Privacy Policy
Last updated: 10 July 2026
This policy explains what personal data Prudential HCL Health Insurance Limited collects through the Prudential Health mobile app, why we collect it, who we share it with, and the rights you have under the Digital Personal Data Protection Act, 2023.
1.Who we are
Prudential HCL Health Insurance Limited ("we", "us", "our") is a health insurance company registered in India, a joint venture of Prudential plc and the HCL Group operating under the brand name Prudential Health. For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the data fiduciary for the personal data described in this policy.
This policy covers the Prudential Health mobile app on Android and iOS. It does not replace your insurance policy documents. Your policy contract, and the privacy terms that apply to it, continue to govern your insurance relationship with us.
If anything here is unclear, write to us at support@prudentialhealth.in.
2.What we collect
We collect only what the app needs to work. Grouped simply:
Identity and contact details
Your name, mobile number, email address (optional) and, if you use the app without a linked policy, your self-reported date of birth. Your mobile number is your login: we send a one-time password to it each time you sign in, so we never store an account password for you.
Policy and member details
If your account is linked to a Prudential Health policy: your policy number, plan name, policyholder name, sum insured, premium, policy dates and status, and the details of covered members on the policy (name, relationship, date of birth, gender, phone number and member ID). These come from our insurance records, not from your device.
Health and fitness data
With your explicit consent, and only with it, the app reads only the health and fitness data needed for the user-facing app features you choose to use, such as daily step count, distance and exercise sessions, from Health Connect on Android or Apple Health/HealthKit on iOS. We do not read any other health records from these platforms unless additional data types are separately disclosed to you and enabled by you. The specific data types we access are listed in the permission screens shown by Google and Apple before you grant access, and you can revoke that access at any time in your device settings, Health Connect settings or Apple Health settings. If you used an earlier version of the app that synced with Google Fit, activity data previously collected from Google Fit remains part of your step history and is handled in exactly the same way.
Health information you type into calculators
Our calculators work on the details you choose to enter. The BMI and BMR calculators use height, weight, age and gender. The Heart Score and diabetes-risk calculators ask for more, including smoking status, ethnicity, family history of diabetes, blood-pressure treatment, steroid use and, where relevant, gestational diabetes or polycystic ovaries. Some of this may be sensitive health-related information. We ask for it only when you open a calculator, use it only for the app feature you selected, such as computing your wellness score, risk score or calculator result, and store past results so you can see your history.
Photos
If you set a profile picture, you choose it from your photo library or take it with your camera. The image is compressed and stored on your own device; if a copy is ever associated with your profile on our servers, it is deleted along with your account as described in section 10. It is not used for identification or verification.
Location
On Android, with your separate and specific consent, the app may take a limited location snapshot during background step sync. We use it only to check whether recorded step counts are plausible against actual movement and to protect the premium-discount programme against fabricated activity. We do not continuously track your location, build a movement history, use location for advertising, use it for unrelated profiling, or share it for any unrelated purpose. Where the in-app location consent refers to using location to provide the services, this step-plausibility check is that use. The current iOS app does not collect location for this purpose.
Device and technical data
A random device identifier generated when you install the app, your device platform, operating system version, app version, and a push-notification token so we can deliver notifications. Our servers also keep standard security logs of sign-ins and sessions.
Usage analytics
If you accept our data-processing consent, we collect analytics about how the app is used: screens viewed, features used, sync results and crash reports. Analytics are filtered so that phone numbers, email addresses and policy numbers are never included; sign-in events record only the last four digits of your number, and the text of your article searches is never logged. If you decline this consent, analytics and crash reporting stay switched off.
3.How we collect it
Four sources, and nothing hidden:
From you, when you register, complete your profile, enter calculator details, upload a photo or contact support.
From your device, with your permission, when the app reads steps and activity from Health Connect or Apple Health, takes a location snapshot on Android, or registers for push notifications. Every one of these is gated behind an operating-system permission, an in-app consent, or both.
From our own systems, which generate technical records such as session logs, sync records and consent records as you use the app.
From our insurance records, when you link the app to your policy and we match your registered mobile number to the policy and covered-member details we already hold as your insurer.
4.Why we use it
The DPDP Act requires a lawful basis for every use of your personal data. Here is how our uses of your data map to those bases:
| What we do | Data involved | Lawful basis |
|---|---|---|
| Create your account, verify OTPs, keep your session secure and run the app | Identity, contact, device data | Consent given at registration and, where applicable, the data you voluntarily provide to receive the requested app service. Certain account, security and service operations may also be processed as legitimate uses permitted under section 7 of the DPDP Act. |
| Track steps, calculate healthy days and determine premium-discount eligibility | Health and fitness data | Your explicit consent, which you can withdraw at any time |
| Compute calculator results and show your history | Calculator inputs | Your specific consent and the details you voluntarily enter to request the calculator result. Sensitive health-related inputs are used only for the calculator feature and related history you choose to use. |
| Validate step data against movement to prevent fraud | Location snapshots (Android) | Your separate location consent |
| Send service communications by SMS, email and WhatsApp | Contact details | Your consent per channel, as described in section 6 |
| Improve the app, fix crashes, understand feature usage | Usage analytics | Your data-processing consent |
| Service your insurance policy and comply with insurance regulation | Policy and member records, audit logs | Legal obligation under IRDAI regulations and other applicable law |
| Detect and prevent fraud, abuse and security incidents | Technical logs, step-validation results | Legal obligation, security and fraud-prevention purposes, and other legitimate uses permitted under the DPDP Act, limited to what is necessary for the relevant purpose. |
We ask for each consent separately and specifically, in plain language, at the point where it matters. Refusing a consent limits only the feature it relates to. You can use the app without granting health, location, analytics or communication consents; you simply will not get the features that depend on them.
The app is not a medical device and does not give medical advice. Step counts, healthy days, calculator scores and articles are general wellness information only. They are not a diagnosis, a treatment recommendation or an underwriting decision. If you have symptoms or health concerns, consult a doctor. In an emergency, call your local emergency services.
5.Healthy days & premium discounts
This is the core exchange in Prudential Health, so we state it plainly. Each day you reach your daily step goal (10,000 steps by default) counts as a healthy day. Healthy days accumulate toward milestones, and reaching a milestone can earn a discount on the premium of your linked Prudential policy, applied at renewal. Your health and fitness data is used solely for the user-facing health, wellness, step-tracking, healthy-days, rewards and premium-discount functionality you request. It is not sold, not used for advertising, not used for marketing analytics, not used for data mining, not used for unrelated profiling, and not used for any purpose unrelated to providing those app features. Health and fitness data obtained from Health Connect, Apple Health or HealthKit is not disclosed to third parties except where necessary to provide the user-facing health or fitness feature you requested, with your permission, or where required by applicable law.
Because a real financial benefit is attached, we apply anti-abuse controls. Daily steps are capped at 200,000, and on Android we may compare step counts against location movement to flag implausible activity. Discount eligibility is computed automatically from your healthy-day count under the published milestone rules. If an automated check would adversely affect a discount or benefit you believe you have earned, you can ask us to have a person review the decision through the contact in section 15.
Your accumulated healthy-day count is shared with our policy administration system so that an earned discount can be applied to your policy. That earned credit belongs to the policy: it survives even if you later delete your app account.
6.Communications
We send one-time passwords and essential security messages (for example, a sign-in on a new device or an account-deletion confirmation) to your registered mobile number. These are necessary to operate your account and cannot be opted out of while you hold an account.
Beyond that, every channel runs on its own consent, collected in the app. Service communications by SMS and email require the email/SMS consent. Service communications on WhatsApp require a separate WhatsApp opt-in, which covers that channel only. Push notifications, including any promotional ones, can be switched off at any time through the notifications toggle in the app's settings or in your device settings, with no effect on your policy or your use of the app. Marketing or promotional communications relating to the app are optional, consent-based and can be withdrawn at any time. You do not need to agree to marketing to use the app, and we do not use health or fitness data from Health Connect, Apple Health or HealthKit for marketing or advertising. We do not send marketing messages by SMS, email or WhatsApp unless we have first asked for and received a specific consent for them, and we comply with TRAI telemarketing regulations for SMS and voice communications in India.
9.Data security
We protect your data with encryption in transit and at rest, access controls that limit our staff to what their role requires, one active session per account (signing in on a new device signs the old one out), OTP re-authentication for sensitive actions such as account deletion, and audit logging of administrative access. Crash reports identify you only by a hashed identifier, never your phone number or name.
No system is perfectly secure, and you play a part too: keep your device locked, do not share OTPs with anyone (we will never ask for one), and tell us immediately at support@prudentialhealth.in if you suspect unauthorised access to your account. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as the DPDP Act requires, and CERT-In where applicable.
10.Data retention and deletion
We keep your account data while your account is active and you use the app. Consent records are kept as proof of the consents you have given. When data is no longer needed for the purpose it was collected for, we delete it or anonymise it.
Deleting your account
You can delete your account in the app at Profile → Settings → Delete account. We confirm it with an OTP sent to your registered number. The moment you confirm:
- your account is deactivated and all sessions on all devices are signed out;
- push notifications stop and the app's local data on your device is wiped;
- a 30-day window begins during which sign-in is blocked. If you change your mind, our support team can restore the account within this window;
- after 30 days your account is permanently erased: your profile (name, phone, email, photo), step and healthy-day records, health-platform connections, calculator results, notifications, consent records, location snapshots and sessions are all deleted. Permanent erasure cannot be undone.
Some records may survive deletion because the law, regulatory obligations or the insurance relationship requires us to retain them. Your policy and covered-member records remain with us as insurer records, retained for the periods required under IRDAI regulations and other applicable laws, with the link to your deleted app account removed where feasible. Security audit logs are retained only to the extent necessary for security, legal or audit purposes. Any healthy-day count already pushed to the policy administration system stays at its last value, because an earned discount belongs to the policy.
One thing we cannot do for you: deleting your account does not revoke the permissions you granted in Health Connect or Apple Health. Please remove Prudential Health's access in your device settings after deleting your account.
If you register again after erasure, you start with a fresh account.
11.Your rights under the DPDP Act
As a data principal under the DPDP Act, you have the right to:
Access. Ask for a summary of the personal data we hold about you and how we have processed it. Much of it is already visible in the app, in your profile, policy card, step history and calculator history. For a full summary, email us.
Correction. Update your profile details in the app, or ask us to correct inaccurate or incomplete data by email. Policy details are corrected through our standard policy-servicing channels.
Erasure. Delete your account in the app as described in section 10, or ask us by email to erase data that is no longer needed for the purpose it was collected for.
Withdraw consent. Every consent can be withdrawn as easily as it was given: disconnect the health platform in Settings, revoke permissions in Health Connect or Apple Health, turn off notifications in Settings, or email us to withdraw location, analytics or communication consents. Withdrawal does not affect processing already done, and it stops the related feature going forward.
Grievance redressal. Raise a complaint with our Grievance Officer (section 15). If you are not satisfied with our response, you may escalate to the Data Protection Board of India, and for insurance-servicing grievances to the Insurance Ombudsman or the IRDAI's Bima Bharosa portal.
Nominate. Name a person who may exercise your rights if you die or become incapacitated. Email us to record a nomination.
We verify identity before acting on a request, normally by OTP to your registered mobile number, and we respond within the timelines the DPDP Act and its rules prescribe.
12.Children
The Prudential Health app is for adults. You must be 18 or older to register an account. Children may appear in the app only as covered members under an adult's policy, and their details (name, date of birth, relationship) are provided to us by the policyholder as part of the insurance contract, not collected from the child. We do not create app accounts for minors, and we do not track children, monitor their behaviour or direct advertising at them.
13.International transfers
Your data is stored and processed primarily in India: our servers run in the Google Cloud Mumbai region, and insurance records are maintained in India in line with IRDAI requirements. Some service providers, such as Google (Firebase, Google Fonts) and Apple (Apple Health, push notifications), operate global infrastructure, so limited technical data may be processed outside India when those services are used. Any such transfer is made in accordance with the DPDP Act and applicable sectoral rules, and never to a country the Indian government has restricted for this purpose.
14.Changes to this policy
We will update this policy when the app, the law or our practices change. The "Last updated" date at the top tells you the current version, and the latest version published in the app will prevail over any earlier version. You should therefore refer to the latest version of this policy whenever you use the app. For significant changes, we will notify you in the app or by a message to your registered contact details before the change takes effect, where required by applicable law. Where a change requires fresh consent under the DPDP Act, we will ask for it separately before relying on that change for the relevant processing. Earlier versions are available from us on request.
15.Grievance officer & contact
Questions, requests and complaints about your personal data go to our Data Protection and Grievance Officer:
The Grievance Officer (Data Protection)
Prudential HCL Health Insurance Limited
48th Floor, Commerz III, Oberoi Garden City, Off Goregaon East, Mumbai - 400063, Maharashtra, India
CIN: U65120MH2025FLC457866
Email: privacy.indiahealth@prudentialhealth.in
App support: apps.india@prudentialhealth.in
Please include your registered mobile number so we can verify you. We will confirm your identity by OTP or another appropriate verification method; never share an OTP itself in an email. We acknowledge grievances within three working days of receipt and endeavour to resolve them within 30 days, or within any shorter timeline prescribed by the DPDP Act, its rules or IRDAI grievance-redressal norms. If you remain dissatisfied, section 11 explains how to escalate to the Data Protection Board of India or the Insurance Ombudsman.