Privacy Policy

Last Updated and Effective: October 24, 2026

Kurma Health (“Kurma Health,” “Kurma,” “we,” “our,” or “us”) owns and operates the website located at kurmahealth.com (the “Website”) and other related websites and platforms (collectively, the “Platform”). Your access to and use of the Platform, any part thereof, or anything associated therewith, including its content (“Content”), any products or services provided through the Platform or Website or otherwise by Kurma Health, and any affiliated website, software, or application owned or operated by Kurma Health (collectively, the “Services”) are subject to this Privacy Policy (“Privacy Policy”) unless specifically stated otherwise. Capitalized terms not otherwise defined in this Privacy Policy have the same meaning as set forth in the Terms of Service (“Terms of Service”).

In keeping with our commitment to protecting your privacy, this Privacy Policy describes:

  1. Personal Data that we receive from you when you interact with the Services
  2. How we use and process the Personal Data that we receive
  3. If and why Personal Data may be disclosed to third parties
  4. How we protect and retain your Personal Data
  5. Your rights and choices regarding the collection and processing of your Personal Data, and how to contact us

When you access the Services or send your Personal Data to us via email, text messages, or other electronic messages, you consent to receive communications from us, in accordance with this Privacy Policy.

Please read this Privacy Policy carefully. If you do not agree with this Privacy Policy, please do not use our Services. By creating an account, using our Services, or providing Personal Data to us, you confirm that you have read this Privacy Policy and understand it. If you have not done so already, please also review our Terms of Service. The Terms of Service contain provisions that limit our liability to you. If you are using the Services on behalf of an individual other than yourself, you represent that you are authorized by such individual to act on such individual’s behalf and that such individual acknowledges and agrees to the terms and conditions herein.

Changes to this Privacy Policy and notifications

We may amend this Privacy Policy from time to time. If we make material changes, we will notify you before they take effect, using the contact details you have provided, and where the law requires it, we will ask for your consent again before applying those changes to your Personal Data. We will also post the updated Privacy Policy on the Website and show the date of the most recent revision at the top of this document. You are responsible for reviewing this Privacy Policy periodically.

We may send you notices about changes to this Privacy Policy or the Terms of Service by email, SMS, or other electronic means, or by posting them on the Website. Where we send promotional messages, we will do so only with your consent and in line with applicable telecom regulations. Notices sent to the contact details in your account are treated as received.

We will not apply material changes that reduce your privacy protections to Personal Data we have already collected unless we notify you and, where required, obtain your consent. This Privacy Policy supersedes all previous versions.

Information we collect about you

The Personal Data we collect depends on how you interact with us, which parts of the Services you use, and the choices you make. We collect information that you give us directly and information that we collect automatically when you use the Services or interact with our advertising and applications on third-party websites. This includes:

  1. Personal Data such as your name, mailing address, telephone number, email address, demographic information (e.g., age, gender, ethnicity), payment information, and the content of your communications with us by email, text message, or other channels. Payment card details are handled by our payment processor.
  2. Health Information such as your health history, biometric information, lab results and scans, and prior diagnoses, which we collect to determine your eligibility for the Services (together, “Healthcare Information”). Healthcare Information is sensitive Personal Data. We collect it only where it is necessary for the purpose stated at the time of collection, and only with your specific consent, which we will request separately.
  3. When you book a test, we share your name, contact details, age, and the tests you have requested with our partner laboratories so they can collect and process your sample. If sample collection is done at your home or another location, the collection address and the name of the collection agent are also shared.
  4. Test results and related records that our partner laboratories send to us, including biomarker values, reference ranges, sample identifiers, collection and reporting dates. We receive these records from the laboratory so we can provide you with your health insights and recommendations.
  5. Your IP address, device information, browser type, usage data, and information collected through cookies and similar technologies, as described in our .
  6. Inferences we draw from the information above about your likely preferences or other characteristics, and your approximate location (city, state, and country) derived from your IP address.
  7. Information from wearable devices, fitness apps, or other third-party accounts that you connect to the Services, in line with the settings you choose on those platforms.

Where we ask for Personal Data, you may decline to provide it. You can also use your browser or device settings to limit some automatic collection, such as cookies. However, if you do not provide information that is necessary for a service or feature, that service or feature may not be available or may not work fully. Before we ask for Healthcare Information, we will tell you why we need it.

Healthcare Information

Kurma Health is not a healthcare provider, and the Services do not replace medical care. The Healthcare Information we collect and process is governed by the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and other applicable Indian laws, including any professional or sector-specific rules that apply to the clinicians, laboratories, or pharmacies involved (collectively, “Privacy Laws”).

Kurma may give you access to tests, clinical consultations, and related services through our partner laboratories, clinicians, and pharmacies (collectively, “Affiliated Providers”). Each Affiliated Provider is responsible for its own compliance with Privacy Laws and for the medical records it creates and maintains. Where an Affiliated Provider discloses your Healthcare Information to us so that we can support its delivery of services to you, for example by hosting its reports or providing it with analytics, we will use and disclose that information only as permitted by Privacy Laws and this Privacy Policy, and only for the purposes for which it was shared. We will not use your Healthcare Information for marketing unless you give us separate, specific consent for that purpose.

How we use your Personal Data

Kurma Health processes your Personal Data for legitimate business purposes, the fulfillment of our services to you, compliance with our legal obligations, and/or your consent. Each purpose rests on your consent or on a legitimate use permitted under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). Where we rely on consent, you can withdraw it at any time. We use Personal Data for the following purposes:

  1. to fulfil the purpose for which you provided it. For example, if you provide payment information, we use it to process your payment;
  2. to arrange your biomarker tests with our partner laboratories, and to present your results and health insights to you;
  3. to provide our AI-powered health features, under which your health data and messages are processed by data processors we contract with, solely on our behalf.
  4. to communicate with you about, and manage, your account;
  5. to understand your preferences so we can personalise your experience of the Services, where you have consented to this personalisation;
  6. to store and track your data securely within our systems;
  7. to determine your eligibility for the products and services available through the Services, including confirming your location;
  8. to respond to lawful requests from public and government authorities, and to comply with applicable law, including court orders;
  9. to protect our rights, privacy, safety, or property, and that of you or others, including by giving notices, pursuing legal remedies, and limiting our losses;
  10. to operate and improve the Services, including by developing new functionality;
  11. to evaluate the quality of service you receive and identify usage trends, using aggregated or de-identified data wherever possible;
  12. to keep the Services safe and secure;
  13. to send you information about changes to our terms, conditions, and policies;
  14. to perform our obligations and enforce our rights under any contract between you and us, including collecting payments;
  15. to send you email alerts, event registrations, and notices about our products, services, events, or news that may interest you, where you have opted in to receive them. You can opt out at any time;
  16. to conduct testing, research, analysis, and product development, using de-identified or aggregated data wherever possible. We will use Healthcare Information for research only with your specific consent or where the law otherwise permits it.

Because Healthcare Information is sensitive Personal Data, we will obtain your specific consent before we collect it and before we use it for any purpose beyond the Services you have requested.

We may de-identify Personal Data so that it no longer identifies you or your household, and use that de-identified data to operate, maintain, and improve the Services and for the purposes described in this Privacy Policy. We de-identify information in accordance with the standards set out in applicable law, including the de-identification standard under HIPAA at 45 C.F.R. § 164.514(b). We take reasonable measures to ensure that de-identified data cannot reasonably be used to identify you or to link it to you. We commit to maintain and use de-identified data only in de-identified form and not to attempt to re-identify it, except to test whether our de-identification process meets the requirements of applicable law. We contractually require any person who receives de-identified data from us to meet the same commitments. If we determine that data can no longer be kept in de-identified form, we will treat it as Personal Data under this Privacy Policy.

We may use your Personal Data to contact you about offers, promotions, and other marketing communications, but only where you have given us consent to receive them. We will not use your Healthcare Information for marketing. You may withdraw your consent to marketing communications at any time by using the unsubscribe link in the message or by writing to us at hello@kurmahealth.com. Our marketing messages will comply with the Telecom Commercial Communications Customer Preference Regulations, 2018, including the requirements on registered templates and the Do Not Disturb registry.

Cookies and other Data Collection Tools

A cookie is a small piece of data sent from a website and stored on your device by your web browser. Cookies contain information about your device, such as a user ID, user settings, browsing history and activities conducted while using the Services. Cookies are not themselves personally identifiable but may be linked to Personal Data. A cookie typically contains the name of the domain from which it originated, its “lifetime” of the cookie (i.e., when it expires) and a randomly generated unique number or similar identifier.

Cookies may be placed when you visit our Website. You can review and change your choices at any time through the ‘’ link in the footer of our Website. Cookies help analyze web traffic or let a web server know when you visit a particular site. Cookies allow the Website to respond to you as an individual. Using cookies, the Website can also tailor its operations to your needs, likes, and dislikes by gathering and remembering information about your preferences. We use cookies and other data collection tools, such as web beacons and server logs, which we collectively refer to as “data collection tools,” to help improve your experience with the Services. For example, we may use web beacons in our email messages or newsletters to tell us whether you open them and act on them.

Some cookies are strictly necessary to provide a service you have requested, such as keeping you signed in or remembering the choices you have made in . All other cookies, including analytics, preference, and marketing cookies, are used only with your consent. You can give, refuse, or withdraw that consent at any time through .

We, and our analytics and advertising partners, use these technologies in our websites, apps, and online services to collect Personal Data (such as the pages you visit, the links you click on, and similar usage information, identifiers, and device information) when you use our services, including Personal Data about your online activities over time and across different websites or online services. This data is used to store your preferences and settings, enable you to sign-in, analyze how our websites and apps perform, track your interaction with the site or app, develop inferences, deliver interest-based advertising, and combat fraud. We do not sell your Personal Data. We do not place advertising or tracking tools on pages where Healthcare Information is entered or displayed, including test booking, health questionnaire, and results pages. We do not share Healthcare Information with advertising platforms.

Overall, cookies help us provide you with a better experience with Kurma Health by showing us which pages you find useful and which you do not.

You can accept or decline cookies. Most web browsers accept cookies by default, but you can change your browser settings to decline them. For more information about managing and deleting cookies, you can visit www.allaboutcookies.org. Some browsers and mobile devices also let you reject cookies or device identifiers, or alert you when a cookie is placed. Although you are not required to accept cookies, blocking or rejecting them may prevent access to some features of the Services.

Note: We treat Global Privacy Control (GPC) signals as a request to opt out of the sharing of Personal Data and targeted advertising for that browser or device. We do not respond to other “Do Not Track” browser signals.

Artificial Intelligence features

We may use artificial intelligence (AI) technologies to power certain features of the Services, such as automated chat support, document summarization, or personalized non-clinical recommendations and insights. When you use an AI feature, we may collect and process the information you enter or upload to generate relevant outputs and improve our Services. We test our AI features for accuracy and fairness before release and review them periodically. AI outputs are provided for general information and do not replace advice from a qualified clinician. If an AI output is inaccurate or affects you significantly, you can ask for it to be reviewed by a person by contacting us at hello@kurmahealth.com. We do not use AI systems to make decisions that have a legal or similarly significant effect on you, such as decisions about your eligibility for insurance, employment, or credit, without human review.

Text messaging and WhatsApp communication

By opting to use the Services provided by Kurma Health, you consent to receive messages from Kurma Health on WhatsApp about your account, the tests you have booked, and your use of the Services. These messages may include sample-collection reminders, test status updates, notices that a report is available, updates on services, promotional offers, and information relevant to your account and services.

You acknowledge and agree that:

  1. You are the owner or authorised user of the mobile number you provide, and you are authorised to consent to messages on it;
  2. Messages may be sent using automated technology;
  3. You do not have to consent to receive these messages as a condition of purchasing any goods or services;
  4. WhatsApp is operated by Meta Platforms, Inc. Messages sent through WhatsApp are also subject to WhatsApp’s terms and privacy policy. Meta may process information such as your phone number, the time of messages, and your device data, as described in its policies;
  5. The frequency of messages varies with your use of the Services;
  6. Standard carrier and data charges may apply;
  7. We are not liable for delayed or undelivered messages caused by factors outside our reasonable control, including network or device issues.

Our messages will not contain your test values or other detailed Healthcare Information. They will tell you that a report is available, and you will view it in your secure account. Please do not send us Healthcare Information, reports, or test results by WhatsApp, email, or any other informal channel.

You may withdraw consent to any messages at any time by replying “STOP” to a message. We will confirm the change by message. Withdrawing consent to marketing messages will not affect your services. Withdrawing consent to service messages, such as sample-collection or report alerts, may mean we cannot provide those services in the way you requested. For assistance or more information, reply “HELP” or contact us at hello@kurmahealth.com.

Disclosure of Your Personal Data

We do not sell your Personal Data. We disclose it only for the purposes described in this Privacy Policy, and only to the recipients listed below.

We may disclose your Personal Data to the following recipients:

  1. Affiliated Providers, such as partner laboratories, clinicians, and pharmacies, that you choose to receive products or services from, to the extent needed to deliver those products or services;
  2. data processors, contractors, and service providers that we use to support our business, such as cloud hosting, software, AI model, communications, and diagnostic testing partners;
  3. law enforcement agencies, courts, or government authorities, where we are required to do so by law or by a valid legal order, or where disclosure is necessary to protect the security, safety, or rights of our users, our staff, or the public;
  4. marketing and analytics vendors, only to the extent you have consented to marketing or analytics cookies under the section. We do not disclose Healthcare Information to marketing vendors; and
  5. a prospective or actual buyer, investor, or successor, in connection with a merger, acquisition, restructuring, or sale of some or all of our business or assets, subject to this Privacy Policy, and we will notify you where the law requires it.

We may also disclose aggregated information about our users and de-identified information that does not identify any individual. Where we do so, we will comply with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), and we will contractually require the recipient to keep the information in de-identified form, not to attempt to re-identify it, and not to disclose it further except on the same terms.

Your rights

You can access, review and update or change your account information through our Services. If you have any questions about how to access other Personal Data, or if you would like to correct or delete any Personal Data we collect and maintain, please contact us at hello@kurmahealth.com. We will accommodate requests as required by law. Otherwise, we will retain a record of your request, and your Personal Data will be maintained in accordance with this Privacy Policy and our data retention and deletion policies.

You can ask us to:

  1. Confirm whether we are processing your Personal Data and give you a summary of it, including the categories of Personal Data collected and the purposes for which it is processed, and the identities of the other Data Fiduciaries and data processors with whom it has been shared, where applicable.
  2. Correct, complete, or update inaccurate or incomplete Personal Data.
  3. Erase Personal Data that is no longer needed for the purpose for which it was collected, or that you have asked us to erase.
  4. Withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. We will explain the likely consequences of withdrawal before you confirm it, including any Services that can no longer be provided.
  5. Nominate another person to exercise your rights on your behalf if you become incapacitated.

We may be unable to erase some Healthcare Information, or to hold it in a form that you have asked us to change, because we are required by law to keep it. Clinical records and laboratory reports are subject to statutory retention periods. When we refuse or limit an erasure request for this reason, we will tell you the legal basis and the period for which the information must be kept. Affiliated Providers that created medical records may hold them under their own legal obligations, and you should contact them directly about those records.

We will respond to your request within the time prescribed under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it. We may ask you to verify your identity before we act on a request, so that we do not disclose your information to someone else. If you are not satisfied with our response, or if you believe we have not complied with the DPDP Act, you may raise a grievance at the contact details above.

Exercising any of these rights will not lead us to deny you the Services or reduce their quality. However, if we need certain Personal Data to provide a Service, we may be unable to provide that Service if you withdraw consent or ask for erasure, and we will tell you so beforehand.

Responding to your Requests

We will respond to your request within the period prescribed under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it. If we need more time, we will tell you the reason and the revised timeline.

To protect your information, we may ask you to verify your identity before we act on a request. We will ask for only as much information as we need for verification. For example, we will normally ask you to send the request from the email address or mobile number registered to your account, or to confirm a one-time code sent to it. We will not ask you to provide Aadhaar details or other government identity documents for this purpose unless the law requires it.

If you cannot make a request from your registered contact details, please contact us at hello@kurmahealth.com, and we will tell you what other verification we can accept.

You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights under this section. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

How we keep your Personal Data secure

We keep Personal Data only for as long as it is needed for the purposes for which it was collected, or as required by law. We also keep certain information after your account is closed where the law requires it, or where it is needed to prevent fraud, resolve disputes, enforce our Terms of Service, or collect fees owed. Clinical records and laboratory reports may be kept for longer periods under applicable medical and record-keeping laws. When information is no longer needed, we erase it or de-identify it.

We use reasonable security safeguards to protect Personal Data against unauthorised access, use, alteration, disclosure, accidental loss, or destruction. These include encryption of Personal Data in transit and at rest, role-based access controls, multi-factor authentication for staff access, logging and monitoring of access to Healthcare Information, and regular backups. The safeguards we apply are proportionate to the sensitivity of the information, and Healthcare Information receives the highest level of protection. We keep our security practices under regular review and are actively working to achieve formal ISO/IEC 27001 certification.

Our processors and partner laboratories must also apply appropriate security measures under their contracts with us. We check that they do so before we share Personal Data with them, and we review their performance periodically.

No method of transmission or storage is completely secure, and we cannot guarantee the absolute security of Personal Data. Nothing in this section limits any right you have under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) or any other applicable law. You are responsible for keeping your password, one-time codes, and other login details confidential, and for keeping your device secure. Please tell us immediately at hello@kurmahealth.com if you believe your account has been compromised.

We will never ask you to share your password or one-time code by email, WhatsApp, or phone.

If we suspect a security breach affecting your account or the Services, we may temporarily suspend your access while we investigate. Where we do so, we will tell you as soon as reasonably practicable, unless doing so would compromise the investigation or is prohibited by law.

If a personal data breach occurs, we will:

  1. promptly investigate the incident and identify its cause;
  2. take reasonable steps to contain it and remediate the vulnerabilities within our control;
  3. notify the Data Protection Board of India and affected individuals as required by the DPDP Act and the rules made under it, including without undue delay and within the timelines those rules set;
  4. cooperate with affected users and with any competent authority;
  5. document the incident and the actions we took; and
  6. review the incident after it has been resolved and take steps to prevent a recurrence.

Data retention

We keep Personal Data only for as long as it is needed for the purpose for which it was collected, or as required by law. Once that purpose has been served and retention is no longer necessary for a legal requirement, we will erase the Personal Data or de-identify it, as the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) requires. We also erase Personal Data when you withdraw consent, unless we are required by law to keep it. We may keep certain Personal Data for longer where this is necessary to comply with a legal obligation, to resolve disputes, to enforce our agreements, or to prevent fraud. Where we do so, we will limit access to that information to what is needed for that purpose.

Affiliated Providers, such as partner laboratories and clinicians, are independent of us for the purposes of the medical records they create. They keep those records for the periods required by applicable medical, clinical, and laboratory laws, and they handle them in accordance with their own privacy notices and agreements with you. We do not control those retention periods, and you should contact the relevant Affiliated Provider about records they hold.

Links to Third-Party Services

Our Services may contain links to websites, services, applications, or other resources operated by third parties (“Third-Party Services”). Information you provide to a Third-Party Service is not governed by this Privacy Policy. Before you share Personal Data with a Third-Party Service, please read its privacy policy, which will explain how it collects, uses, retains, and deletes your information. A link does not mean that we endorse the Third-Party Service, and we are not responsible for its practices. Personal Data that our Affiliated Providers collect is also subject to their own privacy notices, which you can request when you receive healthcare services from them.

We are not responsible for the information practices of other organisations, including social media platforms, app stores, operating system providers, wireless service providers, and device manufacturers, or any other third party you choose to share Personal Data with through the Website, the Platform, or their pages.

Children under the age of 18

The Services are not intended for children. You must be at least 18 years old to use the Services, and you must not provide Personal Data through them if you are under 18 (“Minors”). We do not solicit or knowingly collect information from Minors, and if we become aware of any such information being collected, we will take immediate action to delete it. If you are a parent or guardian and believe that a Minor has provided Personal Data to us, please contact us at hello@kurmahealth.com.

Opt-out and unsubscribe

We may send you service communications, such as account notices, sample-collection updates, and report alerts, using your Personal Data. You may withdraw consent to receive marketing communications, such as offers, promotions, and newsletters, at any time, by using the unsubscribe option in the message or by writing to hello@kurmahealth.com. Withdrawing consent to marketing does not affect the Services you have requested. Even if you withdraw consent to marketing, we may still send you messages that are necessary to provide the Services you have booked or to comply with law. Withdrawing consent to any other processing is governed by the Your Rights section.

Jurisdiction and cross-border transfers

We are located in India. We may store and process your Personal Data in any country where we have facilities or in which we engage service providers. By using the Services, you understand that your information may be transferred to countries outside of your country of residence, including India, which may have data protection rules that are different from those of your country. We transfer Personal Data outside India only as permitted by the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and any restrictions notified by the Central Government.

Contacting us

If you would like to receive additional information about our privacy practices, have questions, or would like to make a request, you may contact us at hello@kurmahealth.com.

We will acknowledge your grievance and respond within the timelines set by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act and its Rules.