Privacy Policy

This Policy explains how Caresoft Systems Private Limited ("Caresoft", "xhealthnetwork", "we") handles personal information through xhealthnetwork.com and the Daily Grid newsletter.

Where we are, and what that means for you.

xhealthnetwork is published from Mumbai, India, for a US readership. Your information is processed in India, under Indian law including the Digital Personal Data Protection Act, 2023.

Many US state privacy laws have revenue and volume thresholds we do not meet, so they may not legally bind us today. We give you those rights anyway — every reader, wherever you are, gets the full set in §15. We would rather be straightforward than technically exempt.

The short version.

We collect business contact information, what you read, and what you give us when you subscribe, register a listing, post a job or download a report.

We do not sell your information, to anyone, for money or anything else. We use analytics with your consent, and we honor Global Privacy Control automatically.

We never collect patient health information — see §4.

Contents

Who this covers
Where your information goes
What we collect
We do not handle patient data
Where it comes from
How we use it
Cookies and analytics
Who we share it with
We do not sell your information
Global Privacy Control
If you register a vendor listing
If you post or apply for a job
Gated reports and sponsors
The Daily Grid
Your rights — everyone gets these
How to exercise them
Sources and newsgathering
How long we keep it
Security
If something goes wrong
Children
Indian law — DPDP Act, 2023
Grievance Officer
Changes and contact

1. Who this covers

Visitors, subscribers, registered users, vendors, job posters and anyone who contacts us. It does not cover third-party sites we link to, or how a vendor or employer handles information you give them directly.

2. Where your information goes

Your information is processed in India, where our team and our company are. Some service providers — hosting, email delivery, analytics — may process it in the United States or elsewhere, depending on where their infrastructure sits.

Privacy law in India differs from the law in your state or country. By using the Site you understand that your information is handled in India under Indian law, with the protections in this Policy applying wherever it is processed.

We require every service provider, wherever located, to protect your information by contract, to use it only for the service they provide us, and not to sell it or use it to train AI models.

3. What we collect

Category	Examples
Identity and contact	Name, work email, employer, job title, business phone, business address
Account	Username, password (stored only as a salted hash), preferences, saved items
Vendor listing	Company details, logo, product descriptions, claimed certifications, contact person
Job posting	Employer details, role information, application contact
Commercial	Orders for advertising, sponsorship or listings; billing contact. Card details go to the payment processor, not to us
Usage	Pages viewed, articles read, searches, downloads, email opens and clicks
Device	IP address, browser, operating system, device type, approximate location from IP (city or region, never precise)
Communications	Emails, support messages, pitches, correction requests
Inferences	Likely professional interests from what you read, used to make the newsletter more relevant

We do not collect: government ID numbers, precise geolocation, biometric data, financial account numbers, racial or ethnic origin, political or religious beliefs, health data about you, or any patient health information (§4).

4. We do not handle patient data

xhealthnetwork is a business publication. We are not a HIPAA covered entity, business associate or subcontractor, and we do not collect, receive, store or process protected health information.

Do not send us patient information. Not in a pitch, not in a support message, not in a vendor listing, not as an attachment. If you do, we will delete it and tell you.

If you need to share something sensitive with the newsroom, write to an editor first and we will agree a secure method (§17).

5. Where it comes from

From you — subscribing, registering, posting, downloading, buying, writing to us.
Automatically — cookies as you use the Site (§7 and the Cookie Policy).
From public and licensed sources — for directories and editorial research: company sites, SEC and other regulatory filings, FDA databases, press releases, court records, licensed business databases.
From our service providers — analytics, email delivery, payments.

Directory entries built from public sources. Some vendor, startup, AI tool and executive entries are compiled from public information rather than submitted. If you appear and want it corrected or removed, write to [email protected]. Where the entry is journalism rather than a directory listing, the Corrections Policy applies instead.

6. How we use it

Running the Site, your account and the newsletter.
Publishing and maintaining directories, rankings, listings and job posts.
Delivering reports you request.
Processing orders for advertising, sponsorship and listings.
Measuring what people read, so we commission better coverage.
Personalizing what the newsletter leads with.
Responding to your messages, corrections and privacy requests.
Preventing fraud, abuse, scraping and unauthorized access.
Meeting legal obligations and enforcing our Terms.
Journalism — researching, verifying and publishing in the public interest (§17).

We do not use your personal information to train artificial intelligence or machine learning models, and we do not permit our service providers to do so with information we give them.

7. Cookies and analytics

Type	What it does	Consent
Strictly necessary	Sign-in, session, security, consent record	Set without consent — the Site cannot work otherwise
Functional	Preferences and saved items	Optional
Analytics	Aggregate measurement of what is read	Only with consent
Advertising	Where used, measuring campaigns	Only with consent, and off entirely if you send GPC

Our banner offers "Essential only" and "Accept all" with equal prominence. Change your choice any time from the footer.
IP addresses are truncated before storage in analytics where the provider supports it.
We place no advertising or tracking technology behind a sign-in, and build no advertising profiles from account activity.
Full detail in the Cookie Policy.

Who	What they get
Hosting and infrastructure	Data at rest and in transit, to run the Site
Email delivery provider	Your email and the message, to send the newsletter
Analytics provider	Usage data, with consent
Payment processor	Payment details. Card numbers never reach us
Report sponsors	Only where disclosed on the download form (§13), and only the fields stated
Employers	Your application, if you apply through the Site (§12)
Professional advisers	Where necessary, under confidentiality
Authorities	Where legally required — below
Acquirer	In a merger or sale of the publication, subject to this Policy and announced in advance

Legal demands. We disclose where required by valid legal process under Indian law, or a foreign order enforceable against us. We assess every demand, push back where there are grounds, disclose the minimum, and notify the affected person unless prohibited. Demands touching newsgathering are also covered by §17.

9. We do not sell your information

We do not sell personal information, to anyone, for money or for any other benefit. We never have, and we have no plans to.

We do not operate advertising exchanges, do not share data with ad networks, and do not participate in cross-site behavioral advertising.

Analytics is the only non-essential technology we use, and only with your consent. If you would rather not be measured at all, choose "Essential only" or send GPC (§10) — nothing about your access changes.

10. Global Privacy Control

If your browser sends a Global Privacy Control signal, we honor it automatically as an opt-out of all non-essential processing. We do not override it and do not ask you to confirm. Nothing further is needed on that browser.

11. If you register a vendor listing

Listing content is published publicly and indexed by search engines. That is the point of it.
Published contact details are visible to anyone. Use a business address and a role inbox, not a personal mobile.
We use your administrative contact details to manage the listing and verify claims.
You can edit or ask us to remove a listing at any time. Removal takes it off the live Site; search engine caches and archive services may persist and are outside our control.
Evidence you submit for a certification or regulatory claim is retained as our verification record (§18).

12. If you post or apply for a job

Employers: contact details in a posting are published. Applications go to the address you specify.
Applicants: your application goes to that employer, who then handles it under their own practices. We cannot retrieve or delete it from their systems.
We keep a record that an application was submitted, for fraud prevention and support, and use application content for nothing else.
We never charge job seekers. Any request for payment is fraudulent — [email protected].

13. Gated reports and sponsors

Some reports require registration. Where a sponsor receives your details, we say so clearly on the download form, before you submit — including which fields they get.

If you would rather not share with the sponsor, do not submit the form. Write to [email protected] and we will tell you whether an unsponsored version exists.

Once a sponsor has your details they are independently responsible for their copy under their own policy. We require them to honor opt-outs and not to resell, but we cannot delete from their systems.

We confirm every address before sending.
We measure opens and clicks to understand what readers find useful. Blocking images in your email client turns that off.
Every email carries a working one-click unsubscribe, honored promptly and within 10 business days at the latest, and our registered postal address in Mumbai — both as CAN-SPAM requires of anyone emailing US recipients.
We do not sell, rent or trade our subscriber list.
Unsubscribing stops marketing. We may still send transactional messages about an account or order.

15. Your rights — everyone gets these

We give every reader the same rights, wherever you live, regardless of whether a particular law applies to us. It is simpler for you and simpler for us.

Right	What it means here
Know and access	What we hold, why, where it came from, who we shared it with — and a copy
Correct	Fix anything inaccurate or incomplete
Delete	Deletion of what we hold, subject to the limits below
Portability	A copy in a usable, machine-readable format
Opt out of analytics and any tracking	Cookie settings in the footer, or send GPC
Opt out of marketing	One click in any email
Withdraw consent	As easily as it was given
Nominate someone	To act for you on death or incapacity, as the DPDP Act provides
Complain	To our Grievance Officer (§23), and to the Data Protection Board of India
No retaliation	We never charge you more, give you less, or deny access for exercising a right

Limits. We may decline or partly decline where we must keep something — to complete a transaction, detect fraud, meet a legal or tax obligation, or where the material is published journalism or would identify a source (§17). We will tell you specifically which limit applies and to what, never a general refusal.

16. How to exercise them

Online: xhealthnetwork.com/privacy-request
Email: [email protected]
Post: Privacy, Caresoft Systems Private Limited, 311, Mahesh Industrial Estate, Silver Park, Mira Road (East), Thane, Maharashtra 401107, India

We acknowledge within 10 business days and respond within 30 days, extendable once where genuinely necessary — we will tell you if we need longer and why.
Opt-outs take effect immediately and need no verification.
For access, correction and deletion we verify identity proportionately — usually by confirming control of the email address we hold. We will not ask you for a government ID.
Authorized agents may submit with written permission; we may contact you to confirm.
No charge, unless a request is manifestly excessive, in which case we will say so first.
If we decline, reply with "Appeal". A different person reviews and responds within 30 days with reasons, and tells you how to escalate.

17. Sources and newsgathering

If you contact us as a source, we protect you. We do not disclose source identities, we minimize what we record about confidential contacts, and we will resist demands for source material to the extent the law allows.

Journalistic material is held separately from marketing systems and is never used for advertising, analytics or profiling.
Do not send sensitive material through the website contact form. Write to an editor first and we will agree a secure channel.
A privacy request that would require us to disclose journalistic material or identify a source may be limited. We will tell you specifically if that is the reason.

18. How long we keep it

Data	Retention
Newsletter subscription	Until you unsubscribe, then a suppression record so we do not email you again
Account data	Life of the account plus 90 days
Vendor listing content	While published; verification records 3 years after removal
Job postings and application records	12 months
Report registrations	24 months
Analytics data	14 months
Email engagement data	13 months
Billing, invoices and tax records	Up to 8 years, as Indian tax law requires
Correspondence	24 months
Privacy request records	24 months
Security and access logs	Minimum 180 days, as CERT-In directions require of Indian providers
Published journalism and editorial records	Retained as part of the archive — see §17

19. Security

TLS encryption in transit, encryption at rest, access limited by role, multi-factor authentication for administrative accounts, passwords stored only as salted hashes, logging of administrative access, regular patching and vulnerability scanning, and security review of service providers.

No system is perfectly secure, and we do not guarantee that unauthorized access will never happen. Where a breach affects you, we will tell you (§20).

20. If something goes wrong

We notify affected people without undue delay, and in any event within 72 hours of confirming a breach.
We report to the Data Protection Board of India as the DPDP Act requires, and to CERT-In within 6 hours where its directions apply.
Where US state breach-notification law would apply to affected readers, we will notify in line with it as a matter of policy, whether or not it binds us.
Evidence is preserved and we publish a root cause summary with corrective actions within 10 working days.

21. Children

The Site is a business publication for adults and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us information, write to [email protected] and we will delete it. We do no tracking, behavioral monitoring or targeted advertising for any user, of any age, so the DPDP Act's prohibitions on those for children are satisfied by design.

22. Indian law — DPDP Act, 2023

Caresoft Systems Private Limited is the Data Fiduciary for personal data processed through xhealthnetwork. You are the Data Principal.

We process on the basis of your consent for the newsletter, accounts, listings and analytics; on legitimate uses permitted by the Act for security and for responding to something you approached us about; and on legal obligation for tax and log retention.
Consent is sought in clear language, unbundled, and is withdrawable as easily as it was given.
Your rights under the Act are in §15, exercised as in §16.
You may nominate someone to exercise your rights on death or incapacity.
The Act places duties on you too: do not impersonate anyone, do not register a false or frivolous grievance, and give authentic information when asking for a correction.
If we are ever notified as a Significant Data Fiduciary, this Policy will be updated with our Data Protection Officer's details.

23. Grievance Officer

Under the Information Technology Act, 2000 and the DPDP Act, 2023:

Grievance Officer: Rajeev Pillai
Email: [email protected]
Address: Caresoft Systems Private Limited, 311, Mahesh Industrial Estate, Silver Park, Mira Road (East), Thane, Maharashtra 401107, India
Acknowledgement within 24 hours; resolution within 15 days.

If you are not satisfied, you may complain to the Data Protection Board of India. Please raise it with us first, as the Act requires — but we will not obstruct, discourage or penalise a complaint to the Board.

24. Changes and contact

We may update this Policy. The "Last updated" date changes, and material changes are announced on the Site and, where we have your address, by email before they take effect. Changes to §4, §9 or §17 will be flagged prominently.

Caresoft Systems Private Limited
311, Mahesh Industrial Estate, Silver Park, Mira Road (East), Thane, Maharashtra 401107, India
CIN U72900MH2022PTC387875 · GSTIN 27AAKCC5044M1ZB

Privacy: [email protected] • Requests: xhealthnetwork.com/privacy-request
Security: [email protected] • Corrections: [email protected]
Abuse: [email protected] • General: [email protected]