Privacy Notice

Gooclaim OS is a Claim OS used by insurers and third-party administrators (TPAs) in India. This notice explains what personal data we handle, why, who sees it, how long we keep it and how to exercise your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025, as they come into force.

1. Who we are

Gooclaim Technologies Private Limited (“Gooclaim”, “we”, “us”) is a company incorporated in India with its registered office in Bengaluru. We build and operate the Gooclaim OS platform and this website, gooclaim.com.

2. Our two roles under the DPDP Act

• For claimants and policyholders, we are a Data Processor. The insurer or TPA handling your claim is the Data Fiduciary: it decides what data is processed and why, and its own privacy notice is the one that governs your data. Gooclaim OS processes that data only on its instructions, under a contract with it. Sections 3 to 9 describe how.
• For visitors to gooclaim.com and people who join our waitlist, we are the Data Fiduciary. Section 10 describes that data.

3. Claimant data we process

On behalf of your insurer or TPA, and only what a workflow needs:

• Identity and contact — name, mobile number, email address, policy number, member ID and claim reference.
• Claim information — the claim’s status, the documents it still needs, the reason for a query, deduction or decision, and its regulatory clock, as recorded in your insurer’s or TPA’s own claims system.
• Documents you upload through a secure upload link, such as a discharge summary or bills. These can contain health information.
• Your conversation with the insurer or TPA on WhatsApp, email or any other channel they turn on, including any complaint you raise.
• Consent and verification records — when you gave or withdrew consent, and whether a one-time code was verified (the code itself is not kept in the conversation record).
• Technical data — message times, delivery receipts and language preference.

Aadhaar, PAN, card and bank numbers are masked before a conversation is stored, and identifying details are masked or hashed in our internal logs.

4. Why we process it

• To tell you the status of your claim, with the source and date.
• To ask for, collect and check the documents your claim needs.
• To explain a query, deduction or decision, using wording your insurer or TPA has approved.
• To record and track a complaint, and send you its outcome.
• To confirm it is you before sharing anything personal.
• To help your insurer or TPA meet IRDAI timelines and reporting, and to keep an audit record of what was done and said.

5. Consent, and the one exception

No conversation about your claim goes ahead until you have given consent, and that consent is recorded. You can withdraw it at any time on the channel where you gave it; once withdrawn, the conversation stops.

The one exception is a notice your insurer or TPA is obliged by IRDAI to send you — for example, a request for a document your claim still needs. Such a notice goes only to the contact registered on your policy, carries claim information only and nothing promotional, and is never sent if you refused or withdrew consent.

6. How messages to you are made

You receive only messages your insurer or TPA has approved. Before any message is sent, every value in it is checked against your insurer’s or TPA’s record. AI models help us understand your question and choose the right approved message; they do not write free-text replies to you. Every AI call goes through our own model gateway, and your data is not used to train any model.

7. Who sees your data

• The insurer or TPA handling your claim, and only its staff whose role allows it.
• Service providers we use to run the platform, under contract with us: cloud hosting, storage, encryption keys and email delivery (Amazon Web Services), WhatsApp delivery (Meta’s WhatsApp Business Platform), and AI models (Anthropic, OpenAI and Mistral AI), reached only through our own model gateway.
• Regulators, courts and authorities, where the law requires it.

Each insurer’s or TPA’s data is kept apart from every other’s. We do not sell personal data.

8. How long we keep it

There is no single answer, and we would rather give you the real one. Everything below turns on one question: is this part of a claim record? If it is, it is kept for years. If it is not, it is deleted in months.

Kept for ten years — from the last activity on the claim. IRDAI requires your insurer or TPA to keep insurance records under a retention policy approved by its own board, rather than fixing a period itself. Ten years is the default Gooclaim OS applies, and they may set it higher:

• documents you upload for a claim;
• a conversation that is part of a claim or a complaint — including what we asked you for and what we told you;
• the audit record of what the platform did on that claim: every automated decision, every message sent, every consent change.

Deleted after 90 days:

• a conversation that turns out not to belong to any claim or complaint — if you write to us and there is no case, it does not become a record;
• an upload link once it has been used or has expired;
• the platform’s own operational logs, which carry no compliance obligation.

Deleted after 30 days: a file that was refused or held — if we could not accept your upload, we do not keep it.

Two things can change these periods. Your insurer or TPA may choose to keep claim records longer than ten years, up to thirty — never shorter. And a legal hold, such as a court case or a regulator’s order, stops every deletion until it is lifted.

When an insurer or TPA stops using Gooclaim OS, its data is returned or deleted as its contract says, except where a law requires it to be kept longer.

9. Your rights as a claimant

Under the DPDP Act you have the right to:

• get a summary of your personal data and how it is processed (section 11);
• have it corrected, completed, updated or erased (section 12);
• have a grievance addressed (section 13);
• nominate someone to act for you if you die or cannot act (section 14);
• withdraw consent at any time.

Because your insurer or TPA is the Data Fiduciary, please send these requests to them first. If you cannot reach them, write to contact@gooclaim.com and we will pass your request to them and help them answer it. Erasure may be limited where a claim record has to be kept — under your insurer’s or TPA’s IRDAI records policy, or a legal hold. If your grievance is not resolved, you may complain to the Data Protection Board of India.

If we become aware of a breach affecting your data, we tell your insurer or TPA without delay, so that it can inform you and the Data Protection Board as the DPDP Rules require.

10. Website visitors and the waitlist

For this data, Gooclaim is the Data Fiduciary.

• What we collect — when you join the waitlist: your name, work email, company, and, if you choose to give them, your role and monthly claim volume, plus which button on the site you used and the campaign tags in the link that brought you here (such as utm_source). These tags are read from the link itself; we do not set cookies to track you.
• Why — to reply to you, arrange a walkthrough and keep you informed about Gooclaim OS. We do not use it for anything else and we do not sell or share it for marketing.
• Where it goes — the website runs on Vercel; waitlist entries are kept in our Google Workspace and emails are sent through Resend. These providers may process data outside India.
• How long — until you ask us to remove it, or when we no longer need it to contact you about Gooclaim OS.
• Your rights — the same as in section 9. Write to contact@gooclaim.com to see, correct or delete your entry, or to stop hearing from us.

11. Cookies and analytics on this website

This website shows no advertising and runs no advertising trackers. It uses Vercel Web Analytics and Speed Insights to count page views and measure page speed in aggregate; they do not use cookies to identify you. The Gooclaim OS platform signs users in with short-lived tokens.

12. Security

• Encryption in transit (TLS 1.2 or higher) and at rest.
• Each insurer’s or TPA’s data isolated at every layer. The tenant is taken from the signed-in session alone, and a cross-tenant request is refused and recorded.
• Staff sign-in supports multi-factor authentication, and each person sees only what their role allows.
• An append-only, tamper-evident audit ledger of what the platform does.
• A responsible-disclosure channel at security@gooclaim.com.

13. Where data is processed

Gooclaim OS runs on Amazon Web Services. The hosting region is agreed with each insurer or TPA in its contract and can be an India region. The AI model providers named in section 7 may process data outside India. Any transfer outside India is made only as section 16 of the DPDP Act allows — never to a country the Government of India has restricted — and with contractual safeguards.

14. Children

This website and our waitlist are not meant for anyone under 18. Where a claim concerns a child, the insurer or TPA deals with the parent or lawful guardian, as the DPDP Act requires.

15. Changes to this notice

We will update this notice when our practices or the law change. The “Last updated” date at the top always shows the latest version.

16. Grievance officer and contact

For any question or grievance about personal data, write to our Grievance Officer at contact@gooclaim.com. We will acknowledge it within three business days and respond within the time the DPDP Rules allow. If you are not satisfied, you may complain to the Data Protection Board of India.