Your Data,
Protected & Respected

India · Malaysia · UAE/GCC · EU · United States · Global

1.1 Key Definitions

2.1 Who This Policy Applies To

This Privacy Policy applies to all individuals who interact with the I-PREDICT Platform, including individual consumers, employees in corporate wellness programmes, health insurance policyholders, telemedicine patients, healthcare providers using our provider portal, and visitors to our websites.

2.2 Geographic Scope

This Policy applies globally. I-PREDICT operates initially in India, Malaysia, and the UAE/GCC. Where the Platform is accessed from the EEA, the UK, or the US, additional jurisdiction-specific rights set out in Section 14 of this Policy are activated.

2.3 User Eligibility

The Platform is intended for individuals aged 18 years and above. The DPDP Act (India) prohibits data processing of children (under 18) without verifiable parental consent. We do not knowingly collect personal data from minors. See Section 12 for our Minors Policy.

A. Identity and Contact Data

• Full name, date of birth, gender, and nationality
• Email address, mobile phone number, and residential address
• Profile photograph (optional) and government-issued identity verification where legally required

B. Health and Medical Data

• Medical history, diagnoses, medications, allergies, and surgical history
• Electronic Health Records (EHR) — where ABDM or other EHR integration is enabled with consent
• Laboratory results, diagnostic reports, and clinical consultation notes
• Mental health assessments, stress and anxiety scores, and mood tracking data
• Body weight, BMI, height, and metabolic parameters
• Menstrual cycle, reproductive health, and hormonal data (Women's Health module)
• Diabetes-related data including glucose readings, HbA1c levels, and CGMS data
• Cardiovascular data including ECG trends and blood pressure readings

C. Biometric and Wearable Data

• Heart rate and heart rate variability (HRV) — collected 24/7 via optical sensors
• Blood oxygen saturation (SpO2) — continuously monitored
• Sleep data including sleep stages, duration, quality scores, and apnoea detection
• Stress and recovery scores derived from HRV and autonomic nervous system analysis
• Activity data: steps, calories, exercise intensity, and movement patterns
• Skin temperature and respiratory rate (where device-supported)

D. Technical and Device Data

• Device identifiers (IMEI, device ID, advertising ID), OS, app version, and IP address
• Wearable firmware version and Bluetooth pairing identifiers
• Mobile SDK usage analytics, crash logs, and app performance data

E. Location Data

• Approximate location (city/region) for service personalisation and regulatory compliance
• Precise location only with explicit consent, for telemedicine provider matching

F. Financial and Insurance Data

• Payment data processed by PCI-DSS compliant processors (we do not store raw card data)
• Health insurance policy details for insurer integrations (with consent)
• Subscription and billing history

G. Employer Wellness Data

• Employer organisation and employee ID for corporate wellness programme participants
• Individual data is never shared with employers without explicit consent

H. AI-Inferred and Generated Data

• AI-derived health risk scores, predictive alerts, and personalised intervention recommendations
• Longitudinal health trend analyses generated by the I-PREDICT AI Engine

We process your Personal Data only for specified, lawful purposes. The table below sets out primary processing activities and their legal basis:

4.1 Automated Decision-Making and AI Analytics

The I-PREDICT AI Engine uses automated processing, including machine learning, to generate health risk scores, predictive alerts, and personalised interventions. You have the right to: (i) request human review of any AI-generated health determination; (ii) receive an explanation of the AI logic and key input factors; and (iii) contest or challenge any AI-generated output. I-PREDICT AI outputs are wellness insights and decision-support tools — they do not constitute clinical diagnoses or medical prescriptions. See the I-PREDICT Medical and AI Disclaimers Policy for full detail.

We do not sell your Personal Data. We may share data with the following recipients under strict contractual and legal controls:

A. Healthcare Providers and Hospitals

We share relevant health data with your treating physician or healthcare facility where you engage telemedicine services. This requires your explicit prior consent and complies with applicable telemedicine regulations.

B. Health Insurers

With your explicit written consent, we may share de-identified or identified data with your health insurer for wellness incentives, premium adjustments, or claims adjudication. Consent may be withdrawn at any time without affecting existing coverage.

C. Employers (Corporate Wellness)

We share only aggregated, de-identified reports with your employer. Individual-level health data will never be shared with your employer without your separate, explicit written consent. Employers are contractually prohibited from using wellness data for employment decisions.

D. OEM Wearable Partner

We share device identifiers and firmware diagnostics with OEM vendor solely for device management and firmware updates. No health or biometric data is shared with the OEM manufacturer.

E. Technology and Infrastructure Partners

Cloud hosting, analytics, payment processing, and communications partners act as data processors under our instructions and under Data Processing Agreements (DPAs). All processors are vetted for applicable data protection compliance.

F. Legal and Regulatory Authorities

We disclose Personal Data where required by law, court order, or regulatory authority, including mandatory health reporting obligations and law enforcement requests where legally valid.

5.1 De-identification and AI Model Training

We de-identify data using k-anonymity, differential privacy, and aggregation techniques. De-identified data may be used for research, product improvement, and population health analytics. If you do not wish your de-identified data used for AI model training, you may opt out via Account > Privacy Settings. This will not affect core service access.

Subject to applicable law and identity verification, you have the following rights:

• AccessObtain a copy of Personal Data we hold about you. Fulfilled within 30 days.
• RectificationRequest correction of inaccurate or incomplete data. Health data corrections may require clinical validation.
• ErasureRequest deletion of your Personal Data unless legal retention obligations apply.
• PortabilityReceive your health data in a structured, machine-readable format (JSON, FHIR). ABDM Health Locker supported for Indian users.
• RestrictionRequest limited processing while rectification or objection requests are assessed.
• ObjectionObject to processing based on legitimate interests, including direct marketing and AI model training.
• Withdraw ConsentWithdraw consent for any processing activity via Account > Privacy Settings. Withdrawal does not affect prior lawful processing.
• GrievanceLodge a formal complaint with our Grievance Officer (India: within 30 days) or relevant supervisory authority.

To exercise any right: privacy@instapredict.ai or Account > Data Rights in-app.

I-PREDICT's infrastructure is hosted in India (primary) with replication in Singapore and the UAE. Health data of Indian users is stored within India in compliance with ABDM data localisation requirements.

EU/UK Users - GDPR SCCs

Transfers to third countries not deemed adequate by the European Commission are conducted using Standard Contractual Clauses (SCCs).

India - DPDP Act

Cross-border transfers are conducted only to countries/entities permissible under DPDP Act Rules. Sensitive personal data including health data requires additional safeguards.

Malaysia - PDPA 2025 Amendments

Cross-border transfers must comply with the 2025 amendments. Adequate protection or contractual safeguards required.

UAE-PDPL

Data transfers involving UAE residents are made only to countries offering adequate protection or under approved contractual safeguards.

In the event of a Personal Data breach we will:

• Notify relevant supervisory authorities within 72 hours of becoming aware (GDPR standard adopted globally)
• Notify affected users without undue delay where the breach creates high risk to their rights
• Notify the Indian Data Protection Board per DPDP Act Rules
• Notify the Malaysia Personal Data Protection Commissioner within 72 hours (effective June 2025)
• Comply with UAE PDPL breach notification obligations and provide details of breach scope and remediation

Report suspected breaches to: security@instapredict.ai

10.1 Web Portals

Our websites use cookies for functional operation, analytics, and personalisation. Cookie preferences are managed via our Cookie Preference Centre. We use only strictly necessary cookies without consent; all other cookies require opt-in.

10.2 Mobile SDK

The I-PREDICT app uses analytics SDKs for product improvement. We do not use cross-app tracking identifiers without consent. Opt-out is available via device settings or in-app privacy controls.

We use a layered, granular consent framework. Each consent type is time-stamped, versioned, and stored in an auditable consent ledger:

• Onboarding Consent: Core service delivery consent collected during registration
• Module-Specific Consent: Separate consent for each health module at activation (mental wellness, diabetes, cardiovascular, women's health)
• Sensitive Data Consent: Explicit double opt-in for biometric and genetic data processing
• Employer Sharing Consent: Separate, clearly distinguished consent for any employer data-sharing
• Insurer Data Consent: Separate signed consent for health data sharing with health insurers
• Research / AI Training Consent: Separate opt-in consent for use of de-identified data in research or AI model training

You may review and withdraw any consent at any time via Account > Privacy Settings.

I-PREDICT is intended for adults aged 18 and above. We do not knowingly collect Personal Data from minors. The DPDP Act (India) prohibits processing children's data without verifiable parental/guardian consent and prohibits behavioural tracking of children. If we become aware that a minor's data has been collected without parental consent, we will delete it immediately. Contact us at privacy@instapredict.ai if you believe a minor's data has been incorrectly collected.

• India: Digital Personal Data Protection Act 2023; IT Act 2000; ABDM Framework; Telemedicine Practice Guidelines 2020
• Malaysia: Personal Data Protection Act 2010 (Amended 2025); Healthcare Code of Practice
• UAE/GCC: Federal Decree-Law No. 45/2021 (PDPL); Federal Law No. 2/2019 on ICT in Healthcare
• EU/UK: GDPR (EU) 2016/679; UK GDPR; eHealth Network Guidelines
• USA: HIPAA/HITECH; FTC Health Breach Notification Rule; CCPA/CPRA (California)
• International: WHO Digital Health Strategy; ISO/IEC 27001; NIST Cybersecurity Framework