CureALife Healthtech – Data Retention Policy

DATA RETENTION POLICY

Effective Date: 10/Sep/2025

1. Objective

This policy is established to define how long different categories of personal, sensitive, and health data are retained by CureALife Healthtech Private Limited, ensuring compliance with legal and regulatory mandates.

2. Retention Periods

The following standard retention periods apply to data stored on the Platform:

• Medical Records: 3–10 years (or as mandated by the relevant medical laws and professional guidelines of the jurisdiction)

• Prescriptions: 5-7 years

• Telemedicine Logs (Audio/Video/Chat): 5-7 years

• Payment Records: As per national tax and financial reporting laws (typically 7 years or more)

• Audit Logs & Access History: 2 years

• Anonymized Research Data: Indefinite (as individual identity cannot be derived)

3. Secure Deletion

Upon the expiration of the defined retention period, data will be permanently deleted using industry-standard secure erasure methods or rendered fully anonymized, in accordance with the user's right to deletion.

4. Legal Holds

In the event of a legal dispute, investigation, or ongoing audit, the retention period for relevant data categories will be temporarily extended until the conclusion of the matter, superseding the standard retention schedule.

© CureALife Healthtech Private Limited. All rights reserved.