● This Privacy Policy applies not only to individual users but also to corporate clients, including their authorized representatives such as employees, officers, and agents who interact with the Platform or its services, and in the course of providing corporate wellness and coaching services, we may collect and process certain personal data relating to such individuals, including but not limited to names, job titles, work email addresses, phone numbers, and other professional contact information; while such data may be provided in a business context, it is important to clarify that under the Digital Personal Data Protection Act, 2023, any information that can directly or indirectly identify an individual—such as contact details or identifiers—constitutes “personal data” and is therefore subject to data protection obligations, regardless of whether it is personal or professional in nature ; accordingly, this Policy governs the collection, use, storage, and protection of such data in the context of our engagement with corporate clients, ensuring that all personal data is processed lawfully, transparently, and securely, and that appropriate safeguards are applied even in business-to-business interactions, thereby maintaining compliance with applicable laws and upholding the privacy rights of all individuals whose data is processed through our Platform.
● In the course of providing services to corporate clients, we may collect and process certain categories of information relating to the Client organization and its authorized representatives, including but not limited to the company name, business contact details (such as official email addresses and phone numbers), designation, role, and department of the primary point of contact, as well as organization-specific information such as business metrics, participation data, or wellness-related inputs shared for analytics and program delivery purposes; additionally, we may collect account-related information including billing addresses, invoicing details, and authorized finance contacts to facilitate contractual and payment obligations, and such information is collected strictly for purposes including account setup, service delivery, communication, reporting, and compliance—for example, we collect the name and business email address of a designated corporate contact to create and manage the organization’s account and ensure effective coordination of services; it is important to note that even business or professional contact information constitutes “personal data” where it can identify an individual, and under the Digital Personal Data Protection Act, 2023, any data that directly or indirectly identifies a person—such as names, emails, or phone numbers—is subject to data protection obligations and must be processed lawfully, securely, and for a specified purpose , and accordingly, all such information is handled in compliance with applicable legal standards while ensuring transparency, necessity, and proportionality in data collection practices.
● We use the information collected from corporate clients and their authorized representatives strictly for legitimate business and contractual purposes, including to establish and manage corporate accounts, deliver enterprise wellness and coaching services, customize program offerings based on organizational requirements, generate anonymized insights and reports, communicate service updates, and facilitate billing, invoicing, and payment processing; for example, we use the name, designation, and business contact details of a corporate representative to coordinate program implementation, provide account-related support, and send invoices or contractual communications; such processing is primarily carried out on the basis of contractual necessity—i.e., to fulfill our obligations under agreements with the Client—and our legitimate interests in operating, improving, and scaling our services, rather than relying solely on individual consent, as business-to-business engagements typically involve processing necessary for service delivery and operational efficiency; however, where required under the Digital Personal Data Protection Act, 2023, we ensure that appropriate notices are provided and that processing remains lawful, purpose-specific, and proportionate, noting that any information capable of identifying an individual (including business contact details) qualifies as personal data and must be handled in accordance with applicable data protection principles .
● The processing of personal data in the context of corporate clients and their authorized representatives is carried out on lawful grounds recognized under applicable data protection laws, including the Digital Personal Data Protection Act, 2023, which requires that personal data be processed only for a lawful purpose and either based on valid consent or under specified “legitimate uses” permitted by law; in a B2B context, such processing is typically justified on the basis of contractual necessity—i.e., to perform obligations under agreements with the Client—and on recognized legitimate uses, such as where individuals voluntarily provide their business contact information for service delivery or communication purposes, rather than relying solely on standalone consent mechanisms ; however, where personal data is used for secondary purposes such as marketing communications, especially where such communications are directed to identifiable individuals, appropriate notice and, where required, consent or an opt-out mechanism is provided in line with best practices and evolving regulatory expectations, noting that while communications sent to general corporate contact channels (e.g., generic business email addresses) may not always require explicit consent, responsible data handling standards and transparency principles still require that recipients are given clear and easy options to opt out of such communications; accordingly, all processing is undertaken in a manner that is lawful, purpose-specific, proportionate, and consistent with the rights of individuals under applicable data protection frameworks.
● We may share corporate and personal data collected in the course of providing services with trusted third parties strictly on a need-to-know basis, including service providers such as cloud hosting partners, payment processors, analytics providers, and other vendors who support the operation of the Platform, all of whom are contractually bound to maintain confidentiality and implement appropriate security safeguards; in the context of delivering insights and reports to corporate clients, we ensure that any data shared is aggregated and anonymized, meaning that all personally identifiable information is removed so that individuals cannot be identified directly or indirectly—for example, we may provide usage trends, engagement metrics, or program effectiveness insights at an organizational level without disclosing individual employee data, and under the Digital Personal Data Protection Act, 2023, such anonymized or non-personal data falls outside the scope of “personal data” and is not subject to the same regulatory restrictions, as it cannot be linked back to an identifiable individual ; additionally, we may disclose information where required to comply with applicable laws, legal processes, or regulatory obligations, and all such sharing is carried out in a manner that is lawful, proportionate, and limited to the purpose for which the data was originally collected, ensuring both compliance and protection of individual privacy rights.
● We retain corporate and associated personal data only for as long as necessary to fulfill the purposes for which it was collected, including the duration of the business relationship with the Client and any additional period required to comply with applicable legal, regulatory, tax, or audit obligations; accordingly, B2B account information, contractual records, and transaction or billing data may typically be retained for a defined period (for example, up to 6–8 years in line with financial and tax compliance requirements), while operational data is retained only as long as necessary for service delivery and business continuity; under the Digital Personal Data Protection Act, 2023, we are required to adhere to the principle of storage limitation, which mandates that personal data must be deleted or anonymized once the purpose for which it was collected has been fulfilled, unless retention is required by law ; accordingly, we implement internal data retention schedules and periodic reviews to ensure that data is not retained indefinitely, and once retention obligations expire, such data is securely deleted, anonymized, or archived in a manner that prevents identification of individuals, thereby ensuring compliance with applicable data protection laws while maintaining necessary business and legal records.
● Individuals associated with corporate clients, including employees or authorized representatives whose personal data is processed through the Platform, are entitled to certain rights in relation to their personal data, broadly consistent with those available to individual consumers under the Digital Personal Data Protection Act, 2023, including the right to access information about their personal data, request correction of inaccurate or incomplete data, seek deletion or erasure of data that is no longer necessary, and raise grievances regarding data processing practices, as the Act grants individuals (referred to as “Data Principals”) clear rights to access, correct, and erase their personal data held by an organization ; however, in a B2B context, the exercise of certain rights—such as account-level changes, service discontinuation, or data deletion requests that may impact contractual obligations—may be subject to the terms of the agreement between the Company and the corporate client, and may require coordination with or authorization from the relevant organization; notwithstanding the foregoing, we remain committed to enabling individuals to review, update, or correct their personal data held by the Company in a transparent and timely manner, while ensuring that such requests are handled in compliance with applicable legal requirements, contractual obligations, and operational feasibility, thereby balancing individual rights with business continuity and legal compliance.
● User Rights: The rights of individual B2B contacts mirror those of consumers: access, correction, deletion, etc. However, note that certain requests (like account closure) may be handled per the corporate agreement. Reiterate that individuals have the right to review or correct their personal data held by BAG.
● Corporate clients and their authorized representatives may raise any privacy-related queries, concerns, or requests regarding the processing of personal data through the designated contact channels Grievance Officer,provided by the Company.