Privacy Policy

Effective date: [EDIT: go-live date] · Version: 1 · Applies to: everyone who uses OHCjob.com (the "Platform")

This policy explains, in plain English, what personal data OHCjob.com collects, why, who receives it, how long we keep it and what you can do about it. It is written to meet the Digital Personal Data Protection Act, 2023 (India) and the Digital Personal Data Protection Rules ("DPDP"), and it also serves as our single worldwide standard. Where a specific country gives you more rights, we honour them (see section 16).

1. Who we are

OHCjob.com is operated by CapriTech Global Services LLC, a limited liability company registered in [EDIT: US state], USA, with its registered office at [EDIT: registered address], EIN [EDIT: EIN] ("we", "us", "CapriTech").

Under DPDP we are the Data Fiduciary: we decide why and how your personal data is processed. Recruiters and employers who receive your data through the Platform become independent Data Fiduciaries for what they receive (section 6).

Contact for privacy matters: privacy@ohcjob.com Grievance Officer (DPDP): [EDIT: name], [EDIT: designation], grievance@ohcjob.com, [EDIT: phone], [EDIT: postal address] — see section 13.

2. Who this policy covers

• Candidates — occupational health professionals (doctors, nurses, EMTs and paramedics, site and offshore medics, pharmacists, lab technicians, physiotherapists, industrial hygienists and related roles) who create a profile and apply to jobs. The service is free for candidates.
• Recruiter users — people who act for a company (OHC service provider, hospital, staffing firm or in-house employer) that posts jobs, reviews applicants or searches the candidate database.
• Visitors — anyone who browses public pages without an account.

The Platform is not offered in the European Union, the European Economic Area, the United Kingdom or Switzerland. We block sign-ups from those regions and do not build features for the GDPR.

3. What personal data we collect (itemised)

3.1 Candidates

Category	Data items	When collected
Identity and contact	Full name, mobile number (E.164), email address, country, region, city, nationality, year of birth (to confirm you are 18+)	Sign-up and profile
Professional profile	Role category, qualifications and year of passing, professional licence or registration (licensing body, licence number, country, expiry date), licence and qualification certificates you upload, total experience and occupational-health experience in years, employment history (employer, title, dates, description), education, languages, employment types you are open to, notice period, expected salary (optional), LinkedIn profile URL (optional), headline and summary	Profile wizard and verification
Job preferences	Preferred countries, regions and cities, willingness to relocate, openness to overseas work, work-authorisation status per country (citizen, resident, needs sponsorship)	Profile
Documents	CV you upload or generate on the Platform, LinkedIn PDF export if you use "Import from LinkedIn"	Profile
Activity	Applications, screening answers, saved jobs, saved searches and alert settings, messages exchanged with recruiters, interview rounds, companies you block, profile views by recruiters, unlocks of your profile	Use of the Platform
Consent and legal	Notice version shown to you, each consent choice with time, IP address and browser, legal-page acceptances, rights requests and grievances, nominee details (if you appoint one)	Sign-up, privacy centre
Technical	IP address, approximate location derived from IP (country level, used for region blocking), device and browser, pages viewed, referral and share codes, cookies (section 8)	Automatically

We deliberately do not collect Aadhaar, PAN, passport scans or other government photo ID, caste, religion, health or medical information about you, disability status, or bank details. If you place such information in a free-text field or a document, please remove it; we may redact it.

3.2 Recruiter users and companies

Category	Data items
User	Name, work email, mobile number, password (stored as an argon2 hash, never in clear), role in the company, two-factor secret for admin users
Company	Legal name, type, website, LinkedIn page, country, address, tax ID (GSTIN, TRN, EIN or local equivalent) for invoicing, business registration and tax documents you upload for verification, names and designations of authorised persons, notes from our verification call
Commercial	Plan, payments and invoices (Stripe handles card data; we never see full card numbers), unlock history, referral codes
Activity	Jobs posted and edited, applicant actions, messages, interview scheduling, database searches, CV downloads, social-media connections you authorise (access tokens are stored encrypted)

3.3 Visitors

IP address, pages viewed, search terms, cookies you accept, and any report you file about a job.

4. Why we process your data and the legal basis

DPDP allows processing only with your consent or for certain legitimate uses. This is how each purpose maps:

Purpose	Data	Legal basis
Create and run your account, show you jobs, let you apply, deliver your application and CV to the recruiter of that job	Identity, profile, documents, activity	Consent C1 (Core service) — required to use the Platform
Make your profile discoverable to verified recruiters searching the candidate database, and reveal your contact details and CV when a recruiter unlocks your profile	Profile, contact details, CV	Consent C2 (Recruiter discovery) — optional; identical to the "Let verified recruiters find my profile" switch
Send job alerts, offers and updates by email, SMS, WhatsApp and phone; use your details to show you OHCjob.com advertising on Google, Meta, LinkedIn and similar platforms	Contact details, preferences, activity	Consent C3 (Marketing and remarketing) — optional
Verify credentials against public professional registers, detect duplicate or fraudulent accounts, screen against sanctions lists, moderate jobs	Identity, licence details, documents, technical data	Consent C1 plus legitimate use (prevention of fraud, compliance with law)
Send transactional notifications you need for the service (OTP codes, application status, interview invitations, security notices, legal-page updates)	Contact details	Consent C1 (these are part of the service and are not marketing)
Billing, invoicing, tax records for recruiters	Company and commercial data	Performance of the recruiter contract; legal obligation to keep financial records
Respond to rights requests, grievances and legal process	Consent and legal data	Legal obligation
Aggregate statistics (jobs per city, counts on hire pages)	De-identified counts only	No personal data is disclosed

We do not make decisions about you by solely automated means that have legal effects on you. Automated checks (duplicate detection, banned-phrase scanning, sanctions screening) only flag items for a human reviewer.

5. Consent: how it works

• Before you sign up we show a short itemised notice (data, purposes, recipients, how to withdraw, how to complain). We record which notice version you saw.
• Consents C1, C2 and C3 are separate check-boxes, unticked by default. We store each choice with the time, notice version, IP address and browser in an append-only consent ledger that we never edit.
• Withdrawing is as easy as giving consent: Dashboard → Privacy has one switch per consent.
  • Withdraw C2 → your profile leaves the recruiter search immediately. Recruiters who unlocked you earlier keep what they already received (section 6).
  • Withdraw C3 → all marketing stops and we remove your hashed identifiers from any advertising audience at the next sync (within 7 days).
  • Withdraw C1 → your account closes and erasure starts (section 10).
• Recruiter users see an equivalent notice and an optional marketing consent.
• If you do not give C1 we cannot provide the service; C2 and C3 are never a condition of using the Platform.

6. Who receives your data

6.1 Recruiters and employers (candidates)

• When you apply (C1): the company that posted that job receives your profile, contact details, CV and screening answers. Our system delivers it only after your credentials have been verified by our team; until then it is queued.
• When a recruiter unlocks you from the database (C2 only): that company receives your contact details and CV. Unlocks are logged and you can see the list of companies that viewed or unlocked your profile in Dashboard → Privacy → Data summary.
• Every recruiter accepts our Recruiter Terms, which allow the use of your data only for recruiting for their own or their client's occupational-health vacancies, prohibit resale, scraping, bulk export and marketing, require them to delete your data on request and to keep it secure. For the data they receive they act as an independent Data Fiduciary and are responsible to you directly. If you have a concern about a recruiter, tell our Grievance Officer and we will act (suspension, ban, referral to the authorities).
• Blocking a company on the Platform stops that company from seeing you in search and from receiving future applications.

6.2 Service providers (processors) by category

We use processors that act only on our instructions under a written data-processing agreement:

Category	What they do for us	Location
Hosting, database and backups	Run the Platform	[EDIT: hosting region, e.g. AWS ap-south-1 Mumbai, India]
Object storage	Store CVs, certificates, logos, invoices (server-side encrypted)	[EDIT: region]
Identity provider (Firebase Authentication, Google LLC)	Phone OTP and Google / Apple / LinkedIn sign-in	USA
Email delivery (SMTP provider)	Transactional and, with C3, marketing email	[EDIT]
SMS and WhatsApp delivery (Interakt)	OTP, alerts and, with C3, campaigns	India
Payments (Stripe, Inc.)	Recruiter card payments, invoices, refunds	USA
Analytics (Google Analytics 4)	Site statistics — loaded only after you accept analytics cookies	USA
Advertising platforms (Google Ads, Meta, LinkedIn)	Show OHCjob.com ads to people who gave C3; measurement pixels load only after you accept advertising cookies	USA

The live register of processors is kept in our admin system and the public list above is updated when it changes.

6.3 Others

• Job aggregators and search engines: public job listings (never candidate data) are syndicated through XML feeds and structured data.
• Authorities: when required by law, court order or to protect users from fraud.
• Business transfer: if CapriTech is acquired or merges, your data may transfer to the successor under this policy; you will be told before any change of purpose.

We never sell or rent personal data, and we do not share it with any third party that is not named by category above.

7. International transfers and data residency

• The Platform is operated from the United States by CapriTech Global Services LLC. Personal data is stored in [EDIT: hosting region] and may be accessed by our staff and processors in the USA and India.
• Cross-border sharing with recruiters is inherent to the service: when you apply to, or are discoverable for, a job in another country, your profile is shared with the recruiter in that country. Their local law then also applies to how they hold your data.
• We take contractual and technical measures for every transfer (encryption in transit and at rest, DPAs, access controls). If the Indian government restricts transfers to a country, we will comply, which may mean recruiters there cannot receive Indian candidates' data.

8. Cookies and similar technologies

Details are in the Cookie Policy. In short: strictly necessary cookies (session, security, cookie preference) always run; analytics and advertising cookies and pixels (Google Analytics, Google Ads, Meta Pixel, LinkedIn Insight) load only after you accept them in the banner, and you can change your choice at any time from the footer. We honour the Global Privacy Control browser signal as an opt-out of advertising cookies and of "sale or sharing" (section 16.2).

9. How long we keep data (retention)

Data	Retention
Candidate account and profile	Until you delete your account, or 3 years after your last activity (we email and message you at least 48 hours before automatic erasure so you can keep the account with one click)
Applications, messages and interview records	With the account; recruiters keep delivered applications for their own records for up to 90 days after a job closes
Verification documents	While the account is active; deleted on erasure
Consent ledger, legal acceptances, rights requests, audit logs of who accessed your data	At least 1 year after the related account is erased, then deleted (these records prove compliance)
Recruiter invoices, payments and tax records	As required by US and applicable tax law (typically 7 years); kept even after a company account closes
Server and security logs	90 days, then deleted or anonymised
Anonymised stub after erasure (role, country, sign-up month)	Indefinitely, for statistics; it cannot identify you

10. Security

We apply the safeguards required by DPDP Rule 6 and good industry practice: TLS on every connection; encryption at rest for the database, backups and files; field-level encryption for mobile number, email address and licence number so that even a database copy does not reveal them; contact details masked to recruiters until they are entitled to see them; role-based access with mandatory two-factor authentication for our staff; an append-only audit log of every view, unlock, export and edit of personal data; rate limiting and bot protection on sign-up, OTP and apply; signed download links for CVs that expire in 10 minutes; regular dependency scanning; daily encrypted backups with tested restores. No system is perfectly secure; if a breach affects you we will tell you without delay (section 14).

11. Your rights and how to use them

Everything below is self-service in Dashboard → Privacy (candidates) or Recruiter → Settings → Privacy (recruiter users), or by email to the Grievance Officer if you cannot log in. We verify that a request comes from you (or your nominee) before acting.

Right	What you get	Where
Access	A summary of your personal data, the purposes, and the list of recruiters who received or unlocked your profile with dates	Privacy → Data summary; "Download my data" gives a JSON export
Correction and completion	Edit any profile field; ask us to correct data we hold elsewhere	Profile; Privacy → Rights request
Erasure	Delete your account and personal data (section 10 retention exceptions apply)	Privacy → Delete account, or withdraw C1
Withdraw consent	One switch per consent	Privacy → Consents
Nominate	Appoint a person who may exercise your rights if you die or become incapacitated	Privacy → Nominee
Grievance	Raise a complaint and receive a ticket number	Privacy → Rights request → Grievance, or grievance@ohcjob.com
Marketing preferences	Choose channels (email, SMS, WhatsApp, phone) or stop all; every marketing email has an unsubscribe link and SMS/WhatsApp honour STOP	Privacy → Marketing preferences

We respond to rights requests within 30 days in most cases and always within the 90-day DPDP limit. Requests are free unless they are manifestly repetitive.

12. Your duties

DPDP asks Data Principals not to impersonate others, not to suppress material information when giving identity or licence details, not to file false or frivolous grievances, and to give only verifiably authentic information when exercising correction or erasure rights. Forged documents lead to a permanent ban and may be reported to the licensing body.

13. Grievance Officer and complaint route

Grievance Officer: [EDIT: name], [EDIT: designation] Email: grievance@ohcjob.com · Phone: [EDIT: phone] · Post: [EDIT: postal address] Hours: [EDIT: e.g. Monday to Friday, 10:00–18:00 IST]

1. Raise the grievance in the Privacy centre or by email. You receive a ticket number immediately and an acknowledgement within 48 hours.
2. We investigate and reply with a resolution or reasons within 90 days (our internal target is 30 days).
3. If you are in India and are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India through its online portal (details at the Board's website [EDIT: URL once published]). Residents of other countries may approach their national data-protection authority (see section 16).

14. Data breaches

If a breach of personal data affects you we will notify you without delay by email (and WhatsApp/SMS where you have opted in) describing what happened, the likely consequences, what we are doing and what you can do. We report breaches to the Data Protection Board of India as the Rules require (initial intimation without delay and a detailed report within 72 hours). Our internal procedure is documented in our breach runbook.

15. Children

The Platform is for adults only. You must be at least 18 to register anywhere in the world. We ask for your year of birth at sign-up and block registrations that fail the check. We do not knowingly process children's data; if you believe a minor has registered, email privacy@ohcjob.com and we will erase the account.

16. Country-specific notices

16.1 India

This policy is our DPDP notice in long form; the short itemised notice appears at sign-up in English and Hindi. Complaints: Data Protection Board of India (section 13).

16.2 United States — "Do Not Sell or Share My Personal Information"

We do not sell personal data for money. Some US state laws treat sharing identifiers with advertising platforms for targeted advertising as "selling or sharing". You can opt out at any time on the Do Not Sell or Share page, by withdrawing consent C3, by declining advertising cookies, or by enabling Global Privacy Control in your browser, which we honour automatically. We do not discriminate against you for opting out.

• Email: every marketing email contains our physical mailing address and a one-click unsubscribe link, processed within 10 business days (CAN-SPAM).
• Text messages: we send marketing SMS or WhatsApp messages to US numbers only with your prior express written consent (C3 plus the SMS/WhatsApp channel switch). Reply STOP to end at any time. Message and data rates may apply.

16.3 UAE, Saudi Arabia, Qatar, Oman, Kuwait, Bahrain

The UAE Personal Data Protection Law (Federal Decree-Law 45/2021), the Saudi Personal Data Protection Law and the Qatar Personal Data Privacy Protection Law all rest on informed consent, purpose limitation, security and data-subject rights. Our itemised notice, separate consents, rights centre and breach process are designed to satisfy those requirements. Cross-border transfer of your data (for example to an employer in India or the USA) happens only with your consent and under contract. Complaints may also be made to the UAE Data Office, the Saudi Data & AI Authority (SDAIA) or the Qatar National Cyber Security Agency, as applicable.

16.4 Other countries

Your national data-protection law may give you further rights; write to privacy@ohcjob.com and we will honour them where they apply.

17. Changes to this policy

We may update this policy. Every material change creates a new version with a new effective date; logged-in users are asked to review and accept it at the next login, and we may also email you. Previous versions are available on request. Continued use after a non-material change means you accept it.

18. Contact

CapriTech Global Services LLC · [EDIT: registered address] · privacy@ohcjob.com · support@ohcjob.com Powered by CapriTech Global Services LLC.