Privacy Policy

This page explains what happens to the information you give this website: what is collected, why, where it is kept, who else sees it, and what you can require us to do about it. It is written in the language of the Digital Personal Data Protection Act, 2023 — the law that governs personal data in India. Under that Act you are the Data Principal and this practice is the Data Fiduciary.

Where the law currently stands. The Digital Personal Data Protection Act, 2023 is in force, but it is being switched on in stages by the Rules made under it, which were notified in November 2025. The provisions setting up the Data Protection Board of India started then. The main obligations on a Data Fiduciary, and the machinery for enforcing your rights, are due to start on 13 May 2027. We are not waiting for that date to apply this policy — but you should know that some of what is described below is a commitment we are making now, ahead of the point at which it becomes enforceable against us.

Who is responsible for your personal data?

This practice is the Data Fiduciary for what you give this site — it decides what is collected and why. It is a sole proprietorship, which is not a company and is not separate from the person who runs it, so the person legally answerable for your data is the proprietor herself.

Data Fiduciary: Prakash Financial Services, trading as Prakash Finserv.
Registered category: Individual insurance agent (life), operating as a sole proprietorship. IRDAI agent registration code RLH20775410.
Registered office: Site 7, House No. 8, LGF, New Rajinder Nagar, New Delhi, Central Delhi, Delhi 110060
Who answers questions about your data: Dr. Sonali Walia — admin@prakashfinserv.com, +91 87968 39997.

Section 8(9) of the Act requires a Data Fiduciary to publish the contact details of a Data Protection Officer, where one applies, or of a person who can answer your questions about how your data is processed. This practice has not been notified as a Significant Data Fiduciary and has no Data Protection Officer. The person who answers those questions is the proprietor, named above.

The words this policy uses

The Act has its own vocabulary, and using it loosely is how privacy notices end up saying nothing. These are the terms that matter here.

Data Principal: You — the person the personal data is about. Where the data is a child's, it also means the parent or lawful guardian.
Data Fiduciary: Whoever decides why and how your personal data is processed. For what you submit through this site, that is this practice.
Data Processor: A company that processes personal data on a Data Fiduciary's instructions and is not allowed to use it for its own purposes. Our database provider is a Data Processor. It is not free to do anything with your data that we have not asked it to do.
Consent notice: The plain-language statement shown to you before you agree, saying what is being collected, what it will be used for, and how to withdraw. On this site it appears at the point where the application form is submitted — not buried in a link.
Personal data: Any data about you from which you can be identified. The Act does not sort personal data into ordinary and "sensitive" classes the way older Indian data rules did. Health information is nonetheless sensitive in the ordinary meaning of the word, and this policy treats it as the most sensitive thing on the page.

What does the application form collect, and why?

The application form asks for identity, contact details, income band, occupation, residency, lifestyle including tobacco use, and health information. It asks because an insurer's underwriter cannot assess an application without those answers. Nothing on the form is collected for marketing, and nothing is collected that an underwriter does not need.

What the application form collects, and the reason for each part
Category	What it covers	Why it is asked
Who you are	Your name, date of birth and gender.	To identify the person the cover would be on, and to match your application to you.
How to reach you	Your mobile number, email address and city.	To send you your application, answer your questions, and let the insurer contact you.
Income band and occupation	A band your annual income falls into, and what you do for a living.	An underwriter sizes cover against income, and some occupations carry a different risk.
Residency	Whether you live in India or abroad, and your tax residency.	Residency changes which application route and which documents apply.
Lifestyle	Tobacco use, alcohol use, and hazardous pursuits.	These change how an underwriter assesses risk. Tobacco use in particular does.
Health information	Your height and weight, your medical history, and your family's medical history.	An underwriter cannot assess a life insurance application without it. This is the most sensitive thing you will tell us.

Health information is the part of this to be most careful about, and we would rather say so plainly than tuck it into a list. It goes to an underwriter so that a decision can be made on an accurate picture of you. You do not have to give it. If you do not, an application cannot be made, because there is nothing for an underwriter to assess.

What is the lawful basis for using it?

Consent. You are shown a consent notice before you submit the form, and nothing is sent anywhere until you act on it. Consent under the Act has to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to what is necessary for the stated purpose (Section 6).

You can withdraw that consent at any time, and it has to be as easy to withdraw as it was to give. Two honest consequences follow. Withdrawing does not make what was lawfully done before the withdrawal unlawful. And withdrawing it with us does not reach into the insurer's systems. Once your application has gone to the insurer, the insurer holds your data as a Data Fiduciary in its own right, under its own privacy notice and its own record-keeping duties. To withdraw it there, write to the insurer.

Where is your information stored?

A submitted application is stored in a managed database in our provider's Mumbai region (ap-south-1), which means the stored record stays in India. That is our choice about how to run this practice. The Act itself does not require personal data to be held in India; we hold it here anyway, because your application concerns an Indian insurance contract and the record ought to sit in the same jurisdiction as the contract.

That provider processes the record on our instructions as a Data Processor, under a contract, and may not use it for its own purposes. The Act requires that relationship to rest on a contract (Section 8).

Insurance record-keeping rules also govern records relating to Indian policies, and those obligations are written for insurers. Your application is sent to the insurer, which holds its own record of it, in its own systems, under its own retention policy — that record is not affected by anything on this page. What this site keeps is a copy, for the purposes set out above.

We email your completed application to the underwriter at the life insurer this practice is appointed by — the insurer named in the footer of every page on this site. That sharing is not an add-on you can opt out of while still applying: placing an application is sending it to an insurer. There is no application without it.

Beyond that, your information goes to:

Our database provider, which stores the submission as a Data Processor on our instructions, and may not use it for anything else.
Anyone we are legally obliged to give it to — a court, a regulator, or a law enforcement authority acting under a power that requires us to produce it.
Meta Platforms, but only the bare fact that an application was completed, and only if you complete one. This is how we tell whether an advert produced an enquiry. It carries none of your answers, none of your health information, and no reference number. If you do not submit an application, nothing about you goes to Meta.

We do not sell personal data, and we do not pass it to data brokers or lead aggregators. The one thing that goes to an advertising company is the signal described above: that an application was completed, sent to Meta only when one is, carrying none of its contents. We do not pass it to any other insurer, because this practice is appointed by one life insurer and places business with that insurer only. Once your application reaches the insurer, the insurer becomes responsible for it as a Data Fiduciary in its own right, and its own privacy notice governs what it then does.

When you consent, we write a record of the act of consenting: the date and time, the IP address the consent came from, your browser's user agent string, and a hash of the version of the consent wording you were shown. That record is immutable — it can be added to but not edited or deleted. The database itself refuses the change; it is not a matter of us choosing not to make one.

Each entry is also signed when it is written, using a key held outside the database entirely. That covers the narrower case of someone with enough access to switch the database's own rule off: the signature would stop matching, and the alteration would show. We check this periodically and before answering any dispute that turns on it.

This is deliberate, and it cuts both ways, so here is the reasoning. If it is ever disputed whether you agreed to something, the only thing that settles it is a record neither side can quietly rewrite — which protects you at least as much as it protects us. The cost is that this particular record is not erased on request, because a consent record that disappears when it becomes inconvenient would be worthless as evidence of consent. It holds no health information and no application answers.

What do the calculators do with what you type?

Nothing. The calculators on this site run entirely inside your browser. What you type into one is never sent to us, never sent to the insurer, never stored, and never logged. Close the tab and it is gone. You can use them without telling us anything at all, and you do not need to give us your contact details to see a result.

What does this site record about your visit?

Three things record your visit, and they are not the same thing. The first is the server, always: when a page is served we record the page requested, the referring page, any campaign tags in the link (UTM values), a session identifier and a device class such as mobile or desktop. Your IP address is not part of that record. None of this involves your browser storing anything, and none of it can be declined, because it is the record a web server inherently keeps of a request made to it.

The second is Google Analytics, and only if you accept it. Since 4 September 2026 this site asks, on a banner at the foot of the page, whether it may count your visit. If you decline, or simply ignore it, the Google Analytics is never loaded and sets nothing. If you accept, it records which pages you open and in what order, an approximate region, and whether you are on a phone or a desktop. Google Analytics does not receive your name, your phone number, your email address, or anything you type into any form on this site.

The third is a Meta (Facebook) advertising measurement, and it happens once, only if you complete and submit an application. At that moment — after the application has been stored — the site tells Meta that an application was completed. That is the entire message: no answers, no question names, no reference number, and nothing about your health.

What it lets us do is see which of our adverts produce enquiries, so that we are not paying for advertising that does not work. What it deliberately does not do is watch you use the site. There is no advertising pixel on the guides, the glossary, the calculators or the plan pages, and none on the application form while you are filling it in. If you read this site and never submit an application, Meta is told nothing about you by us at all. If you start an application and abandon it, the same is true.

The application form deserves a specific statement, because it asks about your health. If you have accepted analytics, the form reports how far through it you got and whether a submission succeeded — a position and a count. It does not report which questions you saw or how you answered any of them, and it does not report the underwriting result. That line is drawn deliberately: several questions are only shown once an earlier one has been answered a particular way, so naming a question would disclose the answer to it. The same restraint governs what Meta is told: that an application was completed, and nothing else.

There is no advertising network watching you move around this site, no remarketing tag on the pages you read, and nothing that follows you from page to page. What is and is not set is listed in full on the cookie policy, including how to withdraw your agreement to analytics. If that changes, that page changes first, and this one changes with it.

What about the link that resumes an application?

If you leave the form part-finished, you can be sent a link to come back to it. That link carries a signed token that expires 7 days after it is issued, after which it stops working and a new one has to be issued.

Treat that link as you would treat the form itself: anyone holding it can open your part-finished application and read what is in it until it expires. Do not forward it, and do not post it anywhere. If you think someone else has it, tell us and we will cut it off — the answers behind it are erased and the link stops working from that point.

How long is your information kept?

Two principles decide this. The Act says a Data Fiduciary should erase personal data once the purpose it was collected for is no longer being served, unless retention is required by law (Section 8). But an insurance application is exactly the kind of record that record-keeping obligations require us to keep. What was asked, what was answered and what was placed have to survive long enough to answer a question about the policy years later — including a question at claim.

So: enquiry data that never became an application is not kept indefinitely, and we will erase it on request. Data that formed part of an application is kept for as long as the record-keeping obligations on insurance business require. We will refuse a request to erase that for as long as those obligations run, and if we refuse one on that basis we will tell you that is the reason.

Not verified for this page: no number of years is stated above, on purpose. The period is set by the record-keeping rules that bind insurance business and by the insurer's own retention policy, and we have not confirmed it from those sources. The principle above holds. A period will appear here once we have checked it.

How is your information protected?

In general terms:

this site is served over an encrypted connection;
submitted applications sit in a managed database in India, not in a spreadsheet or an inbox;
access is limited to the people who need it to do the work;
the consent ledger is append-only, and every record in it is signed as well, so an alteration is both refused and detectable;
the scripts that can run on this site are restricted to a named list, so an injected script from anywhere else is refused by the browser.

One item in that list changed on 5 September 2026 and is worth stating precisely. It used to say the only third-party script was Google Analytics. There is now a second, for advertising measurement — but it is loaded only on the application page, it does nothing until an application has been successfully submitted, and it is never handed anything you type. So the form still stays free of active third-party code for the whole time you are filling it in, which was the point of the original sentence.

Two limits are worth stating rather than glossing over. Ordinary email is not encrypted end to end, and your application is emailed to the underwriter — that is how applications are placed, and it is not a perfectly private channel. And no security measure is absolute. If personal data in our care is ever breached, we will tell you and the authority in the manner the Act requires.

What rights do you have as a Data Principal?

The Act gives you five things you can require, and they are rights rather than favours: to know what we hold, to have it corrected or erased, to complain and be answered, to nominate someone to act for you, and to withdraw your consent. Each is set out below with the section it comes from.

The right to know what we hold (Section 11): You can ask for a summary of the personal data we hold about you, what we are doing with it, and who we have shared it with.
The right to have it corrected, completed or erased (Section 12): You can ask us to correct anything inaccurate, fill in anything incomplete, update anything out of date, or erase what we no longer need. Erasure is not absolute — see how long information is kept, below.
The right to complain to us and be answered (Section 13): You can raise a grievance about how your data has been handled, and we have to give you a route to do it and a response. The Act expects you to use that route before you go to the regulator.
The right to nominate someone (Section 14): You can nominate another person to exercise these rights on your behalf if you die or become unable to exercise them yourself.
The right to withdraw your consent (Section 6): You can withdraw consent at any time, and it must be as easy to withdraw as it was to give. Withdrawing does not make what was lawfully done beforehand unlawful.

How to exercise them

Email admin@prakashfinserv.com, or call +91 87968 39997. Say which right you are exercising and give us enough detail to find your record and be satisfied you are the person it belongs to — the email address or mobile number you used on the form is usually enough. There is no form to fill in and no fee.

Not verified for this page: the Rules made under the Act do not set one answering period for everybody. They require a Data Fiduciary to publish the period within which it will deal with a request or a grievance of this kind — and that requirement is among the provisions not yet in force. We have not settled and verified ours, so none is stated here. In the meantime we will acknowledge your request and answer it as quickly as we can.

How do you complain?

Come to us first. Section 13 of the Act gives you a right to grievance redressal from the Data Fiduciary, and expects you to use it before approaching the regulator. Write to Dr. Sonali Walia at admin@prakashfinserv.com, saying what happened and what you want done about it.

If our answer does not satisfy you, the Act's escalation route is the Data Protection Board of India, which you can approach without a lawyer.

Check this when you complain: the provisions establishing the Data Protection Board came into force in November 2025, but the Board's remaining powers are among those due to commence on 13 May 2027. Before you rely on the Board, check whether it is taking complaints of this kind that day. The Ministry's data protection framework page is where to look.

A complaint about the insurance side of things — an application, a policy, a premium, the conduct of this practice — is a different route with a different regulator. It has four steps: us, then the insurer, then the Insurance Regulatory and Development Authority of India, then the Insurance Ombudsman. The grievance redressal page sets out each one.

Children's information

This site is meant for adults. The application form is not designed for anyone under 18 to use, and we do not knowingly collect a child's personal data through it. If you are under 18, do not submit the form.

Section 9 of the Act requires a Data Fiduciary to obtain verifiable consent from a parent or lawful guardian before processing a child's personal data, and forbids tracking, behavioural monitoring of children and targeted advertising directed at them.

Since 4 September 2026 this site offers analytics, which counts page views and journeys through the site if you accept it. It measures pages, not people, it is not used to target advertising, and nobody who declines is measured by it.

We do no behavioural monitoring and no targeted advertising of children, and we build no advertising profile of anyone from their reading of this site. Nothing here follows you from page to page for advertising purposes: reading a guide, opening a calculator or comparing plans is not reported to any advertiser. There is one advertising measurement, and it happens only if you complete and submit an application — described under what this site records about your visit. A child should not be submitting an insurance application, and the form says so.

If you are under 18, this site is not meant for you and you should not submit the form. If a parent or guardian wants us to erase anything we hold about a child, the grievance route below reaches a named person and we will act on it. If we find we hold a child's data given to us without the consent the Act requires, we will delete it.

How are changes to this policy notified?

The version on this page is always the current one, and the review date at the foot of the page tells you when it was last checked. When we change it, we change that date.

A change that affects how your personal data is used — a new purpose, a new recipient, a different place it is stored — is described here rather than made quietly. That undertaking is kept: the advertising measurement added on 5 September 2026 is described on this page and on the cookie policy, and both were updated before it went live. Where a change goes beyond what you consented to, we will ask you again rather than assume your old consent covers it.

This policy applies to prakashfinserv.com and to the application form on it. It does not govern any other website you reach from here, including the insurer's. What this site stores on your own device is a separate question, answered on the cookie policy; the terms the site is provided on are in the Terms of Use.

Questions about this policy

Write to Dr. Sonali Walia at admin@prakashfinserv.com, or call +91 87968 39997. If something on this page is unclear, or reads as though it is hiding something, say so — a privacy notice nobody can follow is not doing its job.