Privacy Policy

1. Who We Are

Peritale is a general wellness self-awareness and self-tracking companion for women in midlife, operated by MARKABLE Ltd. ("we", "us", "our"). Peritale is a general wellness product, not a medical device. It does not diagnose, prevent, manage, treat or cure any disease or condition, including any hormonal or menopause-related condition.

For the purposes of the Digital Personal Data Protection Act 2023 (the "DPDP Act"), MARKABLE Ltd. is the Data Fiduciary that decides how and why your personal data is processed. You, as the individual whose data we process, are the Data Principal. This policy applies to the Peritale service at peritale.online and the Peritale application at app.peritale.online.

2. What We Collect

We collect the following categories of personal data:

Information you provide

• Account information: Email address, name (optional) and age range.
• Wellness self-report data: Your symptom selections from our wellness questionnaire across areas such as sleep, mood, energy and comfort.
• THINK and SENSE check data: Performance results from brief cognitive and sensory self-check exercises, such as response times and accuracy scores.
• Communications: Messages you send us by email or through our contact and support channels.

Information collected automatically

• Device information: Browser type, operating system and screen resolution.
• Usage data: Pages visited, time on the service and referral source.
• Cookies: Analytics cookies for service improvement (see Section 8).

3. Your Selfie and Facial Data

This section is important. We want to be completely transparent about how your facial image is handled.

• Sensitive personal data: The facial geometry derived from your selfie is treated as sensitive personal data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ("SPDI Rules"), and is processed only on the basis of your explicit consent.
• Processing: Your selfie is analysed to extract numerical wellness data points (such as texture, tone and volume values) that contribute to your wellness picture.
• Image storage: Your facial image is stored in encrypted form, only if you consent, so that your wellness picture can be generated and tracked over time across multiple reads. You may withdraw this consent and request deletion of your stored images at any time.
• Never sold: Your facial data is never sold, traded, rented or made available to any third party.
• No facial recognition: We do not use your image for facial recognition, identity verification or any purpose other than generating your wellness picture.

4. How We Use Your Data

We use your personal data to:

• Generate your personal wellness picture and track how it moves over time when you do multiple reads.
• Create the summary you can choose to bring to your doctor.
• Improve our wellness models, using de-identified, aggregated data only.
• Send you your results and, if you opt in, occasional wellness updates.
• Respond to your questions and support requests.
• Meet our legal obligations under applicable Indian law.

We do not use your data to sell to third parties, build advertising profiles, perform facial recognition, or make any medical diagnosis. Peritale does not diagnose, prevent or manage any condition.

5. Consent and Notice

Under the DPDP Act, we process your personal data on the basis of your free, informed, specific and unambiguous consent, given through a clear affirmative action. Before or at the time we ask for your consent, we give you a plain-language notice describing the personal data we seek, the purpose of processing, how you can exercise your rights, and how you can complain to the Data Protection Board of India.

For your selfie and facial geometry, and for any other sensitive personal data, we ask for your separate, explicit consent. You may withdraw your consent at any time, as easily as you gave it, by contacting us or using the controls in your account. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Where you withdraw consent, we will stop the related processing and delete the relevant data unless we are required to retain it by law.

6. Who We Share Data With

We share data only with:

• Data Processors (service providers): Hosting (Cloudflare Pages), analytics (Google Analytics 4 and Microsoft Clarity, which load only after you consent), web fonts (currently served by Google Fonts), and payment processing. These providers process data on our behalf under binding contractual obligations and only on our instructions.
• At your direction: When you choose to share your wellness summary with a healthcare provider.
• Legal requirements: When required by Indian law, court order or a valid request from a lawful authority.

7. Website Visitor Beacon

Our website pages send a lightweight visitor beacon to a Cloudflare Worker so that we can understand overall site activity. This beacon records only the pathname of the page visited (for example, "/in/privacy-policy"). It does not collect your name, email, IP-based identity or any other personal data, and it is not used to profile or identify you.

8. Cookies and Analytics

Analytics run only after you accept them in our cookie banner. Until you choose to accept, no analytics cookies are set: our consent mechanism (Google Consent Mode) defaults to denied. A "Cookie settings" control on every page lets you change or withdraw your choice at any time. We use:

• Google Analytics 4 (measurement ID G-9GKG02ZL9Z): To understand, in aggregate, how visitors use our site. It loads only after you consent, and collects de-identified usage data. You can also opt out using Google's opt-out tool.
• Microsoft Clarity: Aggregated, anonymised session insights and heatmaps that help us improve usability. It loads only after you consent. See Microsoft's privacy statement.
• Essential cookies: To remember your cookie consent preference and login state. These set no analytics.

Web fonts: Our pages currently load fonts from Google Fonts, so your browser connects to Google and your IP address is processed by Google to deliver the fonts. We are moving to self-hosted fonts to remove this dependency.

We do not use advertising cookies, retargeting pixels or social media tracking pixels.

9. Your Rights as a Data Principal

Under the DPDP Act, as a Data Principal you have the right to:

• Access: Obtain a summary of the personal data we process about you and the processing activities.
• Correction and updating: Request correction, completion or updating of your personal data.
• Erasure: Request deletion of your personal data where it is no longer needed for the purpose it was collected.
• Withdraw consent: Withdraw your consent at any time, as easily as you gave it.
• Grievance redressal: Have your grievance addressed by us through a readily available means (see Section 10).
• Nominate: Nominate another person to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact us at privacy@peritale.online. We will respond within the timelines required under applicable Indian law.

10. Grievance Redressal

We have appointed a Grievance Officer to address any concern you have about how we handle your personal data, in keeping with the DPDP Act and the SPDI Rules. You may contact our Grievance Officer at privacy@peritale.online (subject line: "Grievance Officer, Peritale India"). We aim to acknowledge your grievance promptly and resolve it within the period prescribed under applicable Indian law.

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India.

11. Data Retention

• Wellness data: Retained while your account is active, or until you request deletion.
• Facial images: Stored in encrypted form only with your consent while your account is active, and deleted on account deletion or on your request.
• Analytics data: De-identified, aggregated data may be retained for product improvement.
• Account data: Deleted within 30 days of an account deletion request, except where retention is required by law.

12. Security

We follow reasonable security practices and procedures as required under the DPDP Act and the SPDI Rules, including:

• Encryption in transit (TLS) and at rest.
• Access controls and authentication.
• Regular security reviews.
• Secure data processing practices.

No method of transmission over the Internet is fully secure. While we work hard to protect your data, we cannot guarantee absolute security.

13. Cross-Border Transfers

MARKABLE Ltd. operates from Israel, and some of our service providers process data outside India. Where your personal data is transferred outside India, we do so in accordance with the DPDP Act and put appropriate safeguards in place to protect it.

14. Children's Data

Peritale is intended for adult women and is not designed for use by anyone under 18. We do not knowingly process the personal data of children. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any significant changes on this page and update the "Last updated" date above.

16. Contact Us

For privacy questions, to exercise your rights, or to reach our Grievance Officer:

• Privacy and grievances: privacy@peritale.online
• General contact: hello@peritale.online

Data Fiduciary: MARKABLE Ltd.