Privacy Policy

1. The information we collect

Information you give us

• Account and contact data: your email address when you join the waitlist or create an account, and any name or profile details you add.
• Health data you log: symptoms, check-ins, HRT and treatment details, supplement information, and quiz or assessment answers. This is sensitive personal information. See the Consumer Health Data Privacy Policy.
• Communications: messages, feedback, and support requests you send us.

Information we collect automatically

• Usage data: basic, non-identifying information about how you use Yellow, such as features opened and session length, used to operate and improve the product.
• Device and log data: app version, device type, and similar technical data needed to run and secure the service.
• Cookies and similar technologies: see our Cookie Policy.

We do not collect precise geolocation.

2. Categories of personal information (CCPA/CPRA)

In the last 12 months we have collected these categories of personal information defined by California law:

• Identifiers: email address, account identifiers.
• Customer records: name, if you provide it.
• Internet or network activity: usage and interaction data.
• Sensitive personal information: health data you log. We use sensitive personal information only to provide the service you asked for and the purposes in Section 3, which are within the uses that do not require an option to limit. We do not use it to infer characteristics about you for any other purpose.

We do not collect biometric data, precise geolocation, government IDs, or financial account numbers.

3. How we use your information

We use personal information to:

• provide, maintain, and secure Yellow and its features;
• show you your own patterns and prepare summaries you choose to share;
• respond to you and provide support;
• send product and service messages you have asked for;
• understand and improve the product, using de-identified or aggregated data where possible; and
• meet legal, security, and safety obligations.

We do not use your health data for advertising.

4. How we share your information

We share personal information only:

• With service providers who run Yellow for us (hosting, storage, authentication, email delivery, and analytics), under contracts that limit them to providing the service and require confidentiality;
• For legal reasons, where required by law or to protect the rights or safety of a person; and
• In a business transfer, if Yellow is involved in a merger or acquisition, in which case we will require the recipient to honour this policy and we will notify you.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California and other US state laws. We do not share your information with insurers, employers, advertisers, or data brokers.

5. Your privacy rights

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• obtain a portable copy;
• opt out of any sale or sharing for advertising (we do not do either);
• limit the use of sensitive personal information (we already limit it to the purposes above); and
• not be discriminated against for exercising any right.

California residents have the rights above under the CCPA/CPRA, including a "Shine the Light" request about disclosures to third parties for their direct marketing (we make none). Residents of other US states with privacy laws (including Virginia, Colorado, Connecticut, Texas, and others) have comparable rights. Health data rights are covered in the Consumer Health Data Privacy Policy.

To exercise any right, use our Privacy Rights Request page or email privacy@spotyellow.com. We will verify your identity and respond within 45 days, with one permitted extension. You may use an authorised agent. If we deny a request, we will tell you how to appeal.

Because we do not sell or share personal information for advertising, we honour opt-out preference signals (such as Global Privacy Control) by default.

6. How long we keep information

We keep personal information for as long as your account is active or as needed to provide Yellow, then delete or de-identify it, except where law requires us to keep limited records. Health data retention is detailed in the Consumer Health Data Privacy Policy.

7. Security

We transmit data over encrypted connections, limit access to those who need it, and follow recognised security practices suited to the sensitivity of the data. No system is perfectly secure, and we cannot guarantee absolute security.

8. International users and data transfer

We are based in India and may process and store your data in India, the United States, and other countries where our service providers operate. These countries may have data-protection laws different from your own. Where we transfer data, we take steps to protect it consistent with this policy and applicable law. By using Yellow, you understand your data may be processed outside your country.

9. Children

Yellow is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children under 18. If you believe a child has given us information, contact privacy@spotyellow.com and we will delete it.

10. Changes to this policy

We may update this policy as Yellow grows. We will change the date above and, for material changes, notify you. For material changes affecting health data, we will obtain consent as described in the Consumer Health Data Privacy Policy.

11. Contact and grievances

• Privacy contact: privacy@spotyellow.com
• General contact: hello@spotyellow.com
• Grievance Officer (India): Chandni Menda, cm@spotyellow.com, 364 C, Pocket J and K, Dilshad Garden, Delhi 110095

We will acknowledge grievances within the timelines required by applicable Indian law.