Privacy Policy

1. Who we are

Peritale is a general wellness product made by MARKABLE Ltd. (“we”, “us”), an Israeli company, company number 517096632, of 93A Kibbutz Galuyot St., Herzliya, Israel. Privacy questions: privacy@peritale.online. We decide how and why your personal data is used, which makes us the controller of it. It is not a medical device. Its results are for your own awareness and for talking with your doctor, and any medical question belongs with your doctor.

• Company: MARKABLE Ltd., Israel.
• Privacy contact: privacy@peritale.online.
• Where it is open: the Peritale mapping in the app is open to people in Israel only at the moment. This website can be read from anywhere. The sections for other regions describe the rights that apply to you there, and they apply if you use Peritale from there.

This policy covers peritale.online and the Peritale app at app.peritale.online. Each region has its own section further down. They add to this text and never take rights away.

2. What we collect, why, who sees it and for how long

Here is the full picture: what we collect, why, who sees it, how long we keep it and what you can choose.

We may also collect small amounts of data you give us in other places, such as a message in the chat or a form. Where we collect something not listed here, we tell you at that moment.

3. Your selfie, photos and voice

This part matters most, so we are specific.

• What happens: in the app you take a still selfie. The app uploads the original and a smaller copy to our storage in Google Cloud. We send the photo to two outside image-analysis companies, Perfect Corp and AILab. They return measurements of your face and skin and images that mark where each was found, and we show them in your mapping. We also keep the result package from Perfect Corp in our Google Cloud storage in the United States.
• Your voice: only if you use daily check-ins, the app records your spoken answer and sends it to Google (Gemini) to be turned into text. The audio stays in our storage until you delete that check-in.
• Not for recognition: we do not use your face or voice to identify you, to sign you in, or to match you with anyone else’s images.
• Consent: before the camera opens, the app asks you to tick a consent box. Some laws treat measurements of face geometry as biometric data even when nobody is being identified. This policy and the biometric notice below therefore describe your selfie as biometric data, in every region.
• Storage: your selfie images are stored with Google’s standard encryption, and are kept until you ask us to delete them. Nothing deletes them automatically today.
• Never sold: we never sell your face or voice data, and we never give it to anyone for their own purposes. Our analysis providers receive your selfie so that they can analyse it for us. We use them under their standard terms.
• Your control: you can withdraw your consent and ask us to delete your images and data at any time. Write to privacy@peritale.online, or use the deletion-request form in the app. Say that you want your images deleted, because deleting an account or scan in our system does not remove the image files by itself today (see “How long we keep data”).

4. How we use your data

We use your health information to run Peritale: to build your mapping, set your baseline, show your progress and prepare your report. If you tick the optional research box, we also use it for research, as described below. We do not sell it and we do not use it for advertising.

We use your information to:

• build your personal mapping and your baseline;
• track how your picture changes when you map again;
• prepare the report you can take to your doctor;
• send you your results, your receipts and, if you ask for them, updates;
• answer your questions and keep the service secure;
• meet our legal duties.

We do not sell your data, build advertising profiles from it, or use it to recognise your face.

5. AI and automated analysis

We use AI and outside image-analysis services to analyse your selfie and your check-in answers and to turn them into measurements, markers and scores.

• Your results are information for you and your doctor. They are not a medical conclusion, and the analysis can be wrong. Talk to your doctor before you act on a result.
• We make no decision about you with legal or similarly significant effect by automated means alone. If you would like a person on our team to look at a result, write to us and we will.
• We do not use your personal data to train general-purpose large language models. We use Perfect Corp, AILab and Google (Gemini) under their standard terms.
• If you tick the research box (next section), we may use your scan data to develop and test our own analysis methods, which can include machine-learning models of our own.

6. Optional: research and product improvement

This is a separate, optional box in the app. Whether you tick it changes nothing about your mapping or your report.

• If you do not tick it: we do not select your data for research. Your selfie is still sent to the analysis providers to build your mapping, as described above, and it is kept as described above.
• If you tick it: we may include your selfie, the measurements from it and your answers in research exports that our team downloads and analyses on its own computers and file storage. A face photo can still identify you, so we treat research copies as personal data and protect them as such. We use them to develop and test our own analysis methods. We may publish findings, only as grouped results that do not identify anyone.
• Withdrawing: write to us at any time. We stop using your data for research and delete your research copy. If a model has already been trained with your data, its training cannot be undone, and we will not use your data for any further training.

7. Who sees your data

We do not sell your data and we do not use it for advertising. Providers process data for us and for the purposes in this policy. We use them under their standard terms.

Beyond providers, your data goes only to:

• People you choose: a doctor or clinic, when you choose to share your report with them.
• Authorities: where the law requires it, on a valid legal request.
• A buyer or partner of our business: if MARKABLE merges or is sold, your data would go to the new owner under this same policy, and we would tell you first.

Session-recording tools in the app: if you accept analytics in the app, FullStory and Heap may record how you use the screens, and that can include screens where you enter or see health information. If you reject analytics, they do not load. We do not use advertising tools on any screen.

8. Sharing your report with your doctor

Your report is yours. We prepare it for you to read, print and take to your doctor.

• A doctor or clinic can see your results and report if you connect them to your account in the app, or if you started Peritale from that doctor’s or clinic’s link. The app records your choice.
• Once a doctor or clinic has your report, their own privacy rules apply to their copy.
• You can ask us to stop the sharing at any time by writing to us. Access we gave stops; a copy already received cannot be taken back.

9. Cookies, analytics and page loading

This website. Nothing for analytics loads until you press Accept on the cookie banner. If your browser sends a Global Privacy Control signal, we treat it as a refusal. You can change your choice at any time with the Cookie settings control, which clears the cookies and reloads the page. Your choice is saved in your own browser and not on our servers.

• Essential: remember your cookie choice. They set no analytics.
• Google Analytics 4 (G-9GKG02ZL9Z): counts, in grouped form, how the site is used. Loads only after you accept. You can also use Google’s opt-out tool.
• Microsoft Clarity: grouped session insights and heatmaps to improve the site. Loads only after you accept. See Microsoft’s privacy statement.
• Visitor counter: a small counter we run ourselves records the page and your country for daily counts, and only after you accept.

The app. The app at app.peritale.online has its own cookie banner. FullStory (session recording) and Heap (usage analytics) load only after you accept, and do not load if you reject. Google Tag Manager loads when the app opens, so Google receives your IP address and browser type before you choose, and the Google tags in it are set to follow Google’s consent mode.

Fonts: when a website page loads, your browser contacts Google Fonts, which sees your IP address and browser type, whatever you choose in the banner.

We do not use advertising cookies, retargeting pixels or social-media tracking pixels. More detail is in our Cookie Policy.

Questions typed into the Peritale questions chat. The Hebrew page at www.peritale.online/ask lets you type a question. To improve the answers, we keep the question text (up to 300 characters), the date without a time, the language and the answer that was shown. Before it is saved, the text is filtered automatically to remove email addresses, links, long numbers such as phone numbers, and a name written after "my name is". We do not keep your IP address, your name or any identifier that links a question to a person. Please do not type identifying details or personal medical details. Questions are stored with Cloudflare, which processes them for us, and are deleted automatically 12 months after the day they were asked. Our team receives an internal daily summary of the most repeated questions through Telegram. Because a saved question cannot be linked to a specific person, we cannot find and delete a question on request. The English answer pages at /answers have no input box and collect nothing beyond the cookie choices described above.

10. Where your data is processed

We are based in Israel, which the European Commission recognises as providing adequate protection for personal data (Decision 2011/61/EU). Our providers store and process data in the United States, Europe and other places, and the image-analysis companies and the sign-in provider work outside Israel. The Cloudflare network runs worldwide. Where a provider’s standard terms include transfer safeguards, those apply today. You can write to us to ask what applies to your data.

11. How long we keep data

This is our retention and destruction schedule, including for selfie images. We have no automatic deletion for selfie images or results yet, so the practical rule is: your data stays until you ask us to delete it.

A deletion request currently removes your records from our database. It does not remove the image files in our cloud storage by itself, and it does not reach copies held by our providers. If you ask us to delete your images, we delete the files by hand and ask our providers to remove their copies. Aggregated results that no longer identify anyone may stay.

12. Security

• Encryption in transit (TLS) and at rest, using our providers’ standard encryption.
• Access limited to the small team that needs it.

If something goes wrong that affects your data, we tell you and the regulators as the law requires. That includes unauthorised disclosure, not only hacking. No system is completely secure, so we cannot promise perfect security.

13. Age: 18 and over

Peritale is for people aged 18 and over. Please do not use it if you are younger. If we learn that someone under 18 has used Peritale, we delete their data. We do not run advertising to under-18s.

14. Your rights and how to use them

Depending on where you live, you can ask us to: tell you what we hold about you and give you a copy; correct it; delete it; give it to you in a portable format; stop or limit certain uses; and withdraw a consent you gave. You can also ask how a score about you was worked out. The section for your region lists the rights your law gives you.

• How: write to privacy@peritale.online, or use the deletion-request form in the app. To delete your images, say so in your request.
• Checking it is you: we may ask for something that shows the request comes from you. We ask for as little as we can.
• When: we answer within 30 days. Where the law allows us more time and we need it, we tell you why.
• Cost: free. If we refuse, we tell you why.
• Someone acting for you: an authorised agent may write on your behalf with your written permission.

We will not treat you worse for using your rights. If you are not satisfied with our answer, see the section for your state below, or contact your state Attorney General.

15. US state privacy rights

This section is for residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, Washington, Nevada and other states with similar laws as they take effect. We apply it to everyone in the United States. The Peritale mapping is not offered in the United States at the moment; this section tells you how your data would be handled.

• Your rights: to confirm whether we process your data and to access it; to correct it; to delete it; to get a portable copy; to withdraw consent; to opt out of sale, targeted advertising and profiling (we do none of these, see below); to limit use of sensitive data (we use it only to provide Peritale and, if you tick the research box, for research); to know the providers we give data to by name (the table in Who sees your data); to ask how a score about you was worked out; and to be treated the same whether or not you use your rights.
• No sale, no advertising use: we do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use health information for advertising.
• Sensitive data: health, selfie, voice and similar data are sensitive. The app asks for your consent before the camera opens. We use the data to provide the service you asked for and, if you tick the research box, for research.
• Global Privacy Control: on our website we treat a Global Privacy Control signal as a valid request to opt out, and as a refusal of analytics cookies.
• How to use your rights: email privacy@peritale.online with the subject “Privacy request”, or use the deletion-request form in the app. We answer within 45 days, and once more within 45 days if we need more time and tell you why.
• Appeal: if we refuse your request, reply to our answer with the subject “Appeal” within 60 days. We answer within 45 days (60 where state law allows) and explain our decision in writing. If you still disagree, you can contact your state Attorney General.
• If something goes wrong: if there is a breach of security of your health information, including an unauthorised disclosure and not only a hack, we notify you and the Federal Trade Commission as the FTC Health Breach Notification Rule requires, without unreasonable delay and no later than 60 days after we discover it, and state authorities as state law requires.
• Training of AI models: see AI and automated analysis. We do not use personal data to train general-purpose large language models.

16. California notice at collection

Notice at collection. Over the last 12 months we collected the categories in this table. Retention periods are in the Retention section. We do not sell personal information and we do not share it for cross-context behavioral advertising.

• Sensitive personal information: we use health and biometric-type information only to provide the service you request, so there is no “Limit the Use of My Sensitive Personal Information” link. You can still tell us to delete it.
• Your California rights: to know, delete, correct, opt out of sale and sharing (we do neither) and limit sensitive information, without being treated worse. Write to privacy@peritale.online; we answer within 45 days, plus 45 more if we tell you why.
• Medical information: California's Confidentiality of Medical Information Act can treat apps like ours as handling medical information. We do not disclose it without your written authorization, which is the separate sharing consent, except as the law allows.
• Shine the Light: we do not disclose personal information to third parties for their direct marketing.
• Do Not Track: we do not change how the site works in response to Do Not Track signals. On our website, analytics cookies stay off until you accept, and we honour Global Privacy Control.
• Under 16: Peritale is for adults only.

17. Biometric information notice

This section is our biometric notice for Illinois, Texas, Washington, Colorado and other states, and we apply it to everyone in the US. The selfie mapping is not offered in the United States at the moment; this notice tells you how it works so that you know before it opens.

• What we record: a still selfie, which two outside providers, Perfect Corp and AILab, analyse. They measure features of your face and skin, and the results can include where facial features and skin regions sit on the photo. If you use daily check-ins, we also record your spoken answers. We do not use these measurements to identify you, and we do not compare them with other people’s images. Whether such measurements count as biometric identifiers under each state’s law is a legal question. Because the answer may differ by state, we describe them here as biometric data.
• Your consent: before the camera opens, the app shows a consent box that you tick. That tick is your electronic consent to taking and analysing the selfie. This notice is where the providers, the purposes and the retention are explained.
• Why: only to build your mapping and report. Research use happens only if you tick the research box.
• Retention and destruction: we have not set an automatic destruction date. Selfie images, and the face and skin measurements stored with them, are kept until you ask us to delete them. How a deletion request works today is explained in “How long we keep data”.
• No sale or profit: we never sell, lease, trade or otherwise profit from your biometric data.
• Disclosure: to Perfect Corp and AILab, which analyse the selfie; to our hosting and storage providers; to our research team if you ticked the research box; to the extent the law requires; or with your consent.
• Illinois: the selfie mapping is not offered in Illinois at the moment.

18. Consumer Health Data Privacy Policy (Washington, Nevada, Connecticut)

Our Consumer Health Data Privacy Policy is a separate page, as the Washington My Health My Data Act, the Nevada consumer health data law and the Connecticut consumer health data provisions ask. It covers the consumer health data we collect, why, who we share it with, and how to access it, withdraw consent or ask for deletion. It applies to everyone in the United States and is effective from 24 October 2026.

19. European Economic Area

The Peritale mapping is currently open in Israel only. It is not offered in the European Economic Area, and we have not appointed an EU representative. If you are in the EEA and you use this website or write to us, you can ask us about your data at privacy@peritale.online. Israel is recognised by the European Commission as providing adequate protection for personal data. You can complain to the data protection authority of your country.

20. Changes to this policy

We may update this policy. For a significant change we post a notice on the site and in the app, and the date at the top shows the latest version. If a change needs your consent, we ask for it again.

21. Contact us

• Privacy questions and requests: privacy@peritale.online
• General contact: hello@peritale.online

Controller: MARKABLE Ltd., Israel.