Privacy notice
What personal and health data we collect when you rent from us, why, how long we keep it, who sees it, and your choices.
Last updated 3 Nov 2026
Who we are
CXCare is a brand of COMMITX TECHNOLOGY (OPC) PRIVATE LIMITED (CIN U62099KA2025OPC204939), 251, 1st Floor, 12 Block, 1st B Main Road, West of Chord Road II Stage, Bangalore North, Bengaluru 560086, Karnataka. Questions about your data go to our grievance officer (see the grievances page).
What we collect
- Your mobile number, to log you in with a WhatsApp code and so the technician can call before delivery.
- Your name, the patient's name, the delivery address and landmark, and an email address if you give one.
- Your order and payment records. Razorpay handles your card, UPI or bank details; we receive only payment references.
- Documents when an order needs them: a doctor's prescription, and one ID document for larger orders.
- If a deposit refund has to go by bank transfer, the UPI ID or bank account you give us for it. We keep it only until the refund is made; after that only its last four digits (or the UPI handle's bank) stay with the refund record.
- Photos our technicians take of the equipment at delivery and at pickup (its condition, serial plate and setup, and any damage), and the name and signature of the person who receives it. They are taken inside your home, so we keep them private and remove location and device details from them. We delete them 180 days after the rental closes, except the photos behind a deposit deduction (the damage we charged for, and the same unit's condition photos from its delivery), which stay with that invoice for 8 years after the end of its financial year, as the law requires for accounting records.
- If you raise a complaint or ask for a call back: your name, phone number, email if you give one, and what you tell us (see Complaints and call-backs below).
- If you report a fault with the equipment: which unit, what is wrong, any words you add and how to reach you (see Fault reports below).
Health documents
A prescription is health data, and ID documents are sensitive too. We ask for them only when an item's policy or the order value needs them, and only after you tick the separate health-data consent on the documents step.
We use them only to deliver and set up the equipment safely and to check who receives it. They are stored encrypted in a private document store, outside our accounting system, and only staff who need them can view them.
We keep them until 90 days after the rental ends. If an order is never paid, they are deleted 7 days after it expires. You can withdraw your consent by removing the documents before you pay; after that, ask our grievance officer and we delete them unless the law requires us to keep them.
Why we use your data
To take and deliver your order, set up and support the equipment, send receipts and invoices, and meet our legal duties. Order updates come on WhatsApp only if you choose them at checkout; otherwise by email. Supply reminders and review requests are sent only if you turn them on (see Messages we send).
Who we share it with
Our technicians (your address and phone), Razorpay (payments), WhatsApp (messages you agreed to), Cloudflare (the Turnstile bot check on login, checkout, complaints and call-back requests), our error-monitoring provider (scrubbed error reports from our servers, see Error reports) and the companies that host our systems. We never sell your data.
Complaints and call-backs
When you raise a complaint, we use your name, phone number, email (if you give it), what you tell us and our reply to handle the complaint, to contact you about it and to keep the record the Consumer Protection (E-Commerce) Rules require. We keep complaint records for 3 years after the complaint is closed, then remove your details; the reference, dates and category stay in our complaint register.
When you ask us to call you back, we use your number, name and question to call you. We keep call-back requests for 12 months unless you become a customer, then remove your details.
Please don't include medical details or ID numbers in a complaint or a call-back request.
Fault reports
When you report a fault, we keep which unit it is, what is wrong (from the list), any words you add, how you want us to reach you, and our notes of the call. We use them to call you back, to send a replacement and to repair the unit. We don't ask for health details; please don't include them.
Our care desk, dispatchers and the staff who inspect and repair the unit see the report; the technician who brings a replacement sees only its reference, the unit and the visit. We keep your words and our call notes until 36 months after the rental closes, then remove them; the dates, the kind of fault and the outcome stay with the unit's service record.
Photos behind a deposit deduction
When we deduct from a deposit for damage or a missing unit, you can see the photos that show it in My rentals: the unit's condition photos from its delivery and the photos of the damage taken at the return. A photo opens only when you tap it, only while you're logged in, and only for your own rental. Each time one is opened we record that it was opened, when and by which account (not the photo itself); we keep that record for at least a year (400 days).
Claim packs
A claim pack is one PDF for your insurer, made when you ask for it and never stored: our details as the seller, your name and billing address, the patient's name, the rental period, each unit with its serial number, your invoices and payments, and the documents on file as references only (their kind and dates, never the document).
Your prescription is added only if you tick the box for that download. Claim, policy and hospital details you type are printed on that copy only; we don't save them anywhere. We record that a claim pack was downloaded, when and by which account (not what was in it), and keep that record for at least a year (400 days).
Reviews
If you review a rental, we publish your rating, your words if they meet our review policy, the date and the name you choose: your first name and last initial, or 'A verified customer'. Please don't include health details or anyone's name. You can withdraw your review at any time from My rentals: its words and your name are removed at once. Words we don't publish are deleted 30 days after our decision.
Messages we send
Order updates (confirmations, deliveries, rent reminders and pay links, faults and replacements, receipts) come on WhatsApp if you chose that at checkout, otherwise by email. Supply reminders and review requests come only if you turn them on. Each can be turned off on its own, on WhatsApp or by email, in Messages in your account, as easily as it was turned on; you can also reply STOP to a reminder or an invitation on WhatsApp. We keep a record of each change (what, when and the notice version you saw) as evidence of your choice.
UPI AutoPay, buy-outs and supplies
If you turn on UPI AutoPay, Razorpay (our payment provider) and your bank set up the mandate in your UPI app. We keep the mandate's state, the most a debit can be and its validity, Razorpay's references for you and the mandate, and each debit's amount, date, state and the ways we sent you its notices. We never see or keep your UPI ID or bank details. We use these only to take the rent you agreed to, to tell you before and after each debit, and to keep the payment records the law asks of us; they are kept with your rental's payment records.
If you buy the equipment or order supplies, we keep what you bought, its invoice and payment, and for supplies the delivery way and whether you asked for reminders, with your rental's records. Supply reminders come only if you tick the box for them or turn them on in Messages.
Business accounts and orders for a patient
When an organisation asks for a business account, we use the contact's name, phone and email, the organisation's name, type, city and GSTIN, and their message to call back and set up the account. Requests that don't become an account are kept for 12 months, then their details are removed.
For an account, we keep each member's name, phone and role, and who placed each order. When a member orders for a patient, we use the patient's name and the delivery address only to deliver, set up, support and collect the equipment, after the member confirms that the patient or their family agreed. The account's members see its orders and invoices; nobody else does. The patient's contact gets delivery and technician messages only if the member asks, and never a payment link or an amount.
Programme membership
If you join a programme for its published rate, we send your member ID, and nothing else, to the programme's sponsor to confirm you qualify, only after you tick the box that says so. The sponsor is told only that the ID was checked: never what you rent, your orders or your address, and it receives nothing from us. We keep your membership, its member ID and the record of your consent while it lasts and for 12 months after it ends; we don't ask for or keep documents for it.
Login codes by SMS
If WhatsApp doesn't reach you, you can ask for your login code by SMS. It is sent through an SMS provider registered on the telecom regulator's (TRAI's) DLT system, which we will name under Who we share it with once chosen. The code is never stored in our database; we keep only the last four digits of the number and the time it was sent.
How we measure the site
We count how the site is used, to make it faster and easier: which pages are opened, which equipment is viewed, how many searches find nothing, how far people get through booking and payment, and how fast pages load. We also note when a page breaks, without the error's text.
We don't record who you are. Measurement carries no name, phone number, email, address, order or ticket number, IP address or search text. Your browser gets a measurement cookie (care_as) for this browsing session only; our server turns it into a code that changes every day, so one day's visit can't be tied to another day or to you. Searches that find nothing are counted apart from visits, and a search appears in our reports only after several people have typed it.
The raw records are kept for at most 72 hours, then added up into daily totals, which we keep for 25 months. No third party receives them: no advertising or analytics companies, and no tracking pixels.
If we ask for your permission first, nothing is measured with a cookie until you say yes. If your browser sends a Global Privacy Control signal, measurement stays off. You can turn measurement off or on here at any time; your choice is kept in this browser for a year.
Error reports
When something breaks on our servers, an error report goes to our error-monitoring provider so we can fix it. Reports are scrubbed first: no cookies, form contents, phone numbers, emails, or order and ticket numbers. Errors in your browser reach us through our own measurement, without their text.
Children
Our service is for adults (18 or over). We don't knowingly collect children's data, and our measurement builds no profile of any visitor. If you think a child has given us their details, contact our grievance officer and we will remove them.
Your choices
You can ask to see or correct your data, withdraw a consent, or ask us to delete data we no longer need. Contact our grievance officer; we reply within the times on the grievances page.
Once a rental is closed, you can see and delete your prescription and ID documents yourself, under Your documents in your account.