GDPR POLICY

THE GOOD CARE PEOPLE INNOVATIONS PRIVATE LIMITED

Effective Date: 17 October 2026

Last Revised: 17 October 2026

Website: https://www.thegoodcarepeople.com

1. Introduction

The Good Care People Innovations Private Limited ("The Good Care People", "TGCP", "Company", "we", "us" or "our") respects the privacy, confidentiality and dignity of people who seek care, enquire about our services or apply to work with us. This GDPR Policy explains our approach to the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR") where that Regulation applies to particular processing activities.

This is a supplementary policy. It should be read with our Privacy Policy, Cookie Policy, Terms & Conditions, Medical Disclaimer and Patient Rights & Responsibilities. It does not replace a more specific privacy notice or consent information where an individual service or activity requires one. Nothing in this Policy limits a right available under applicable law.

2. Company Identification and Contact

Legal entity: The Good Care People Innovations Private Limited.

CIN: U87100KL2026PTC104080.

Registered office: 63/159, First Floor, DD Milestone, Kadavanthara, Ernakulam, Kerala – 682020, India.

Official email: office.admin@thegoodcarepeople.com.

Official telephone: +91 98460 28827.

Website: https://www.thegoodcarepeople.com.

Our designated Grievance Officer and Privacy/Data Protection Contact is Reshma PR, Director, reachable through the official email and telephone above. This contact designation should not be interpreted as an assertion that TGCP has appointed a statutory EU Data Protection Officer (DPO) or an EU representative; those legal requirements are assessed separately.

3. When the EU GDPR Applies

TGCP is incorporated and based in India. The EU GDPR does not automatically apply to every interaction merely because a website can be accessed in the European Union or European Economic Area (EU/EEA), or because an individual has European nationality.

The EU GDPR may apply to processing carried out in the context of an establishment in the EU, or to relevant processing by an organisation outside the EU associated with specifically offering goods or services to individuals located in the EU or monitoring their behaviour in the EU. The facts of each service, communication and processing activity determine whether and how the Regulation applies.

Where the EU GDPR applies, TGCP will address the corresponding legal obligations, including any necessary privacy notices, lawful bases, special-category safeguards, data-subject rights, contracts and international-transfer requirements. Publication of this Policy alone does not establish that all those operational requirements have been implemented.

4. EU/EEA Scope and the United Kingdom

For purposes of this document, the EU GDPR is discussed as applicable within its own legal and territorial scope, including relevant EEA arrangements. The United Kingdom has a separate UK GDPR and domestic data-protection framework, which may apply to particular activities involving individuals in the UK.

TGCP will assess UK-specific obligations separately where relevant; references to the EU GDPR do not automatically establish UK GDPR compliance or imply the appointment of a UK representative. EU/EEA and UK rules for cookies and electronic marketing may also differ from general GDPR provisions.

5. TGCP Activities Covered by This Policy

Where subject to the EU GDPR, relevant processing may arise from TGCP’s five service categories: Homecare Services; Hospital & Bystander Support; Patient Transfer Services (Domestic & International); Training & Skill Assessment; and Health Screening.

Relevant information may also be provided through website contact forms, client assessment requests, Healthcare Assistant registration forms, telephone calls, authorised electronic communications, events and subsequent service coordination. The actual scope of data processing depends on the particular enquiry, programme or engagement.

6. Categories of Personal Data

Depending on the activity and necessity, categories of information may include:

Names, contact details, addresses, country of residence and communication preferences.

Client enquiries, patient-care requirements, appointment or assessment information and correspondence.

Health information relevant to care coordination, screening, mobility, medical clearance or transfer arrangements.

Emergency contacts and authorised-family or representative details.

Healthcare Assistant application information, experience, qualifications, assessments, photographs and resumes.

Identity information provided for lawful verification, including masked Aadhaar or an approved alternative document where relevant.

Transaction, invoicing, service-confirmation or payment-reference information exchanged outside the website.

Technical information such as IP address, device/browser details, security logs and cookie identifiers, where collected.

TGCP does not require every category for every visitor or service. Collection should be limited to information genuinely necessary for the disclosed purpose.

7. Sources of Information

Information may be collected directly from the individual, from an appropriately authorised relative or representative, or from parties lawfully involved in a service such as treating clinicians, hospitals, screening providers, professional applicants or transport coordinators. Where data is received indirectly, TGCP will consider the applicable transparency obligations, the source’s authority and any restrictions or exceptions under the relevant law.

An individual submitting another person’s health information must have appropriate authority or another lawful basis. Such submission does not automatically authorise unrelated processing or disclosure.

8. Purposes of Processing

Where relevant to the service and legally permitted, personal data may be processed to respond to enquiries, evaluate care needs, coordinate qualified personnel, plan domestic or international patient transfers, organise health screening, review professional applications, manage client communications, meet legitimate regulatory obligations and maintain website security.

TGCP may also process appropriate information to administer disputes and grievances, maintain required records, prevent misuse and improve operations. Optional marketing, non-essential analytics and unrelated uses must be considered separately and will not be treated as automatically authorised by a healthcare enquiry.

9. Lawful Bases Under Article 6

Where the EU GDPR applies, each processing purpose must have an appropriate lawful basis under Article 6. Depending on the circumstances, a relevant basis may include consent; steps requested before entering a contract or performance of a contract; compliance with a legal obligation; protection of vital interests; or legitimate interests supported by the required balancing assessment. A public-interest basis is not assumed merely because TGCP operates in healthcare.

The lawful basis depends on the purpose and circumstances of each processing activity. Where the EU GDPR applies, the relevant privacy information identifies the basis relied on for that activity. A client’s need for a service, a family member’s request or a signed general form does not automatically establish the basis for every later use.

10. Health Information and Other Special Categories

Health information is a special category of personal data under Article 9 of the EU GDPR. When Article 9 applies, processing generally requires both an Article 6 lawful basis and a separate, valid Article 9 condition, together with any additional safeguards or Member State requirements.

Depending on the circumstances and applicable law, an Article 9 condition may concern explicit consent; necessary healthcare purposes under legally recognised professional confidentiality conditions; vital interests where the individual is incapable of consent; or another specifically applicable exception. TGCP will not assume that providing care in India automatically satisfies an EU professional-secrecy exemption or that ordinary, implied consent is sufficient for all health-data uses.

Access to health information should be limited to appropriate authorised personnel and providers according to the actual care arrangement and governing law.

11. Consent and Withdrawal

Where TGCP relies on consent under the EU GDPR, consent must be freely given, specific, informed and indicated by a clear affirmative action. Explicit consent will be sought where legally required for processing special-category data. Consent for one purpose will not automatically extend to another unrelated purpose.

Individuals may withdraw consent using the contact details in this Policy. Withdrawal does not invalidate processing lawfully performed before withdrawal and does not prevent processing that has another valid legal basis. Where TGCP cannot provide a requested optional feature without particular data, that consequence should be explained clearly.

12. Patient Information, Family Representatives and Confidentiality

Patient records and care-related information deserve particular protection. TGCP aims to use such information only for specified, relevant functions, with confidentiality and safeguards appropriate to the circumstances.

Family membership alone does not confer unlimited access to a patient’s records. Disclosures to carers, family members, hospitals or representatives must be supported by lawful authority, valid consent, medical necessity or another applicable legal basis. Where the individual’s decision-making capacity is relevant, the appropriate consent and representation rules will be considered.

13. Healthcare Assistants and Professional Applicants

Applicants through TGCP’s Healthcare Assistant Access facility may provide educational records, work history, training details, resumes, photographs and suitable identification documents. TGCP’s approved options are masked Aadhaar, Voter ID (EPIC), Driving Licence and Indian Passport; PAN may be requested separately only for an appropriate purpose.

Aadhaar is not the exclusive identity option. Application does not guarantee selection or assignment. Where the EU GDPR applies, the privacy information provided to applicants explains the applicable basis, disclosures, retention and rights for the recruitment activity.

14. Homecare and Hospital & Bystander Support

Care enquiries and delivery may require sharing a minimum relevant amount of information with authorised care personnel, treating clinicians and facilities, taking account of the individual’s needs and legal permissions. Information concerning diagnosis, medication, mobility and risks should not be shared beyond those who have a legitimate and lawful role in the particular arrangement.

TGCP personnel do not replace hospital responsibilities or independently acquire unrestricted access to hospital records by virtue of an assignment. Access and use remain subject to professional scope, hospital procedures and applicable confidentiality rules.

15. Patient Transfer Services (Domestic & International)

TGCP coordinates transport through external providers and may arrange appropriately qualified personnel to accompany a patient where appropriate. A transfer can require disclosure of limited necessary identity, travel, mobility and clinical information to authorised transportation providers, airlines, receiving facilities, clinicians or other parties.

Any sharing is subject to the applicable legal basis, individual notices, confidentiality obligations, appropriate documentation and, where relevant, international-transfer restrictions. TGCP does not own ambulances or aircraft, guarantee a patient’s fitness to travel or determine independent airline, immigration or clinical approvals.

16. Health Screening and Reports

TGCP may directly organise and conduct screening with appropriate personnel and qualified clinical involvement, or coordinate a programme delivered through independent clinical providers. Information may include preliminary measurements, attendance details, screening observations and reports generated through authorised processes.

Screening reports are not comprehensive medical diagnoses. Identifiable results should be shared with the individual or another lawfully authorised recipient using proportionate access safeguards. A corporate event organiser’s sponsorship of a programme does not, by itself, entitle that organiser to individual medical results. Any aggregate reporting should be appropriately de-identified where required.

17. Data Minimisation, Accuracy and Purpose Limitation

Where the EU GDPR applies, TGCP must process personal data lawfully, fairly and transparently; use it for specified legitimate purposes; limit collection to what is necessary; take reasonable steps to maintain accuracy; avoid excessive retention; protect its security; and demonstrate accountability.

Requests to correct relevant records will be assessed using appropriate verification and professional record-keeping practices. Information collected for patient care or professional assessment will not be repurposed for unrelated advertising solely because it is held by TGCP.

18. Controllers, Processors and Joint Responsibilities

Depending on actual arrangements, TGCP may determine the purposes and means of some processing as an independent controller, process information on behalf of another organisation, or share responsibilities with another controller. Those legal roles depend on the facts, not merely on the labels in an agreement.

The parties’ roles depend on the actual processing arrangement. Where Article 28 applies, a controller must use a compliant processor agreement; where parties jointly determine purposes and means, Article 26 applies. Hospitals, airlines, laboratories, cloud or website providers may have separate responsibilities under the GDPR.

19. Sharing of Information and Recipient Categories

Information may be disclosed where lawful and necessary to authorised staff and Healthcare Assistants, qualified treating professionals, hospitals, diagnostic or screening providers, transfer or travel partners, technology and cloud providers, professional advisers, insurers where relevant, regulators or authorities, and other recipients identified through a service-specific notice.

Disclosures are limited by the purposes, legal basis, notices and confidentiality duties applicable to the relevant processing. Patient information and identity documents are not available for unrestricted commercial disclosure, and a third-party relationship does not eliminate TGCP’s own legal duties.

20. Transfers Outside the EU/EEA

Where a transfer is subject to Chapter V of the EU GDPR, TGCP will determine whether an applicable adequacy decision, appropriate safeguards such as valid Standard Contractual Clauses, or a narrowly applicable derogation can lawfully support the transfer. Additional risk assessment and supplementary measures may be necessary.

The mere fact that data concerns an individual in Europe does not settle whether a particular communication constitutes a restricted transfer under Chapter V. Conversely, a direct arrangement involving providers in India or another country does not automatically satisfy EU transfer restrictions. Relevant arrangements must be evaluated individually. TGCP does not claim that India has received an EU-wide adequacy decision or that Standard Contractual Clauses are already in place for every provider.

21. Retention and Secure Disposal

Information will be kept only for as long as necessary for the identified purpose, subject to applicable legal obligations, care-record requirements, disputes and legitimate record-preservation needs. Retention may differ for enquiries, applicant materials, patient information, screening reports, account records and website logs.

Specific retention periods depend on the processing purpose, legal obligations, record-keeping requirements and any legitimate need to address disputes. Where required, the applicable Privacy Policy, collection notice or service arrangement describes the period or criteria. Information is retained or disposed of subject to applicable requirements and any valid preservation duty.

22. Security and Access Controls

The EU GDPR requires appropriate technical and organisational measures taking account of the processing and its risks. Possible measures include access controls, protected storage, secure transmission, confidentiality arrangements, incident procedures, backups and supplier oversight, as appropriate to the circumstances. This Policy does not certify that a specific system or control has been independently tested. No online environment can be guaranteed to be entirely risk-free.

23. Cookies, Analytics and Electronic Communications

Cookies and similar technologies may be used for website security, essential functionality and, where enabled, optional features such as analytics or embedded content. Their actual operation depends on the live website configuration.

Non-essential cookies or device-storage technologies may require consent under applicable EU/EEA national electronic-privacy laws, separately from any GDPR lawful basis for subsequent personal-data processing. Visitors should consult TGCP’s Cookie Policy. Submitting a healthcare enquiry is not blanket consent to unrelated analytics, advertising or direct marketing.

24. Individual Rights Under the EU GDPR

To the extent the EU GDPR applies and subject to relevant conditions or exceptions, an individual may have the right to be informed, obtain access, request rectification or erasure, restrict processing, receive portable data in applicable circumstances, object to certain processing, withdraw consent, and exercise protections concerning qualifying solely automated decisions.

The right to erasure is not absolute; relevant legal obligations, healthcare record duties or legal claims may justify limited retention. A person may object to direct marketing at any time where the relevant right applies. Additional rights and exceptions may depend on applicable Member State law.

25. Making a Privacy Rights Request

Individuals may contact office.admin@thegoodcarepeople.com or telephone +91 98460 28827, addressed to Reshma PR, Director – Grievance Officer & Privacy/Data Protection Contact. A request should identify the relevant concern and provide sufficient information to enable a reasonable search without unnecessarily including clinical or identity documents.

Where the EU GDPR applies, TGCP will respond without undue delay and generally within one month of receiving a valid request. Where permitted, that period may be extended by up to two further months for complex or numerous requests, with appropriate notice. TGCP may seek reasonable identity verification and will explain any refusal, fee or legal exception in accordance with the applicable rules.

26. Automated Processing and Profiling

TGCP may use digital tools to administer enquiries, create structured screening summaries or support operational coordination. Such administrative or rules-based processing should not be represented as an independent medical diagnosis or a final professional decision.

Where Article 22 of the EU GDPR applies to a decision based solely on automated processing that produces legal or similarly significant effects, additional restrictions and safeguards will be considered, including applicable rights to human intervention and to contest the decision. TGCP does not state that such decision-making is currently deployed without a specific system assessment.

27. Personal Data Breaches

Suspected loss, unauthorised disclosure, theft or misuse of personal data should be escalated promptly to the designated contact so that the incident can be contained, documented and assessed. Where the EU GDPR applies, the relevant controller must determine whether notification to a supervisory authority is required, ordinarily within 72 hours of becoming aware of a notifiable breach, and whether affected individuals must be informed without undue delay because of high risk.

The notification analysis depends on the circumstances, risks, TGCP’s legal role and any other applicable law. Not every security incident triggers the same reporting duty, but incident assessment and appropriate remedial action should not be delayed.

28. Accountability, Assessments and Professional Oversight

The EU GDPR requires measures such as records of processing activities, data protection by design and default, processor oversight and appropriate accountability. A data protection impact assessment (DPIA) is required where processing is likely to result in a high risk to individuals. Whether a DPIA, DPO appointment or another specific measure is required depends on the actual nature, scale, context and purposes of processing.

29. EU Representative, DPO and Supervisory Authorities

If Article 27 applies and no exception is available, the controller or processor must designate a representative in the EU in writing. No EU representative is identified in this Policy. Individuals may contact TGCP using the details below for privacy requests or concerns.

A statutory EU DPO appointment is required only in circumstances defined by applicable law, including specified cases of large-scale special-category processing or monitoring. Reshma PR is TGCP’s designated Privacy/Data Protection Contact, not automatically its statutory EU DPO. Where relevant, individuals have the right to lodge a complaint with an EU/EEA supervisory authority and seek judicial remedies in accordance with the GDPR.

30. Policy Updates, Indian Law and Official Contact

This Policy may be updated to reflect legal changes, new international service arrangements, changes in technology, operational practices or a refined assessment of applicable GDPR obligations. Material changes will be addressed through appropriate notice where required. The dates shown above identify this policy version.

TGCP remains subject to applicable Indian law, including information-technology and data-protection requirements as they become effective. This EU GDPR Policy supplements but does not displace our Indian-facing Privacy Policy or other applicable legal obligations. Publication does not establish that EU GDPR applies to every TGCP activity or constitute certification of compliance.

For enquiries or privacy grievances, contact Reshma PR, Director – Grievance Officer & Privacy/Data Protection Contact, The Good Care People Innovations Private Limited, 63/159, First Floor, DD Milestone, Kadavanthara, Ernakulam, Kerala – 682020, India. Email: office.admin@thegoodcarepeople.com. Telephone: +91 98460 28827. Website: https://www.thegoodcarepeople.com.

© 2026 The Good Care People Innovations Private Limited. All rights reserved.