Digital Personal Data Protection Act (DPDPA 2023) Compliant

Privacy Policy

Effective Date: September 16, 2026 • Version 1.0 (India)

Our Zero-Trace Privacy Pledge: We deeply respect the privacy of frontline professionals. Verification documents (such as hospital IDs, medical council registrations, and police badges) are reviewed strictly to confirm eligibility and are permanently purged from our storage servers upon verification. We never sell your personal data.

1Introduction & Scope

HeroPass Technologies ("HeroPass", "we", "our", or "us") is committed to protecting the privacy of frontline workers (including healthcare staff, law enforcement, defense personnel, and emergency responders) and partner merchants. This Privacy Policy details our data governance practices in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000 of India.

2Information We Collect

We collect only the minimum data strictly necessary to operate our service:

A. Member Profile Information: Name, mobile phone number, email address, profession category, organization/hospital name, and city.

B. Frontline KYC Verification Files: Proof of frontline employment (e.g., employee ID, hospital badge, police service card, medical council registration certificate).

C. Redemption & Usage Logs: Audit timestamps of in-store QR scans and online voucher claims (used exclusively to calculate merchant redemption metrics and personal savings).

3KYC Document Auto-Purge & Retention Policy

In accordance with Section 8 of the DPDPA 2023 (Storage Limitation and Data Minimization):

Encrypted Private Storage: When you upload a verification file, it is transferred over TLS 1.3 encryption and stored in an access-restricted, private storage container that is invisible to search engines and unauthenticated users.
Strictly Authorized Review: Only designated HeroPass human compliance officers have temporary access to inspect the document for verification purposes.
Automated Document Purge: Immediately upon approval, the raw document bytes are permanently deleted and purged from our cloud storage.
Non-Sensitive Audit Record: Following the purge, our database retains only a non-reversible confirmation record (e.g., "Government ID verified on [Date]"), ensuring that no sensitive personal identification copies remain on our servers.

4Purpose of Processing

We process your personal information strictly for the following purposes:

To verify your identity as an active or retired frontline professional.
To generate your time-limited, cryptographic HMAC digital pass for checkout verification.
To communicate important account updates, approval notifications, and service announcements.
To detect and prevent fraudulent account sharing, duplicate redemptions, and system abuse.

5Zero Selling of Personal Data

HeroPass has a strict, uncompromising privacy standard:

We do not sell, rent, monetize, or trade your personal information or contact details to third parties, advertisers, or data brokers.
Partner merchants never receive copies of your government ID or private verification documents. When you present your digital pass in-store, the cashier sees only your verified status, first name, and pass validity.

6Your Rights under Indian Law (DPDPA 2023)

As a data principal under Indian law, you have the right to:

Access & Summary: Request a summary of personal data held about you.
Correction & Updating: Correct inaccurate or incomplete profile details.
Erasure & Deletion: Request the total deletion of your HeroPass account and all associated redemption histories.
Nomination: Nominate an individual to exercise data rights in the event of incapacity or death.

Grievance Officer & Data Inquiries

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Rules, the contact details of our Data Protection & Grievance Officer are:

HeroPass Grievance Office

Email: privacy@heropass.in

Response Timeline: Inquiries are acknowledged within 24 hours and addressed within 15 business days.