Privacy Policy

01Introduction & Scope

Chhaya Technologies Ltd ("we", "us", "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we handle your personal information, and any personal information you give us about a member of your family or a beneficiary.

This Policy applies to all Chhaya services, including our website at chhaya.life, our mobile applications Chhaya — Everyday Life Cover available on Google Play and other app stores, and all insurance and related services we provide through those channels.

We also tell you about your legal rights and how to contact us. If we update this Policy, we will post the new version on this page and update the version number and effective date above.

02Information We Collect

Personal information means any information that relates directly or indirectly to an individual who is identified or identifiable, either from that information alone or together with other information we hold. Certain personal information is classified as sensitive personal information.

We take all appropriate steps to ensure the personal information we collect is accurate, complete, not misleading and up to date, having regard to the purpose for which it was collected and further processed.

Information you give us

• Identity data — name, date of birth, gender, occupation, and government-issued identification including your national identity number and images of identity documents.
• Contact data — address, email address and phone numbers.
• Financial data — payment details, purchase history and historical transaction data.
• Health data — information about your health provided during the course of a policy, a claim, or a health or counselling service.
• Photos and documents — medical reports, bills, prescriptions, identity documents and other images you capture or upload in support of registration or a claim.
• Messages — emails and in-app messages exchanged with us in connection with your account, policy or claim.

Information we collect automatically

• Technical data — IP address, browser type and time zone settings.
• Device and other identifiers — device model, operating system and app version, device identifiers, crash and diagnostic logs, and push notification tokens.
• App activity — how you navigate and use our website and apps, including your interactions with app features.
• Approximate location — where you permit it, used to show you relevant hospitals, pharmacies and service points and to support fraud prevention.

Permissions our mobile app may request

• Camera and photos — to let you photograph or upload identity and claim documents. We access these only when you choose to capture or attach a document.
• Notifications — to send you policy, premium and claim updates.
• Approximate location — to show nearby network hospitals, pharmacies and service points.

You can withdraw any permission at any time through your device settings. Some features will not work without the permission they rely on.

03How We Use Your Information

Our goal in using your information is to provide a seamless, technology-led insurance experience. We process your data to perform our contract with you, to comply with our legal obligations, and to pursue legitimate business interests that do not override your fundamental rights.

• Underwriting — assessing risk and providing appropriate pricing.
• Claim processing — verifying and settling claims when you need coverage.
• Service delivery — issuing policies, collecting premiums, and providing the services included in your package.
• Legal and regulatory compliance — meeting our obligations to the Insurance Development and Regulatory Authority, the Bangladesh Financial Intelligence Unit, and tax authorities.

04General & Contact Information

We collect general identification and contact information about you and other relevant individuals when you register with us for any of our services. This may include your first name, surname, address, telephone number, gender, date of birth, occupation and national identity number.

Maintaining accurate records is the foundation of our reliability. We keep your contact information synchronised across our systems so that coverage does not lapse and claim communications reach you.

05Health & Insurance Services

When you use a health or counselling related product or service of ours, we collect and record sensitive personal information about you. This includes information about your health — for example, information you provide during the course of an insurance policy or a claim.

We process health-related data with heightened security and care, and only where we have your explicit consent or another lawful basis, in accordance with applicable data protection laws.

06Use & Handling of Personal Information

We are committed to using and handling personal information in accordance with applicable data protection laws. We collect and use personal information only where we have a legitimate business reason to do so.

We use your personal information to respond to requests about our products and services; register you and other relevant individuals for the products and services you buy; assess your eligibility and process your premium and other payments; make or facilitate payments in relation to products or services you buy; and communicate with you on important matters about the services you use.

07Marketing

We use personal information about potential customers received from our business partners to ask whether they are interested in our products and services.

To improve what we offer, we also use personal information to carry out market research, including profiling activities. Unless you have told us you do not wish to receive marketing communications, we may use your personal information to send you direct marketing about our products and services.

You can opt out of marketing at any time — in the app under Settings, using the unsubscribe link in any marketing email, or by contacting us. Opting out of marketing does not stop service messages about your policy, premiums or claims.

08Telephone Records

We record telephone conversations with our customers and potential customers so that we have evidence of their requirements and for quality assurance purposes. These recordings are stored securely and accessed only by authorised personnel for the purposes stated.

Call recordings are retained for 90 (ninety) days and are then securely deleted, unless a recording is required as evidence in connection with a claim, a complaint, or a legal or regulatory matter, in which case it is retained until that matter is resolved.

09Security

We take our information security responsibilities seriously and apply appropriate technical and organisational measures to prevent the loss, misuse, modification, unauthorised access or disclosure, alteration or destruction of your personal data.

We limit access to your personal data to those employees, agents, contractors and third parties who have a business need to know, and they are subject to confidentiality obligations.

Our information security management system is certified to ISO/IEC 27001:2022.

10Data Retention

We keep your personal information only for as long as necessary for the purposes described in this Policy, or for as long as we are required to keep it by law.

Records we are required to retain

Where you hold, or have held, an insurance policy through Chhaya, we retain the following for a minimum of 5 (five) years from the end of our relationship with you:

• Identity verification records, including national identity and KYC documents
• Policy and coverage records
• Premium payment and refund records
• Claims history and claim documents
• Consent and authorisation records
• Support correspondence relating to your policy, premium or claim

These records are held in restricted storage, are not accessible to our general staff, and are used only to meet legal, regulatory and audit obligations or to service a claim. They are securely destroyed once the applicable retention period ends.

Everything else

Information we are not required to retain is deleted when it is no longer needed for the purpose it was collected for, or when you close your account. This includes your login credentials, profile details, device and notification data, marketing preferences, website and app usage history, and saved quotes and draft applications.

11Account Deletion

You may ask us to delete your Chhaya account and the data associated with it at any time. There is no charge for making this request.

How to request deletion

• In the app — Settings → Account → Delete Account
• On the web — https://chhaya.life/delete-account

Both routes require verification by one-time code sent to your registered mobile number, so that we can confirm the request is genuinely from you.

What happens after you request

1. 1Days 1–14 — waiting period. Your account is placed on hold. Nothing is deleted during this time, and your data is not used for any purpose. Logging in to the Chhaya app within these 14 days automatically cancels the request and restores your account — you do not need to contact us.
2. 2Day 15 onward — deletion. Deletion begins and is completed within 30 days. This cannot be reversed.

Records we are legally required to retain are handled as described in Data Retention above. Deleting your account does not by itself cancel any insurance contract, and does not affect records already held by our underwriting partners or payment service providers under their own legal obligations.

After deletion, you may register again with the same mobile number. Your new account will be empty, and you will need to complete identity verification again.

12Sharing Personal Information

Where your data is stored

Your personal information is stored on servers located in Bangladesh. We also use cloud infrastructure located outside Bangladesh for processing, redundancy and backup. Where personal information is processed or stored outside Bangladesh, we apply appropriate contractual and technical safeguards, and the Bangladesh-based storage remains the primary record.

Who we share it with

We share your identity and contact information (name, email address and address) and your health information with our underwriting partners — the licensed insurers and reinsurers who issue and underwrite your policy — so that they can assess risk, issue your policy, settle claims, and meet their own legal and regulatory obligations.

We also engage service providers who process personal information on our behalf and under our instructions, including payment service providers, cloud hosting providers, and medical professionals and service providers involved in a claim or a health service you use. These providers act as our processors and may not use your information for their own purposes.

We may also disclose personal information where required by law, court order, or a lawful request from a regulator or law enforcement authority.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

13Your Legal Rights

You have legal rights in relation to your personal information. You have the right to access your personal information; correct inaccurate personal information; request erasure of your personal information in certain circumstances; object to or restrict our use of your personal information; request that we transfer your personal information to another organisation; and withdraw your consent where we rely on consent.

You will not have to pay a fee to access your personal information, to delete your account, or to exercise any of these rights.

We will respond to your request within a reasonable period. Where a right cannot be given effect because we are legally required to retain the information, we will tell you which obligation applies and for how long.

14Sensitive Personal Information

Where personal information is sensitive personal information, we collect and use it only with your explicit consent, unless we are permitted to use it under applicable law. Sensitive personal information includes information about racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic or biometric data; health data; and sex life or sexual orientation.

We may process your sensitive personal information to protect your vital interests, in connection with legal proceedings, or for the purposes of obtaining, establishing, exercising or defending legal rights.

15Children's Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal information directly from children under 18 for the purpose of creating an account.

We may hold information about a child where an adult policyholder has named them as a dependant or beneficiary. That information is provided by the adult and is used only to administer the policy and any claim under it.

If you believe a child has created an account with us, please contact us and we will delete the account and its data.

16Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and change the version number and effective date shown at the top.

Where a change materially affects how we use your personal information, we will notify you through the app, by email, or by text message before the change takes effect.

17How to Contact Us

Please contact us with any query about your data or this Policy.