Privacy Policy

1. Scope

This Privacy Policy explains how Antara through its Platform ("Antara," "we," or "us") collects, uses, and protects your personal information in compliance with the Indian data protection and privacy laws including the Indian Digital Personal Data Protection Act (DPDP), the European Union General Data Protection Regulation (GDPR) for individuals located in the EU/EEA, and the U.S. Health Insurance Portability and Accountability Act (HIPAA) where we handle Protected Health Information (PHI). It describes the types of personal information we collect, the purposes for which we collect and use that information, the parties with whom we may share it, and the measures we take to protect your data. By accessing or using the Platform, you consent to the collection and processing of your personal information as described in this Privacy Policy.

2. Types of Personal Information We Collect
   • We may collect the following categories of personal information:
3. Contact Information: Name, email address, postal address, phone number, and other similar contact data.
4. Financial Information: Payment instrument information, transaction details, and related financial data.
5. Technical Information: Website and mobile app usage, IP address, cookies, device information, and similar technologies.
6. Transaction Information: Purchase history, order details, preferences, and related information.
7. Health Information: Medical/health history, treatment plans, prescribed medication, medical reports, and related health data.
8. Product and Service Information: Account membership details, registration information, program-specific data, and marketing preferences.
9. Personal Information: Age, sex, date of birth, nationality, government identification details, occupation, and other personal data provided by you.
10. Reviews and Feedback: Opinions, reviews, and feedback about our products, and services.
11. Loyalty Program Information: Membership details, account information, program affiliations, and reward preferences.

3. Collection of Personal Information
   • We collect personal information through the following means:
4. Information You Provide: When you register, make a purchase, complete surveys, or interact with our website or mobile applications.
5. Automatic Information: Through cookies, pixels, and similar technologies that collect information when you interact with us.
6. E-mail Communications: When you open our e-mails or click on links, we may receive confirmation and track your interactions.
7. Automatic Information from Other Websites: When you interact with third-party websites using our technology or with whom we have agreements.
8. Information from Other Sources: When authorized third-party websites provide or receive information about you.
9. Each processing purpose is explicitly mapped to a lawful basis under GDPR and DPDP. For example, we rely on consent for marketing, contractual necessity for service delivery, legal obligation for compliance requirements, and legitimate interests for improving services. For health and medical data, we rely on explicit consent and, where applicable, provision of health or social care services.

4. Purposes and Legal Basis for Processing Personal Information by Antara
   • Antara shall only retain User Information to the extent required to provide its Services and offering of Products to Users. The information collected by Antara from you may be used for a variety of business and regulatory purposes, encompassing, but not limited to, the following:
5. User Registration: To register the User on the Platform and associated programs.
6. Contractual Necessity: To perform our contractual obligations, provide products and services, and communicate with you.
7. Service Processing: Processing the User's requests and provision of Services, ensuring the secure and reliable delivery of healthcare services.
8. Consent: With your consent, we may send marketing communications, offer personalized services, and process sensitive personal information (such as health data) to and/or for you.
9. Product and Service Offerings:Enabling Antara, its affiliates, and partners to offer their products and/or services and communicate with you regarding such offerings.
10. Research and Education: Conducting internal research, analysis, and business development to improve the Services and offering and enhance User experience.
11. Data Processing and Sharing: Processing, disclosing, transmitting, and/or sharing data/information with Antara's affiliates, strategic partners, and other third parties with whom Antara has business or contractual relationships.
12. Website Administration: Technical administration and customization of the Platform, ensuring proper functionality and enhancing user experience.
13. Personalized Information Delivery: Delivering personalized information to the User, tailored to their preferences and requirements.
14. Service Enhancement: Continuously improving the Services, features, and functionality of the Platform through analysis of user feedback, research, and development efforts.
15. User Research and Administration: Conducting user surveys, research, and development activities, as well as managing user accounts and profiles.
16. Customer Care: Addressing User requests, inquiries, complaints, or disputes, and performing other customer care-related activities, including those arising from Users' use of the Services, and for general administrative and business purposes.
17. Communication:Communicating any changes in the Services, Privacy Policy, or Terms of Use to the Users.
18. Legitimate Interests:To operate, evaluate, and improve our business, website, and mobile applications; personalize user experience; conduct market research and analysis; and prevent fraud and security breaches.
19. Identity Verification and Fraud Prevention: To comply with applicable laws, legal processes, and regulatory requirement and verifying the identity of Users and undertaking necessary measures to prevent fraudulent activities, ensuring the integrity and security of the Platform.
20. Dispute Resolution: Investigating, enforcing, and resolving disputes, and applying the Terms of Use and Privacy Policy of Antara, either directly or through engagement of third-party service providers.
21. HIPAA Business Associate Agreements (BAAs): Where third-party vendors process PHI on our behalf, we enter into Business Associate Agreements (BAAs) requiring them to comply with HIPAA obligations, maintain security safeguards, and restrict use/disclosure of PHI.

5. Sharing of Personal Information
   • We may share personal information with the following parties:
6. Service Providers: Data processors who assist in processing personal information for specific purposes and under our instructions. While these service providers do not possess independent rights to share the information, certain providers, such as online communication service providers, may utilize and disclose the collected Personal Information in accordance with their own privacy policies.
7. Partners: Third parties with whom we have contractual relationships to offer products, services, or applications on or through our platform.
8. Antara Group Entities: Affiliated companies within the Antara Group, subject to applicable privacy laws, for business operations and marketing purposes.
9. Legal Requirements: When required by law, legal process, or government authorities, we may disclose personal information.
10. Business Transfers:In the event of a merger, acquisition, or sale of our business, personal information may be transferred as part of the transaction.
11. Consent and Authorization:We may share personal information with your consent or when authorized by you.

6. International Transfers of Personal Information
   • Your personal information may be transferred to and processed in countries outside the European Economic Area (EEA) or India, which may have different data protection laws. In such cases, we will ensure that appropriate safeguards are in place to protect your personal information including but not limited to Digital Personal Data Protection Act, 2025 local laws, etc.

7. Breach Notification
   • In the event of a personal data breach:
     • In terms of GDPR: We will notify the relevant supervisory authority without undue delay, and where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to your rights and freedoms. Where required, we will also notify affected individuals.
     • In terms of HIPAA: For breaches involving Protected Health Information (PHI), we will notify affected individuals without unreasonable delay, and in no case later than 60 calendar days after discovery, unless law enforcement requests a delay. Notifications will include the nature of the breach, the data involved, mitigation steps, and contact details for further information.

• HIPAA-Specific Safeguards: In compliance with the HIPAA Security Rule, we implement:
  • Administrative Safeguards: role-based access controls, workforce training, and enforcement of security policies.
  • Technical Safeguards: encryption of PHI in transit and at rest, secure authentication, and audit logging.
  • Physical Safeguards: restricted facility access, secure disposal of PHI, and physical protections for servers and devices.

• Risk Management & Assessments: We conduct periodic risk assessments to identify potential vulnerabilities in the handling of PHI and personal data. We implement mitigation plans to address identified risks, in line with GDPR’s data protection by design and HIPAA Security Rule requirements.

8. Data Security
   • We implement technical and organizational measures to ensure the security of your personal information and protect it against unauthorized access, disclosure, alteration, or destruction. We regularly review and update our security practices to meet industry standards.
   • Records of Processing: We maintain detailed records of our data processing activities, including purposes of processing, categories of data subjects, types of personal data, recipients of data, international transfers, retention periods, and applied security measures. These records are available to supervisory authorities upon request.
   • Transparency on Retention and Transfers:
     • Contact information: retained for three (3) years.
     • Health/medical data: retained for six (6) years after end of service, unless longer retention is required by law.
     • Transaction data: retained for eight (8) years for accounting and tax purposes.
       After the expiry of retention, data will be securely deleted or anonymized.
       Where personal data is transferred outside India or the EEA, appropriate safeguards such as Standard Contractual Clauses (SCCs) or other approved mechanisms are applied.

9. Data Retention
   • Antara will retain User's Personal Information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law including but not limited to comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention period may vary depending on the nature of the Personal Information and the purpose for which it was collected. Once the retention period expires, Antara will securely dispose of or anonymize the Personal Information to prevent unauthorized access, use, or disclosure.

10. Your Rights
    • As a data subject, you have certain rights regarding your personal information, in accordance with the applicable data protection laws. These rights include:
      • Right to Access: You have the right to obtain confirmation as to whether or not your personal information is being processed and, if so, to access that information and receive a copy of it.
      • Right to Rectification: You can request the correction, amendment, or updating of any inaccurate or incomplete personal information we hold about you.
      • Right to Erasure (Right to be Forgotten): You have the right to request the deletion or removal of your personal information under certain circumstances, such as when the information is no longer necessary for the purposes for which it was collected or processed.
      • Right to Restrict Processing: You can request the restriction of processing of your personal information under certain circumstances, such as when you contest the accuracy of the data or when the processing is unlawful, but you do not wish to have the data erased.
      • Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format and have the right to transmit that information to another data controller, where technically feasible.
      • Right to Object: You can object, on grounds relating to your particular situation, to the processing of your personal information when the processing is based on legitimate interests pursued by us or a third party. You also have the right to object to processing for direct marketing purposes.
      • Right to Withdraw Consent: If we rely on your consent as the legal basis for processing your personal information, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing based on consent before its withdrawal.
      • Right to lodgea complaint with the supervisory authority as defined under data privacy law in India.
      • Right to escalate a grievance to the Data Protection Board of India if not satisfied with Antara’s resolution.
      • Right to seek judicial remedies in case your complaint is not addressed by the supervisory authority.
      • When we rectify, erase, or restrict processing of your personal data, we will notify relevant third parties, unless doing so is impossible or requires disproportionate effort.

• To exercise your rights or make a privacy-related request or to raise User’s data deletion request, please contact us using the contact information provided below:

1. Name: Krishan Kant Srivastava
2. Designation: Data Protection Officer
3. Contact Number: +91-7895199464
4. Email: krishan.kant@antaraseniorcare.com
5. Working Days: Monday to Friday
6. Working Hours: 10:30 am to 6:30 pm

• We will respond to your request within the timeframe required by law and provide you with information on the actions taken in response to your request.
• Please note that certain limitations or exceptions may apply to these rights, as permitted or required by applicable laws.
• Training & Workforce Sanctions: All Antara employees undergo regular training on GDPR, DPDP, and HIPAA privacy and security requirements. Violations of privacy obligations may result in disciplinary action, up to and including termination of employment.

11. Children's Privacy
    • Our Platform is not intended for children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected personal information from a child, please contact us to request deletion of the information.

12. Changes to the Privacy Policy
    • We may update this Privacy Policy periodically to reflect changes in our privacy practices or legal requirements. We will notify you of any material changes through appropriate channels. We encourage you to review the Privacy Policy regularly to stay informed about how we protect your personal information. Continued use of Antara's services after modifications signifies acceptance of the updated Privacy Policy.

13. Disclaimer of Liability:
    • Antara makes every effort to protect the privacy and confidentiality of User's personal information in accordance with applicable laws and regulations. However, it is important to note that no data transmission or storage system can be guaranteed to be 100% secure. Therefore, by using Antara's services and providing your personal information, you acknowledge and accept the following disclaimers:
      • No Absolute Security: Antara has implemented commercially reasonable security measures to safeguard the personal information collected from Users. Notwithstanding these efforts, the User acknowledges and accepts that no security system is entirely immune to vulnerabilities. Antara expressly disclaims any warranties or guarantees of absolute security. The Platform and its systems may remain susceptible to unauthorized access, hacking, data loss, or other forms of security breaches.
      • User Responsibility: he User further acknowledges and agrees that it is their sole responsibility to take appropriate precautions to protect their personal information. Antara shall not be held liable for any unauthorized access, data breaches, hacking incidents, or data loss, whether arising directly or indirectly. The User agrees to access and use the Platform entirely at their own risk and shall bear full responsibility for any consequences arising therefrom.
      • Third-Party Actions: Antara cannot be held liable for any unauthorized access, use, or disclosure of personal information by third parties, including service providers, affiliated entities, or other users of the Platform. Users understand and acknowledge that certain third parties may have their own privacy policies and practices outside the control of Antara.
      • Limitation of Liability: To the fullest extent permitted by law, Antara, its affiliates, directors, officers, employees, agents, and contractors shall not be liable for any damages, losses, or liabilities arising out of or related to the collection, use, disclosure, storage, or protection of personal information, including but not limited to indirect, incidental, consequential, or punitive damages. Antara's entire and aggregate liability to the User under and in relation to the policy or otherwise shall not exceed the greater of Indian Rupees One Hundred (INR 100) or the price or value of the Product of Service, if any, paid by you to Antara under the relevant order to which the cause of action for the liability arises.
      • User Responsibilities: Users are responsible for ensuring the accuracy, completeness, and legality of the personal information they provide to Antara. Users are also responsible for safeguarding their login credentials and maintaining the security of their accounts. Antara shall not be liable for any unauthorized access or use of personal information resulting from the User's failure to comply with security measures or their responsibilities.
      • Third-Party Websites or Links: Antara's services may contain links to third-party websites or applications. This Privacy Policy does not apply to such third-party websites or applications. Users should review the privacy policies and terms of those third parties before providing any personal information. Antara shall not be responsible for the privacy practices or content of third-party websites or applications.
      • Escalation Rights: If you are not satisfied with our resolution, you have the right under GDPR to approach the supervisory authority in your country. Under DPDP, you may escalate your grievance to the Data Protection Board of India after exhausting Antara’s internal grievance mechanism.

14. Complaints and Grievance Redressal:
    • Antara is committed in addressing any concerns or complaints regarding the protection of your privacy and the handling of your personal information. If you have any complaints or grievances related to our Privacy Policy, we encourage you to follow the complaint resolution process outlined below:
      • Contact Us: In the event of a privacy-related complaint or grievance, please contact our designated privacy contact via email or postal mail using the contact details provided below in point 14. Please provide as much detail as possible regarding your complaint or grievance.
      • Investigation and Response: Upon receiving your complaint or grievance, Antara will promptly investigate the matter and take appropriate measures to address your concerns. We will acknowledge the receipt of your complaint and keep you informed of the progress during the investigation process.
      • Resolution and Redressal: Antara will make every effort to resolve your complaint or grievance in a fair and timely manner. If a resolution is reached, we will provide you with the necessary information and actions taken to address your concerns.
      • Escalation: If you are not satisfied with the initial resolution provided, you may escalate your complaint or grievance to the Nodal Officer nominated by Antara.
      • Cooperation: Antara requests your cooperation in providing accurate and relevant information to facilitate the investigation and resolution of your complaint or grievance.

We encourage you to communicate your complaint or grievance directly to us to allow us the opportunity to address your concerns and provide a satisfactory resolution.

15. Contact Us:
    • If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at the following:
16. Contact Information for Privacy-Related Complaints: Krishan Kant Srivastava
17. Email: krishan.kant@antaraseniorcare.com
    • We will respond to your inquiries or requests within a reasonable time frame.

• By using the Platform, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy, including the collection, use, and disclosure of your personal information as described herein.