Privacy Policy

1. Who We Are

MARKABLE is a general wellness self-awareness and self-tracking companion for women in midlife, operated by MARKABLE Ltd. ("we", "us", "our"). MARKABLE is a general wellness product, not a medical device. It does not diagnose, prevent, manage, treat or cure any disease or condition, including any hormonal or menopause-related condition.

For the purposes of the Digital Personal Data Protection Act 2023 (the "DPDP Act"), MARKABLE Ltd. is the Data Fiduciary that decides how and why your personal data is processed. You, as the individual whose data we process, are the Data Principal. This policy applies to the MARKABLE service at markable.life and the MARKABLE application at app.markable.life.

2. What We Collect

We collect the following categories of personal data:

Information you provide

• Account information: Email address, name (optional) and age range. If you choose to sign in with Google or Facebook, we receive your name, email address and profile picture from that provider. We use them to create and manage your account and to sign you in, and we use your email address as described in this policy.
• Health and wellness information: Information you choose to provide or generate through MARKABLE, including symptom and cycle-related responses, results from THINK cognitive tasks, results from SENSE vision and hearing checks, and numerical wellness data and scores generated from your selfie analysis. This information is collected to provide your wellness assessment, establish a personal baseline, and allow you to track changes over time. We treat this as sensitive personal data and process it on the basis of your consent (see Section 5).
• Communications: Messages you send us by email or through our contact and support channels.

Information collected automatically

• Device information: Browser type, operating system and screen resolution.
• Usage data: Pages visited, time on the service and referral source.
• Cookies: Analytics cookies for service improvement (see Section 8).

3. Your Selfie and Facial Data

This section is important. We want to be completely transparent about how your facial image is handled.

• Sensitive personal data: The facial geometry derived from your selfie is treated as sensitive personal data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ("SPDI Rules"), and is processed only on the basis of your explicit consent.
• Processing: Your selfie is analysed to extract numerical wellness data points (such as texture, tone and volume values) that contribute to your wellness picture.
• Image storage: Your facial image is stored in encrypted form, only if you consent, so that your wellness picture can be generated and tracked over time across multiple reads. You may withdraw this consent and request deletion of your stored images at any time.
• Never sold: Your facial data is never sold, traded or rented, and it is never shared with or made available to any third party for its own purposes. It is processed only by Data Processors acting on our instructions.
• No facial recognition: We do not use your image for facial recognition, identity verification or any purpose other than generating your wellness picture.

4. How We Use Your Data

We use health and wellness information only to provide MARKABLE's wellness features, including generating your results, establishing your personal baseline, tracking changes over time, and creating your wellness summary. We do not sell health and wellness information or use it for advertising.

We use your personal data to:

• Generate your personal wellness picture and track how it moves over time when you do multiple reads.
• Create the summary you can choose to bring to your doctor.
• Improve our wellness models, using only de-identified, aggregated data that no longer identifies you.
• Send you your results and, if you opt in, occasional wellness updates.
• Respond to your questions and support requests.
• Meet our legal obligations under applicable Indian law.

We do not use your data to sell to third parties, build advertising profiles, perform facial recognition, or make any medical diagnosis. MARKABLE does not diagnose, prevent or manage any condition.

5. Consent and Notice

Under the DPDP Act, we process your personal data on the basis of your free, informed, specific and unambiguous consent, given through a clear affirmative action. Before or at the time we ask for your consent, we give you a plain-language notice describing the personal data we seek, the purpose of processing, how you can exercise your rights, and how you can complain to the Data Protection Board of India.

For your selfie and facial geometry, and for any other sensitive personal data, we ask for your separate, explicit consent. You may withdraw your consent at any time, as easily as you gave it, by contacting us or using the controls in your account. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Where you withdraw consent, we will stop the related processing and delete the relevant data unless we are required to retain it by law.

6. Who We Share Data With

We do not sell health and wellness information or use it for advertising. Where Data Processors (service providers) process information on our behalf in order to operate the service, they may use it only for the purposes described in this policy and subject to our contractual requirements.

We share data only with:

• Data Processors (service providers): Hosting (Cloudflare Pages), account sign-in (Clerk), analytics (Google Analytics 4, which runs only after you accept analytics cookies), web fonts (currently served by Google Fonts), and payment processing. These providers process data on our behalf under binding contractual obligations and only on our instructions.
• At your direction: When you choose to share your wellness summary with a healthcare provider.
• Employer and organisational wellness programmes: When MARKABLE is offered through your employer or another organisation, that organisation receives only aggregated, de-identified statistics. It never receives your individual results, images or answers.
• Business transfers: If MARKABLE is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
• Legal requirements: When required by Indian law, court order or a valid request from a lawful authority.

7. Website Visitor Beacon

When you visit our website, a small beacon (a Cloudflare Worker) records a per-country daily count of visits. It receives only the address of the page you visited, with no personal data, and is used solely for aggregate counting.

8. Cookies and Analytics

Analytics run only after you accept them in our cookie banner; until then no analytics cookies are set. We use:

• Google Analytics 4 (G-EKN2TP5SW8): To understand, in aggregate, how visitors use our site. Loads only after you accept. You can also opt out using Google's opt-out tool, and we honour the Global Privacy Control (GPC) browser signal as an opt-out.
• Essential cookies: To keep you signed in and remember your cookie choice. These set no analytics.

Web fonts: Our pages currently load fonts from Google Fonts, so your browser connects to Google and your IP address is processed by Google to deliver the fonts. We are moving to self-hosted fonts to remove this dependency.

We do not use advertising cookies, retargeting pixels, or social media tracking pixels.

9. Your Rights as a Data Principal

Under the DPDP Act, as a Data Principal you have the right to:

• Access: Obtain a summary of the personal data we process about you and the processing activities.
• Correction and updating: Request correction, completion or updating of your personal data.
• Erasure: Request deletion of your personal data where it is no longer needed for the purpose it was collected.
• Withdraw consent: Withdraw your consent at any time, as easily as you gave it.
• Grievance redressal: Have your grievance addressed by us through a readily available means (see Section 10).
• Nominate: Nominate another person to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact us at privacy@markable.life. We will respond within the timelines required under applicable Indian law.

10. Grievance Redressal

We have appointed a Grievance Officer to address any concern you have about how we handle your personal data, in keeping with the DPDP Act and the SPDI Rules. You may contact our Grievance Officer at privacy@markable.life (subject line: "Grievance Officer, MARKABLE India"). We aim to acknowledge your grievance promptly and resolve it within the period prescribed under applicable Indian law.

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India.

11. Data Retention

• Health and wellness information: Symptom and cycle-related responses, THINK and SENSE results, and assessment scores are retained while your account is active, or until you request deletion.
• Facial images: Stored in encrypted form only with your consent while your account is active, and deleted on account deletion or on your request.
• Analytics data: De-identified, aggregated data may be retained for product improvement.
• Account data: Deleted within 30 days of an account deletion request, except where retention is required by law.

12. Security

We follow reasonable security practices and procedures as required under the DPDP Act and the SPDI Rules, including:

• Encryption in transit (TLS) and at rest.
• Access controls and authentication.
• Regular security reviews.
• Secure data processing practices.

No method of transmission over the Internet is fully secure. While we work hard to protect your data, we cannot guarantee absolute security.

13. Cross-Border Transfers

MARKABLE Ltd. operates from Israel, and some of our service providers process data outside India. Where your personal data is transferred outside India, we do so in accordance with the DPDP Act and put appropriate safeguards in place to protect it.

14. Children's Data

MARKABLE is intended for adult women and is not designed for use by anyone under 18. We do not knowingly process the personal data of children. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any significant changes on this page and update the "Last updated" date above.

16. Contact Us

For privacy questions, to exercise your rights, or to reach our Grievance Officer:

• Privacy and grievances: privacy@markable.life
• General contact: hello@markable.life

Data Fiduciary: MARKABLE Ltd.