Privacy Policy

1. Who we are

Peritale is a perimenopause wellness companion for women in midlife, operated by MARKABLE Ltd. ("we", "us", "our"). Peritale is a general wellness product, not a medical device. It is not intended to diagnose, treat, cure, or prevent any disease or medical condition.

For the purposes of UK data protection law, MARKABLE Ltd. is the data controller responsible for your personal information. This policy explains how we collect, use, store, and protect your personal data when you use Peritale at peritale.online and our application at app.peritale.online.

2. What we collect

Information you provide

• Account information: email address, name (optional), and age range.
• Symptom and wellness data: your selections from our symptom questionnaire.
• THINK and SENSE data: performance results from brief cognitive and sensory wellness exercises, such as reaction time and accuracy scores.
• Facial wellness read: a selfie you choose to take, processed into facial geometry data (see Section 3).
• Communications: messages you send us by email or through our contact forms.

Information collected automatically

• Device information: browser type, operating system, and screen resolution.
• Usage data: pages visited, time on site, and the source that referred you.
• Cookies and a privacy-friendly visitor beacon: see Section 7.

3. Your facial wellness read

This section is important, and we want to be completely transparent about how your facial image is handled.

• What it is: your selfie is analysed to produce biometric facial geometry, a set of numerical wellness data points. Under the UK GDPR, this facial geometry is special category (biometric) data, so we ask for your separate, explicit consent before we capture it.
• Storage: your facial image and the data derived from it are encrypted and stored only if you give consent, so that we can generate your wellness picture and track how it moves over time across multiple reads.
• Your control: you can withdraw your consent and request deletion of your stored images and facial data at any time.
• No facial recognition: we do not use your image for facial recognition, identity verification, or any purpose other than your wellness read.
• Never sold: your facial data is never sold, and it is never shared with or made available to third parties for their own purposes.

4. How we use your data

We use your information to:

• generate your personal Peritale wellness picture;
• track your wellness patterns over time when you complete more than one read;
• create a summary you can take to your GP or another healthcare professional;
• improve our models and algorithms using anonymised, aggregated data only;
• send you your results and, if you opt in, wellness updates;
• respond to your questions and support requests;
• comply with our legal obligations.

We do not use your data to sell to third parties, build advertising profiles, perform facial recognition, or make any medical diagnosis.

5. Lawful bases for processing

Under the UK GDPR and the Data Protection Act 2018, we rely on the following lawful bases:

• Consent (Article 6(1)(a), and Article 9(2)(a) for special category data): for your facial wellness read, other health-related wellness data, and optional wellness communications. You can withdraw your consent at any time.
• Performance of a contract (Article 6(1)(b)): to provide the Peritale service you have asked for, including any subscription you take out.
• Legitimate interests (Article 6(1)(f)): to improve and secure the product and prevent fraud, where these interests do not override your rights.
• Legal obligation (Article 6(1)(c)): where processing is required by applicable UK law.

6. Who we share data with

We do not sell, trade, or rent your personal information to anyone. We share data only with:

• Service providers (processors): hosting on Cloudflare Pages, with the application served from app.peritale.online; analytics (Google Analytics 4 and Microsoft Clarity, which run only after you accept analytics cookies); web fonts (currently served by Google Fonts); and payment processing. These providers act on our behalf under written contracts that require them to protect your data.
• At your direction: when you choose to share your wellness summary with a GP or other healthcare professional.
• Legal requirements: when required by UK law, court order, or a valid request from a public authority.

7. Cookies, analytics and our visitor beacon

Analytics run only after you accept them in our cookie banner. Until you choose to accept, no analytics cookies are set: our consent mechanism (Google Consent Mode) defaults to denied, in line with PECR and the UK GDPR. A "Cookie settings" control on every page lets you change or withdraw your choice at any time. We keep tracking to a minimum, and we do not use advertising cookies, retargeting pixels, or social media tracking pixels.

• Essential cookies: to remember your cookie consent choice and your login state. These set no analytics.
• Google Analytics 4 (measurement ID G-9GKG02ZL9Z): to understand, in aggregate, how visitors use the site so we can improve it. It loads only after you consent, and you can also opt out using Google's opt-out tool.
• Microsoft Clarity: aggregated, anonymised session insights and heatmaps that help us improve usability. It loads only after you consent. See Microsoft's privacy statement.
• Visitor beacon: when you load a page, your browser sends the page path (pathname only) to a Cloudflare Worker we operate. This is used purely to keep a daily count of visits. It carries no personal data, no name, no email, and no profile. It is not used to identify or track you across the web.

Web fonts: our pages currently load fonts from Google Fonts, so your browser connects to Google and your IP address is processed by Google to deliver the fonts. We are moving to self-hosted fonts to remove this dependency.

8. Your rights under UK GDPR

If you are in the United Kingdom, you have the following rights over your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your account and the data associated with it.
• Portability: receive your data in a structured, commonly used, machine-readable format.
• Object: object to processing that we carry out on the basis of legitimate interests.
• Restriction: ask us to restrict how we process your data in certain circumstances.
• Withdraw consent: withdraw consent at any time where consent is our lawful basis. This does not affect processing carried out before you withdrew.

To exercise any of these rights, contact us at privacy@peritale.online. We will respond within 30 days.

9. International data transfers

MARKABLE Ltd. operates from Israel, which the UK recognises as providing an adequate level of data protection for transfers under the UK GDPR. Where we transfer your data to a country that is not covered by UK adequacy arrangements, we put appropriate safeguards in place, such as the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.

10. Data retention

• Wellness data: retained while your account is active, or until you ask us to delete it.
• Facial images and facial data: stored in encrypted form only with your consent, and deleted on account deletion or at your request.
• Analytics data: anonymised and aggregated data may be retained indefinitely for product improvement.
• Account data: deleted within 30 days of an account deletion request.

11. Security

We use recognised security measures, including encryption in transit (TLS) and at rest, access controls and authentication, and secure data-processing practices. We keep procedures to detect, report, and respond to personal data breaches, including notifying the Information Commissioner's Office within 72 hours where the UK GDPR requires it. No method of transmission over the internet is completely secure, so while we work hard to protect your data, we cannot guarantee absolute security.

12. Children's privacy

Peritale is designed for adult women in midlife and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will note significant changes on this page, and the "Last updated" date above shows when the policy was last revised.

14. Contact and the ICO

For privacy questions or to exercise your data rights:

• Email: privacy@peritale.online
• General contact: hello@peritale.online

Data controller: MARKABLE Ltd.