Privacy Policy

Papama is operated by Papama Care Pvt. Ltd. (“Papama”, “we”, “us”). We arrange trusted, non-medical, in-home elder care in Karaikudi, Trichy, Madurai and Chennai.

This policy explains what personal information we collect through papama.in and the Papama apps, why we collect it, who can see it, and the choices you have. It is written for families, not for lawyers.

For the purposes of India’s Digital Personal Data Protection Act, 2023 and the rules under it, Papama Care Pvt. Ltd. is the Data Fiduciary responsible for the information described here.

Account information

• Your email address and a password, which is stored only as a secure one-way hash — we never store your actual password.
• If you turn on two-factor authentication, a secret used to check your one-time codes.
• Your account role (family, Care Companion or staff) and basic timestamps.
• We do not ask families for a name or phone number to open an account.

Information about the person you arrange care for (the “care recipient”)

• Their name, your relationship to them, and date of birth, if you choose to add it.
• Notes you choose to share about mobility, memory, hearing or vision, behaviour, medical background, daily and meal routine, communication preferences, and the kind of Care Companion you would prefer.
• Emergency contact names, relationships and phone numbers.

Care assessment

If you complete a care assessment, we collect the care-needs details you enter — for example whether the person lives alone, help needed with meals, medication reminders, walking, errands or appointments, mobility and cognitive notes, sleep and night-waking patterns, language preference, doctor or hospital preference, and home-safety notes.

Service address

The house or flat, street, locality, city, state and PIN code where care is delivered, any landmark or access instructions, and — only if you provide them — map coordinates.

Bookings and care records

• Your service requests, the plan and schedule you choose, and the price our server calculates for your PIN’s city.
• Your care plans and their versions.
• For completed visits: check-in and check-out times and location, tasks completed, and the Care Companion’s visit notes and observations.
• Any safety incident recorded during a visit, and any rating or review you leave.

Care Essentials orders

Items you order, the delivery address, order and payment status, the amount, and the payment method our team records. During Early Access we arrange payment manually — we do not collect card, UPI or bank details on the website.

Support and messages

In-app notifications and the content of support requests you send us.

Technical information

A session token is stored in your browser to keep you signed in. Our servers keep operational logs (such as an internal request identifier, the type of event and the time) to run and secure the service, and standard web-server logs may briefly record the requesting IP address and page path. We use your IP address momentarily to limit abusive traffic, and we do not store it in our database alongside your account.

People who apply to be a Care Companion provide more information, because we screen everyone who enters a customer’s home:

• Full legal name, date of birth, mobile number, email, current and permanent address, and city, state and PIN code.
• Languages spoken, read and written, and preferred working language.
• Identity document type and number (for example Aadhaar or PAN), PAN number, and police-verification details.
• Work experience, education, certifications, availability, base city and service area.
• Short written answers to scenario questions used by our Trust & Safety team.
• Uploaded documents: a profile photo and copies of identity, address-proof, police-verification and certificate documents (JPEG, PNG or PDF, up to 10 MB each).

Care Companion documents and identity numbers are stored privately, are never shown on a public page, and are opened only by authorised Papama Trust & Safety staff. We do not currently hold Care Companion bank or payout account details in this system.

We use each type of information for a specific purpose:

Account information — to create and secure your account, sign you in, and contact you about your bookings and account.

Care recipient information — to understand the person’s care needs, match a suitable Care Companion, prepare a care plan, and let the assigned Care Companion deliver the agreed care.

Service address — to confirm whether Papama serves that location, calculate the correct city price, and give the assigned Care Companion what they need to reach the home.

Care assessment and care notes — to plan appropriate care and brief the Care Companion.

Bookings, visits and reviews — to operate the service, show you what happened during a visit, handle billing, investigate safety concerns, and improve quality.

Care Companion information and documents — to verify identity and eligibility, run background and reference checks, and maintain service quality and safety.

Support requests — to answer your questions and resolve issues.

Technical information and logs — to keep the service running, diagnose problems, and protect against abuse and fraud.

We do not use your information for advertising, and we do not use it for any purpose that is unrelated to providing and improving Papama.

When you add someone else’s details — a parent, grandparent or other dependent — you confirm that you are permitted to share their information with Papama for the purpose of arranging their care, and that you will inform them, where appropriate, that Papama holds it.

We use that information only to understand and deliver the care you request. Access is restricted to authorised Papama staff and the Care Companion assigned to the visit. One family can never see another family’s information.

Some of what you share — medication reminders, allergies, mobility, medical background, care notes and emergency information — is sensitive. We collect it only so a Care Companion can look after your parent safely and so our team can match and support the arrangement. It is shown only to the assigned Care Companion and authorised Papama staff, and only to the extent needed for the visit.

Papama provides non-medical care. It is not a medical service, an emergency service, or a substitute for a doctor, hospital or ambulance. In an emergency, contact local emergency services.

We do not claim any health-data certification such as HIPAA, which is a United States law and does not apply to this service.

Directly from you — when you register, add a care recipient or an address, complete an assessment, book care, place an order, apply as a Care Companion, or contact support.

From an assigned Care Companion — when they check in, complete tasks and file a visit report.

Automatically, in a limited way — the sign-in session stored in your browser, and server operational logs.

With the Care Companion assigned to a visit — only the details they need (see section 10).

With the infrastructure provider that hosts Papama’s servers and database.

With the certificate authority that issues the security certificate for papama.in — this involves only the domain name.

If we enable optional AI-assisted summaries in future, with the provider of the AI model that powers that feature. This is not active today, and we will update this policy before it is.

With authorities or professional advisers where we are legally required to, or to establish or defend a legal claim, or to investigate a safety incident or fraud.

We do not sell your personal data. We do not share it with advertisers or data brokers, and we do not use it for advertising.

A company that processes personal data on our behalf is a Data Processor. Today this is our cloud hosting provider, which runs the servers and database that Papama operates on.

We require any processor to protect the information, act only on our instructions, and use it only to provide their service to us.

Access to information is controlled by role. A Care Companion assigned to a visit is shown only:

• the customer’s name and the care recipient’s name,
• the service address and access instructions,
• the care plan, the visit tasks and the relevant care notes,
• an emergency contact.

They are not shown your account email, unrelated bookings, other families’ information, or internal notes. Families see updates only for their own care recipients. Operations and Trust & Safety staff can access the records needed to match care, resolve a support request, or investigate a safety concern.

During Early Access, Papama collects payment manually — our team records that a payment was received and by what method. We do not process card, UPI or bank-account details on the website.

If we add online payments later, they will be handled by a licensed payment provider and we will update this policy first.

We send in-app notifications about your bookings and account. SMS, push and email delivery are being built and are not active yet — no external SMS or email is sent from Papama today.

You can turn off non-essential notifications in your settings. Some messages, such as a security or safety notification, are part of the service and cannot be switched off while you have an account.

Families do not upload photos or documents in the current product.

Care Companion applicants upload verification documents and a profile photo, as described in section 3. These are stored privately and opened only by authorised Trust & Safety staff.

Our team uploads product images for the Care Essentials catalogue; these are not personal information about you.

Papama does not use cookies.

To keep you signed in, we store a session token in your browser’s session storage, which is cleared when you close the browser or sign out.

We do not use analytics, advertising or third-party tracking technologies, and website fonts are served from papama.in rather than a third party. If we add analytics in future, we will update this policy and provide controls where required.

We use reasonable technical and organisational safeguards, including:

• encrypted (HTTPS) connections, enforced with HSTS;
• passwords stored only as salted hashes;
• optional two-factor authentication;
• role-based access controls;
• browser security response headers and a strict content-security policy;
• request rate-limiting;
• session expiry and revocation; and
• a database and internal services that are not exposed to the public internet.

Encryption of data at rest, formal third-party security certification, and routine off-site backups are on our roadmap and not yet complete. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We keep personal information only for as long as it is reasonably needed to: provide the service and operate your account; meet legal, tax and regulatory requirements; resolve disputes; and prevent fraud and abuse.

When information is no longer needed for these purposes, we delete it or remove the details that identify you. We have not yet published fixed retention periods for each type of record; we are defining a retention schedule and will add it to this policy.

Subject to applicable law, you can ask us to:

• give you a summary of the personal information we hold about you and how we use it;
• correct or update information that is inaccurate or incomplete;
• delete your personal information, where we are not required to keep it;
• withdraw a consent you have given (see section 18);
• nominate another person to exercise your rights if you are unable to; and
• raise a grievance about how we handle your information.

You can do some of this yourself in the app — update your profile, your care recipient’s details and your addresses, remove a care recipient, and turn off non-essential notifications. For anything else, including a copy of your data or deletion of your account, contact us as described in section 21. We will respond within the time required by applicable law.

Where we rely on your consent — for example to process detailed care and health-related notes about your parent — that consent is specific to arranging the care you request, and you give it by choosing to enter that information.

You can withdraw it by removing the information, removing the care recipient, or asking us to close your account. Withdrawing consent may mean we can no longer provide some or all of the service. It does not affect processing we have already carried out lawfully.

We do not run marketing consent, and we do not pre-tick any consent box.

Papama is for arranging care for adults — parents and elderly family members. The current product is not intended for, and does not knowingly collect personal information about, children. Baby Care is not offered.

If we introduce any service that involves a person under 18, we will add the verifiable parental-consent and safeguarding steps the law requires before doing so.

Papama’s servers and database are hosted in a single region, and we intend to keep personal information within India. If we ever process or store personal information outside India, we will do so only as permitted by law and will update this policy.

We will update this page as the product and our data practices change, and we will change the “Last updated” date at the top. For a significant change we will make reasonable efforts to notify account holders in the app.

Papama Care Pvt. Ltd.

For any question or request about your privacy — access, correction, deletion, withdrawing consent, nominating someone to act for you, or a grievance about how we handle your information — contact us through Papama Support in the app, or by email at privacy@papama.in.

We will acknowledge your request, and respond and resolve grievances within the time required by applicable law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.