Privacy Policy

2.1 If you are a seeker

You give us:

• Account details: name, email address, phone number, city and country, and date of birth so we can confirm you are 18 or older.
• Booking details: the program, dates or slots, participant details, dietary and accessibility needs, and an emergency contact.
• Health declaration: the health and fitness information you provide before attending, which can include conditions, injuries, medication, allergies and pregnancy where relevant.
• LEWIS reflections: your responses across the nine wellbeing areas, and the insight reports built from them.
• Feedback and reviews after a program.
• Anything you write to us in support or grievance correspondence.

We generate:

• Your booking history, LIFED credit balance and dashboard.
• Program suggestions shown to you and the plain explanation of why each one fits.
• Your wellbeing trend over time, as before-and-after measurement rolls out.

We collect automatically:

• Device, browser, app version, IP address, and usage events needed to run and secure the service.
• Cookies and similar technologies, as described in Section 11.

We receive from others:

• From our payment partner: the fact and status of a payment, and limited card metadata.
• From an organisation that has enrolled you: your work email and eligibility status.
• From a Healthmate: confirmation that you attended and any incident report concerning you.

2.2 If you are a Healthmate

• Identity and entity details.
• Qualifications, certifications, licences and professional registrations.
• Contact details for you and your team.
• Venue location, facilities, capacity and photographs.
• Program objectives, structure, schedules, inclusions and pricing.
• Payout details and KYC information required to pay you lawfully.
• Where relevant, insurance certificates, food licences, safety provisions and regulatory permits.
• Bookings, availability, settlements, ratings, reviews and support correspondence.

Full banking credentials are held by our regulated payment partner, not by LIFED.

2.3 If you are an organisation using LIFED

• Contact details for account administrators.
• A participant roster containing names, work email addresses and eligibility status.
• Contracts, credit balances, invoices and utilisation records.

We do not collect wellbeing information from you about your people, and we do not accept it if offered.

Under the Digital Personal Data Protection Act, 2023, we must have a specific lawful basis for every use. India's law is narrower than some others: there is no general “legitimate interests” basis for commercial processing, so most of what we do rests on your consent.

Withdrawing consent is as easy as giving it. Withdrawal is not retrospective, and it does not stop processing we are legally required to continue, such as keeping transaction records.

4.1 Your LEWIS responses, insight reports, wellbeing trends and program feedback are together what we call Restricted Wellbeing Data.

4.2 Restricted Wellbeing Data:

1. is never disclosed to your employer or any sponsoring organisation in a form that identifies you or could reasonably be used to identify you;
2. is never disclosed to a Healthmate;
3. is never disclosed to another seeker;
4. is never sold, rented or used for advertising by us or anyone else;
5. is accessible inside LIFED only to named roles with a documented operational need, and every access is logged;
6. is never used to make a decision about you that has a legal or similarly significant effect.

4.3 We will not disclose Restricted Wellbeing Data in identifiable form to an organisation even if it asks, offers to pay, or makes it a condition of signing or renewing a contract.

That refusal is written into every corporate agreement we sign, and a client cannot treat our refusal as a breach.

4.4 The only exceptions are:

1. you specifically ask us to share it with someone you name;
2. there is a serious and immediate threat to life or health and sharing is necessary to address it;
3. a lawful order compels it, in which case we will tell you unless the law forbids us.

4.5 People only reflect honestly when they are certain nobody is grading them. That certainty is the product. If we ever traded it for a contract, the reflections would stop being honest and the whole thing would be worth nothing to anyone.

5.1 What a Healthmate sees

To host you safely and well, the Healthmate you booked receives your name, booking, dates or slots, dietary and accessibility needs, emergency contact and health declaration.

That is the complete list. They never see your LEWIS responses, insight reports, wellbeing trend, or bookings with anyone else.

They are contractually required to use the information only for your booked program, keep it secure, not use it for their own marketing, and delete it within 12 months after delivering the program unless you separately and directly consent to hear from them.

5.2 What other seekers see

Your published reviews, and your first name where you choose to display it. Nothing else.

5.3 What an organisation sponsoring you sees

Billing and utilisation information, and aggregate wellbeing reporting as set out in Section 6.

Our standard arrangement is a voucher model, where you redeem anonymously against a pooled balance and your employer sees only aggregate consumption.

Where an organisation instead sponsors a specific named booking so it can be invoiced, it will see that you made that booking, because that is how the invoice works.

What it never sees, in any model, is anything covered by Section 4.

5.4 Third parties who process data for us

Every one of them is under a written contract limiting them to our instructions, requiring security safeguards and prohibiting any other use.

5.5 Others

Authorities may receive data where a valid legal order requires it.

An acquirer may receive data if LIFED is merged or acquired, on the condition that this Policy continues to apply.

5.6 What we never do

We do not sell personal data. We do not share it with advertising networks or data brokers. There is no advertising on LIFED, so there is nothing for your information to be targeted with.

6.1 We produce aggregate, de-identified insights to improve matching, show Healthmates how their programs are helping, and give organisations cohort-level wellbeing trends as outcome measurement rolls out.

6.2 Before any aggregate output is produced or shared:

1. direct identifiers are removed;
2. no report is produced for a group smaller than 25 people;
3. no breakdown by team, location, function, grade, gender, age band or another attribute is produced where the resulting group is smaller than 50 people;
4. suppression and rounding are applied so a value cannot be worked out by comparing two reports;
5. recipients are contractually prohibited from attempting to re-identify anyone.

6.3 The two different thresholds are deliberate. A single threshold can be defeated by slicing.

6.4 Aggregate outputs contain no free-text comments, attributable quotes, attendance lists tied to wellbeing values or callouts of outliers.

6.5 Organisation reports contain participation rates and distributions and movement across the nine wellbeing areas for the cohort as a whole. Outcome measurement is still rolling out, and we will not present a trend as proven before the data supports it.

People with access are limited to named roles with a documented need, confidentiality obligations and appropriate training.

Third parties are reviewed before onboarding and periodically afterwards.

We maintain a documented incident response plan.

No system is perfectly secure, and we are not going to claim otherwise. What we can commit to is taking reasonable security safeguards as required by Section 8 of the Digital Personal Data Protection Act, 2023, and telling you promptly if something goes wrong.

When a period ends, data is deleted or irreversibly de-identified. Deleting your account does not delete records we are legally required to retain.

You have the right to:

• Know and access. Get a summary of the personal data we hold, how we process it and which parties we have shared it with.
• Correct and complete. Fix information that is inaccurate, incomplete or out of date.
• Erase. Have data deleted where we no longer need it and no law requires us to keep it.
• Nominate. Name another person to exercise your rights if you die or become unable to.
• Withdraw consent. Withdraw consent at any time, as easily as you gave it.
• Complain. First to us, and then to the Data Protection Board of India.

You can exercise your rights through the privacy centre in your account, or by writing to privacy@lifed.com . We respond within 30 days and may first need to verify your identity. There is no charge.

If we refuse a request, we will tell you why in writing and explain how to escalate.

10.1 LIFED accounts are for people aged 18 and over.

10.2 A person under 18 may attend a program only where a parent or legal guardian books, provides verifiable consent and completes the health declaration. We process the child's information only for that program and for their safety.

10.3 LEWIS is not available to anyone under 18.

10.4 We do not track children, monitor their behaviour, or direct advertising at them.

10.5 Where we work with a school or another institution, a separate written protocol governs consent, collection, access, retention and child-protection reporting.

11.1 What we use

11.2 We do not use advertising cookies, third-party advertising pixels or profiles built for anyone else's marketing.

11.3 When you first visit, you choose. Non-essential cookies are off until you turn them on, and nothing is pre-ticked.

You can change your choices at any time through the cookie settings link in the footer. Rejecting is as easy as accepting.

11.4 Your browser also lets you block or delete cookies. Blocking strictly necessary cookies will stop parts of LIFED from working.

11.5 The mobile app uses equivalent local storage and device identifiers for the same purposes, with the same choices.

12.1 Personal data is stored on servers located in [India / specify].

12.2 Some service providers listed in Section 5.4 may process data outside India.

12.3 Any transfer outside India is made in line with Section 16 of the Digital Personal Data Protection Act, 2023 and Rule 15 of the DPDP Rules, 2025, and only to destinations permitted under that framework as it stands at the time.

Where we transfer data, contractual safeguards are put in place with the recipient.

12.4 If you are in the UK or European Union, additional protections may apply and are set out in our [UK and EU Addendum].

13.1 If there is a personal data breach, we will notify the Data Protection Board of India as the DPDP Rules, 2025 require.

13.2 We will notify affected individuals within 72 hours, in plain language, telling you what happened, what information was involved, what we are doing about it and what you can do to protect yourself.

13.3 We will not delay telling you in order to finish investigating. You will get what we know, when we know it, and an update when we know more.

We will notify material changes at least 15 days before they take effect, by email or in the app.

Where a change requires fresh consent, we will ask for it rather than assume it.

Previous versions are available on request.

15.1 This Policy is governed by the laws of India, principally the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, together with the Information Technology Act, 2000 and Consumer Protection Act, 2019 where relevant.

15.2 India has one central data protection law, not separate state ones. The regulator is the Data Protection Board of India and has national jurisdiction.

Consumer complaint jurisdiction may depend on where you live or work under the Consumer Protection Act, 2019.

15.3 DISHA was a draft health data law proposed in 2018. It was never enacted and has no legal force. Our obligations and your rights arise from the Digital Personal Data Protection Act, 2023.

15.4 How to complain

1. Write to us at privacy@lifed.com . We acknowledge within 48 hours and respond within 30 days.
2. If you are not satisfied, escalate to our Grievance Officer: [Name], grievance@lifed.com , [Address].
3. If you are still not satisfied, you may complain to the Data Protection Board of India.
4. For matters about your booking rather than your data, the Consumer Commission route remains available.

15.5 The courts at Kochi have jurisdiction over matters arising from this Policy that are not within the Board's remit, without affecting your statutory right to complain where you live or work.