Data Security Policy

1Security Philosophy

TruCover Wellness handles some of the most sensitive categories of personal data: health records, insurance information, and financial data. We treat data security not as a compliance checkbox but as a foundational trust requirement. Our security programme is aligned with the SOC2 Trust Service Criteria — Security, Availability, Processing Integrity, Confidentiality, and Privacy.

2Key Security Controls

2.1 Encryption

• All data at rest is encrypted using AES-256
• All data in transit is encrypted using TLS 1.3 or higher
• Database-level encryption for all health and financial data fields
• Encryption keys are managed using a dedicated key management system with annual rotation

2.2 Access Control

• Role-based access control (RBAC) — users can only access data within their authorised role
• Principle of least privilege — employees see only their own data; HR sees only aggregate data
• Multi-factor authentication (MFA) is mandatory for HR admin and intermediary accounts
• Privileged access management (PAM) for system administrators
• Access logs maintained for all data access events — retained for 2 years

2.3 Network Security

• Web Application Firewall (WAF) protecting the TruCover platform
• DDoS protection on all public-facing endpoints
• API security — authentication tokens, rate limiting, input validation
• Quarterly penetration testing by certified third-party security professionals

2.4 Infrastructure & Hosting

• Platform hosted on SOC2-certified cloud infrastructure within India
• Data residency: all user data is stored and processed in India
• Automated backup with 4-hour recovery point objective (RPO)
• Infrastructure as code with change management and version control

3Health Data Handling

Health data is the most sensitive category of data on our platform. We implement specific controls:

• Doctor consultation notes are encrypted at the record level — inaccessible even to TruCover internal staff without a logged access event
• Mental wellness assessment responses are anonymised at source — no personal identifier is linked to responses in analytics systems
• Health data is never shared with employers, HR teams, or insurers without explicit user consent
• Wellness tracks (vitals, sleep, hydration) are voluntary — users can delete their data at any time via the app

4Data Access by Role

5Incident Response

In the event of a data security incident, TruCover will:

• Contain the incident within 4 hours of detection
• Notify the Grievance Officer and senior management within 8 hours
• Notify affected users within 72 hours if their personal data is involved
• Report to CERT-In as required under the IT Act and CERT-In Directions, 2022
• Conduct a root cause analysis and implement corrective actions within 30 days
• Provide a post-incident report to affected corporate clients upon request

6Vendor & Third-Party Security

• All third-party vendors (cloud providers, diagnostic labs, pharmacy networks) are assessed for security compliance before onboarding
• Data Processing Agreements (DPAs) are executed with all vendors who process personal data
• Vendors are subject to annual security review
• No personal data is transferred outside India without regulatory compliance

7Employee & Internal Team Security

• All TruCover staff complete mandatory data security training during onboarding and annually
• Background verification conducted for all staff with access to personal or health data
• Clean desk and clear screen policies enforced in the workplace
• All devices used for platform access are encrypted and managed via mobile device management (MDM)

8Requesting Security Information

Corporate clients may request the following from TruCover:

• SOC2 readiness attestation letter
• Data Processing Agreement (DPA)
• Vendor security questionnaire response
• Summary penetration test report (executive summary, no technical details)

9Contact