Privacy Notice

Quarkmind Private Limited, S. No. 136, Flat No. L/1101, Marvel Diva II, Magarpatta, Hadapsar, Pune 411028, Maharashtra · hello@curoinsight.com · +91 88302 81387

This notice explains how Quarkmind Private Limited (CuroInsight) (“CuroInsight”, “we”) processes personal data when we run health checks for your employer and provide the CuroInsight Health app, the health card, and our WhatsApp and SMS services. It is given under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its Rules, and the Information Technology Act, 2000.

1. What we collect

• Identity and contact: name, mobile number, year of birth, gender, preferred language, and from your employer your employee code, company, plant, department and job role.
• Health data: your examination findings, test results, reports, fitness decisions and certificates, and the consents you give. Activity (steps, distance, active minutes) only if you switch on activity sync.
• Use of benefits: partner visits checked in with your card, bill amounts, coins, rewards and challenges.
• Device and app: device type, app version, a notification token, sign-in records, and crash reports from which health data and contact details are removed. Your location only when you ask for partners near you; it is not stored.
• Messages: what you send us on WhatsApp, SMS or email, and records of what we send you.

2. Why we use it, and on what basis

• Statutory examinations under the Factories Act, 1948 and the State Factories Rules: examination, certification by a certifying surgeon appointed by the State Government, and the registers your employer must keep. Basis: the law, and the purposes the DPDP Act allows for employment and legal compliance.
• Your reports, the app, the card and partner discounts. Basis: your consent, given at the health check or in the app.
• Plain-language explanations of doctor-reviewed results by the CuroInsight Intelligence Engine, which uses AI. Basis: your consent. Only de-identified values with your age and sex are used; never your name, number or employee code. The engine never diagnoses; doctors set the rules it follows.
• Offers and news on WhatsApp, never based on your health results. Basis: your separate consent; reply STOP at any time.
• Security, fraud prevention and our legal duties (tax, audit, disputes).

3. Who sees what

• Your employer's HR sees your fitness decision and any work restrictions, never your test values, and group figures in which groups under ten people are hidden.
• Your employer's compliance officer receives the statutory record the law requires the employer to keep (registers, certificates, reports). Each access is logged.
• Doctors and laboratories who examine you or test your samples, under confidentiality.
• Partners see only that your card is valid, your discount and tier, never your health information.
• Our service providers (processors): cloud hosting in India; WhatsApp messaging; SMS delivery; app notifications; crash reporting; and an AI provider that receives only de-identified data. They act on our instructions under contract. Some of them may process data outside India, as the DPDP Act allows; health data is stored in India.
• Authorities, when the law requires.

We never sell your data, and never use health data for advertising.

4. How long we keep it

Statutory health records are kept for the period the Factories Act and State Rules require (generally at least [to confirm: fifteen (15)] years from the last entry). App and activity data are deleted when you delete your account, except what we must keep by law. Sign-in and message records are kept for [to confirm: three (3)] years.

5. Your rights

You may ask to see a summary of your data and who it was shared with; correct, complete or update it; erase data we no longer need or must not keep; withdraw a consent (in the app under Me > My choices, or by writing to us), which stops that processing from then on; and nominate a person to exercise these rights if you die or cannot act. You can download your data and delete your account in the app.

Withdrawing a consent does not affect processing the law requires for statutory examinations.

6. Security

Health data is kept in a separate clinical record system, encrypted in transit and at rest; access is limited by role and logged. We will tell you and the Data Protection Board of India of a personal data breach as the DPDP Act requires.

7. Children

The Services are for adults. We do not knowingly process children's data except as dependants' data arranged by an employer with verifiable parental consent.

8. Questions and complaints

Questions and grievances: write to hello@curoinsight.com or call +91 88302 81387, or write to Quarkmind Private Limited, S. No. 136, Flat No. L/1101, Marvel Diva II, Magarpatta, Hadapsar, Pune 411028, Maharashtra. We acknowledge a grievance within two (2) working days and resolve it within thirty (30) days.

If you are not satisfied with our answer you may complain to the Data Protection Board of India.

9. Changes

We will tell you in the app before a material change. The version and date of this notice are shown above.