Privacy Notice (India): Digital Personal Data Protection Act, 2023

What we process and why

We process the personal data described in our Privacy Policy: your email and account details, the health and symptom data you log, and basic usage data. We process it to provide and improve Yellow, to communicate with you, and to keep the service secure and lawful. We process your data for these specified purposes only.

The basis for processing: your consent

We process your personal data on the basis of your consent, or for certain legitimate uses permitted by the DPDP Act. When we ask for consent, we do so through a clear request, in plain language, describing the personal data and the purpose. You may give or refuse consent freely.

Withdrawing consent

You can withdraw your consent at any time, as easily as you gave it. To withdraw, use your account settings or email [email protected]. Withdrawing consent does not affect processing done before withdrawal. After you withdraw, we will stop the relevant processing and delete or de-identify your data unless the law requires us to keep it.

Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Access a summary of the personal data we process about you and the processing activities.
• Correction and completion of inaccurate or incomplete data, and updating of your data.
• Erasure of your personal data, subject to legal retention requirements.
• Grievance redressal through the channel below.
• Nominate another person to exercise your rights in the event of death or incapacity.

To exercise any right, email [email protected] or use our Privacy Rights Request page. We will respond within the timelines required by law.

Your duties

The DPDP Act asks Data Principals not to file false or frivolous grievances and to provide accurate information when you assert your rights or where verified identity is required.

Children

Yellow is for adults and is not directed to anyone under 18. We do not knowingly process the personal data of children. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

Sharing and processors

We share personal data only with service providers (Data Processors) who process it on our behalf under contract, as described in our Privacy Policy. We do not sell personal data.

Transfer outside India

We may process and store data with service providers located outside India, including in the United States. We do so consistent with the DPDP Act and applicable restrictions, and we protect the data to the standards in our policies.

Security and breach notification

We maintain reasonable security safeguards to protect personal data. If a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act.

Retention

We keep personal data only as long as needed for the purposes above or as the law requires, then erase or de-identify it.

Grievance Officer

If you have a concern about how we handle your personal data, contact our Grievance Officer:

• Name: Chandni Menda
• Email: [email protected]
• Address: 364 C, Pocket J and K, Dilshad Garden, Delhi 110095

We will acknowledge and respond to grievances within the period required by the DPDP Act and its rules. If you are not satisfied, you may escalate to the Data Protection Board of India.

Changes

We may update this notice as the law and our practices evolve. We will change the date above and, for material changes, notify you.