, filters applied, time on page, referring URL and interaction events.

Approximate or precise location — your city selection always; precise GPS location only if you grant permission in your browser or app, used to show services available near you and to verify a professional's arrival at the service address.

Cookies and similar technologies — see our Cookie Policy at karereach.com/cookies.

5. How we use customer data

We do not sell personal data. We do not use your health data for advertising, and we do not take automated decisions that produce legal or similarly significant effects on you without human review.

6. Personal data of care professionals

If you apply to join as a care professional, the guided onboarding and ongoing use of the professional panel involve the following data:

Identity and contact — full name, date of birth, sex, photograph, mobile number, email, residential address and emergency contact.

Government identifiers — Aadhaar (or the Aadhaar-based offline verification result), PAN, driving licence or other photo ID as applicable. Where Aadhaar is used, it is used only in a manner permitted by law and the number is masked in our systems.

Qualification and registration data — degrees and diplomas, registration number with the relevant State Nursing Council, State Physiotherapy Council, Rehabilitation Council of India or other competent body, registration validity, specialisations, years of experience, employment history and references.

Background verification data — police verification or criminal-record check, address verification and previous-employer checks, obtained by us or by a background-screening vendor acting for us, with your specific consent.

Health and fitness data — where a service category requires it, immunisation status or a fitness-to-practise certificate.

Operational data — service catalogue entries, cities and pin codes served, availability calendar, service radius, job acceptances and rejections, check-in and check-out timestamps and location at the service address, session notes, cancellation and no-show history, customer ratings, reviews and complaints.

Financial data — bank account and IFSC or UPI handle for payouts, PAN, GST registration where applicable, TDS records, earnings ledger, commission deductions, payout statements and invoices.

We use this data to assess and verify your application, to grant and maintain the Verified badge, to publish your public profile, to route and assign jobs, to operate ratings and quality monitoring, to calculate and settle earnings and statutory deductions, to investigate safety incidents and complaints, and to meet our tax, accounting and regulatory duties.

6.1 What customers can see about you

Your public profile shows your display name, photograph, service categories, qualification titles and verification status, experience, languages, service areas, indicative pricing and aggregate ratings and reviews. It does not show your government identifiers, address, background-check contents, bank details or earnings. Once a booking is confirmed, the assigned customer additionally receives your contact number and arrival details so that the session can go ahead.

7. Personal data of partner agencies

For agency accounts we collect business and personnel data, including:

Business data — trade and legal name, constitution, CIN or registration number, GSTIN, PAN, registered and operating addresses, service areas, specialities and years in operation.

Licence and compliance data — clinical establishment registration where applicable, trade licence, professional indemnity and public liability insurance, address proof and tax documents, each uploaded and tracked through to approval.

Authorised-person data — name, designation, mobile, email and ID of directors, partners, proprietors and panel administrators.

Team data — the names and contact details of care professionals you invite, the status of pending, accepted and cancelled invitations, the seats you hold, and the verification documents of each team member.

Commercial data — bookings routed to your team, commissions, invoices, credit notes, payouts and the agency earnings ledger.

Where your agency uploads the personal data of your employees or contractors to the Platform, your agency is responsible for having a lawful basis and the necessary consents for that disclosure, and Kare Reach processes that data as described in this Policy and in the Agency Terms & Conditions.

8. Children and vulnerable persons

The Platform is not intended for use by persons under 18. A customer must be 18 or older to hold an account and to make a booking.

Where a booking is for a child or for a person with a disability or impaired capacity, the person making the booking must be the parent, the lawful guardian or a person otherwise legally authorised to act for them, and we rely on that confirmation when we process the Care Recipient's data. In line with section 9 of the DPDP Act, we do not undertake tracking or behavioural monitoring of children and do not direct advertising at children.

9. Who we share personal data with

All service providers act as Data Processors on our behalf under written contracts that require confidentiality, security measures and the deletion or return of data on termination.

10. Storage, location and retention

Personal data is stored on servers located in India at [cloud provider and region]. Where a service provider processes data outside India, we do so only to countries not restricted by the Central Government under section 16 of the DPDP Act and under contractual safeguards.

When a retention period expires, we erase the data or irreversibly anonymise it, unless a law, a regulator, an insurer or an active legal proceeding requires us to keep it for longer.

11. Your responsibilities when you share someone else's data

If you give us personal data about another person — a Care Recipient, a family member, an emergency contact or a team member — you confirm that you are authorised to do so, that you have told them how their data will be used, and that you have obtained their consent where the law requires it. Please share only what is necessary, and keep it accurate and up to date.

12. How we protect personal data

Encryption in transit (TLS 1.2 or higher) and encryption at rest for databases, documents and backups.

Role-based access control and least-privilege access, so that a professional sees only their assigned bookings and an agency administrator sees only its own team.

Multi-factor authentication for administrative access, and password hashing with a modern algorithm.

Masking of identifiers such as Aadhaar and tokenisation of payment instruments by the gateway.

Audit logging of access to care and health records, periodic access reviews, vulnerability scanning and penetration testing.

Confidentiality undertakings and privacy training for employees, professionals and vendors.

A documented incident-response plan. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal in the form and within the timelines prescribed under the DPDP Act and the rules made under it.

No system is perfectly secure. Keep your password and OTPs confidential, use the in-app chat rather than private channels for care discussions, and tell us immediately at [email protected] if you suspect unauthorised use of your account.

13. Your rights

As a Data Principal under the DPDP Act you have the right to:

obtain a summary of the personal data we process about you and the processing activities involved;

obtain the identities of the Data Fiduciaries and Processors with whom your data has been shared, and a description of the data shared;

have inaccurate or incomplete data corrected, completed or updated;

have data erased where it is no longer needed for the purpose it was collected for and no law requires us to retain it;

withdraw consent at any time, as easily as it was given;

nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and

have a grievance addressed by us before approaching the Data Protection Board of India.

Most of these can be exercised directly from your account settings. Otherwise, write to our Grievance Officer, Huzaifa Taiyeb Ali, at the address in section 16. We will verify your identity and respond within [30] days, or sooner where the law prescribes a shorter period. We may decline a request where the law allows us to, and will tell you why.

14. Communications and marketing preferences

Transactional messages — OTPs, booking confirmations, professional assignment, reminders, invoices and safety alerts — are part of the service and cannot be switched off while you hold an active booking or account.

Promotional messages are sent only with your consent. You can opt out from notification settings in your account, by using the unsubscribe link in an email, or by replying STOP to an SMS. Our telephone and SMS outreach follows the TRAP regulations and the DND preferences registered with your telecom operator.

15. Cookies

We use strictly necessary cookies for sign-in and security, preference cookies to remember your city and language, and analytics cookies to understand how the Platform is used. Non-essential cookies are set only where you accept them in the consent banner, and you can change your choice at any time. See karereach.com/cookies for the full list.

16. Grievance Officer and contact

In accordance with the DPDP Act, the Information Technology Act, 2000 and Rule 3(2) of the Intermediary Guidelines, our Grievance Officer is:

We acknowledge every complaint within 48 hours and resolve it within [30] days of receipt. If you are not satisfied with our response, you may complain to the Data Protection Board of India. Consumers may also use the National Consumer Helpline (1915) or the consumer grievance redress mechanism under the Consumer Protection Act, 2019.

17. Changes to this Policy

We may update this Policy to reflect changes in our services or in the law. The version number and effective date at the top will change, and material changes will be notified by email or by an in-app notice at least [7] days before they take effect. Where a change materially expands how we use personal data, we will ask for fresh consent.

18. Governing law

This Policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of the courts at Kota, Rajasthan, without prejudice to any statutory remedy available to a Data Principal or a consumer.