StepWell App Privacy Policy – Asirvad Micro Finance Limited

Introduction

StepWell is an internal wellness mobile application of Asirvad Micro Finance Limited ("AMFL"). It counts the steps an employee walks, shows daily progress, and runs step challenges, branch leaderboards and rewards for employees. This Privacy Policy explains what information the StepWell application collects, why it is collected, how it is used and protected, and the choices available to its users.

This policy is specific to the StepWell application and is to be read together with the AMFL Data Privacy Policy approved by the Board of Directors. Where this policy is silent, the AMFL Data Privacy Policy applies.

Who We Are

Throughout this document, "we", "us", "our" and "ours" or any cognate variations thereof refer to Asirvad Micro Finance Limited.

"Asirvad Micro Finance Limited" or "AMFL" means: Asirvad Micro Finance Limited, Building No: 4/85 B, C & D, Chanthappadi, Valapad, Thrissur, Kerala, India - 680567, Tel: 0487 2992299.

Scope and Coverage

This policy covers the StepWell mobile application (Android package com.asirvad.stepwell) and the AMFL servers that support it.

StepWell is available only to employees of AMFL.
Employees sign in with their existing HRMS (Human Resource Management System) credentials. Accounts cannot be created inside the application.
This policy does not extend to third-party websites or applications.

Data We Collect

Category	Information collected	Source
Employee account details	Employee ID, name and branch.	AMFL HRMS, at sign-in
Step activity (fitness information)	Step counts, estimated walking distance, and the date and time the steps were recorded.	Phone's step sensor (Android) / Core Motion (iOS)
Device information	An identifier generated by the application for the installation, and the device platform (for example, Android).	Generated by the application
Motion activity status	Whether the phone appears to be in a vehicle or on a bicycle. Used only on the phone to avoid counting vibration as steps; it is not sent to AMFL servers.	Google Play services Activity Recognition (Android) / Core Motion (iOS)

Data we do not collect

The HRMS password is not stored by the application. It is sent only to AMFL HRMS, in encrypted form, to verify identity.
No GPS or location data, contacts, photos, files, camera, microphone, call logs or messages.
No health records, heart rate or other medical information.
Height and other body measurements are not collected at present. If this changes, this policy will be updated before such data is collected.
No advertising identifiers; the application contains no advertisements.

Usage of Information

AMFL uses the information collected through StepWell only for the following purposes:

To count steps, including when the application is closed, and to show daily and weekly progress.
To rank employees within the same branch on the daily leaderboard.
To run step challenges and to determine eligibility for rewards and prizes.
To keep each account active on one device at a time; signing in on a new device signs out the previous one.
To synchronise data between the application and AMFL servers, and to resolve technical issues.

The information is not used for advertising or marketing, and is not sold or rented to anyone.

App Permissions

Permission	Purpose
Physical activity (Activity Recognition) / Motion & Fitness	To read step counts from the phone and to detect travel in a vehicle or on a bicycle, so that vibration is not counted as steps.
Foreground service (health) and notifications	To keep counting steps when the application is closed. Android shows a persistent "Counting your steps" notification while this is active.
Run at startup	To resume step counting after the phone restarts, only while the user is signed in.
Internet and network state	To sign in through HRMS and to synchronise step data with AMFL servers when a connection is available.

These permissions can be turned off at any time in the phone settings. Step counting stops until the physical-activity permission is allowed again.

Background Operation

To record steps throughout the day, StepWell runs a background step-counting service while the user is signed in. Captured steps are sent to AMFL servers periodically in the background; other data, such as the profile and leaderboard, is refreshed when the application is opened. Background counting stops when the user signs out, or when the account is signed in on another device.

Disclosure and Transfer of Information

Colleagues in the same branch: the employee's name and daily step count appear on the branch leaderboard.
Internal Use: the Human Resources department and authorised administrators of AMFL may access step data to run challenges, award rewards, handle requests and administer the programme.
Service providers: Google Play services (Android) and Apple Core Motion (iOS) process motion data on the device to provide step counting and activity detection. StepWell does not use third-party analytics, advertising or crash-reporting services.
With Legal Compliance: information may be disclosed to government agencies where disclosure is required by law or by an order under the laws in force.

Data Security

In compliance with the DPDP Act, 2023 and the AMFL Data Privacy Policy, AMFL uses the following measures to protect StepWell data:

Data is transmitted between the application and AMFL servers over encrypted connections (HTTPS).
The sign-in session is kept in encrypted storage on the phone (Android Keystore / iOS Keychain).
Step data held on the phone is cleared at every sign-in and sign-out, so data from one employee is never shown to another on a shared device.
On Android, the application's data is excluded from device backups.
Access to StepWell data on AMFL servers is restricted to authorised personnel.

Retention of Personal Data

StepWell data is AMFL employee data and is kept securely by AMFL for as long as required for the purposes set out in this policy, or as required by legal and regulatory obligations. Detailed upload records used to prevent duplicate counting are deleted automatically after 7 days; daily step totals are retained as part of employee records.

When an employee leaves AMFL, HRMS blocks all access, which ends access to StepWell. The data remains protected under AMFL's employee data practices and can be deleted on request as described below.

Data Principal Rights under DPDP Act 2023

Under the Digital Personal Data Protection Act, 2023, users of StepWell have the following rights:

Right to Access: request details of the personal data held about them in StepWell.
Right to Correction: request correction of inaccurate or incomplete information.
Right to Erasure: request deletion of their StepWell data (subject to legal obligations). As StepWell is an internal application, deletion is processed manually by the Human Resources department.
Withdrawal of Consent: stop using the application, sign out, revoke permissions in the phone settings, or uninstall the application at any time.

Requests can be raised with the Human Resources department or by writing to privacyteam@asirvad.in.

Children

StepWell is intended only for AMFL employees and is not directed at anyone under 18 years of age.

Grievance Redressal Mechanism

In case of any feedback or concern regarding the protection of personal information in StepWell, you can contact us at privacyteam@asirvad.in. Alternatively, you may direct your privacy-related feedback or concerns to the DPO whose details are as mentioned below:

Name: Mr Ravish Varun
Phone: +91 7034255176
E-mail: privacyteam@asirvad.in

You have the right to file a complaint with the Data Protection Board of India.

Changes to This Privacy Policy

We may update this policy from time to time, for example when application features change or legal requirements under the DPDP Act, 2023 change. The latest version will always be available at https://apps.asirvad.com/privacypolicies/app_stepwell_privacy_policy.pdf, with the effective date shown at the top. Significant changes will be communicated to employees.