Privacy Policy

1. Who we are

MARKABLE is a perimenopause wellness companion for women in midlife, operated by MARKABLE Ltd. ("we", "us", "our"). MARKABLE is a general wellness product, not a medical device. It is not intended to diagnose, treat, cure, or prevent any disease or medical condition.

For the purposes of UK data protection law, MARKABLE Ltd. is the data controller responsible for your personal information. This policy explains how we collect, use, store, and protect your personal data when you use MARKABLE at markable.life and our application at app.markable.life.

2. What we collect

Information you provide

• Account information: email address, name (optional), and age range. If you choose to sign in with Google or Facebook, we receive your name, email address and profile picture from that provider. We use them to create and manage your account and to sign you in, and we use your email address as described in this policy.
• Health and wellness information: information you choose to provide or generate through MARKABLE, including symptom and cycle-related responses, results from THINK cognitive tasks, results from SENSE vision and hearing checks, and numerical wellness data and scores generated from your selfie analysis. This information is collected to provide your wellness assessment, establish a personal baseline, and allow you to track changes over time.
• Facial wellness read: a selfie you choose to take, processed into facial geometry data (see Section 3).
• Communications: messages you send us by email or through our contact forms.

Information collected automatically

• Device information: browser type, operating system, and screen resolution.
• Usage data: pages visited, time on site, and the source that referred you.
• Cookies and a privacy-friendly visitor beacon: see Section 7.

3. Your facial wellness read

This section is important, and we want to be completely transparent about how your facial image is handled.

• What it is: your selfie is analysed to produce biometric facial geometry, a set of numerical wellness data points. Under the UK GDPR, this facial geometry is special category (biometric) data, so we ask for your separate, explicit consent before we capture it.
• Storage: your facial image and the data derived from it are encrypted and stored only if you give consent, so that we can generate your wellness picture and track how it moves over time across multiple reads.
• Your control: you can withdraw your consent and request deletion of your stored images and facial data at any time.
• No facial recognition: we do not use your image for facial recognition, identity verification, or any purpose other than your wellness read.
• Never sold: your facial data is never sold, and it is never shared with or made available to third parties for their own purposes.

4. How we use your data

We use health and wellness information only to provide MARKABLE's wellness features, including generating your results, establishing your personal baseline, tracking changes over time, and creating your wellness summary. We do not sell health and wellness information or use it for advertising.

We use your information to:

• generate your personal MARKABLE wellness picture;
• track your wellness patterns over time when you complete more than one read;
• create a summary you can take to your GP or another healthcare professional;
• improve our models and algorithms using only anonymised, aggregated data that no longer identifies you;
• send you your results and, if you opt in, wellness updates;
• respond to your questions and support requests;
• comply with our legal obligations.

We do not use your data to sell to third parties, build advertising profiles, perform facial recognition, or make any medical diagnosis.

5. Lawful bases for processing

Under the UK GDPR and the Data Protection Act 2018, we rely on the following lawful bases:

• Consent (Article 6(1)(a), and Article 9(2)(a) for special category data): for your facial wellness read, other health-related wellness data, and optional wellness communications. You can withdraw your consent at any time.
• Performance of a contract (Article 6(1)(b)): to provide the MARKABLE service you have asked for, including any subscription you take out.
• Legitimate interests (Article 6(1)(f)): to improve and secure the product and prevent fraud, where these interests do not override your rights.
• Legal obligation (Article 6(1)(c)): where processing is required by applicable UK law.

6. Who we share data with

We do not sell health and wellness information or use it for advertising. Where service providers process information on our behalf in order to operate the service, they may use it only for the purposes described in this policy and subject to our contractual requirements.

More broadly, we do not sell, trade, or rent your personal information to anyone. We share data only with:

• Service providers (processors): hosting on Cloudflare Pages, with the application served from app.markable.life; account sign-in (Clerk); analytics (Google Analytics 4, which runs only after you accept analytics cookies); web fonts (currently served by Google Fonts); and payment processing. These providers act on our behalf under written contracts that require them to protect your data.
• At your direction: when you choose to share your wellness summary with a GP or other healthcare professional.
• Employer and organisational wellness programmes: When MARKABLE is offered through your employer or another organisation, that organisation receives only aggregated, de-identified statistics. It never receives your individual results, images or answers.
• Business transfers: If MARKABLE is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
• Legal requirements: when required by UK law, court order, or a valid request from a public authority.

7. Cookies, analytics and our visitor beacon

Analytics run only after you accept them in our cookie banner; until then no analytics cookies are set. We use:

• Google Analytics 4 (G-EKN2TP5SW8): To understand, in aggregate, how visitors use our site. Loads only after you accept. You can also opt out using Google's opt-out tool, and we honour the Global Privacy Control (GPC) browser signal as an opt-out.
• Essential cookies: To keep you signed in and remember your cookie choice. These set no analytics.
• Visitor counting: A privacy-friendly beacon (a Cloudflare Worker) that records only a per-country daily count of visits; no identifier is stored.

Web fonts: Our pages currently load fonts from Google Fonts, so your browser connects to Google and your IP address is processed by Google to deliver the fonts. We are moving to self-hosted fonts to remove this dependency.

We do not use advertising cookies, retargeting pixels, or social media tracking pixels.

8. Your rights under UK GDPR

If you are in the United Kingdom, you have the following rights over your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your account and the data associated with it.
• Portability: receive your data in a structured, commonly used, machine-readable format.
• Object: object to processing that we carry out on the basis of legitimate interests.
• Restriction: ask us to restrict how we process your data in certain circumstances.
• Withdraw consent: withdraw consent at any time where consent is our lawful basis. This does not affect processing carried out before you withdrew.

To exercise any of these rights, contact us at privacy@markable.life. We will respond within 30 days.

9. International data transfers

MARKABLE Ltd. operates from Israel, which the UK recognises as providing an adequate level of data protection for transfers under the UK GDPR. Where we transfer your data to a country that is not covered by UK adequacy arrangements, we put appropriate safeguards in place, such as the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.

10. Data retention

• Health and wellness information: symptom and cycle-related responses, THINK and SENSE results, and assessment scores are retained while your account is active, or until you ask us to delete it.
• Facial images and facial data: stored in encrypted form only with your consent, and deleted on account deletion or at your request.
• Analytics data: anonymised and aggregated data may be retained indefinitely for product improvement.
• Account data: deleted within 30 days of an account deletion request.

11. Security

We use recognised security measures, including encryption in transit (TLS) and at rest, access controls and authentication, and secure data-processing practices. We keep procedures to detect, report, and respond to personal data breaches, including notifying the Information Commissioner's Office within 72 hours where the UK GDPR requires it. No method of transmission over the internet is completely secure, so while we work hard to protect your data, we cannot guarantee absolute security.

MARKABLE is a general wellness product and is not an NHS organisation. We draw on the security principles used in the NHS Data Security and Protection Toolkit, including encryption in transit and at rest, access controls, data processing agreements with service providers that handle health-related data, and breach-notification procedures.

12. Children's privacy

MARKABLE is designed for adult women in midlife and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will note significant changes on this page, and the "Last updated" date above shows when the policy was last revised.

14. Contact and the ICO

For privacy questions or to exercise your data rights:

• Email: privacy@markable.life
• General contact: hello@markable.life

Data controller: MARKABLE Ltd.