Privacy Policy

Version 1.4.4 (platform) - 17 October 2026 (the Privacy Policy of the Covarage platform at platform.covarage.com)

1. Introduction

COVARAGE PTE. LTD. (UEN 202531227H) ("Covarage", "we", "our", "us") is committed to protecting the Personal Data of our users, customers, employees, partners, and vendors in accordance with the Personal Data Protection Act 2012 ("PDPA") of Singapore. This Policy explains how we collect, use, disclose, store, retain, and protect Personal Data in connection with our insurance document platform, renewal-date records, introductions to licensed insurance intermediaries, concierge services, and policy record-keeping.

2. Definitions

• Personal Data: Data, whether true or not, about an identifiable individual.
• Business Contact Information (BCI): Business email, business phone number, job title or business address. BCI is excluded from PDPA obligations under Section 4(5).
• Data Intermediaries: Vendors or service providers that process data on behalf of Covarage, including cloud and hosting providers.
• User: Any individual interacting with Covarage's website, APIs, mobile applications, concierge services, or insurance operations.

3. Collection of Personal Data

We collect Personal Data when individuals:

• Record the insurance requirements they wish to obtain cover for, or provide renewal details.
• Upload policy documents, employment information, or claim documents.
• Interact with Covarage's apps, web portals, WhatsApp, email, or support channels.
• Communicate with us for account support, document handling or servicing.
• Add a backup email address or a phone number for signing in, or choose to receive sign-in codes by WhatsApp.
• Engage our concierge or medical partners.
• Submit documents such as NRIC, passport, medical reports, or invoices.
• Provide information through employers, brokers, insurers, or landlords.

We also record the IP address from which a consent is given, a password reset is asked for or a sign-in code is asked for, and we use cookies that keep you signed in. The platform uses no analytics or advertising tools.

Identification numbers. We collect an NRIC, FIN or passport number only where it is needed to enrol someone in an insurance policy or to admit them for medical care, because the insurer or the hospital must identify that person accurately. We store it once, so it does not have to be given again. It is encrypted, and only its last four characters are shown on screen. Only the medical concierge team can see it in full, to arrange your care: they are staff of IASO Pte. Ltd., our concierge partner, working on our platform, and each time they do it is recorded. We never use it to identify you when you sign in.

4. Use of Personal Data

• Service Delivery: Operating user accounts, storing uploaded documents, showing the renewal dates a user records, recording the requirements a user provides, passing those details to a licensed insurance intermediary where the user asks to be introduced, where we do so monitoring how promptly that intermediary responds, and storing and forwarding a claim document at the user's request; and carrying the messages, and the files with them, that a user and the broker handling their request send each other on the platform.
• Business Operations: Analytics, product development, fraud detection, and customer support.
• Account Access and Recovery: using a backup email address or sign-in phone number that a user adds to let them sign in, to confirm it is them (by a code sent by WhatsApp, where they choose it), to help them recover their account and to send them notices about it.
• Referral programme: contacting a person or firm that registers interest in our referral programme about joining it.
• Family members: if your company's policy allows it, you may add your spouse or child. We collect their details from you only to enrol them in that policy and administer it, and pass them to the policy's broker, and through the broker to the insurer, for that purpose alone; where the policy has no broker on the platform, our own team does this. Your company's Owners and Admins see who you add, to approve it; the proof of relationship you upload goes only to the broker and our own team. Health questions for their cover go to the broker or insurer, not through the platform. If your company recovers the cost from your salary, we record your agreement to that and any withdrawal of it, and tell your company.
• Support access: if you switch on support access in your profile, you give Covarage's support team your go-ahead to look into your account to help you. It lasts seven days, or until you switch it off, and each time it is switched on or off is recorded. It does not change what our staff can see: section 7 says how they reach your data, and that each time they open your record it is recorded.
• Case notes: the brokerage handling a request may keep its own notes on it on the platform. They are seen only at that brokerage, by the broker handling the request, their manager and the brokerage's directors; your company does not see them, and Covarage reads them only to answer an audit.
• Legal and Regulatory: Responding to lawful requests and fulfilling obligations to authorities and partners.
• Note: We do not sell Personal Data.

5. Disclosure of Personal Data

We disclose Personal Data only where necessary to:

• Licensed insurance intermediaries to whom a user has asked to be introduced, including each brokerage a request is offered to in turn, and through them, insurers.
• Insurance brokers that a company works with on the platform - those it was introduced to, and those it invited and Covarage has checked - for that company's records, including the details of its employees that the company has added.
• Concierge partners, clinics, hospitals, and medical networks.
• Cloud service vendors and data intermediaries.
• Legal advisors, auditors, or government agencies.
• A user's own intermediary or insurer, where the user asks us to forward a claim document.

A person's own insurance cover is seen only by that person and by Covarage's staff, and is shared with a doctor or clinic only for a booking they ask for. It is never shown to their employer or to their employer's brokers.

6. Where your data is kept, and when it leaves Singapore

We store your records in Singapore: our database, sign-in and file storage are hosted there, and the platform's servers run there.

Some of our service providers process personal data outside Singapore to do their work. Each is bound by data processing terms with us that require it to protect your data and to use it only to provide its service to us. The platform cannot run without them, so when you accept this Policy at sign-up you agree to these transfers:

• Vercel, which hosts the platform: pages and requests pass through its global network, and its service logs (your IP address, your browser and the addresses of the pages you open) are kept in the United States and other countries.
• Supabase, which runs our database and sign-in: its service logs (your email address or phone number, IP address and browser) are kept for seven days in the United States and Singapore, and its support team is in the United States.
• Amazon Web Services sends the platform's emails from Singapore. Each email is then delivered by your own email provider, wherever it is.
• Google, which runs our own mailboxes, holds what you write to us at support@covarage.com or dpo@covarage.com, and the emails the platform sends our own team about what happens on it: each action, who took it and their email address, who or what it concerns, and when.
• Twilio, in the United States, and WhatsApp (Meta), in the United States and other countries, receive your mobile number and each sign-in code if you choose to receive codes by WhatsApp. Twilio shows a record of each message (your number and the code) in its message log for seven days, and keeps it after that in an archive in our Twilio account until we delete it. Twilio is bound by its data protection terms with us; WhatsApp handles the message under its business terms as a processor. You can choose an authenticator app instead, and then your number does not go to them.
• If you message Covarage on WhatsApp, at +65 8867 0918, your message, your WhatsApp name and number and any file you send pass through WhatsApp (Meta) and Twilio, in the United States and other countries, to the platform, which keeps a copy of them in Singapore. Twilio shows each message in its message log for seven days and keeps it after that in the archive in our Twilio account, as it does for sign-in codes; it keeps its own copy of each file you send for 13 months, and then deletes it. A copy of each message's text, without the files, is emailed to Covarage's own mailbox, which Google runs.

We will update this list before we add a provider that processes personal data outside Singapore.

7. Protection of Personal Data

We implement the following safeguards:

• Administrative: Access governance (role-based access), employee training, and vendor due diligence.
• Staff access: Covarage staff reach a customer's data only for the task in hand. Every time an NRIC number is shown in full, and every time a person's record is opened in our back office, it is recorded. Sensitive actions, such as resetting someone's sign-in, need a Covarage Owner's approval or a fresh sign-in code, and the other Owners are told.
• Technical: access controls, a second sign-in step (an authenticator app or a WhatsApp code) for every account, and encryption of identification numbers.
• Physical: Secure office facilities and controlled disposal of documents.

8. Retention of Personal Data

While your account is open, we keep your records for as long as you keep them on the platform. When you delete a document, it leaves the platform at once and its file is removed within a day.

If you leave a company on the platform, your access to that company's records ends and those records stay with the company. Your account stays yours, with any records of your own, such as your own insurance cover.

When you close your account you can choose to delete all your records, and we delete them straight away: your policy documents, your uploads and your company, employee and vehicle records. Copies held in our backups are overwritten within seven days. If you close your account without choosing that, we delete those records five years after the account is closed.

Whatever you choose, we keep these for five years and then delete them: our own accounting records of any transaction between us, which the law does not let us delete; the requests your company sent through the platform and which brokerage handled each, with your company's name and UEN, because that is our record of each introduction and its fee; and the record of your consents and of any deletion request and what we did about it, because it is how we show we handled your data properly.

Messages that your company and the broker handling a request send each other on the platform, and the files with them, are kept with that request as the record of what was asked and answered: for as long as the request stays on the platform, and for five years after your account is closed, then deleted.

A brokerage's notes on a request are kept with that request, unchanged, for as long as the request stays on the platform and for five years after your account is closed, then deleted.

The WhatsApp messages that carry sign-in codes are kept as section 6 says.

Messages you send us on WhatsApp, and the files with them, are kept as our record of what you asked us and what we did, for five years after the conversation ends, and then deleted.

If you register interest in our referral programme and no partnership agreement follows, we delete your details 12 months after our last contact with you.

Write to dpo@covarage.com and we will confirm what was deleted and what was kept.

9. Data Protection Officer (DPO)

For questions, access requests, or complaints, please contact:

• Email: dpo@covarage.com
• Address: 20 Cecil Street, #22-00 PLUS Building, Singapore 049705