Industries · Insurance
Health and claims data needs firmer limits than a sales lead
A health policy starts with a proposal form and medical declarations, often collected by an agent or a bank branch. Claims bring in hospital bills, discharge summaries and investigation reports, handled by a third party administrator and sometimes a surveyor. The same person's data ends up with the insurer, the intermediary, the TPA and the hospital network.
What you hold
The personal data in a typical week
The register every duty starts from. In TrustOS each category is linked to the systems that hold it, the purposes it serves and an owner.
Data register · Insurance6 categories
- Proposal forms and medical declarations
- Claim documents, bills and discharge summaries
- Nominee and family member details
- Policy, premium and payment records
- KYC documents and bank details for payouts
- Agent and call centre interaction records
Pressure points
Where the DPDP Act bites in insurance
Data collected by people you do not employ
Agents, brokers, bancassurance partners and web aggregators collect proposal data on your behalf. You need to know what they keep, for how long, and whether the notice they showed was yours.
Family members who never signed anything
A floater policy holds details of a spouse, children and parents. Nominees are named without being asked. Each of them is a Data Principal with rights of their own.
Rejected proposals and lapsed policies
Medical reports from a declined proposal often sit in the underwriting system for years. Once the reason to keep them is gone, they should go too, unless a law says otherwise.
TPAs and hospital networks
Claims data flows through third party administrators and empanelled hospitals. A breach at any of them can become your notification to make.
How TrustOS helps
The modules that matter most here
Keep one approved notice per product and channel, and see which version an agent or aggregator was using on a given date.
Route a nominee's or family member's request to the right policy record and track it to a reply, separately from the policyholder's own requests.
Set a retention rule for declined proposals and lapsed policies, with the regulatory reason recorded where data must be kept.
Assess TPAs, brokers and aggregators against the same checklist and keep the findings with each contract.
What it looks like in TrustOS · sample data
An example scenario
Illustrative example: a declined proposal
Suppose a proposer's health policy is declined after a medical test. Months later she asks the insurer what it still holds about her. In this hypothetical, the request arrives through the Privacy Centre, TrustOS finds the underwriting, CRM and diagnostic partner records, and the privacy team replies with a summary and a decision on what will be erased, with the reasons recorded.
Rules that sit alongside the Act
- IRDAI guidelines on information and cyber security
- IRDAI regulations on protection of policyholders' interests
- IRDAI guidelines on outsourcing by insurers
- CERT-In directions on reporting cyber incidents
TrustOS helps you keep these obligations in the same record. Your counsel decides how they apply to you.
Questions
From insurance teams
Is health information treated differently under the DPDP Act?
The Act does not set up a separate category of sensitive data. Insurers still handle health information with more care because of IRDAI rules, contracts and the harm a leak can cause, and TrustOS lets you flag those data types and apply tighter rules to them.
Can our agents and partners use the Privacy Centre?
The Privacy Centre is for policyholders, nominees and other Data Principals. Partners work through tasks and assessments in the TrustOS workspace, with access limited to what they handle.
Will this slow down claims?
It should not. TrustOS sits beside your claims system and records what happens to personal data. It does not sit in the path of a claim decision.
For insurance teams
See TrustOS run on insurance data
Bring the systems that hold your proposal forms and medical declarations, and the requests your team handles today. We will show the work moving through TrustOS, from the first request to the evidence.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.