Data Deletion Policy

Effective Date: July 24, 2026

Last Updated: July 24, 2026

1. Overview

This Data Deletion Policy explains how you can request deletion of your personal data from Program Insider systems. We are committed to respecting your data rights under the EU/UK GDPR, India's Digital Personal Data Protection (DPDP) Act 2023, and other applicable data protection laws.

2. Scope of This Policy

This policy covers personal data you submit through Program Insider forms, accounts, and services, including:

• Contact and enquiry forms (name, email, phone, comments)
• Service registration and event sign-ups
• Payment and transaction records (partial deletion may apply)
• Communication records and follow-up interactions
• Profile and account information
• Data processed through analytical and tracking tools

See our Privacy Policy for details on what data we collect and how.

3. What Data Can Be Deleted

Subject to legal and operational requirements, we can delete the following personal data:

• Form Submissions: Enquiry forms, contact forms, and service registration data (displayName, email, phone number, country code, comments, and enquiry type)
• Lead Records: Records of leads generated from your submissions and associated communication metadata
• Account Data: Personal profile information linked to your account
• Analytics Identifiers: Where permitted, we can request deletion of analytics data (GA4, Meta Pixel) associated with your email or account, though some aggregated data may persist
• Device Fingerprints: Hashed device identifiers used for anti-scraping purposes are automatically deleted within 48 hours; no manual deletion request is needed

4. Data That May Be Retained (Legal Holds)

In the following circumstances, we must retain limited personal data even upon your deletion request, as required by law or for legitimate operational purposes:

• Tax and Financial Records: Transaction records, invoices, payment confirmations, and billing information as required by Indian Income Tax Act, GST regulations, and anti-money laundering (AML) compliance. These are retained for the minimum period required by law (typically 5–7 years).
• Payment Verification: Records necessary to reconcile payments, dispute resolution, and chargeback prevention.
• Legal Obligations: Where deletion is prohibited by court order, regulatory notice, or legal hold.
• Contractual Records: Records of services rendered, scope of engagement, and correspondence necessary to fulfill existing contractual obligations.
• Fraud Prevention and Security: Limited data retained to prevent fraudulent activity, abuse, or unauthorized access to our services.
• Audit and Compliance Trails: Records maintained for internal audit, regulatory compliance, and quality assurance purposes.

Where data is retained on legal grounds, we will inform you of the reason and expected retention period.

5. How to Request Deletion

To request deletion of your personal data, please send a written request to our Data Protection Team:

• Email: support@programinsider.in
• Subject Line: Data Deletion Request – [Your Name]

Your request should include:

• Your full name (as used in your account or form submissions)
• Your email address used on our website
• Your phone number used on our website (if applicable)
• Optional but helpful: enquiry date, transaction ID, program name, or page from which you submitted a form
• A statement of what data you wish to delete (e.g., "all personal data" or specific records)

6. Identity Verification

To protect your privacy and prevent unauthorized deletion requests, we will verify your identity before processing your request. Verification may include:

• Confirming details from your form submissions or account
• Requesting a copy of a government-issued ID
• Verifying possession of the email address or phone number on file

Verification is completed within 7 business days. If you do not respond to a verification request, we may not be able to process your deletion request.

7. Processing Timeline and Status

We aim to meet the following timelines:

• Acknowledgment: We will acknowledge receipt of your deletion request within 5 business days.
• Verification: Identity verification is completed within 7 business days.
• Deletion Completion: We target completion of deletion within 30 calendar days after successful verification, unless legal or technical constraints require additional time.

If we cannot meet these timelines, we will inform you of the reason and revised timeline.

8. Third-Party Service Providers and Data Sharing

Your personal data may have been shared with our service providers for service delivery. Where applicable, we will request deletion from the following categories of processors:

• Payment Gateway (PayU): We initiate deletion requests for transaction records, subject to their retention policies and legal requirements.
• Email Delivery Providers: We request deletion of email records, though transactional confirmations may be retained for legal compliance.
• Event Registration (Zoom): If you registered for events or sessions, we will request deletion of your registration data from Zoom.
• Analytics Providers (Google Analytics, Meta Pixel): We will request deletion of analytics data associated with your email or account from these platforms. However, aggregated and anonymized analytics data may persist.
• Trustpilot: We will request deletion of reviews or personal data linked to your Trustpilot profile if applicable.
• Bot Detection and Security (Cloudflare Turnstile): Device identifiers used for bot detection are automatically deleted within 48 hours and do not require manual deletion.
• Hosting and Database Providers: We will request deletion from our hosting and database infrastructure, subject to backup and redundancy requirements.

Important Note: Third-party service providers may have their own retention policies, data protection obligations, and legal requirements. We will coordinate deletion requests but cannot guarantee deletion timelines or scope from third parties. We recommend contacting these providers directly if you have specific concerns.

9. Automated Processing and Profiling Data

If you have used our specialty-matching or program-discovery tools (described in our Privacy Policy, Section 7), the input data (USMLE scores, graduation year, visa requirements) used for those assessments can be deleted upon request. However:

• Aggregated, anonymized analytics about tool performance may be retained.
• We do not use matching results to build advertising profiles, and this data is not sold.

10. What Happens After Deletion

Once your deletion request is processed:

• Confirmation Email: We will send you a confirmation email detailing what was deleted, what was retained, and the reasons for any retained data.
• Residual Data: In some cases, deleted data may persist in automated backup systems for a limited period (typically up to 90 days) but will not be accessed or used during this period.
• Future Communications: If you were receiving marketing or promotional emails, deletion of your email removes you from those lists. Transactional emails (receipts, confirmations) may continue if you have an active account or pending transactions.

11. Right to Rectification

If you believe your personal data is inaccurate or incomplete, you have the right to request correction. This is often faster than deletion and is recommended when data is simply outdated. Contact us with your correction request using the same email address listed in Section 5.

12. Withdrawal of Consent

If we process your data based on your consent (for example, for non-essential analytics or marketing communications), you can withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

13. Right to Data Portability

You have the right to request your personal data in a portable, machine-readable format (e.g., CSV, JSON). Contact us using the details in Section 5 to submit a data portability request.

14. Exercising Your Rights in Your Jurisdiction

EU/UK Users (GDPR): Your rights under GDPR include access, rectification, erasure (right to be forgotten), restriction of processing, and data portability. You also have the right to lodge a complaint with your national data protection supervisory authority.

India Users (DPDP Act 2023): Under India's Digital Personal Data Protection Act, 2023, you have the right to request deletion, correction, and portability of your personal data. If we deny your request, we must provide reasons. You may escalate to the Data Protection Board of India if unresolved.

15. Charges and Fees

We do not charge a fee for data deletion requests unless your request is manifestly unfounded, excessive, or repetitive. Where we charge a fee, we will inform you in advance.

16. No Retaliation

We will not deny you services, discriminate against you, or take any adverse action based on your exercise of data deletion or privacy rights.

17. Contact Our Data Protection Team

For any questions about this policy, to file a complaint, or to exercise your rights, contact:

• Email: support@programinsider.in
• Title: Data Protection Team, Program Insider

We will respond to all inquiries and requests within 30 days or as required by applicable law.

18. Relationship to Privacy Policy

This Data Deletion Policy is part of our broader Privacy Policy. For information on what data we collect, how we use it, and your other privacy rights, please review the full Privacy Policy.

19. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the effective date and provide notice. Your continued use of our website after changes indicates your acceptance of the updated policy.