Lacspace
Loading
How Lacspace collects, uses, secures, and retains personal data across its websites, apps, AI features, and services — and the rights you have over your data.
Effective 25 July 2026 · Updated 25 July 2026 · 43 sections · 78 clauses
A plain-language summary — the full text below is what legally applies.
1.1Lacspace Corporation Pvt. Ltd. and its affiliates ("Lacspace," "we," "us," or "our") respect your privacy. This Privacy Policy explains how we collect, use, disclose, secure, and retain personal data when you use our websites, mobile and web applications, AI features, APIs, and services (the "Services"), and the rights you have over your data.
1.2This Policy works alongside our Terms of Use, Cookie Policy, and License & Code of Conduct.
2.1Lacspace is a global, country-neutral technology company with teams and offices across Asia and customers worldwide. For legal purposes we are registered in India (CIN U46511DL2025PTC079972, RoC-Delhi) and Nepal (Reg. No. 377566/82/83, PAN 622468837).
When we decide why and how personal data is processed (for example, our marketing site or account sign-up), we act as a data controller.
When we process data on behalf of a business customer using our platforms, we act as a data processor, and that customer is the controller.
Personal data — information that identifies or can identify an individual.
Processing — any operation performed on personal data (collection, use, storage, disclosure, deletion).
Controller — the party that determines the purposes and means of processing.
Processor / Sub-processor — a party that processes data on a controller's behalf.
Special-category data — sensitive data such as health data, given heightened protection.
4.1This Policy covers personal data processed by Lacspace across its ecosystem of products — including CareSewa, Lekhio, CorperaHQ, and our other software, apps, and AI-powered services (see the full list on our products page). Certain products may provide additional, product-specific privacy notices, which supplement this Policy for those products.
5.1Many Lacspace platforms are multi-tenant: business customers (for example, a hospital, school, or company) operate isolated tenants and act as controllers of the data within them. Where you interact with a Service through such an organisation, that organisation's privacy notice governs its use of your data, and this Policy explains our role as the processor providing the technology.
Account & profile — name, email, phone, organisation, role, and credentials.
Billing — billing name, address, tax details, and transaction records (card data is handled by our payment processors).
Content — data and files you submit to or create within the Services.
Communications — messages you send us for support, sales, or feedback.
Device & usage — IP address, device and browser type, operating system, pages viewed, and interactions.
Log & diagnostics — timestamps, error reports, and performance data.
Cookies & similar — as described in our Cookie Policy.
Approximate location — derived from IP address for security and localisation.
8.1We may receive data from third parties you connect (for example, single sign-on, payment, or messaging providers), from business customers who invite you to their tenant, and from partners or public sources for fraud-prevention and analytics. We combine this only as needed to provide and secure the Services.
9.1Some Services (notably healthcare products) may process sensitive data, such as health information, on behalf of a provider. We process such data only under appropriate legal bases and safeguards, apply heightened protection, and never sell it. Where you are a patient, your provider controls this data, and CareSewa's consent model puts sharing decisions in your hands.
10.1Our Services are not directed to children under 16 (or the age set by local law) except where a Service is provided to a school or institution under appropriate consent and supervision. We do not knowingly collect children's data outside such contexts and will delete it promptly if collected inadvertently. Parents, guardians, or institutions may contact us to review or remove a minor's data.
Provide, operate, maintain, and secure the Services.
Authenticate users and prevent fraud, abuse, and security incidents.
Process payments, manage subscriptions, and provide support.
Personalise experiences and improve features and performance.
Communicate service, security, and (with consent) marketing messages.
Comply with legal obligations and enforce our terms.
12.1Where required by law, we rely on one or more of the following legal bases:
Contract — to provide the Services you request.
Consent — for marketing, certain cookies, and sensitive data, which you may withdraw at any time.
Legitimate interests — to secure, improve, and promote our Services, balanced against your rights.
Legal obligation — to comply with applicable laws and lawful requests.
Vital interests — in rare cases, to protect someone's life or safety.
13.1Some Services use AI to power features like search, suggestions, and automation. We do not use your confidential Customer Data to train shared foundation models except as permitted by your plan and consent. We do not make solely automated decisions that produce legal or similarly significant effects about you without a lawful basis and, where required, human review.
14.1With your consent where required, we may send newsletters, product updates, and offers. Every marketing message includes an unsubscribe option, and you can adjust preferences at any time. We do not sell your personal data, and we honour opt-outs promptly. Essential service and security messages are not marketing and continue while you use the Services.
15.1We use analytics to understand how the Services are used, to improve features, and to personalise content. Where required, analytics and advertising cookies are used only with your consent, which you can manage via our Cookie Policy.
16.1We share personal data only as described in this Policy: with service providers and sub-processors, with your organisation where you use a tenant, with parties you direct us to, in connection with a business transfer, or where legally required. We do not sell your personal data.
17.1We engage trusted providers to operate the Services under contractual confidentiality and data-protection obligations, including for:
cloud hosting, storage, and content delivery;
payment processing and billing;
communications (email, SMS, push) and support tooling;
analytics, security, and fraud prevention.
17.2Sub-processors may only process data on our instructions and to provide their service to us.
18.1If Lacspace is involved in a merger, acquisition, financing, reorganisation, or sale of assets — including our evolving corporate structure and future international entities — personal data may be transferred as part of that transaction, subject to this Policy or a policy with equivalent protections. We will notify you of any material change in who controls your data.
19.1We may disclose personal data where we reasonably believe it is required to comply with law, respond to lawful requests and legal process, enforce our terms, or protect the rights, property, safety, or security of Lacspace, our users, or the public. Where lawful and appropriate, we will seek to narrow such requests and notify affected customers.
20.1As a global company, we may process and store data in India, Nepal, and other countries where we or our providers operate. Where we transfer personal data across borders, we use appropriate safeguards required by law — such as Standard Contractual Clauses or equivalent mechanisms — to protect your data consistently, regardless of where it is processed.
21.1Our platforms are multi-country by design and, where a Service or law requires it, we support data-residency and localisation obligations for particular regions. Contact us if your organisation has specific residency requirements for an enterprise deployment.
22.1Subject to applicable law, you may have the right to:
Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten"), subject to legal retention.
Restrict or object to certain processing, including profiling and direct marketing.
Port your data to another provider in a structured, machine-readable format.
Withdraw consent at any time, without affecting prior lawful processing.
23.1To exercise your rights, email privacy@lacspace.com or use in-product privacy controls where available. We will verify your identity and respond within the timeframe required by law. If your data is controlled by a business customer (your tenant), we will refer your request to that controller and support them in responding. There is no charge for reasonable requests.
24.1If you are in the European Economic Area or the United Kingdom, you have the rights above under the GDPR/UK GDPR, and the right to lodge a complaint with your local supervisory authority. Our legal bases are set out above, and international transfers are safeguarded as described in this Policy.
25.1If you are in India, you have rights under the Digital Personal Data Protection Act, including access, correction, erasure, grievance redressal, and nomination. You may raise grievances with our Grievance Officer before approaching the Data Protection Board of India.
26.1If you are a resident of California or another US state with privacy legislation, you may have rights to know, access, delete, correct, and opt out of the "sale" or "sharing" of personal information. We do not sell your personal information. We will not discriminate against you for exercising your rights. Submit requests to privacy@lacspace.com.
27.1Some browsers offer "Do Not Track" or global privacy-control signals. Where legally required, we honour recognised opt-out signals for advertising cookies. You can also opt out of marketing at any time via the unsubscribe link in our emails or your account settings.
28.1You can manage cookies through your browser settings and, where offered, our consent tool. Essential cookies required to run the Services cannot be disabled. See our Cookie Policy for details.
29.1We apply industry-standard technical and organisational measures, including encryption in transit, access controls, least-privilege permissions, and append-only audit logging. No system is completely secure, but we work continuously to protect your data and to limit access to those who need it to operate the Services.
30.1Our platforms are multi-tenant with structural isolation: every record carries a tenant and every query filters by it, so one customer's data is not accessible to another. Role-based access controls, consent gates, and audit trails keep access accountable and limited.
31.1We retain personal data only as long as necessary for the purposes described, to provide the Services, and to meet legal, accounting, or reporting obligations. Retention periods vary by data type and context. Regulated data (for example, clinical records) may be retained or soft-deleted as required by law. When no longer needed, data is deleted or anonymised.
32.1If a personal-data breach is likely to affect you, we will notify affected users and relevant authorities as required by applicable law and within the required timeframes, and take prompt corrective and remedial measures. Report suspected incidents to security@lacspace.com.
33.1You play a key role in protecting your data: keep your credentials confidential, enable available security features, manage your team's permissions, and notify us promptly of any suspected unauthorised access. We are not responsible for loss arising from your failure to secure your account.
34.1For healthcare services, the connected provider (hospital, clinic, lab, or pharmacy) is the controller of patient data; Lacspace provides the technology as a processor. CareSewa is built so that patients hold a Health ID and control sharing through explicit consent — connect, share, revoke — with tenant isolation and audit logging protecting every record.
35.1For education products, the school or institution is typically the controller of student and staff data, and we process it on their instructions. We support institutions in meeting their obligations regarding minors' data and do not use student data for advertising.
36.1Payment details are processed by trusted, compliant third-party payment gateways. Lacspace does not store full card numbers on its servers. We retain transaction records as needed for billing, tax, and legal purposes.
37.1For marketplace or delivery services, we share the data necessary to fulfil your order (for example, delivery details) with the relevant merchant or delivery partner. Those parties handle that data under their own privacy practices for fulfilment purposes.
38.1If you post in public community areas, that content and your chosen display name may be visible to others. Do not share sensitive personal information publicly. You can edit or remove your content where the Service allows, subject to caching and backups.
39.1The Services may link to third-party sites and content we do not control. This Policy does not apply to those third parties; please review their privacy notices before providing data to them.
40.1We may update this Policy to reflect changes in our practices, technology, or the law. Material changes will be communicated by reasonable means (for example, email or a website notice), and the "Effective" date above will be updated. Continued use after the effective date constitutes acceptance.
41.1You can reach our privacy team and Grievance Officer at privacy@lacspace.com or grievance@lacspace.com. We acknowledge and address privacy grievances within the timeframes required by applicable law.
42.1We would like the chance to resolve your concerns directly, so please contact us first. You also have the right to complain to your local data-protection or supervisory authority — for example, an EU/EEA/UK authority, or the Data Protection Board of India — if you believe your rights have been infringed.
43.1For privacy questions or to exercise your rights, contact privacy@lacspace.com, or visit our contact page. For security reports, use security@lacspace.com.
43.2Lacspace Corporation Pvt. Ltd. — a global, country-neutral technology company. Registered in India and Nepal; offices across Asia; customers worldwide.
This document is version v2.0, effective 25 July 2026 (updated 25 July 2026), comprising 43 sections and 78 clauses. Published by Lacspace Corporation Pvt. Ltd. — a global, country-neutral technology company registered in India (CIN U46511DL2025PTC079972) and Nepal (Reg. No. 377566/82/83). © 2026 Lacspace Corporation Pvt. Ltd. All rights reserved.
Download a watermarked copy: privacy-policy.pdf. The authoritative version is always the one published on this page.