Effective Date : 7 October 2026
Last Updated: 7 October 2026
This Privacy Policy ("Policy") explains how Infedis Infotech LLP, operating under the HiDoc brand ("HiDoc", "we", "us" or "our"), collects, uses, stores, protects and otherwise processes personal data in connection with the StepUp by HiDoc website and learning management platform ("StepUp", "Platform").
This Policy applies to personal data processed through the StepUp website, learner registration and login, course access, learning activities, certificates, learner questions and related Platform functionality.
Data Fiduciary / Entity : Infedis Infotech LLP
Email : vanshikapradhan@hidoc.co
Registered Office : Office 108, Suyog Center, Gultekdi, Pune, Maharashtra
HiDoc respects the privacy of individuals using StepUp and seeks to process personal data in a lawful, fair and transparent manner.
StepUp is designed to collect and process only such personal data as is reasonably necessary for specified and lawful purposes, including operating the Platform, authenticating users, providing learning services, administering course completion and certificates, maintaining Platform security, responding to learner queries and complying with applicable legal requirements.
The primary personal information required for learner registration is the mobile number used for OTP-based authentication.
HiDoc does not require an email address for initial learner registration.
This Policy is intended to operate consistently with applicable Indian data protection and information technology laws, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), to the extent applicable and in force from time to time, the Information Technology Act, 2000 and other applicable laws and regulations.
StepUp is designed to minimise the personal data collected from users.
2.1 Mobile Number and Authentication Information
For registration and login, StepUp may collect and process:
The mobile number is the principal personal data used to create and authenticate a learner account.
2.2 Learning and Course Information
When you use StepUp, the Platform may process information necessary to provide the learning service, including:
2.3 Certificate Information
Where a course provides a certificate, StepUp may process the minimum information necessary to determine course completion and make the certificate available for download.
Certificates are provided through the authenticated learner account. StepUp does not currently provide a public certificate-verification facility.
2.4 Learner Questions and Support Information
If you voluntarily submit a course-related question or support request, HiDoc may process the information contained in that submission to respond to or administer the request.
Users should not submit unnecessary sensitive personal data, confidential information or personal information relating to another individual.
2.5 Technical and Security Information
StepUp may process limited technical information where reasonably necessary for authentication, security, fraud prevention, troubleshooting and operation of the Platform, such as:
HiDoc seeks to minimise such information and will not process it for unrelated advertising or profiling purposes.
Based on the current StepUp configuration, the Platform does not intentionally require learners to provide information such as:
If the information collected by the Platform changes, this Policy will be updated as appropriate and any additional notice or consent required by applicable law will be provided.
Personal data may be processed only to the extent reasonably necessary for specified and lawful purposes, including:
4.1 Account Creation and Authentication
To :
4.2 Providing Courses and Learning Services
To :
4.3 Learner Questions and Support
To :
4.4 Certificates
To :
4.5 Security and Fraud Prevention
To :
4.6 Platform Operation
To :
4.7 Legal and Compliance Purposes
To,HiDoc does not intend to use personal data collected through StepUp for behavioural advertising, advertising retargeting or similar profiling activities.
Any future introduction of materially different tracking, profiling or advertising practices involving personal data will be subject to applicable legal requirements, including providing appropriate notice and obtaining consent or providing applicable controls where required.
StepUp may use cookies or similar technical mechanisms only where reasonably necessary for:
StepUp does not use cookies or similar technologies for advertising retargeting or behavioural advertising.
Where any non-essential tracking technology is introduced in the future, HiDoc will provide appropriate notice and obtain consent or provide applicable controls where required by law.
Users may be able to control certain cookies through their browser settings. Disabling essential cookies may affect Platform functionality.
StepUp uses mobile-number-based OTP authentication.
When you register or log in:
OTP information is used for authentication and security and is not intended to be used as a substitute for a password.
Users must not share OTPs with any other person.
StepUp data is hosted and stored on
HiDoc servers located in India.
HiDoc seeks to maintain the Platform's personal data within its designated HiDoc server environment in India.
The principal personal data associated with a learner account is the learner's mobile number, together with the minimum account, learning, completion, certificate and security information necessary to provide and administer the Platform.
HiDoc will not collect or retain personal data merely because it may technically be capable of being collected.
Any storage, access or processing arrangement will remain subject to applicable legal requirements.
HiDoc may use external technical or operational services where reasonably necessary to operate, secure or maintain StepUp.
This Policy does not identify individual external service providers by name.
Where a service provider processes personal data on behalf of HiDoc, HiDoc will implement appropriate contractual, technical and organisational safeguards and will ensure that such processing is carried out only for specified and lawful purposes and to the extent necessary for the relevant service.
HiDoc will remain responsible for complying with its obligations under applicable law in relation to personal data processed through the Platform.
HiDoc does not sell personal data.
Personal data may be disclosed only where reasonably necessary and permitted or required by applicable law, including:
10.1 Service and Operational SupportTo persons or entities processing information on HiDoc's behalf for necessary Platform, technical, security or operational purposes, subject to appropriate safeguards.
10.2 Legal and Regulatory AuthoritiesWhere disclosure is:
Where reasonably necessary for legal, audit, compliance, security or professional advisory purposes and subject to applicable confidentiality obligations.
10.4 Corporate TransactionsWhere permitted by applicable law, information may be disclosed as part of a merger, acquisition, restructuring, transfer of business or similar corporate transaction, subject to appropriate legal safeguards.
The current StepUp launch is configured as a free-access offering, and payment processing is not presently required for the currently available courses.
If paid services are introduced in the future, the applicable payment information and processing arrangements will be disclosed before the relevant transaction and handled in accordance with applicable law.
StepUp certificates are completion-related certificates and are provided for download where the applicable course requirements are satisfied.
Certificate-related processing is limited to what is necessary to determine completion, generate or make the certificate available for download, and comply with applicable legal or administrative requirements.
StepUp does not currently provide a public certificate-verification service.
Learners may submit course-related questions through StepUp.
Such questions may be reviewed and processed by HiDoc only to the extent reasonably necessary to:
Learners should not include unnecessary personal, sensitive, confidential or third-party information in course questions.
Depending on the processing activity and the applicable legal framework in force at the relevant time, personal data may be processed:
HiDoc will align its notices, consent mechanisms, withdrawal mechanisms and rights processes with the DPDP Act and DPDP Rules as and when the relevant provisions become applicable.
Nothing in this Policy is intended to suggest that a provision of the DPDP Act or DPDP Rules applies before its applicable commencement date.
Where processing is based on consent, HiDoc will seek consent in an appropriate manner and for specified purposes.
Where required by applicable law, consent will be:
Where consent is withdrawn, HiDoc will cease the relevant processing where legally required, subject to processing that may continue on another lawful basis or where retention or processing is required by law.
Withdrawal of consent may affect the availability of a Platform feature where the relevant processing is necessary for that feature.
HiDoc will not retain personal data for any fixed period merely for administrative convenience.
Personal data will be retained only for as long as is necessary for the specified purpose for which it was collected or otherwise processed, or for such period as may be required or permitted under applicable law.
The applicable retention period may therefore differ depending on the nature and purpose of the information and the legal obligations applicable to that information.
HiDoc may retain personal data where necessary or permitted for purposes including:
Where the personal data is no longer necessary for the specified purpose and there is no legal obligation or other lawful basis requiring or permitting its continued retention, HiDoc will erase, delete, anonymise or otherwise dispose of the personal data in accordance with applicable law and its applicable retention and deletion procedures.
Any request for erasure will be dealt with subject to applicable law, including any requirement or lawful basis permitting continued retention.
HiDoc takes reasonable technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure, loss, misuse or destruction.
Depending on the nature of the information and applicable risks, security measures may include:
HiDoc will maintain security safeguards appropriate to the nature of the personal data processed and the risks associated with such processing, in accordance with applicable law.
No electronic transmission or storage system can be guaranteed to be completely secure.
If HiDoc becomes aware of a personal data breach, it will take appropriate steps to investigate, contain, mitigate and remediate the incident.
Where required by applicable law, HiDoc will notify affected individuals and/or the competent authority within the applicable prescribed timelines and in the prescribed manner.
HiDoc may also take reasonable measures to prevent recurrence and improve its security controls following an incident.
Subject to applicable law and the relevant provisions being in force, users may have rights relating to their personal data, including rights concerning:
Requests may be submitted to:
Email: vanshikapradhan@hidoc.co
HiDoc may need to verify the identity of the requester before processing a request.
Where a request cannot be fulfilled because of a legal or other permitted exception, HiDoc may explain the applicable reason to the extent permitted by law.
For privacy-related questions, complaints or requests, users may contact:
Privacy / Grievance Contact
Email: vanshikapradhan@hidoc.co
Infedis Infotech LLP / StepUp by HiDoc
HiDoc will endeavour to address privacy-related grievances within the timelines prescribed under applicable law.
Where applicable, users may exercise further rights or remedies before the competent authority or Data Protection Board in accordance with applicable law and the relevant provisions in force at the relevant time.
Users may request deletion of their StepUp account by contacting the Privacy / Grievance Contact.
Upon receiving a valid deletion request, HiDoc will process the request in accordance with applicable law and its applicable retention and deletion requirements.
Deletion may result in loss of access to:
Personal data may continue to be retained where retention is required or permitted by applicable law, including for legal compliance, security, fraud prevention, dispute resolution or establishment, exercise or defence of legal claims.
Where continued retention is no longer required or otherwise lawfully permitted, the relevant personal data will be erased, deleted, anonymised or otherwise disposed of in accordance with applicable law.
StepUp is intended only for individuals aged 18 years or above.
The Platform is not intended for children and HiDoc does not knowingly seek to register children.
If HiDoc becomes aware that personal data has been collected from a person below the permitted age contrary to applicable law, HiDoc may take appropriate steps to restrict the account and delete the relevant information, subject to applicable legal requirements.
Users are expected to:
HiDoc may update this Policy to reflect:
The revised Policy will be published on the Platform with an updated "Last Updated" date.
Where required by applicable law, HiDoc will provide additional notice or obtain consent for material changes
For privacy-related questions, requests or grievances:
Infedis Infotech LLP - StepUp by HiDoc
Email: vanshikapradhan@hidoc.co
Registered Office: Office 108, Suyog Center, Gultekdi, Pune, Maharashtra
25. GOVERNING LAW
This Policy shall be governed by the laws of India, subject to the mandatory rights and remedies available to individuals under applicable data protection, consumer protection and other applicable laws.