Curefy Privacy Policy

Who We Are

Curefy ("Curefy", "we", "us", "our") is operated by Yapita Health Pvt. Ltd., a company registered in India with its office at 715A, Spencer Plaza, 7th Floor, 768, 769 Anna Salai, Chennai, Tamil Nadu, India - 600002.

Curefy provides a software platform that helps healthcare businesses such as clinics, hospitals and medical tourism companies (our "Clients") collect patient data and communicate with their patients and customers. Through Curefy, Clients can connect their Facebook Page and Instagram accounts and use them to send appointment confirmations and reminders, share reports and updates, and answer patient questions from one place.

This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and how you can ask us to delete it. It applies to our website curefy.app, our web and mobile applications, and our related services (together, the "Services").

Who This Policy Covers

• Clients and their staff: businesses and people who sign up for and use Curefy.
• End users: patients and customers who message a Client through Instagram, or whose details a Client adds to Curefy.
• Website visitors: anyone who visits our website or contacts us.

When we process end-user information on behalf of a Client, the Client decides why and how that information is used, and we act as the Client's service provider (a "Data Processor" under the Digital Personal Data Protection Act, 2023). The Client is responsible for its own privacy notice to its patients and customers. If you are an end user, you can also contact the Client directly about your information.

Information We Collect

3.1 Information you give us

• Account details: name, business name, email address, phone number, job role, password and billing details.
• Business details: clinic or business address, services, working hours and similar information Clients add to their account.
• Contact and support requests: information you share when you fill in a form, email us or talk to our support team.

3.2 Information Clients add about their patients and customers

• Name, phone number, email address and appointment details.
• Messages, documents or reports a Client chooses to send through Curefy.
• Any other information a Client uploads to manage its communication with patients.

3.3 Information we collect automatically

• Device and browser information: IP address, browser type, operating system, device identifiers and language settings.
• Usage information: pages visited, features used, time spent, clicks, referring pages and error logs.
• Server information: access times, request logs and similar technical records needed to run and secure the Services.
• Cookies and similar technologies, as described in Section 11.

3.4 Information from Meta platforms (Platform Data)

When a Client connects a Facebook Page or Instagram professional account to Curefy, and gives permission through Meta's login and permissions screens, we receive:

• The Client's basic profile (name, email if permitted, and account ID) from Facebook Login.
• Details of the connected business assets: Facebook Page and Instagram account names and IDs.
• Access tokens that let Curefy send and receive messages on the Client's behalf.
• Messages that end users send to the Client, and the sender's name, phone number or profile name and ID as shared by the platform.
• Message status updates, such as sent, delivered and read.

We only receive the information allowed by the permissions the Client approves. A Client can remove Curefy's access at any time from its Meta Business settings.

3.5 Health information

Because our Clients work in healthcare, messages and documents shared through Curefy may contain health-related information. We treat all such content as highly sensitive, use it only to deliver the Client's messages, and never use it for advertising, profiling or any purpose of our own.

How We Use Information

We use information only for the following purposes:

• To provide the Services: creating and managing accounts, connecting business messaging accounts, and sending, receiving and displaying messages for our Clients.
• To send messages a Client requests, such as appointment confirmations, reminders, follow-ups and report notifications.
• To support Clients: answering questions, fixing problems and sending service updates.
• To keep the Services safe: detecting and preventing fraud, spam, abuse and security incidents.
• To improve the Services: understanding how features are used, using aggregated or de-identified data where possible.
• To process payments and keep business and tax records.
• To communicate with Clients about their account and, where allowed, about new features. Clients can opt out of marketing emails at any time.
• To meet legal obligations and respond to lawful requests from authorities.

We process personal data based on consent, the performance of our contract with Clients, our legitimate interests in running a safe and reliable service, and compliance with law, as applicable under the Digital Personal Data Protection Act, 2023 and other laws that apply.

How We Use Data from Meta Platforms

Curefy acts as a technology provider for its Clients. We use Platform Data received from Meta (Facebook and Instagram) only to provide the messaging service each Client has asked for, and only on that Client's behalf.

Our commitments on Platform Data:

• We use it only to let the connected Client send, receive, organise and reply to messages with its own patients and customers.
• We keep each Client's data separate and never use one Client's data for another Client.
• We do NOT sell, license or rent Platform Data.
• We do NOT use Platform Data for advertising, to build user profiles, or for any purpose unrelated to the Client's service.
• We do NOT use Platform Data to make decisions about anyone's eligibility for health care, insurance, employment, housing or credit.
• We share Platform Data only with the Client it belongs to and with service providers who help us run Curefy under strict confidentiality terms.
• We follow the Meta Platform Terms and the Meta Developer Policies.

If a Client disconnects its account or stops using Curefy, we stop collecting Platform Data for that Client and delete it as described in Sections 7 and 8.

How We Share Information

We do not sell personal data. We share information only as follows:

• With the Client concerned: end-user messages and details are shown only to the Client they were sent to.
• With Meta: when a Client sends a message through Messenger or Instagram, the message content and recipient details are passed to Meta so it can be delivered. Meta's own use of this data is covered by Meta's Privacy Policy.
• With service providers: companies that help us with cloud hosting, data storage, email delivery, payments, analytics and customer support. They may only use the data to provide services to us and must protect it.
• For legal reasons: when required by law, court order or a valid request from a government authority, or to protect the rights, safety and property of Curefy, our Clients or others.
• In a business transfer: if Curefy is involved in a merger, acquisition or sale of assets, subject to this policy continuing to protect your data.

How Long We Keep Data

• Client account data: for as long as the account is active, then deleted within 90 days of account closure, unless we must keep it longer by law.
• Messages and Platform Data: for as long as the Client needs them to use the Services. Deleted within 30 days after the Client disconnects its Meta account, closes its Curefy account or asks us to delete it.
• Access tokens: deleted immediately when a Client disconnects or removes Curefy's access.
• Billing and tax records: for the period required by Indian law.
• Security logs: for up to 180 days.

How to Request Deletion of Your Data

You can ask us to delete your personal data at any time. We will confirm your request and complete deletion within 30 days, except where we must keep certain records by law.

Option 1: Email us

Send an email to support@curefy.app with the subject "Data Deletion Request". Please include your name and the email address or phone number linked to your data so we can find it.

Option 2: Remove Curefy from your Facebook account

If you logged in to Curefy with Facebook:

• Go to your Facebook "Settings and privacy", then "Settings".
• Open "Apps and websites".
• Find "Curefy" and select "Remove".

When you remove Curefy, Meta notifies us and we delete the data we received through your Facebook login.

If you are a patient or customer of a Client: you can ask the clinic or business you messaged to delete your information, or email us at support@curefy.app and we will work with that Client to handle your request.

Your Rights

Depending on where you live, and in line with the Digital Personal Data Protection Act, 2023, you may have the right to:

• Get information about the personal data we hold about you.
• Ask us to correct, complete or update your data.
• Ask us to delete your data.
• Withdraw consent you have given, without affecting processing done before withdrawal.
• Nominate another person to exercise your rights if you die or become unable to do so.
• Raise a complaint with our Grievance Officer and, if unresolved, with the Data Protection Board of India.

If you are in the European Economic Area or the United Kingdom, you may also have the right to object to or restrict processing and to receive your data in a portable format. To use any of these rights, email support@curefy.app.

Security

We protect data using measures such as encryption in transit (HTTPS/TLS) and at rest, access controls limited to authorised staff, secure storage of access tokens, regular security reviews and activity logging. No system is completely secure, but we work to protect your information and will notify affected Clients, users and authorities of a personal data breach as required by law.

Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, understand how our website is used and keep the Services secure. You can control or delete cookies in your browser settings. Blocking some cookies may stop parts of the Services from working.

Children

Curefy accounts are for businesses and are not meant for anyone under 18. We do not knowingly collect personal data directly from children. Where a Client communicates with a minor's parent or guardian about the minor's care, the Client is responsible for obtaining any required parental consent.

Where Data Is Stored

Our data is stored on secure servers located in India / Mumbai. Messages sent through Messenger or Instagram are also processed by Meta on its own infrastructure, which may be located outside India. Where data is transferred outside India, we do so only as permitted by applicable law.

Changes to This Policy

We may update this policy from time to time. We will post the updated version on this page and change the "Last updated" date. If the changes are significant, we will notify Clients by email or in the app before they take effect.