Data Processing

Roles

Where a business customer uses InsurCall to serve its own policyholders, InsurCall acts as a software processor or service provider and the business customer acts as data controller or fiduciary for those policyholders, as applicable.

Within InsurCall's own pilot operations, account and staff data are processed by InsurCall on the basis of its legitimate interests and contractual necessity.

Processing purposes and categories

• Support conversations: answering questions from approved knowledge and capturing claims-intake information.
• AI operations: local or explicitly permitted inference, embeddings, retrieval, response synthesis.
• Operations: authentication, tenancy isolation, messaging gateway, audit and security logging.
• Communications: WhatsApp messaging, templates, delivery events, escalation handoffs.

Lawful basis and consent

Personal data processing is carried out under the Digital Personal Data Protection Act, 2023 and related notified rules, with consent evidence captured where required and opt-outs enforced at the processing boundary.

Processing that is not covered by an explicit consent or legal basis must not be performed.

Subprocessors and transfers

The current and potential subprocessors are listed on the Subprocessors page. International data transfers apply only where a processor or hosting region outside India processes data, and must be supported by appropriate safeguards.

Data subject rights and retention

Data subject rights requests, retention behaviour and deletion safeguards are handled through the Data Rights, Retention and Security pages respectively.