The following Privacy Policy governs the collection, use, processing, storage, disclosure and protection of personal information by Plum Benefits Private Limited and Plum Benefits Insurance Brokers Private Limited (together, "Plum", "we", "us", "our"). It describes the types of information we collect about you when you use our website https://www.plumhq.com/, our mobile applications, and our insurance broking and health benefits administration services, and how we use, disclose, store, and protect such information. References to "Plum" mean either or both entities, as applicable to the relevant service or processing activity. Each entity is responsible for complying with the legal and regulatory obligations applicable to its respective activities. We aim to process personal data in compliance with applicable laws and applicable regulatory requirements.

PURPOSE AND SCOPE

The Privacy Policy applies to personal information collected or processed through our website, mobile applications and services, whether online or offline, including insurance broking, employee health benefits administration, telehealth, health check-ups, OPD, wellness and related services.

The Privacy Policy describes how we handle personal information relating to our users, beneficiaries, employees of corporate clients, their dependants, website visitors and other individuals whose information is processed in connection with our services. Where Plum processes personal information on behalf of a corporate client or other organisation, such processing is subject to applicable contractual arrangements and legal requirements. Where such organisation independently determines the purposes and means of processing, its own privacy policy may also apply. Nothing in this Privacy Policy limits Plum's obligations under applicable law.

HOW WE COLLECT DATA ABOUT YOU

We may collect different data from or about you depending on how you use the website, applications and services.

Data provided by registered users:

Account creation and login

When you create an account or log in to your account, we collect personal information such as first name, last name, email address, and authentication information, where applicable.

Data provided by non-registered users:

Information received from other sources

We may receive personal information from your employer, insurer, Third Party Administrator, healthcare provider or other authorised source where relevant to the provision or administration of the applicable services and in accordance with applicable law.

Data collected through automated means:

System data

Technical data about your computer or device, like device type, operating system, and IP address. This data helps us improve the delivery of our web pages and to measure traffic on the site.

The collection of data will also depend on the individual settings of your device and software. It is recommended to refer to the policies of your device manufacturer or software provider to learn about information they might share with us.

User Generated Data:

Account Creation, log in, and Usage as a viewer

We collect information and material (user-generated content) provided to us voluntarily by our users or the viewers to publish and process on our platform.

The user-generated content is inclusive of text, photos & videos associated with the accounts/ emails used to create an account with Plum or to access links as viewers.

Data Collected from Third Parties:

Third-party integrations (where applicable)

Where you authorise integration with third-party applications or services, we may access and process information through such integrations to the extent necessary to provide the functionality requested by you, subject to the applicable permissions and legal requirements.

Data collected during transactions:

Transactional Data

On the basis of types of services requested, Plum also collects information such as:

• type of service that has been requested
• order details for such a request
• payment & transaction information (such as merchant's name, payment method, and chargeable amount for the service)
• date and time the service was provided

For the purpose of promotion codes, name of the person associated with such a code will also be collected

Some information is collected through the use of cookies, web beacons, and tracking technologies.

THE TYPES OF INFORMATION WE COLLECT AND STORE

We may collect personal and sensitive personal information about you and store this information in connection with the provision and fulfillment of our services to you. Depending on the Plum entity providing the relevant service and the services you use, the personal information we collect or process may include:

• First name, last name, email address, phone number, employee ID, and designation
• Date of birth, gender, and marital status
• Health and medical information, including medical history, prescriptions, lab reports, and teleconsultation records, where relevant to the services availed
• Insurance policy information, including policy numbers, coverage details, and claims history, where relevant to claims assistance or administration
• Identity and KYC information, where required for the relevant service, which may include PAN, masked Aadhaar and address proof
• Bank account or payment information, where required for claim reimbursement, premium transactions or other permitted payment purposes
• Information relating to dependents (such as spouse, children, and parents), including name, date of birth, relationship, and health data, where relevant to the services availed
• Device and technical data, including IP address, device ID, app version, and browser fingerprint
• Usage and behavioural data, including app usage patterns, feature interactions, and consent records

Certain categories of information, including health and medical information, financial information, passwords and biometric information, where collected, may constitute sensitive personal data or information under applicable law and will be handled in accordance with the requirements governing such information.

We collect and process personal information only for specified, lawful purposes connected with our services or other purposes permitted by applicable law.

HOW WE USE YOUR PERSONAL INFORMATION

The above personal information may be used for the following purposes:

• To provide you with information about our offerings and/or our periodic newsletters, subject to applicable consent requirements and your communication preferences
• To respond to your requests
• To undertake business intelligence, service improvement and data analytics in connection with our offerings, using aggregated or de-identified information wherever reasonably practicable, and subject to applicable data protection and security requirements
• To manage our relationship with you
• For internal record keeping
• To provide you with authorization to login and use your user account
• To verify your identity
• To maintain correct and up-to-date information about you
• To identify you as a contracting party
• To improve our website
• To enable automated handling of the subscriptions
• To facilitate and support claim intimation, documentation, coordination and status tracking with insurers, Third Party Administrators and other relevant service providers
• To facilitate cashless hospitalisation and pre-authorisation processes by coordinating with insurers, Third Party Administrators, network hospitals and healthcare providers
• To support the detection and prevention of fraud, misuse or other unlawful activity in connection with the services
• To comply with regulatory reporting obligations to IRDAI and other competent statutory or regulatory authorities
• To disclose personal information to insurers, Third Party Administrators, healthcare providers and other authorised recipients where necessary for policy administration, claims assistance, healthcare service delivery or other permitted purposes, subject to applicable consent, confidentiality and disclosure requirements
• To otherwise be able to provide the services to you
• To comply with our legal or statutory obligations

We process personal information for the purposes for which it was collected or for other purposes permitted under applicable law. Where consent is required under applicable law, such consent will be obtained in accordance with the applicable requirements.

Where Plum processes personal information on behalf of a corporate client or other organisation, the purposes of processing may also be determined by that organisation, subject to applicable contractual arrangements and legal requirements.

TRANSPARENCY AND YOUR CHOICES

We aim to provide clear information about the collection and use of personal information and the choices available to you. Where consent is required for a particular processing activity, such consent will be sought in accordance with applicable law.

Optional marketing communications and other optional processing activities will be subject to applicable consent and preference requirements. Declining consent for an optional activity will not, by itself, prevent access to services for which that information or processing is not necessary.

Nothing in this Privacy Policy restricts any rights or remedies available to you under applicable consumer protection, data protection or other laws.

ACCEPTABLE USE

By using our platform, you agree not to upload, transmit, store, or share any information or content that: (a) belongs to another person and to which you do not have any right; (b) is defamatory, obscene, pornographic, paedophilic, invasive of another's privacy, including bodily privacy, insulting or harassing on the basis of gender, libellous, racially or ethnically objectionable, relating or encouraging money laundering or gambling, or otherwise inconsistent with or contrary to the laws in force; (c) is harmful to a child; (d) infringes any patent, trademark, copyright, or other proprietary right; (e) violates any law for the time being in force; (f) deceives or misleads the addressee about the origin of the message, or communicates any misinformation or information which is patently false and untrue or misleading in nature; (g) impersonates another person; (h) threatens the unity, integrity, defence, security, or sovereignty of India, friendly relations with foreign States, or public order, or causes incitement to the commission of any cognisable offence, or prevents investigation of any offence, or is insulting to another nation; (i) contains software virus or any other computer code, file, or program designed to interrupt, destroy, or limit the functionality of any computer resource; or (j) is patently false and untrue and is written or published in any form, with the intent to mislead or harass a person, entity, or agency for financial gain or to cause any injury to any person.

We reserve the right to remove any such content and terminate your access to the platform if you fail to comply with these terms. Users are reminded periodically, and at least once annually, that non-compliance with these terms may result in termination of access.

WHO HAS ACCESS TO YOUR DATA WITHIN OUR ORGANIZATION?

Within our organisation, access to personal information is limited to authorised personnel who require it to provide the relevant services, respond to inquiries or carry out other permitted activities. Access is restricted based on respective roles and legitimate business requirements, on a need-to-know basis and subject to applicable confidentiality and information security requirements.

WHO DO WE SHARE YOUR DATA WITH OUTSIDE OUR ORGANIZATION, AND WHY?

Depending on the services you use, we may share your personal information with the following categories of recipients, only to the extent reasonably necessary for providing or administering the relevant services, and subject to applicable consent, confidentiality and other legal requirements:

Employers

Your employer or the organisation through which you access Plum's services, where applicable, for enrolment, eligibility, policy administration and benefits administration. Individual-level health, medical or claims information will not ordinarily be shared with your employer, except where such sharing is required or permitted by applicable law or expressly authorised by you, and subject to applicable confidentiality and data protection requirements.

Insurers and Third Party Administrators (TPAs)

Insurance companies and TPAs for policy administration, claims processing, cashless hospitalisation, pre-authorisation, and related insurance services.

Healthcare Providers

Hospitals, clinics, diagnostic centres, and teleconsultation providers for the delivery of healthcare services facilitated through Plum.

Investigators and Other Claims Service Providers

Investigators, surveyors, and other claims service providers for verification or assessment of claims.

Payment Processors and Banking Partners

Payment gateway providers and banking partners for processing premium payments, claim reimbursements, and other permitted payment transactions.

Processors

We may use service providers and third parties for operating and improving the sites, assisting with certain functions, such as payment processing, email transmission, conducting surveys or contests, data hosting, managing our ads, third-party solutions for marketing and analytics, and some aspects of our technical and customer support. We take measures to ensure that these service providers access, process, and store information about you only for the purposes we authorise, through the execution of Data Processing Agreements or Addenda or other appropriate contractual arrangements containing applicable confidentiality, data protection and security obligations.

Authorities

We may access, preserve, and disclose information about you to third parties, including the content of messages, where such disclosure is required or permitted under applicable law, regulation, legal process or lawful regulatory requirements. We may also disclose information about you to regulators, statutory authorities and other competent authorities where required for regulatory reporting or other disclosures required or permitted by applicable law, or if necessary to protect the rights, property, or security of, or prevent fraud or abuse of, the Company or others, to the extent permitted by applicable law.

Transfer of business

If we (or our assets) are acquired, or if we go out of business, enter bankruptcy or go through some other change of control, personal information could be one of the assets transferred to or acquired by a third party, subject to applicable legal requirements and appropriate confidentiality and data protection safeguards.

Cross-border transfer of personal information

Where personal information is transferred outside India, such transfer will be undertaken in accordance with applicable law. Transfers of sensitive personal data or information will be subject to the requirements applicable to such transfers, including requirements concerning the level of protection provided by the recipient and applicable contractual or consent conditions. Any additional restrictions applicable to regulated information, including insurance broking records, will also be observed.

WHY AND FOR HOW LONG DO WE STORE THE INFORMATION WE COLLECT FROM YOU?

We retain certain information collected from you while you are a member on the site, and in certain cases where you have deleted your account, for the following reasons:

• So that you can use our sites
• To ensure that we do not communicate with you if you have asked us not to
• To provide you with a refund, if entitled
• To better understand the traffic to our sites so that we can provide all members with the best possible experience
• To detect and prevent abuse of our sites, illegal activities and breaches of our Terms of Service
• To comply with applicable legal, tax or accounting requirements

We retain user data for as long as necessary for the purposes described above. This means that we retain different categories of data for different periods of time depending on the type of data, the category of user to whom the data relates, and the purposes for which we collected the data.

Personal information may also be retained where necessary to comply with applicable legal, regulatory, insurance, taxation, accounting, audit or recordkeeping requirements, including requirements that continue to apply after the cessation of services, withdrawal of consent or deletion of an account.

Records relating to insurance broking activities will be maintained and retained in accordance with applicable requirements of IRDAI, including requirements concerning the maintenance, location, retention and lawful destruction of regulated records.

Upon expiry of the applicable retention period, personal information will be deleted or anonymised in accordance with applicable law and our data retention and deletion procedures.

SECURITY

We are committed to protecting your personal information, including sensitive health and insurance data. Our security measures include, as applicable to the relevant systems and services:

• ISO/IEC 27001:2022 certification for information security management
• SOC 2 Type II assurance
• Encryption and other appropriate cryptographic controls for personal data at rest and in transit
• Role-based access controls designed to restrict access to personal information based on authorised roles and business requirements
• Periodic security assessments, vulnerability assessments and penetration testing, as appropriate
• Security awareness training and appropriate personnel security controls
• Incident response procedures for identifying, responding to and managing security incidents

While we implement reasonable and appropriate organisational and technical measures to protect your personal information, we also encourage you to take appropriate precautions to safeguard your account credentials and personal information.

We maintain appropriate information security governance and incident response procedures to identify, assess, manage and report information security incidents in accordance with applicable legal and regulatory requirements, including relevant CERT-In Directions and, for Plum Benefits Insurance Brokers Private Limited, applicable IRDAI information and cyber security requirements.

YOUR RIGHTS UNDER APPLICABLE INDIAN LAW

Subject to applicable law, you may:

Request to review personal information or sensitive personal data or information provided by you and request correction or amendment of information found to be inaccurate or deficient, where feasible.

Choose not to provide information requested from you, subject to any resulting limitations on the services that can be provided.

Withdraw consent previously provided for the collection or processing of your information by submitting a written request, subject to applicable law and lawful retention requirements. Withdrawal of consent may affect the provision of services that require such information.

Raise grievances relating to the handling of your personal information using the contact details provided below.

Requests will be handled in accordance with applicable legal requirements and prescribed timelines.

THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023

Upon commencement and to the extent applicable to the relevant processing, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 provide Data Principals with certain rights in relation to their personal data. These include:

• The right to obtain information about how your personal data is being processed
• The right to correction, completion, updating and erasure of your personal data
• The right to nominate another person to exercise your rights in the event of your death or incapacity
• The right to grievance redressal

Where such rights are applicable, you may contact us at security@plumhq.com to submit a request. We will process such requests in accordance with the requirements and timelines prescribed under applicable law.

Where Plum acts as a Data Processor on behalf of another Data Fiduciary, requests relating to personal data processed on behalf of that Data Fiduciary may be referred to or coordinated with the relevant Data Fiduciary, in accordance with applicable law and contractual arrangements.

GRIEVANCE REDRESSAL

If you have any grievance regarding the processing of your personal information, you may contact the designated Grievance Officer / Data Protection Officer or designated privacy contact identified below.

Privacy-related grievances will be addressed expeditiously and within the timelines prescribed under applicable law, including, where applicable, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

For privacy-related and IT related grievances concerning Plum, you may contact:

Grievance Officer: Sankaralingam T
Email: sankar@plumhq.com

For grievances relating specifically to insurance broking services, you may contact the  Grievance Desk of Plum Benefits Insurance Brokers Private Limited:

Email: grievance@plumhq.com

Grievances relating to insurance broking services will be addressed in accordance with applicable IRDAI requirements, including taking adequate steps for redressal within fourteen (14) days of receipt of the grievance, in accordance with the IRDAI (Insurance Brokers) Regulations, 2018. Complaints will also be acknowledged within fourteen (14) days, and the complainant will be informed of the person responsible for handling the complaint and the expected timetable for dealing with it.

Insurance-related complaints will be handled in accordance with the applicable policyholder protection and grievance redressal requirements. Complainants will be informed of available escalation mechanisms where they are dissatisfied with the response to their complaint.

If your insurance-related grievance remains unresolved, you may escalate the grievance through IRDAI's Bima Bharosa grievance redressal mechanism or such other grievance redressal channels as may be notified by IRDAI from time to time.

OUR POLICY CONCERNING CHILDREN & THEIR DATA

Our Sites and services are not intended for independent use by individuals under the age of eighteen. However, we may process personal data relating to children where, for example, a child is enrolled as a dependent under an employer's group health insurance policy or avails of health services through Plum. In such cases, we collect and process personal data relating to the child in accordance with applicable law, including any consent or other authorisation requirements applicable to the relevant processing activity.

Where we become aware that personal information relating to a child has been collected or processed without the consent or other authorisation required under applicable law, we will take appropriate steps to address the matter, including deletion where legally required. Upon commencement of the applicable provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, we will comply with the requirements governing children's personal data, including obtaining verifiable consent from a parent or lawful guardian and complying with applicable restrictions on tracking, behavioural monitoring and targeted advertising directed at children, subject to any applicable statutory exceptions or exemptions.

LINKS TO OTHER WEBSITES

Our sites may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third-party's site. We strongly advise you to review the Privacy Policy of every site you visit.

Where a third party independently determines how it collects and processes personal information, its own privacy policy and practices may apply. We do not control third-party sites that may be accessible through our services. Thus, this Privacy Policy does not apply to information you provide to third-party sites or gathered by the third parties that operate them. Nothing in this section limits Plum's obligations under applicable law in relation to third parties acting on its behalf.

CHANGES TO THIS POLICY

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. If we make any material change/s to the Policy, we will notify you via email, through a notification posted on the Services, or as required by applicable law. You can see when the Policy was last updated by checking the date at the bottom of this page. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective from when they are posted on this page, unless otherwise specified or required by applicable law. Where any change requires additional notice or consent under applicable law, the relevant requirements will be followed.

CONTACT US

If you have any questions about this Privacy Policy, you can contact us at security@plumhq.com.

CONTACT DETAILS OF OUR DATA PROTECTION OFFICER

Sankaralingam T

Data Protection Officer

Plum Benefits Pvt Ltd

6th Floor, TOWER-B, Primeco Union City, Main Rd, Sadara Mangala Industrial Area, Thigalarapalya, Whitefield, Bengaluru, Karnataka 560048

E-mail : sankar@plumhq.com

‍

Last Updated: 08th October 2026