Your Health Data
Protected by Design

Instapredict Technologies Pvt Ltd ('I-PREDICT', 'we', 'us', 'our') governs this Privacy Policy across all platforms including the I-PREDICT mobile application, wearable devices, web portals (www.instapredict.ai, www.i-predict.net), telemedicine services, employer wellness programmes, and insurer integrations. By using our Platform, you acknowledge that you have read and understood this Policy.

1.1 Key Definitions

2.1 Who This Policy Applies To

This Privacy Policy applies to all individuals who interact with the I-PREDICT Platform, including individual consumers, employees in corporate wellness programmes, health insurance policyholders, telemedicine patients, healthcare providers using our provider portal, and visitors to our websites.

2.2 Geographic Scope

This Policy applies globally. I-PREDICT operates initially in India, Malaysia, and the UAE/GCC. Where the Platform is accessed from the EEA, the UK, or the US, additional jurisdiction-specific rights set out in Section 13 of this Policy are activated.

2.3 User Eligibility

The Platform is intended for individuals aged 18 years and above. The DPDP Act (India) prohibits data processing of children (under 18) without verifiable parental consent. We do not knowingly collect personal data from minors. See Section 12 for our Minors Policy.

We collect the following categories of data depending on services used and permissions granted:

A. Identity & Contact Data

• Full name, date of birth, gender, and nationality
• Email address, mobile phone number, and residential address
• Profile photograph (optional) and government-issued identity verification where legally required

B. Health & Medical Data

• Medical history, diagnoses, medications, allergies, and surgical history
• Electronic Health Records (EHR) — where ABDM or other EHR integration is enabled with consent
• Laboratory results, diagnostic reports, and clinical consultation notes
• Mental health assessments, stress and anxiety scores, and mood tracking data
• Body weight, BMI, height, and metabolic parameters
• Menstrual cycle, reproductive health, and hormonal data (Women's Health module)
• Diabetes-related data including glucose readings, HbA1c levels, and CGMS data
• Cardiovascular data including ECG trends and blood pressure readings

C. Biometric & Wearable Data

• Heart rate and heart rate variability (HRV) — collected 24/7 via optical sensors
• Blood oxygen saturation (SpO2) — continuously monitored
• Sleep data including sleep stages, duration, quality scores, and apnoea detection
• Stress and recovery scores derived from HRV and autonomic nervous system analysis
• Activity data: steps, calories, exercise intensity, and movement patterns
• Skin temperature and respiratory rate (where device-supported)

D. Technical & Device Data

• Device identifiers (IMEI, device ID, advertising ID), OS, app version, and IP address
• Wearable firmware version and Bluetooth pairing identifiers
• Mobile SDK usage analytics, crash logs, and app performance data

E. Location Data

• Approximate location (city/region) for service personalisation and regulatory compliance
• Precise location only with explicit consent, for telemedicine provider matching

F. Financial & Insurance Data

• Payment data processed by PCI-DSS compliant processors (we do not store raw card data)
• Health insurance policy details for insurer integrations (with consent)
• Subscription and billing history

G. Employer Wellness Data

• Employer organisation and employee ID for corporate wellness programme participants
• Individual data is never shared with employers without explicit consent

H. AI-Inferred & Generated Data

• AI-derived health risk scores, predictive alerts, and personalised intervention recommendations
• Longitudinal health trend analyses generated by the I-PREDICT AI Engine

We process your Personal Data only for specified, lawful purposes. The table below sets out primary processing activities and their legal basis:

4.1 Automated Decision-Making & AI Analytics

The I-PREDICT AI Engine uses automated processing, including machine learning, to generate health risk scores, predictive alerts, and personalised interventions. You have the right to:

• Request human review of any AI-generated health determination
• Receive an explanation of the AI logic and key input factors
• Contest or challenge any AI-generated output

We do not sell your Personal Data. We may share data with the following recipients under strict contractual and legal controls:

A. Healthcare Providers & Hospitals

We share relevant health data with your treating physician or healthcare facility where you engage telemedicine services. This requires your explicit prior consent and complies with applicable telemedicine regulations.

B. Health Insurers

With your explicit written consent, we may share de-identified or identified data with your health insurer for wellness incentives, premium adjustments, or claims adjudication. Consent may be withdrawn at any time without affecting existing coverage.

C. Employers (Corporate Wellness)

We share only aggregated, de-identified reports with your employer. Individual-level health data will never be shared with your employer without your separate, explicit written consent. Employers are contractually prohibited from using wellness data for employment decisions.

D. OEM Wearable Partner

We share device identifiers and firmware diagnostics with OEM vendor solely for device management and firmware updates. No health or biometric data is shared with the OEM manufacturer.

E. Technology & Infrastructure Partners

Cloud hosting, analytics, payment processing, and communications partners act as data processors under our instructions and under Data Processing Agreements (DPAs). All processors are vetted for applicable data protection compliance.

F. Legal & Regulatory Authorities

We disclose Personal Data where required by law, court order, or regulatory authority, including mandatory health reporting obligations and law enforcement requests where legally valid.

5.1 De-identification & AI Model Training

We de-identify data using k-anonymity, differential privacy, and aggregation techniques. De-identified data may be used for research, product improvement, and population health analytics.

Subject to applicable law and identity verification, you have the following rights:

• AccessObtain a copy of Personal Data we hold about you. Fulfilled within 30 days.
• RectificationRequest correction of inaccurate or incomplete data. Health data corrections may require clinical validation.
• ErasureRequest deletion of your Personal Data unless legal retention obligations apply.
• PortabilityReceive your health data in a structured, machine-readable format (JSON, FHIR). ABDM Health Locker supported for Indian users.
• RestrictionRequest limited processing while rectification or objection requests are assessed.
• ObjectionObject to processing based on legitimate interests, including direct marketing and AI model training.
• Withdraw ConsentWithdraw consent for any processing activity via Account > Privacy Settings. Withdrawal does not affect prior lawful processing.
• GrievanceLodge a formal complaint with our Grievance Officer (India: within 30 days) or relevant supervisory authority.

I-PREDICT's infrastructure is hosted in India (primary) with replication in Singapore and the UAE. Health data of Indian users is stored within India in compliance with ABDM data localisation requirements.

In the event of a Personal Data breach we will:

• Notify relevant supervisory authorities within 72 hours of becoming aware (GDPR standard adopted globally)
• Notify affected users without undue delay where the breach creates high risk to their rights
• Notify the Indian Data Protection Board per DPDP Act Rules
• Notify the Malaysia Personal Data Protection Commissioner within 72 hours (effective June 2025)
• Comply with UAE PDPL breach notification obligations and provide details of breach scope and remediation

10.1 Web Portals

Our websites use cookies for functional operation, analytics, and personalisation. Cookie preferences are managed via our Cookie Preference Centre. We use only strictly necessary cookies without consent; all other cookies require opt-in.

10.2 Mobile SDK

The I-PREDICT app uses analytics SDKs for product improvement. We do not use cross-app tracking identifiers without consent. Opt-out is available via device settings or in-app privacy controls.

We use a layered, granular consent framework. Each consent type is time-stamped, versioned, and stored in an auditable consent ledger:

• Onboarding ConsentCore service delivery consent collected during registration
• Module-Specific ConsentSeparate consent for each health module at activation (mental wellness, diabetes, cardiovascular, women's health)
• Sensitive Data ConsentExplicit double opt-in for biometric and genetic data processing
• Employer Sharing ConsentSeparate, clearly distinguished consent for any employer data-sharing
• Insurer Data ConsentSeparate signed consent for health data sharing with health insurers
• Research / AI Training ConsentSeparate opt-in consent for use of de-identified data in research or AI model training

I-PREDICT is intended for adults aged 18 and above. We do not knowingly collect Personal Data from minors. The DPDP Act (India) prohibits processing children's data without verifiable parental/guardian consent and prohibits behavioural tracking of children.

If we become aware that a minor's data has been collected without parental consent, we will delete it immediately.

• India: Digital Personal Data Protection Act 2023; IT Act 2000; ABDM Framework; Telemedicine Practice Guidelines 2020
• Malaysia: Personal Data Protection Act 2010 (Amended 2025); Healthcare Code of Practice
• UAE / GCC: Federal Decree-Law No. 45/2021 (PDPL); Federal Law No. 2/2019 on ICT in Healthcare
• EU / UK: GDPR (EU) 2016/679; UK GDPR; eHealth Network Guidelines
• USA: HIPAA/HITECH; FTC Health Breach Notification Rule; CCPA/CPRA (California)
• International: WHO Digital Health Strategy; ISO/IEC 27001; NIST Cybersecurity Framework

We will update this Privacy Policy as required by regulatory changes, new service launches, or product developments.