Legal
Privacy Policy
How Cent Care collects, uses, shares and protects personal data, including the health information of the seniors we care for.
Cent Care Pvt. Ltd. ("Cent Care", "we", "us") provides in-home elder care services across India. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what rights you have.
We are the Data Fiduciary for this data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). If you use our website or our services, this policy applies to you.
The short version. We collect what we need to provide care and nothing we cannot justify. We record health readings during visits because that is the service. We never sell your data. We share it only with the partners who help deliver your care, and only the part of it they need. You can ask us for a copy, ask us to correct it, or ask us to delete it, and we will act within 30 days.
1. Who this policy covers
Three groups of people, with different relationships to us:
- The Care Sponsor. Usually the adult son or daughter who arranges and pays for care. Often living in another city or country.
- The Care Recipient. The senior receiving care at home. In many cases the Care Sponsor arranges the service on their behalf.
- Website visitors. Anyone browsing cent.care, whether or not they become a customer.
2. What we collect
2.1 From the Care Sponsor
- Name, mobile number, email address, city and country of residence
- Relationship to the Care Recipient
- Billing details and payment records. Card and bank details are handled by our payment gateway and are never stored on our systems
- Your communications with us, including calls, WhatsApp messages, emails and form submissions
2.2 From or about the Care Recipient
Some of this is health data, which the DPDP Act treats with particular seriousness. We collect it because it is the service you are asking us to provide.
- Name, age, date of birth, home address and contact number
- Existing medical conditions, current medication, allergies and blood group
- Preferred hospital, treating doctor and emergency contacts
- Vital signs recorded at each visit, such as blood pressure, blood sugar, oxygen saturation, pulse and weight
- Medication adherence, mobility and general wellbeing observations recorded by the care operator
- Visit notes and photographs taken during a visit, for example of a completed medicine handover or a hazard in the home
- Location of the home, used to verify that a visit actually took place and to dispatch help in an emergency
- Diagnostic test results, where you have asked us to arrange testing
2.3 From website visitors
- Pages viewed, time spent on each page, scroll depth and the site or advertisement that brought you to us
- Device type, browser, operating system and language
- A truncated IP address. We deliberately remove the final block, storing 103.21.244.x rather than the full address. This tells us the approximate city and internet provider without holding an identifier that points to a specific connection
- A randomly generated visitor identifier stored in your browser. It contains no personal information and is not linked to your name unless you contact us
3. Why we collect it, and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Delivering care visits, scheduling operators and running the visit protocol | Care Recipient identity, address, medical baseline, visit records | Consent, and performance of the service you asked for |
| Detecting a change in health early and escalating it | Vital signs recorded over time | Consent |
| Responding to an emergency, including dispatching an operator and contacting a hospital or ambulance | Location, medical conditions, emergency contacts | Consent, and protection of vital interests where the person cannot consent at that moment |
| Keeping the Care Sponsor informed about visits and health changes | Visit records, vitals, contact details | Consent |
| Arranging diagnostics, medicine delivery or a doctor consultation at your request | Prescription, relevant medical details, address | Consent |
| Billing, invoicing, tax records and accounting | Sponsor identity, payment records | Legal obligation |
| Understanding how the website is used so we can improve it | Truncated IP, pages viewed, device, referrer | Legitimate use for service improvement |
| Responding to enquiries and complaints | Your communications with us | Consent |
| Safety, fraud prevention and verifying that visits took place | Geo-verified check-in records, operator logs | Legitimate use |
4. Consent, and consent given on someone else's behalf
We ask for clear, specific consent before we begin collecting health data. Consent is recorded with a timestamp and the version of this policy in force at that time.
Where the Care Sponsor arranges care for a parent or relative, they confirm at sign-up that the Care Recipient has been informed and agrees. In addition, our care operator confirms the Care Recipient's own agreement at the first visit and records it. We do this because the person whose health data we hold should know we hold it, even when someone else arranged the service.
If a Care Recipient is unable to give consent because of a medical condition, we will proceed on the basis of consent from the person lawfully entitled to act for them, and we will record who that person is and on what basis they are acting.
Withdrawing consent
You may withdraw consent at any time by writing to support@cent.care or calling us. Withdrawal applies going forward and does not undo anything lawfully done before it. If you withdraw consent for health data collection, we will not be able to continue providing the care service, and we will tell you that plainly rather than letting the service quietly fail.
5. Who we share data with
We do not sell personal data. We do not share it with advertisers for their own use. We share only what a partner needs to do their part of your care:
- Our care operators. The assigned operator sees the Care Recipient's medical baseline, address and access instructions. They do not see billing information.
- Doctors and clinical reviewers we engage, where you have asked for a consultation or where a reading needs clinical interpretation.
- Diagnostic laboratories, where you have ordered a test.
- Pharmacies, where you have ordered medicine, limited to the prescription and delivery details.
- Hospitals and ambulance partners, in an emergency, limited to what is needed to treat the person safely.
- Payment gateways for processing payments and issuing GST invoices.
- Technology providers who host our systems, send our messages or provide analytics, under written confidentiality obligations.
- Government authorities, where we are legally required to disclose.
Analytics services on this website
- Google Analytics 4. Used for aggregate website statistics. Google does not log or store IP addresses in GA4; it derives an approximate location and discards the address.
- Meta Pixel. Used to measure the performance of our advertising on Facebook and Instagram. Meta may use this data in line with its own policies.
- Our own first-party analytics. Hosted on our servers, storing a truncated IP as described above. It does not use cookies.
You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on, and you can limit Meta's advertising data use in your Facebook or Instagram account settings.
6. Cookies and browser storage
Our own analytics does not set cookies. It stores a random identifier in your browser's local storage, which you can clear at any time through your browser settings. Google Analytics and Meta Pixel may set their own cookies, governed by their respective policies.
7. How long we keep data
| Type of data | Retention period |
|---|---|
| Care records, visit notes and vital signs | For the duration of the service, then 3 years, so that a family or a doctor can request history after the service ends |
| Billing, invoices and tax records | 8 years, as required under Indian tax and company law |
| Consent records | For as long as we hold the related data, plus 3 years |
| Enquiries that did not become customers | 12 months |
| Website analytics logs | 180 days, after which they are deleted automatically |
| Visit photographs | 12 months, unless part of an open incident |
When a retention period ends, we delete the data or irreversibly anonymise it.
8. Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we hold about you and who we have shared it with
- Correct data that is inaccurate, and complete data that is incomplete
- Erase data where it is no longer needed for the purpose it was collected for, subject to legal retention requirements
- Nominate another person to exercise your rights on your behalf in the event of death or incapacity. This matters for our customers, and we encourage every Care Recipient to nominate someone
- Withdraw consent, as described in section 4
- Complain to us, and escalate to the Data Protection Board of India if you are not satisfied
To exercise any of these, write to support@cent.care. We will verify your identity and respond within 30 days. There is no charge.
9. Grievance Officer
If you have a concern about how we handle personal data, contact our Grievance Officer:
Archana Mukhopadhyay
Grievance Officer, Cent Care Pvt. Ltd.
Email: support@cent.care
Phone: +91-70398 35598 or +91-75010 45270
1st Floor, Gitanjali, Plot No. 64, Saptarshi Park, Durgapur, West Bengal 713206
We acknowledge every grievance within 72 hours and resolve it within 30 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
10. How we protect data
- Access is limited to staff who need it for their role. A care operator sees only their assigned families. Our finance team cannot access health records at all
- Data is transmitted over encrypted connections and stored on access-controlled servers
- Photographs and documents are served through expiring private links, never public folders
- Every access to a health record is logged with the person and the time
- Care operators are background-verified and bound by written confidentiality obligations
If a personal data breach occurs, we will notify the Data Protection Board of India and every affected person as required by law, describing what happened, what data was involved and what we are doing about it.
11. Children's data
Our services are for adults, generally seniors. We do not knowingly collect personal data of anyone under 18. If we learn that we have, we will delete it.
12. Data stored outside India
Our systems are hosted in India. Some service providers, such as analytics and messaging platforms, may process limited data outside India. Where that happens, we ensure appropriate contractual safeguards and comply with any restrictions notified by the Government of India under the DPDP Act.
13. Changes to this policy
If we make a significant change, we will update the date at the top of this page and notify active customers by email or WhatsApp. Where the change requires fresh consent, we will ask for it rather than assume it.
14. Contact us
Cent Care Pvt. Ltd.
1st Floor, Gitanjali, Plot No. 64, Saptarshi Park, Durgapur, West Bengal 713206
Email: support@cent.care
Phone: +91-70398 35598 or +91-75010 45270