Privacy Policy

1. Who we are

MARKABLE is a general wellness self-awareness and self-tracking companion for women in midlife, operated by MARKABLE Ltd. ("MARKABLE", "we", "us", "our"). The MARKABLE website is served at markable.life and the application at app.markable.life.

MARKABLE is a general wellness product. It is not a medical device, and it does not diagnose, treat, prevent or manage any condition, including any hormonal or menopause-related condition. This policy explains how we handle personal data of users in Hong Kong, and how we meet our obligations under the Personal Data (Privacy) Ordinance (Cap. 486) (the "PDPO") and its six Data Protection Principles. MARKABLE Ltd. is the data user (controller) responsible for your personal data.

2. Your rights under the PDPO

The PDPO sets out six Data Protection Principles (DPPs) that govern how we handle your personal data, and we have built this policy around them:

• DPP1 – Purpose and collection. We collect personal data only for purposes directly related to the MARKABLE wellness service, by lawful and fair means, and we tell you what we collect and why.
• DPP2 – Accuracy and retention. We take practicable steps to keep your data accurate and to retain it no longer than is necessary.
• DPP3 – Use limitation. We use your personal data only for the purposes set out in this policy, or a directly related purpose. We will seek your fresh, voluntary consent before using your data for any new purpose.
• DPP4 – Security. We apply practicable safeguards to protect your data against unauthorised access, loss or misuse.
• DPP5 – Openness. We make our data practices, policies and the types of data we hold available to you, as in this policy.
• DPP6 – Access and correction. You may request access to, and correction of, the personal data we hold about you (see Section 8).

3. What we collect

Information you provide

• Account information: email address, name (optional) and age range. If you choose to sign in with Google or Facebook, we receive your name, email address and profile picture from that provider. We use them to create and manage your account and to sign you in, and we use your email address as described in this policy.
• Health and wellness information: information you choose to provide or generate through MARKABLE, including symptom and cycle-related responses, results from THINK cognitive tasks, results from SENSE vision and hearing checks, and numerical wellness data and scores generated from your selfie analysis. This information is collected to provide your wellness assessment, establish a personal baseline, and allow you to track changes over time.
• Communications: messages you send us by email or contact forms.

Information collected automatically

• Device information: browser type, operating system and screen resolution.
• Usage data: pages visited, time on site and referral source.
• Cookies: essential and analytics cookies (see Section 7).

4. Your selfie and facial geometry

This section matters most, and we want to be completely clear about it.

• Consent first. Your selfie is biometric personal data. We capture it only with your separate, explicit consent, and you may decline or withdraw that consent at any time.
• What we derive: our software analyses your selfie to extract numerical facial-geometry wellness data points (such as texture, tone and volume values). This reflects general wellness patterns. We do not measure your hormones.
• Storage: your facial image is stored in encrypted form, with your consent, so that we can generate your wellness picture and track how it moves over time across multiple reads.
• No facial recognition: we do not use your image for facial recognition, identity verification or any purpose other than wellness pattern analysis.
• Never sold: your facial data is never sold, and never shared with or made available to any third party for its own purposes. It is processed only by service providers acting on our behalf.
• Deletable: you may request deletion of your stored image and derived data at any time, and we will action it.

5. How we use your data

We use health and wellness information only to provide MARKABLE's wellness features, including generating your results, establishing your personal baseline, tracking changes over time, and creating your wellness summary. We do not sell health and wellness information or use it for advertising.

We use your information to:

• generate your personal wellness picture;
• track your wellness patterns over time when you complete more than one read;
• create the summary you can choose to bring to your doctor;
• improve our wellness models using only anonymised, aggregated data that no longer identifies you;
• send you results and, if you opt in, wellness updates;
• respond to your questions and support requests; and
• comply with legal obligations.

In keeping with DPP3, we will not use your personal data for any new purpose that is not directly related to the above without first obtaining your fresh, voluntary consent. We do not sell your data, build advertising profiles, perform facial recognition or make any medical diagnosis.

6. Who we share data with

We do not sell health and wellness information or use it for advertising. Where service providers process information on our behalf in order to operate the service, they may use it only for the purposes described in this policy and subject to our contractual requirements.

We share data only with:

• Service providers who process data on our behalf under strict contractual obligations: hosting (Cloudflare Pages), account sign-in (Clerk), analytics (Google Analytics 4, which runs only after you accept analytics cookies), web fonts (currently served by Google Fonts), payment processing, and a privacy-friendly visitor-count beacon (see Section 7).
• At your direction: when you choose to share your wellness summary with a healthcare professional.
• Employer and organisational wellness programmes: When MARKABLE is offered through your employer or another organisation, that organisation receives only aggregated, de-identified statistics. It never receives your individual results, images or answers.
• Business transfers: If MARKABLE is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
• Legal requirements: when required by law, court order or a lawful request from a Hong Kong authority.

We do not sell, trade or rent your personal data to anyone.

7. Visitor counting and analytics

Analytics run only after you accept them in our cookie banner; until then no analytics cookies are set. We use:

• Google Analytics 4 (G-EKN2TP5SW8): To understand, in aggregate, how visitors use our site. Loads only after you accept. You can also opt out using Google's opt-out tool, and we honour the Global Privacy Control (GPC) browser signal as an opt-out.
• Essential cookies: To keep you signed in and remember your cookie choice. These set no analytics.
• Visitor counting: A privacy-friendly beacon (a Cloudflare Worker) that records only a per-country daily count of visits; no identifier is stored.

Web fonts: Our pages currently load fonts from Google Fonts, so your browser connects to Google and your IP address is processed by Google to deliver the fonts. We are moving to self-hosted fonts to remove this dependency.

We do not use advertising cookies, retargeting pixels, or social media tracking pixels.

8. Access and correction

Under DPP6 and sections 18 to 22 of the PDPO, you have the right to:

• Ask whether we hold personal data about you;
• Access a copy of the personal data we hold about you;
• Correct any data that is inaccurate;
• Delete your account and associated data, including your stored selfie; and
• Withdraw consent at any time where we rely on your consent.

To make a data access or correction request, email us at privacy@markable.life. We will respond within the timeframe required by the PDPO (generally 40 days). We may charge a reasonable fee for a data access request, as permitted by the Ordinance.

9. Cross-border transfers

MARKABLE Ltd. operates from Israel, and our service providers may process data in other locations. Where your personal data is transferred outside Hong Kong, we take practicable steps to ensure it is given a level of protection comparable to that required under the PDPO, including through contractual safeguards with our processors.

10. Data retention

• Health and wellness information: symptom and cycle-related responses, THINK and SENSE results, and assessment scores are retained while your account is active, or until you request deletion.
• Facial images: stored in encrypted form while your account is active, and deleted on account closure or on your request.
• Analytics data: anonymised, aggregated data may be retained for product improvement.
• Account data: deleted within 30 days of an account deletion request, except where retention is required by law.

11. Security

We apply practicable security measures, in line with DPP4, including:

• encryption in transit (TLS/SSL) and at rest;
• access controls and authentication;
• regular security review; and
• secure data-processing practices.

No method of transmission over the Internet is completely secure. While we work hard to protect your data, we cannot guarantee absolute security.

12. Children's privacy

MARKABLE is intended for adult women and is not for use by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post any material change on this page and update the "Last updated" date above.

14. Contact and complaints

For privacy questions, or to exercise your data access and correction rights:

• Email: privacy@markable.life
• General contact: hello@markable.life

Data user: MARKABLE Ltd.