1. Introduction
Glianomics Pvt Ltd ("Glianomics", "we", "us", "our"), operating the TRACKT platform, is committed to protecting your personal data and respecting your privacy rights. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use the TRACKT application and associated services ("Service").
TRACKT is a behavioral wellness support platform designed for individuals managing their health, habits, and routines — including users on GLP-1 therapy. Given the sensitive nature of the data we process, we have designed this policy in line with India's Digital Personal Data Protection Act 2023 ("DPDP Act"), consistent with the Digital Personal Data Protection Rules 2025 ("DPDP Rules", as and when operative provisions commence), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ("SPDI Rules"), and applicable data protection laws in other jurisdictions where users access the Service.
Our use of cookies and similar tracking technologies is described in our Cookie Policy, which forms part of this overall privacy framework.
Please read this Policy carefully. By registering an account, you acknowledge that you have read and understood this Policy.
2. Who We Are
Data Fiduciary (India) / Data Controller (applicable jurisdictions): Glianomics Pvt Ltd
21/1306 (2), SOMAN NAGAR, Karamana, Thiruvananthapuram-695002, Kerala, India
Email: privacy@glianomics.com
Grievance Officer: Bishnu Ravi Kesavan, Co-Founder, Glianomics Pvt Ltd
Email: grievance@glianomics.com
Available: Monday–Friday, 10:00 AM – 6:00 PM IST
Data Protection Contact (EU/GDPR applicable users): Bishnu Ravi Kesavan
Email: dpo@glianomics.com
[Note: formal DPO appointment deferred to EU launch — confirm scope with Legal]
3. Categories of Personal Data We Collect
3.1 Data You Provide Directly
- Account information: name, email address, date of birth (for age verification), and profile details
- Demographic information: age, gender (optional)
- Health and lifestyle inputs: weight, body metrics, meals, mood, sleep, activity logs, and medication schedules (user-reported)
- Interactions with the AI Coach and in-app communication features
3.2 Data Collected Automatically
- Device and system data: device type, operating system, app version, device identifiers
- Usage logs and interaction patterns: features used, session duration, response timing
- Approximate location derived from IP address (country/region level only)
- Cookies, pixel tags, and similar tracking technologies — see our Cookie Policy for details of the types of cookies used, their purpose, and how to manage your preferences
3.3 Sensitive Personal Data or Information (SPDI)
Under Rule 3 of the IT (SPDI) Rules 2011, the following data collected by TRACKT is classified as Sensitive Personal Data or Information and receives the highest level of protection:
| SPDI Category | Data Collected by TRACKT |
|---|---|
| Health and medical records | Weight, body metrics, medication schedules, GLP-1 therapy data, behavioral health logs |
| Biometric data | HRV, sleep patterns, activity metrics (via wearable integrations) |
| Passwords | Account authentication credentials |
You have the right to decline to provide SPDI. Where SPDI is required for core functionality (e.g., behavioral tracking), declining to provide it will limit the features available to you.
3.4 Data from Third-Party Integrations
TRACKT may receive data from third-party health platforms and wearable devices (Apple Health, Google Health, Samsung Health, connected wearables) that you choose to integrate. This data may include HRV readings, sleep data, step counts, and other biometric inputs.
You acknowledge that: (a) such data may contain inaccuracies, delays, or gaps; (b) Glianomics does not control or warrant the accuracy of data received from third-party integrations; and (c) AI outputs generated using this data may be affected by its quality.
3.5 Inferred and Derived Data
TRACKT's systems generate wellness indicators and behavioral patterns derived from your inputs. These derived outputs are used to provide personalized support features within the application. They represent informational interpretations of your interaction patterns and are not medical conclusions or clinical assessments.
4. How We Use Your Data — Purpose and Legal Basis
We process your personal data only for specific, defined purposes. The table below sets out each processing purpose, the data used, whether it is mandatory or optional, and the legal basis under DPDP Act 2023 and applicable law.
| Processing Purpose | Data Categories | Mandatory / Optional | Legal Basis (DPDP Act) | Legal Basis (GDPR, where applicable) |
|---|---|---|---|---|
| Account creation and authentication | Account data | Mandatory | Consent §6 | Contract Art 6(1)(b) |
| Delivery of core behavioral wellness features | All personal data | Mandatory for core service | Consent §6 | Contract Art 6(1)(b) |
| Processing of health and SPDI data for wellness analysis | SPDI, behavioral data | Mandatory for wellness features | Explicit Consent §6 | Explicit Consent Art 9(2)(a) |
| Safety monitoring and harmful output prevention | Usage logs, behavioral data | Mandatory | Consent (§6); DPDP §7(h) for medical-emergency subset — responding to a threat to life or immediate threat to health | Vital Interests Art 9(2)(c) |
| Personalized feature calibration (individual profile only) | Interaction patterns | Mandatory for personalization | Consent §6 | Contract Art 6(1)(b) |
| Research and analytics using de-identified aggregate data | Anonymised data | Optional — Opt-in required | Separate Consent §6 | Explicit Consent Art 9(2)(a) |
| Service improvement using anonymised data | Anonymised data only | Optional — Opt-in required | Separate Consent §6 | Explicit Consent Art 9(2)(a) |
| Marketing and promotional communications | Contact data | Optional — Opt-in required | Separate Consent §6 | Consent Art 6(1)(a) |
| Notifications and service communications | Contact data | Optional (required for reminders) | Consent §6 | Consent Art 6(1)(a) |
| Cookie-based analytics and tracking | Cookie/device data | Optional — Opt-in required where applicable | Consent §6 | Consent Art 6(1)(a) |
| Legal obligation compliance | As required | Mandatory | DPDP Act §7(c) — compliance with any judgment, decree or order, or any law for the time being in force in India | Legal Obligation Art 6(1)(c) |
5. Consent Architecture
TRACKT operates on a layered, purpose-specific consent model in compliance with DPDP Act 2023 §6 and DPDP Rules 2025. Consent is free, specific, informed, unconditional, and given through a clear affirmative action.
Consent Layer 1 — Core Service (Mandatory): Collected at account registration via acceptance of Terms of Use. Covers account creation and core service delivery.
Consent Layer 2 — Health Data Processing (Mandatory for wellness features): A separate in-app consent screen presented before first use of health tracking features. Covers collection and processing of SPDI. Each data category (weight, medication, sleep, etc.) is individually disclosed. You may decline individual categories, which will limit corresponding features.
Consent Layer 3 — Research and Analytics (Optional — Opt-in): A separate opt-in consent for use of your de-identified, aggregated data for research, system analytics, and general service improvement. Pre-ticked boxes are not used. You may opt in or out at any time through Privacy Settings.
Consent Layer 4 — Marketing Communications (Optional — Opt-in): A separate opt-in for marketing and promotional communications. Independent of Layers 1–3.
Consent Layer 5 — Cookies and Tracking (Optional — Opt-in where required): Managed through the in-app cookie consent interface and detailed in our Cookie Policy.
All consents are: timestamped, linked to the policy version in effect at the time of consent, stored securely, and independently withdrawable without affecting other consents or core service access.
Multilingual Consent Notices. In accordance with the DPDP Rules 2025, consent notices are available in English. You may request a consent notice in any of the 22 languages listed in the Eighth Schedule of the Constitution of India by contacting privacy@glianomics.com. We will provide the notice in your preferred language without undue delay.
Consent Manager. TRACKT is designed to be compatible with the Consent Manager framework established under the DPDP Rules 2025. As this framework is operationalized by the Data Protection Board, we will update our consent infrastructure to support Consent Manager-mediated consent where applicable.
6. AI Processing and Personalization
6.1 AI in TRACKT. TRACKT uses AI systems to analyze your behavioral patterns and generate personalized insights, nudges, and recommendations. These systems are designed to be non-clinical and non-authoritative. Details of how these systems function at a technical level are proprietary and not disclosed in this policy.
6.2 Personalization vs. Model Training. Your interaction patterns with TRACKT are used to calibrate the behavioral nudges and suggestions you receive. This calibration occurs within your individual profile. Your personal data is not used to train AI or machine learning models that are shared across users. Only aggregate, de-identified data — which cannot reasonably be used to re-identify you — may be used for general service improvement, and only with your separate opt-in consent under Layer 3 above.
6.3 AI Output Limitations. AI outputs may be incomplete, inconsistent, or incorrect. All outputs are non-prescriptive and should not be relied upon for medical or clinical decisions.
6.4 Automated Processing. Some TRACKT features involve automated processing to generate wellness indicators and recommendations. These outputs are for informational purposes only and do not produce legally binding decisions. You may raise a grievance with the Grievance Officer if you believe an AI-generated output is inaccurate, inappropriate or has adversely affected you. This right operates through the grievance mechanism under §13 of the DPDP Act 2023.
8. Data Retention
Retention periods are set out in full in our Data Retention & Erasure Policy.
For the purposes of this Policy, 'Archived User Data' means personal data that is no longer actively used for the primary purpose for which it was collected but is retained in a restricted-access archive pending deletion at the applicable retention period end.
For a detailed schedule of retention periods applicable to each category of personal data, please refer to our Data Retention & Erasure Policy available at [URL — to be inserted] or on request at privacy@glianomics.com.
We retain your personal data for as long as is necessary for the purposes for which it was collected, or as required by applicable law, regulatory obligation or legitimate legal proceedings. When personal data is no longer required, we delete or anonymise it, or where this is not possible (for example, because your personal data has been stored in backup archives), we securely store your personal data and isolate it from any further processing until deletion is possible.
Upon account deletion, your personal data will be queued for deletion within a reasonable period, except where retention is required by law or legal proceedings. See the Data Retention & Erasure Policy for full details and how to request erasure.
9. Your Rights as a Data Principal / Data Subject
Depending on the laws applicable to you, you have the following rights. To exercise any right, contact privacy@glianomics.com with proof of identity. We will respond within 30 days of receiving your verified request.
| Right | Description | Basis |
|---|---|---|
| Right to Access | Obtain a copy of your personal data held by Glianomics | DPDP Act §11; GDPR Art 15 |
| Right to Correction | Request correction of inaccurate or incomplete data | DPDP Act §12; GDPR Art 16 |
| Right to Erasure | Request deletion of your personal data | DPDP Act §12; GDPR Art 17 |
| Right to Withdraw Consent | Withdraw any consent at any time without affecting prior processing | DPDP Act §6; GDPR Art 7(3) |
| Right to Data Portability | Receive your data in a machine-readable format | GDPR Art 20 (applicable users) |
| Right to Object | Object to processing based on legitimate interest | GDPR Art 21 (applicable users) |
| Right to Restrict Processing | Restrict processing in certain circumstances | GDPR Art 18 (applicable users) |
| Right to Nominate | Nominate a representative to exercise your rights in the event of your death or incapacity | DPDP Act §14 (India users) |
| Right to raise a Grievance regarding AI-generated outputs | You may raise a grievance with the Grievance Officer if you believe an AI-generated output is inaccurate, inappropriate or has adversely affected you. This right operates through the grievance mechanism under §13 of the DPDP Act 2023. Note: the DPDP Act 2023 does not provide a standalone right to automated-decision review equivalent to GDPR Article 22. | DPDP Act §13 (grievance redressal) |
Exceptions: Some rights may be subject to legal exceptions (e.g., legal hold obligations, fraud prevention). We will notify you of any applicable exception at the time of your request.
Escalation: If you are not satisfied with our response, you may lodge a complaint with:
- India: Data Protection Board of India under DPDP Act §27 (complaint filing procedures are published by the Board at its official portal)
- Applicable jurisdiction: Your competent data protection supervisory authority
10. Security
We implement technical and organisational security measures appropriate to the nature and sensitivity of the data we process. These include:
- Industry-standard encryption of data at rest and in transit
- Role-based access control with least-privilege principle
- Multi-factor authentication for privileged system access
- No developer access to identifiable production data; anonymised datasets used for development and testing
- Secure cloud infrastructure
- Continuous monitoring and audit logging, retained in accordance with our security policy
- Regular vulnerability assessments and penetration testing
- Incident response procedures including regulatory notification capability
For full details, see our Internal Security & Data Protection Policy (available on request at privacy@glianomics.com).
11. Data Breach Notification
In the event of a personal data breach:
- We will notify CERT-In within 6 hours of becoming aware of a cyber security incident, as required under the CERT-In Directions 2022
- We will notify the Data Protection Board of India and affected Data Principals in accordance with the timelines and procedures prescribed under the DPDP Act 2023 and DPDP Rules 2025
- Where GDPR applies, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
- We maintain an internal breach register in accordance with applicable legal requirements
12. International Data Transfers
Your data is stored on cloud infrastructure. Where your data is transferred to or accessed from outside India, Glianomics ensures that appropriate safeguards are in place in accordance with applicable law. For transfers from India, we comply with the cross-border transfer requirements under the DPDP Act 2023 and DPDP Rules 2025, including in relation to countries or territories notified by the Central Government.
For users where GDPR or equivalent legislation applies: transfers of your personal data outside your jurisdiction are made subject to appropriate transfer safeguards as required by applicable law. You may request details of the transfer mechanisms in use by writing to privacy@glianomics.com.
13. Children's Privacy
Age Restriction. TRACKT is not intended for individuals under 18 years of age.
Verifiable Parental Consent. In accordance with DPDP Act 2023 §9 and DPDP Rules 2025, we will not process personal data of a child (defined as an individual under 18 years) without obtaining verifiable consent from the child's parent or lawful guardian. We implement age-verification measures at registration for this purpose.
Prohibitions. We do not engage in behavioral monitoring, targeted profiling, or behavioral advertising directed at minors.
Discovery of Minor Accounts. If we discover that a user is under 18 and parental consent has not been properly obtained, we will suspend the account and initiate deletion of the data associated with that account, in accordance with the DPDP Rules 2025.
Parental Rights. A parent or lawful guardian may exercise data rights (access, correction, erasure) on behalf of a child by contacting privacy@glianomics.com with appropriate verification.
14. Changes to This Policy
Non-material changes (contact detail updates, formatting, clarifications that do not alter the substance of processing): We will provide reasonable advance notice via update of the "Effective Date" and an in-app notification.
Material changes (new data categories, new processing purposes, new third-party sharing, changes that are less protective of your rights): We will provide advance notice via email to your registered address and in-app notification before the change takes effect. Your affirmative re-consent will be required where the change requires it under applicable law. If you do not consent to a material change, you may close your account and request data deletion.
15. Grievance Officer and Contact
For privacy queries, data rights requests, or complaints:
Grievance Officer: Bishnu Ravi Kesavan, Co-Founder, Glianomics Pvt Ltd
Address: 21/1306 (2), SOMAN NAGAR, Karamana, Thiruvananthapuram-695002, Kerala, India
Email: grievance@glianomics.com
Privacy Queries: privacy@glianomics.com
EU/GDPR Contact: dpo@glianomics.com
Available: Monday–Friday, 10:00 AM – 6:00 PM IST
If you are not satisfied with the outcome of your grievance, you may escalate to the Data Protection Board of India under DPDP Act §27, or to your applicable supervisory authority.