1. Sava Healthcare Limited (“Sava”, “we” or “us”) has created the following privacy statement in order to demonstrate its Privacy Policy, and also to ensure compliance with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) read with the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”), being India’s data protection legislation, and other extant Indian data privacy regulations. The contents hereof are applicable to our website as well as the websites of our separate business undertakings and divisions (unless the same are country-specific websites, which are governed separately below), and the term “website” shall be accordingly construed.
2. This Privacy Policy describes the ways in which we collect and process information about our customers and visitors to our website (“you” or “your”) and/or which identifies you directly or indirectly (“Personal Data”), either alone or in combination with other information made available to us, through your interactions with us via our website, or through any mobile page, application, or other service (both offline and online) provided by Sava. As the individual to whom Personal Data relates, you are a “Data Principal” under the DPDP Act. This Privacy Policy also covers how we respect your privacy rights under the DPDP Act with respect to the processing of your Personal Data for the purposes described in this Privacy Policy.
3. The responsible use of personal data is a core value at Sava, and we fully respect the DPDP Act, the DPDP Rules and other extant privacy laws and regulations. We are responsible for the processing of your Personal Data as we determine the purposes and means of such processing, thereby acting as the “Data Fiduciary” of such Personal Data within the meaning of the DPDP Act.
4. To ensure that you can make informed decisions and feel confident about sharing your Personal Data with us, please read this Privacy Policy before using this website so as to understand who we share your Personal Data with and for what purposes and the choices you have concerning how your Personal Data is collected and used by us.
5. Where we process your Personal Data on the basis of your consent, such consent will be sought by a request accompanied or preceded by a notice conforming to section 5 of the DPDP Act read with rule 3 of the DPDP Rules, and will be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to such Personal Data as is necessary for the specified purpose. You may withdraw your consent at any time, with the ease of doing so being comparable to the ease with which such consent was given, by contacting us at legal@savaglobal.com or through the means indicated on this website; the withdrawal of consent will not affect the lawfulness of any processing carried out before such withdrawal.
6. This Privacy Policy does not apply to any non-personal information disclosed by you or collected by us, any Personal Data that is made or caused to be made publicly available by you or by any other person who is under an obligation under law to make it publicly available, or any information or data which is disclosed pursuant to law.
7. This Privacy Policy is intended to explain our privacy practices and covers the following areas:
   1. Privacy policies of other websites
   2. Personal Data of children
   3. How we collect and make use of Personal Data
   4. Who we may share your Personal Data with
   5. Retention and erasure of Personal Data
   6. Security of your Personal Data and Personal Data breaches
   7. Your rights and how to exercise them
   8. Changes to our Privacy Policy and/or Cookies Policy

1. Privacy policies of other websites
   1. The following Policy discloses our information gathering and dissemination practices for this website. This website may contain links to other sites. Sava is not responsible for the privacy practices or the content of such other websites.
   2. You may also be asked to refer to additional privacy policies or separate data privacy notices on our country specific website/s (if any) if you reside in a certain location or where you use certain applications or websites not covered under this Policy. Wherever required, we will also present you with specific privacy notices for the purposes of activities not covered under this policy which govern collection and/or disclosure of Personal Data submitted by users, if any.
2. Personal Data of childrenOur products and services are not directed at minors. We do not knowingly process any Personal Data of children, i.e., individuals under the age of 18 years, on our website or for the purposes mentioned in this Privacy Policy, and we do not undertake tracking or behavioural monitoring of children or targeted advertising directed at children, in accordance with section 9 of the DPDP Act. Where it becomes necessary to process the Personal Data of a child, or of a person with disability who has a lawful guardian, we will first obtain the verifiable consent of the parent or lawful guardian in the manner prescribed under the DPDP Rules. If Personal Data of a child has been mistakenly provided to us, and you would like to request that such Personal Data be erased, please contact our designated contact person for data protection at legal@savaglobal.com.
3. How we collect and make use of Personal Data
   1. Our website does not require any form of registration or sign-up to view our products and services. However, depending on how you interact with us, we may collect and process Personal Data, including all or some of the following Personal Data about you:
   2. Information you provide to us voluntarily: Personal Data that you provide to us, such as when using the contact form on our website or addressing any correspondence to us, including your name, email address, other contact details, your place of work, etc.
      1. We process and save the Personal Data provided in the contact request only to process and answer your request regarding our products and services and to get in touch with you.
      2. The legal basis for processing your Personal Data is your consent and, where you have voluntarily provided such Personal Data to us for a specified purpose and have not indicated that you do not consent to its use, the legitimate use recognised under section 7(a) of the DPDP Act.
   3. Information that is collected automatically
      1. Social Media Listening:
      1. We may also collect Personal Data that you have yourself made publicly available on public social media platforms (including blogs, forums, engagement pages, etc.), related to Sava and our products.
      2. This activity, called “social media listening”, is limited to Personal Data made publicly available by you, to which the DPDP Act does not apply by virtue of section 3(c)(ii) thereof. We nonetheless undertake it responsibly, for example to (i) have a better understanding of how certain key audiences react to the use of Sava products, (ii) have a better understanding of our reputation as well as other market trends, (iii) identify key-stakeholders and to initiate contact with them.
      3. This may include your Personal Data in form of comments, messages, blogs, photos, and videos, although we will take steps to limit this Personal Data to the minimum necessary and keep it for no longer than necessary for the social media listening activity.
      4. If you want to limit further who can see your information, we recommend that you use the privacy settings available to you on such platforms.
      5. When you share your Personal Data on a public social media platform, we suggest you also familiarize yourself with the privacy policy of that specific platform as these platforms are not owned and managed by us.
      2. Website usage analytics:
      1. We may also collect and process information about your visit to this website, including, but not limited to, your IP address and domain name, geographical location, your browser version and operating system, traffic data, location data, web logs and other communication data, the resources that you access, the pages you visit, the website you came from and the searches you perform.
      2. We may use such information to help improve the contents of the site and to compile aggregate statistics about people using our site for our internal usage statistics and market research purposes. In doing this, we may install “cookies” or similar tracking technologies.
      3. Please refer to our Cookies Policy to learn more about what types of cookies we use, the purpose they serve and how you can manage your preferences.
      4. The legal basis for the processing of your Personal Data when we do website analytics is your consent, which is obtained through the cookie consent mechanism on our website and which you may withdraw at any time in the manner described in our Cookies Policy.
      3. Website preferences and security:
      1. We may collect certain information about you like your IP address, unique device identifiers like MAC address, computer type, browser type and version, screen resolution, operating system and version. We may also derive your location information from your IP address.
      2. We use this information to secure our websites and network systems and to improve our services by recording your preferences, maintaining service levels, diagnosing, and troubleshooting technical issues.
      3. The legal basis for the processing of your Personal Data for these purposes is your consent and, where applicable, the legitimate uses recognised under section 7 of the DPDP Act.
   4. Where you have provided to us or to our service providers Personal Data relating to another person, please ensure that you are authorised to do so and that you have that person’s knowledge and consent for us to use their information. Please provide that person with a link to this Privacy Policy so they understand how we process Personal Data.
   5. Each request for your consent will be accompanied or preceded by a notice, as required under section 5 of the DPDP Act read with rule 3 of the DPDP Rules, containing an itemised description of the Personal Data sought to be collected, the specified purpose/s of the processing, the goods or services to be provided or the uses to be enabled by such processing, and details of the manner in which you may withdraw your consent, exercise your rights and make a complaint to the Data Protection Board of India. Further notices highlighting certain uses we wish to make of your Personal Data together with the ability to opt in or out of selected uses may also be provided when we collect Personal Data from you.
   6. We practice data minimisation and limit the Personal Data we collect to what is necessary for the specified purpose. You are requested to not disclose your Personal Data (including any health or financial information) to us unless we specifically ask for it.
   7. We may combine, aggregate, or anonymize Personal Data with data we may collect from or about you from other sources, such as public databases, providers of demographic information, joint marketing partners, public social media platforms (data made public by you), and other third parties.
   8. We may use your data for our business purposes, including audits, reviews, monitoring and prevention of fraud, infringement, and other potential misuse of our products and services, and for modifying our services, in each case consistent with the purpose/s specified in the notice provided to you and to which you have consented, or as otherwise permitted under the DPDP Act.
   9. Also, we may process your Personal Data without your consent where such processing constitutes a “legitimate use” under section 7 of the DPDP Act or is otherwise exempt under section 17 of the DPDP Act, including:
      1. if we are required to do so because of an applicable law, or for complying with any judgment, decree or order made under law, or pursuant to requests from public and government authorities (including orders of court or government regulations), including, where permitted by applicable law, authorities outside your country of residence;
      2. if we need to enforce our terms and conditions;
      3. when we believe in good faith that the use of Personal Data is necessary to protect legal rights, the security or integrity of this website;
      4. to protect your safety or the safety of others;
      5. as part of any criminal or other legal investigation or proceeding in your country or in other countries; or,
      6. to the extent reasonably necessary for development of or to proceed with the negotiation or completion of a corporate or commercial transaction or business reorganisation.
4. Who we may share your Personal Data with?
   1. This section of the Privacy Policy describes the circumstances in which we may share your Personal Data. We may share your Personal Data with our subsidiaries and affiliates worldwide to exchange information and maintain databases in different countries. As the Data Fiduciary, we remain responsible for compliance with the DPDP Act in respect of any processing undertaken on our behalf by any data processor.
   2. We may also transfer Personal Data to third parties who act on our behalf as data processors, for further processing in accordance with the purpose/s for which the information was originally collected or may otherwise be lawfully processed, such as product or services delivery, evaluating the usefulness of our products or services, marketing, advertising, data management, or technical support. We engage such data processors only under a valid contract, as required under section 8(2) of the DPDP Act.
   3. In the course of our activities and for the same purposes as those listed in this Privacy Policy, your Personal Data can be accessed by, or transferred to the following categories of recipients on a need-to-know basis to achieve such purposes:
      1. our personnel (including employees, departments, or other companies of the Sava group);
      2. our IT systems providers, cloud service providers, database providers and consultants;
      3. any third party to whom we assign or novate any of our rights or obligations; and
      4. our advisors and external lawyers in the context of the sale or transfer of any part of our business or its assets.
   4. These parties are contractually required to use Personal Data only for the purpose/s agreed upon, to implement reasonable security safeguards, not to sell Personal Data to third parties, and not to disclose it to third parties except as may be permitted by us, as required by law, or as stated in this Privacy Policy.
   5. We may disclose your Personal Data to a third party in the event of our business or a part thereof, and the customer data connected with it, is proposed to be reorganised, sold, assigned, or transferred, in which case we would require the buyer, assignee, transferee or recipient to treat Personal Data in the same manner and in accordance with this Privacy Policy.
   6. We may also disclose your Personal Data to a third party if we are required to do so under the applicable law, requests from public and government authorities (including orders of court or government regulations), even outside your country of residence; if we need to enforce our terms and conditions; when we believe in good faith that the disclosure is necessary to protect legal rights, the security or integrity of this website; to protect your safety or the safety of others; as part of any criminal or other legal investigation or proceeding in your country or in other countries; or to third parties, advisors, and other entities to the extent reasonably necessary for development of or to proceed with the negotiation or completion of a corporate or commercial transaction.
   7. Your Personal Data may also be processed, accessed, or stored in countries outside India, in which Sava, its affiliates or subsidiaries maintain facilities, or where our service providers are located. Under section 16 of the DPDP Act, the transfer of personal data outside India is permitted except to such countries or territories as may be restricted by the Central Government by notification, and we will not transfer your Personal Data to any country or territory so restricted. Any such transfer shall also be subject to such requirements as the Central Government may specify in respect of making Personal Data available to foreign States or their agencies. If we transfer your Personal Data to other jurisdictions, we will continue to protect it in accordance with the DPDP Act, the DPDP Rules and this Privacy Policy, by applying the level of protection required under applicable data privacy laws and by implementing adequate technical and organisational measures, including appropriate data protection clauses or other contractual protections with the recipients of such Personal Data in accordance with applicable law.
   8. Except as set out in this Privacy Policy, we will not otherwise sell, share or transfer your Personal Data to third parties.
5. Retention and erasure of Personal Data
   1. Our retention periods for Personal Data are based on business needs and legal requirements. We will retain your Personal Data for as long as necessary to fulfil the specified purpose for which it was collected, or to comply with legal or regulatory requirements, or any other permissible, related purpose. In accordance with section 8(7) of the DPDP Act, we will erase your Personal Data upon your withdrawal of consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, unless retention of the same is necessary for compliance with any law for the time being in force.
   2. When we deem that Personal Data is no longer needed, we either irreversibly anonymise the information (and we may further retain and use the anonymised information) or securely destroy the information.
6. Security of your Personal Data and Personal Data breaches
   1. No data transmission over the Internet or website can be guaranteed to be secure from intrusion. However, we have implemented reasonable security safeguards, being appropriate technical and organisational measures designed to provide an adequate level of security and confidentiality to your Personal Data and to prevent its breach, as required under section 8(5) of the DPDP Act read with rule 6 of the DPDP Rules, including measures in the nature of encryption or masking, control of access to our computer resources, monitoring and logging of access, and data backups.
   2. The purpose of these measures is to protect Personal Data, in accordance with the requirements of the DPDP Act, the DPDP Rules and other data protection legislative requirements, against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure, or access and against other unlawful forms of processing, and to prevent any “personal data breach” within the meaning of the DPDP Act.
   3. In the event of a personal data breach affecting your Personal Data, we will, in accordance with section 8(6) of the DPDP Act read with rule 7 of the DPDP Rules, intimate each affected Data Principal and the Data Protection Board of India of such breach in the manner and within the timelines prescribed thereunder, including a description of the breach, its likely consequences for you, the measures implemented or being implemented by us to mitigate risk, and the safety measures that you may take to protect your interests.
   4. While we strive to protect your Personal Data at all times, we cannot guarantee its absolute security and, to the extent permitted by applicable law (including the DPDP Act), shall not be liable for any breach of security by an outside party, including where an unauthorized access, modification, destruction or disclosure of your Personal Data or data is attributable to any acts of an outside party, or any breach of security, virus and data protection protocols at your end or on the computer or system that you use to access our website.
   5. You are responsible for keeping your Personal Data confidential and for complying with any other security procedures that we notify you of.
7. Your rights and how to exercise them
   1. Whenever we process Personal Data, we take reasonable steps to keep your Personal Data accurate, complete, consistent and up to date for the purposes for which the same was collected.
   2. If you have any questions in relation to our use of your Personal Data, you may contact our designated contact person for data protection at legal@savaglobal.com, who is able to answer your questions about the processing of your Personal Data.
   3. Under the DPDP Act, subject to the conditions and within the limits set forth in the law, you may exercise the following rights:
      1. to be informed about, and to obtain from us upon request, a summary of the Personal Data being processed by us and the processing activities undertaken by us with respect to such Personal Data (section 11 of the DPDP Act);
      2. to access or be provided with the identities of all other Data Fiduciaries and data processors with whom your Personal Data has been shared by us, along with a description of the Personal Data so shared, and, if you believe that any Personal Data relating to you is inaccurate, misleading, obsolete, or incomplete, to request its correction, completion or updating (sections 11 and 12 of the DPDP Act);
      3. to request the erasure of your Personal Data, which we shall erase unless its retention is necessary for the specified purpose or for compliance with any law for the time being in force (section 12 of the DPDP Act);
      4. where processing is based on consent, to withdraw your consent at any time, with the ease of doing so being comparable to the ease with which such consent was given (without affecting the lawfulness of the processing before such withdrawal) – please note that this may impact your experience on the site and the services we are able to offer (section 6 of the DPDP Act);
      5. to have readily available means of grievance redressal provided by us in respect of any act or omission regarding the performance of our obligations under the DPDP Act (section 13 of the DPDP Act); and
      6. to nominate, in the manner prescribed under the DPDP Rules, any other individual who shall, in the event of your death or incapacity, exercise your rights under the DPDP Act (section 14 of the DPDP Act).
   4. You also have the right to ask us not to process your Personal Data for marketing purposes. Where you do not wish to receive marketing from us, you can decline or withdraw your consent at any time, either by clicking the unsubscribe link in any marketing message received from us, or by contacting our designated contact person for data protection at legal@savaglobal.com.
   5. We will use reasonable endeavours to ensure that your Personal Data held with us is accurate. In order to assist us with this, you should notify us of any changes to the Personal Data that you have provided us by contacting our designated contact person for data protection at legal@savaglobal.com. Please note that it is your duty as a Data Principal under section 15 of the DPDP Act to ensure that the Personal Data provided by you is authentic, to not impersonate another person or suppress any material information, and to not register a false or frivolous grievance or complaint.
   6. If you have any questions, or want to exercise the above rights or you are not satisfied with how we process your Personal Data, you may send an email to our designated contact person for data protection at legal@savaglobal.com with a scan of your identity card for identification purpose, it being understood that we shall only use such data to verify your identity and shall not retain the scan after completion of the verification. When sending us such a scan, you should make sure to redact your picture and national identification number or equivalent on the scan.
   7. Exercise of these rights is subject to certain exemptions under the DPDP Act to safeguard the public interest and our interests. If you exercise any of these rights, we will check your entitlement and respond in most cases within a month, and in any event within such time period as may be prescribed under the DPDP Act and the DPDP Rules or published by us.
   8. If you are not satisfied with our response to any exercise of these rights, you may address our designated contact person for data protection at legal@savaglobal.com, who will look into your concern. You may request us to restrict how we use your information whilst your concern is being looked into. If you remain dissatisfied with our response after exhausting the grievance redressal opportunities provided by us, you have the right to make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act and the DPDP Rules.
8. Changes to our Privacy Policy and/or Cookies Policy
   1. We may change the content of our websites and how we use cookies, and consequently change or update our Privacy Policy and/or Cookies Policy from time to time by posting new policies on this website. Please keep checking these policies occasionally so that you are aware of any change/s. If we change our Privacy Policy or Cookies Policy, we will update the date it was last changed below. If these changes are material, we will indicate this clearly on our Website.
   2. Our Privacy Policy and Cookies Policy was last updated on 7th August 2026.