Last updated on 29^th June 2026

Preamble: PNB MetLife’s Privacy Principles

PNB MetLife India Insurance Company Limited (“PNB MetLife” or “the Company”) is committed to upholding the highest standards of privacy and data protection for all individuals whose personal data it processes, including customers, employees, partners, vendors, and other stakeholders. Our Privacy Principles guide how we collect, use, process, store, disclose, retain, and safeguard personal data in accordance with including the Digital Personal Data Protection Act, 2023 (Act), other applicable statutes and regulatory provisions.

Respect Privacy Rights

We respect the data protection rights of individuals whose personal data we processes, including customers, employees, partners, vendors, and other stakeholders.

Process Personal Data for a Legitimate Purpose

We collect and process personal data lawfully, fairly, and transparently, and only for specific, explicit, and legitimate business purposes. All such purposes are clearly outlined in our privacy notices.

Protect Personal Data

We follow data minimisation principles and implement appropriate technical and organisational safeguards to protect personal data from unauthorised access, misuse, loss or disclosure in accordance with the Act, other statutes and applicable regulatory provisions.

Maintain Accountability

We remain accountable for complying with applicable laws and this Privacy Policy. Our governance structures, regular training, monitoring activities, and enforcement mechanisms ensure responsible and lawful personal data handling in accordance with the Act, other statutes and applicable regulatory provisions.

Policy Statement (Scope and Purpose)

This Privacy Policy applies to all personal information (PI) processed by PNB MetLife relating to its customers, employees, job applicants, contractors, vendors, service providers, business partners, intermediaries, distributors, agents, and any other stakeholders whose PI is collected or otherwise processed by the Company. PNB MetLife collects, uses, stores, shares, and processes PI strictly for lawful and legitimate purposes, in accordance with the Act, other applicable statutes, and applicable regulatory provisions.

• Collection of Information – To provide insurance products and services to policyholders and prospective customers; servicing customer requests; fulfilling legal and regulatory obligations; conducting underwriting, risk assessment, and fraud prevention measures; and delivering subsequent policy-related and contractual services in accordance with the Act, other statutes and applicable regulatory provisions.
• Usage of Information – To administer and service insurance policies, process and settle claims, manage and enhance customer relationships, provide necessary support and policy-related services, and improve products, systems, and overall customer experience
• Sharing of Information – To disclose PI only to authorised third-party service providers, vendors, reinsurers, regulators, or group entities strictly on a need to know basis and subject to appropriate contractual, confidentiality, and security safeguards. PI collected through the proposal form during solicitation or issuance of policy shall not be shared with any third party without the explicit consent of the policyholder, except where such disclosure is necessary for providing policy-related services or is otherwise permitted under the Act, other statutes and applicable regulatory provisions.
• Location Access – PNB MetLife Android/iOS applications may request access to your device’s location (approximate or precise) based on the services you choose to use and your device permission settings. This access is used strictly within the application to enable location-based features, such as identifying nearby service providers or enhancing your service experience. PNB MetLife does not collect, store, or retain your location data beyond its immediate use within the application. You retain full control and can enable or disable location permissions at any time through your device settings.
• Storage and Retention of Information – To retain PI only for the period necessary to fulfil the lawful purposes for which it was collected, or as required under applicable laws and regulations mandates, or until withdrawal of consent where legally permissible. All such information is maintained with strict confidentiality and safeguarded through appropriate security measures.
• Communication and Changes to the Privacy Policy – To communicate with individuals regarding products, services, policy updates and material changes to this Privacy Policy through appropriate channels as and when required.
• Information Security – To protect PI through reasonable administrative, technical and physical safeguards to prevent unauthorised access, misuse, alteration, loss, or disclosure.

This Privacy Policy establishes the principles and minimum standards for processing Personal Information (PI) across all Company operations. It applies to all individuals whose Personal Information (PI) is handled by the Company, including customers, policyholders, website users, employees, job applicants, vendors, distributors, intermediaries, and other service providers. This obligation shall extend to and govern all individuals whose PI is processed by the Company, whether or not they are customers or policyholders. The Company processes PI across related business processes such as customer onboarding and due diligence, customer servicing and claims handling, website and digital platform usage, HR operations and employee benefits, recruitment and onboarding, vendor onboarding and management, distributor management, intermediary engagement activities, procurement operations, regulatory reporting, fraud prevention, and IT system operations. By accessing the website or using our services, you agree to this Privacy Policy

What is Personal Information?

Personal Information (Personal Data) means any data about an individual who is identifiable by or in relation to such data. This includes any information that can directly or indirectly identify a person, in accordance with the definition under the Digital Personal Data Protection Act, 2023.

The DPDP Act applies to digital personal data or data that is collected oAline and later digitized.

This includes, without limitation:

• Name, contact details, and address
• Government-issued identification numbers (e.g., PAN, Aadhaar, passport)
• Financial and account information (e.g., bank details, transaction information)
• Health and medical information (e.g., medical records, health conditions)
• Biometric identifiers (e.g., fingerprints, facial recognition data)
• Technical identifiers (e.g., IP address, device ID, metadata)
• Employment-related information (e.g., job role, employee records)

Applicable Law

PNB MetLife processes personal data in accordance with applicable Indian laws and regulations, including:

• Information Technology (Amendment) Act, 2008 (as amended from time to time)
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (as amended from time to time)
• Digital Personal Data Protection Act, 2023 (as and when applicable)

Where multiple legal frameworks apply, compliance is determined based on jurisdiction, applicability and regulatory intent.

Third Parties

For the purposes of this Privacy Policy, a Third Party includes any service provider, contractor, consultant or vendor engaged by PNB MetLife to process personal data on its behalf.

PNB MetLife ensures that such third parties:

• Are bound by contractual confidentiality and data protection obligations
• Implement appropriate security measures
• Process personal data only for authorised purposes
• Are subject to periodic oversight and assessment

Health‑related features offered under 360Health, facilitated to users via the Khushi App*

Android Health Connect

The 360Health platform facilitated through the Project Khushi App uses the Android Health Connect SDK provided by Google (more information available on Google’s official documentation). Health Connect is an open platform that allows users to control their fitness data.

With the user’s explicit consent, the Project Khushi App processes and collects step, activity, and sleep data through the Health Connect SDK. Once connected, users can view their step data in a graphical format, and the app automatically retrieves step data from Health Connect. Data collection continues until the user disables the step counter functionality, logs out of the app, or deletes the app.

All Health Connect data is handled in accordance with the Google Service User Data Policy.

Health Connect and Apple Health Data

Collection and Usage of Health Data

We value the privacy and security of our users. The 360Health platform facilitated through the Project Khushi App requests access to health-related permissions, including the ability to read step count, calories burned, heart rate, and oxygen saturation data.

This data is collected solely to enhance the user experience and enable health and fitness–related features. Data received from Health Connect and Apple Health platforms is not sold and is not shared with any third party without the user’s explicit consent.

Purpose of Health Data Access

The 360Health platform facilitated through the Project Khushi App utilizes health-related permissions to track daily steps and calories burned. This data is processed locally on the user’s device and is not shared with any third parties.

User Consent

By using 360Health platform in the Project Khushi App, users explicitly consent to the collection and use of health-related data for the purposes described in this privacy policy. Users may grant or withdraw these permissions at any time through the app settings.

Security Measures- to be confirmed by IT Team

We implement robust security measures to protect the confidentiality and integrity of health-related data. These include secure storage practices and the use of HTTPS across the Project Khushi App for secure communication.

Industry-standard technical and organizational measures are applied to protect data against unauthorized access, use, loss, destruction, or disclosure. Sensitive data (such as login credentials) is encrypted using industry-standard cryptographic techniques, including but not limited to AES-256.

The collection, storage, usage, and sharing of data by the Company complies with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable laws.

Your Rights

You have the right to access, correct or erase your personal data and to withdraw your consent in accordance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023.

Requests may be submitted through the grievance redressal mechanism described in this Privacy Policy or write to askprivacy@pnbmetlife.com

*These shall be effective from the Board approval.