Privacy Policy

Caspian Healthcare Foundation ("we") respects your privacy and processes your personal data in line with India's Digital Personal Data Protection Act, 2023. This policy explains what we collect, why, who helps us handle it, and your rights.

What we collect

• Enquiry details: name, email, phone/WhatsApp, city and role. The enquiry form sends these to our inbox through FormSubmit, an email forwarding service.
• Application details (to enrol): your title and the name as it should appear on your certificate, date of birth, medical council and registration number, qualification and specialty, workplace, your permanent and correspondence addresses, a passport-style photograph, and your responses about your goals and preferences.
• Your unfinished application is saved on your own device as you type, so that you can continue later. It stays in your browser for up to 45 days and is not sent to us until you submit it. Your photograph and your consent choices are never saved this way.
• Next-batch updates: if you ask to be told when the next batch opens, your email address or WhatsApp number (or both), your name and city if you give them, the page you signed up on, and a scrambled (hashed) form of your internet address, used only to limit repeated sign-ups from one connection.
• Session feedback: the feedback form is anonymous unless you add your name. If you tick the box allowing us to quote you, we may show your comment on this website with your name and title, corrected for typing errors only and never changed in meaning.
• Payment information is handled by our payment gateway, Razorpay; we do not store your card or bank details.

Identity & medical-registration verification

So that a certificate is issued to a genuinely registered doctor and is publicly verifiable, we may verify your details through a licensed verification provider (Surepass Technologies):

• Medical registration (NMC / State Medical Council): we check the registration number you provide against the National Medical Register to confirm your registered name.
• Aadhaar via DigiLocker, only with your explicit, separate consent: you sign in to your own DigiLocker and choose to share your Aadhaar. We use this solely to confirm that your name matches and to obtain your address.

We never store your Aadhaar number. We retain only the outcome of the check (verified: yes/no), the verified name and address, and a reference number for audit. This verification is optional: if you decline, or a check cannot be completed, we simply review your application manually rather than refusing it. You may withdraw your consent at any time.

How we use it

• To respond to your enquiry, confirm your seat, run the course, and issue your certificate.
• To confirm eligibility and to print your name correctly on a verifiable certificate.
• To tell you, once, when enrolment for the next batch opens, if you asked us to. Nothing else is sent under that sign-up.
• To improve the course from your feedback, and to show quotes only where you have agreed.
• To meet legal, accounting and tax obligations.

Sharing

We share data only with the service providers who help us run the course, and where required by law. We do not sell your data.

• Razorpay, our payment gateway.
• Surepass, our identity-verification provider, for the optional checks above.
• Supabase, our database and secure file-storage provider, in Mumbai, India. Applications, photographs, feedback and next-batch sign-ups are stored there.
• FormSubmit, which forwards enquiry forms and enrolment notifications to our email inbox.
• WhatsApp, a service of Meta Platforms, when you message us or ask for updates on WhatsApp, under WhatsApp's own terms and privacy policy.
• Vercel, which hosts this website and its cookieless visitor statistics.

Retention & your rights

We keep enrolment records for as long as needed for the course, certification and legal requirements; your photograph and verified details are kept as part of your course record and certificate. Next-batch sign-ups are kept until you ask us to stop; we then mark your contact as unsubscribed so you are not contacted again, and if you would rather we delete it completely, we will. Under the DPDP Act you may request access to, correction or deletion of your data, and withdraw consent, by writing to us. To stop updates, you can also reply STOP. We will respond within 30 days.