1. Scope and privacy contact

This Privacy Policy explains how the Karigora initiative of Nu-XGen AI (“Karigora”, “we”, “us”) handles personal data when you use karigora.com, related mobile experiences, account services, communications and transactions. Karigora determines the purposes and means of Platform data processing. Privacy questions and rights requests may be sent to hello@karigora.com.

This Policy should be read with the Terms & Conditions. It is designed around applicable Indian privacy and technology law, including the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 as their provisions come into force, without limiting stronger rights that another applicable law gives you.

2. Personal data we collect

• Account and identity data: name, email, verified mobile number, password authentication record, account type, language and profile identifiers.
• Private location data: address line, selected place label, city, region, country, exact latitude and longitude used for account integrity, matching, delivery and safety. Exact home coordinates are not displayed on public profiles.
• Profile and professional data: photo, biography, skills, qualifications, registrations, licences, evidence, availability, work areas, rates, services and shop information.
• Transaction data: requests, messages, quotes, acceptances, orders, appointment and delivery events, amounts, payment status, payout references, invoices, disputes and reviews.
• Healthcare data: appointment information, prescriptions, patient communications and medicine-fulfilment records when you deliberately use those protected features.
• Device and usage data: IP address, browser or app information, security events, cookies, session identifiers, page interactions, approximate network location and diagnostic logs.
• Support and moderation data: complaints, correspondence, reports, investigation material and actions taken.

3. How data is collected

We collect data you enter or upload, data created through your transactions, data supplied by another participant where necessary to complete a request, and technical data generated when the Platform operates. With your browser or device permission, “Use my location” obtains coordinates for you to confirm before submission. Search suggestions may be supplied by map and geocoding providers.

Professional or business verification may involve information from issuing bodies, official registers, payment providers, publicly available sources or verification partners where lawful and proportionate.

4. Why we use personal data

• Create, secure and recover accounts; verify mobile ownership; prevent duplicate or fraudulent identities.
• Provide location-aware discovery, calculate distances and coverage, coordinate delivery and protect exact location details.
• Enable requests, messages, bookings, prescriptions, quotes, payments, payouts, refunds, reviews and dispute handling.
• Review providers, doctors, shops, listings, images, licences and professional evidence.
• Protect users and the Platform through access controls, logs, abuse detection, moderation, fraud prevention and incident response.
• Communicate service messages, verification codes, transaction updates, policy changes and support responses.
• Measure and improve reliability, usability, accessibility, search quality and marketplace performance using aggregated or appropriately limited data.
• Comply with law, valid governmental or court requests, tax and accounting obligations, consumer complaints, cyber-incident duties and enforcement of legal rights.

5. Consent and your choices

Where processing is based on consent, we seek a clear affirmative action and explain the purpose. You may decline optional address details, browser geolocation and non-essential communications. Declining data necessary for account security, a requested transaction or a regulated service may prevent that feature from working.

You may withdraw consent for future consent-based processing by changing the relevant setting or contacting us. Withdrawal does not affect earlier lawful processing or data we must retain for an active order, legal obligation, safety investigation or legal claim.

The registration checkbox records agreement to the Terms and Responsible-Use Rules and acknowledgement of this Privacy Policy; it is never preselected.

6. When we share data

• With the other transaction participant, only to the extent needed for a request, booking, sale, delivery, communication or dispute.
• With hosting, database, authentication, SMS/WhatsApp, email, map, storage, analytics, support and security providers acting for Karigora under appropriate controls.
• With payment gateways, banks and payout providers for payment, refund, fraud, chargeback and settlement processing. Their independent privacy notices may also apply.
• With licensed professionals, medicine shops or delivery participants when you intentionally use the relevant protected workflow.
• With advisers, auditors, insurers or a successor organisation under confidentiality and only for legitimate business, compliance or transaction purposes.
• With courts, regulators, law-enforcement or government bodies when disclosure is legally required or reasonably necessary to protect rights, safety and security.

7. Public and private information

Public profiles and listings may show your chosen display name, photo, safe city or area label, skills, professional information, service details, shop details, ratings and content you choose to publish. Do not place a private phone number, home address, prescription or sensitive identifier in a public field.

Verified mobile numbers, email addresses, exact home coordinates, private address lines, authentication secrets, payment credentials, prescriptions and protected messages are not intentionally published. A transaction may reveal limited contact or delivery information to the specific participant when operationally necessary and authorised.

8. Retention and deletion

We keep account data while the account is active and afterwards only for as long as reasonably necessary for security, fraud prevention, dispute resolution, legal claims and applicable retention duties. Registration information and associated records may be retained for at least 180 days after account cancellation where intermediary law requires it. Financial, tax, healthcare, complaint and transaction records may require longer periods under applicable law.

Unsuccessful onboarding OTP challenges are short-lived and are scheduled for secure cleanup. Backups may retain deleted data for a limited rotation period before overwriting. We may retain de-identified or aggregated information that no longer identifies you.

9. Security

Karigora uses measures appropriate to the data and risk, including transport encryption, access controls, private database policies, server-held secrets, verified sessions, rate limits, audit events, restricted administrator capabilities and provider due diligence. No internet system is perfectly secure; please use a unique password and report suspicious activity promptly.

If a personal-data breach creates a notification duty, Karigora will notify affected people and the competent authority in the manner and timeframe required by applicable law.

10. International processing

Some infrastructure or service providers may process data outside your state or country. We use contractual, technical and organisational safeguards and observe applicable restrictions on cross-border transfer. The Platform may limit a provider or transfer route where law or risk requires it.

11. Your rights

Send a rights request to hello@karigora.com from the account email where possible. We will verify identity proportionately, respond within the applicable period and explain any lawful limitation.

• Ask for a summary of personal data being processed and relevant sharing information, where applicable.
• Correct, complete or update inaccurate personal data.
• Request erasure of data that is no longer needed, subject to lawful retention and active transaction requirements.
• Withdraw eligible consent and manage optional communications.
• Raise a grievance and, where the law provides, nominate another individual to exercise rights in the event of death or incapacity.
• Complain to the competent data-protection, consumer or other authority after using the available grievance channel where required.

12. Children, cookies and policy updates

Karigora accounts are intended for adults aged 18 or above. Do not create an independent account for a child. If we learn that a child’s data was supplied without valid authority, we may restrict the account and delete the data unless retention is legally required.

Essential cookies and local storage keep you signed in, protect sessions, remember security state and operate requested features. Optional analytics or preference technologies, if introduced, will be described and controlled as required by law.

We may update this Policy as the Platform and law evolve. Material changes will be announced appropriately. The current version and effective date appear above.