Privacy Policy

Last updated: 22 October 2026 · Version 2026.10.22

The short version

Peritale is made by MARKABLE Ltd., an Israeli company. It is a general wellness product for your own awareness and for talking with your doctor.
To build your mapping we collect a short face video and photos, your voice, your task results (cognition, hearing, vision) and your answers about symptoms, cycle, medications and hormone therapy. This is health information, and we protect it that way.
We use it to build your mapping and your report. We never sell it, and we never use it for advertising.
Only providers that work for us under contract see it, plus the doctor or clinic you choose to give your report to. The section "Who sees your data" names them.
Recordings from the mapping are deleted automatically 30 days after upload. Your results stay in your account until you delete them. You can ask us to delete your data at any time.
Research use is a separate, optional yes. Analytics cookies stay off until you accept them. You can change either choice at any time.

1. Who we are

Peritale is a general wellness product made by MARKABLE Ltd. (“we”, “us”), an Israeli company. We decide how and why your personal data is used, which makes us the controller of it. It is not a medical device. Its results are for your own awareness and for talking with your doctor, and any medical question belongs with your doctor.

Company: MARKABLE Ltd., Israel. Registered address: [TO CONFIRM: registered address]. Company number: [TO CONFIRM: registration number].
Privacy contact: privacy@peritale.online.
Privacy officer: [TO CONFIRM: name or external service of the privacy officer / DPO].

This policy covers peritale.online, the mapping flow and the Peritale app at app.peritale.online. Each region has its own section further down. They add to this text and never take rights away.

2. What we collect, why, who sees it and for how long

Everything is optional except what the mapping itself needs. Here is the full picture in one table: what we collect, why, who sees it, how long we keep it and what you can choose.

Your account

What we collect: Email address, name, and how you sign in (Google, Facebook, Apple or email). From a social sign-in we keep your name and email address. We do not use or show your profile picture.
Why: To create your account, sign you in and send your results and receipts.
Who sees it: Us and our sign-in and hosting providers.
How long: While your account is active. Deleted within 30 days after you ask us to delete it.
Your choices: You can sign in again or delete your account at any time.

Age

What we collect: Your birth month and year. We ask for it before anything else.
Why: To confirm that you are 18 or over.
Who sees it: Us.
How long: Kept with your account. If you are under 18 we stop and keep nothing except a note that the screen was not passed.
Your choices: You can decline, and then Peritale cannot be used.

Face video and photos

What we collect: A short video of your face, recorded with its sound, and still photos taken from it. Our software measures features of your face and skin, such as tone, texture and the shape and position of facial features.
Why: To build your mapping.
Who sees it: Us, our hosting and storage providers, and image-analysis providers that work for us (named below). Our research team downloads working copies to analyse them.
How long: Mapping recordings are deleted automatically 30 days after upload. Working copies are deleted within [TO CONFIRM: 30] days after analysis. In the app, selfie scans are kept while your account is active and deleted no later than [TO CONFIRM: 12 months] after your last use, or when you ask.
Your choices: You decide to take part before the camera starts. You can withdraw and ask for deletion at any time.

Voice

What we collect: Short voice recordings (reading aloud, speaking, repeating sounds) and spoken answers to questions.
Why: To measure the voice tasks and to turn your spoken answers into text for your report.
Who sees it: Us, our hosting providers, and Google, which turns spoken answers into text.
How long: Voice clips from the mapping: 30 days. Spoken answers are processed and not stored by us. The text result stays with your results.
Your choices: You can type instead of speaking.

Task results: cognition, hearing, vision

What we collect: Your reaction speed, word retrieval and attention results, and your short hearing and vision samples.
Why: To build your mapping and your baseline.
Who sees it: Us and our hosting providers.
How long: While your account is active. Without an account, in your own browser until you clear it.
Your choices: You can skip a task.

Symptoms, cycle, medications, hormone therapy

What we collect: Your answers for comprehensive symptom mapping, cycle information, medications and supplements (typed, spoken, or from a photo of the box or label), hormone-therapy history, daily check-ins and meals you log.
Why: To build your mapping, your report and your progress over time.
Who sees it: Us, our hosting providers, and Google, which reads spoken answers and photos for us. A drug name and strength (nothing else) is looked up in the US National Library of Medicine drug database.
How long: While your account is active, then deleted as above.
Your choices: You can skip any question. You can edit or delete your entries.

Scores and inferences

What we collect: Scores and ranges we work out from the above, such as your stage band and your top symptoms.
Why: To show your results and your progress.
Who sees it: Us and our hosting providers.
How long: Same as your results.
Your choices: You can ask how a score was worked out. A person on our team will explain it.

Your report

What we collect: The summary we build for you to read, print or take to your doctor.
Why: For you.
Who sees it: You, and anyone you choose to give it to.
How long: Same as your results.
Your choices: You decide if, when and with whom you share it.

Technical data

What we collect: Browser and device type, screen size, camera name, language, approximate country, and your IP address.
Why: To make the camera and microphone work, to keep the service secure and to limit abuse.
Who sees it: Us and our hosting providers.
How long: Your IP address is used for abuse limits for about one hour. Server logs follow our host's own log schedule.
Your choices: Needed to run the service.

Reminder email

What we collect: Your email address, the time and the topic, if you ask for a reminder.
Why: To send the reminder you asked for.
Who sees it: Us and our email provider.
How long: Until the reminder is sent, and for no more than 7 days after it is due if sending fails. You can cancel with the link in the email.
Your choices: Optional.

Messages to us

What we collect: Your name, email, message and the page you wrote from, if you use the contact form or chat on the website.
Why: To answer you.
Who sees it: Us and our form and email providers.
How long: [TO CONFIRM: retention period for support messages]
Your choices: Optional.

Payment

What we collect: Payment is handled by our payment provider [TO CONFIRM: payment processor name]. We receive the payment status and the plan you chose.
Why: To take payment and keep your subscription.
Who sees it: Us and the payment provider.
How long: As tax and accounting law requires.
Your choices: Optional.

We may also collect small amounts of data you give us in other places, such as a message in the chat or a form. Where we collect something not listed here, we tell you at that moment.

3. Your face video, photos and voice

This part matters most, so we are specific.

What happens: during the mapping you record a short video of your face with sound and we take photos from it. Our software measures features of your face and skin and turns them into wellness markers. In the app, a selfie scan is analysed by image-analysis services run by our providers.
Your voice: we use your voice to measure the speech tasks and to turn your answers into text.
Not for recognition: we do not use your face or voice to identify you, to sign you in, or to match you with anyone else's images.
Consent first: before the camera or microphone starts, we ask for your separate, explicit yes. Some laws treat measurements of face geometry as biometric data even when nobody is being identified. We therefore apply biometric-grade protections to everyone, in every region.
Storage: recordings from the mapping are stored encrypted by our hosting provider and deleted automatically 30 days after upload. Working copies that our research team downloads to analyse a recording are deleted within [TO CONFIRM: 30] days after analysis.
In the app: selfie scans (the original and a smaller copy) are kept while your account is active, and deleted when you delete your account, when you ask, or [TO CONFIRM: 12 months] after your last use, whichever comes first.
Never sold: we never sell your face or voice data, and we never give it to anyone for their own purposes. Providers process it only for us, under contract, and may not use it to train their own models.
Your control: you can withdraw your consent and ask us to delete your recordings at any time. Use your privacy choices page or write to us with the code shown at the end of your mapping.

4. How we use your data

We use your health information only to run Peritale: to build your mapping, set your baseline, show your progress and prepare your report. We do not sell it and we do not use it for advertising.

We use your information to:

build your personal mapping and your baseline;
track how your picture changes when you map again;
prepare the report you can take to your doctor;
send you your results, your receipts and, if you ask for them, reminders and updates;
answer your questions and keep the service secure;
meet our legal duties.

We do not sell your data, build advertising profiles from it, or use it to recognise your face. We collect only what the mapping needs, and we review each question for whether it is needed.

5. AI and automated analysis

We use AI to analyse your face video, photos, voice and answers, and to turn them into markers and scores. The voice that guides you through the mapping is AI-generated.

Your results are information for you and your doctor. They are not a medical conclusion, and the analysis can be wrong. Talk to your doctor before you act on a result.
We make no decision about you with legal or similarly significant effect by automated means alone. If you would like a person on our team to look at a result, write to us and we will.
We do not use your personal data to train general-purpose large language models, and our providers may not use your content to train theirs.
If you say yes to research use (next section), we may use your recordings to develop and test our own analysis methods, which can include machine-learning models of our own.

6. Optional: research and product improvement

This is a separate yes, off unless you turn it on. Saying no changes nothing about your mapping or your report.

If you say no: we use your recordings only to build your mapping, and delete them 30 days after upload.
If you say yes: we may keep a copy of your recordings and answers for research and product improvement. In that copy your name and email are removed and replaced with a code. A face and voice recording can still identify you, so we treat research copies as personal data and protect them as such. We use them to develop and test our own analysis methods. We may publish findings, only as grouped results that do not identify anyone.
Withdrawing: you can withdraw at any time on your privacy choices page or by writing to us. We stop using your recordings for research and delete your research copy. If a model has already been trained with your data, its training cannot be undone, and we will not use your data for any further training.

We do not sell your data and we do not use it for advertising. Providers process data only for us, under written contracts, and only for the purposes in this policy. They are not allowed to use your content for their own purposes.

Type of provider	Who	What they receive	Where
Hosting, storage and delivery	Cloudflare (website, mapping flow, 30-day recording storage; a global network); Google Cloud and Firebase (app servers and scan storage); Neon (app database)	Everything you give us in Peritale, as needed to run it	United States, Europe and a global network
Sign-in	Supabase	Your email, name and sign-in session	[TO CONFIRM: Supabase region]
AI analysis	Google (Gemini) for spoken answers, medication photos and meal photos; PerfectCorp and [TO CONFIRM: name of second selfie-analysis vendor] for selfie scans in the app	Voice, photos and answers sent for analysis	United States and elsewhere
Voice read-back	Google Cloud Text-to-Speech	Short lines of text that we read aloud to you	United States and elsewhere
Email	Resend	Your email address, and the reminder or receipt	United States
Contact form	Formspree	Name, email, message and page	United States
Research team file storage	Microsoft (OneDrive)	Working copies of recordings while we analyse them	[TO CONFIRM: region]
Analytics (only after you accept)	Google Analytics, Microsoft Clarity, and a visitor counter we run ourselves	Pages visited, device type and approximate location	United States and global
Page delivery	Google Fonts and, in the mapping flow, jsDelivr	Your IP address and browser type when a page loads	Global
Payment	[TO CONFIRM: payment processor]	Payment details you enter, and the payment status	[TO CONFIRM: region]

Beyond providers, your data goes only to:

People you choose: a doctor or clinic, when you choose to give them your report.
Authorities: where the law requires it, on a valid legal request. We ask for valid legal process, and we tell you about a request where the law allows.
A buyer or partner of our business: if MARKABLE merges or is sold, your data would go to the new owner under this same policy, and we would tell you first.

We do not use advertising or session-replay tools on any screen where you enter or see health information.

8. Sharing your report with your doctor

Your report is yours. We prepare it for you to read, print and take to your doctor.

We give it to a doctor or clinic only when you choose to, and only to the person you choose. Each time you share, we ask for a separate, specific yes.
Once a doctor or clinic has your report, their own privacy rules apply to their copy.
You can stop sharing at any time. Access we gave stops; a copy already received cannot be taken back.

9. Cookies, analytics and page loading

Nothing for analytics loads until you press Accept on the cookie banner. If your browser sends a Global Privacy Control signal, we treat it as a refusal. You can change your choice at any time with the Cookie settings control, which clears the cookies and reloads the page. Your choice is saved in your own browser and not on our servers.

Essential: remember your cookie choice and keep you signed in. They set no analytics.
Google Analytics 4 (G-9GKG02ZL9Z): counts, in grouped form, how the site is used. Loads only after you accept. You can also use Google's opt-out tool.
Microsoft Clarity: grouped session insights and heatmaps to improve the site. Loads only after you accept. See Microsoft's privacy statement.
Visitor counter: a small counter we run ourselves records the page and your country for daily counts, and only after you accept.

Fonts and code libraries: when a page loads, your browser contacts Google Fonts and, in the mapping flow, jsDelivr (which serves the library that tracks your face on your own device). They see your IP address and browser type. We are moving both onto our own servers.

We do not use advertising cookies, retargeting pixels or social-media tracking pixels. More detail is in our Cookie Policy.

10. Where your data is processed

We are based in Israel, which the European Commission recognises as providing adequate protection for personal data (Decision 2011/61/EU). Our providers store and process data on infrastructure in the United States, Europe, Israel and other places, and the Cloudflare network runs worldwide. Where the law requires a transfer safeguard, we use approved ones, such as standard contractual clauses. You can ask us for a copy of the safeguards that apply to you.

11. How long we keep data

This is our retention and destruction schedule, including for face and voice data. We delete data when the purpose is met, at the latest at the time shown, or sooner when you ask.

Data	How long	Delete it sooner
Mapping recordings (video, voice clips, photos, session data)	Deleted automatically 30 days after upload.	Ask us, with the code from your mapping.
Working copies for analysis	Deleted within [TO CONFIRM: 30] days after analysis.	Ask us.
Research copies (only if you said yes)	Until you withdraw, or until [TO CONFIRM: end of research programme / retention period].	Withdraw on your privacy choices page.
Selfie scans in the app	Deleted [TO CONFIRM: 12 months] after your last use at the latest.	Delete the scan or the account.
Results, answers and report	While your account is active. Without an account, in your browser until you clear it.	Delete in the app, or ask us.
Account data (email, name)	Deleted within 30 days after you ask us to delete your account.	Delete your account.
Reminder email	Until sent, and no more than 7 days after it is due.	Cancel link in the email.
Consent records	Kept for [TO CONFIRM: period] so we can show what you agreed to.	Not deletable while the law requires proof of consent.
Website analytics	[TO CONFIRM: Google Analytics and Clarity retention settings]	Cookie settings.
Backups	[TO CONFIRM: backup retention]

A deletion request removes the data from our systems and asks our providers to remove their copies. Aggregated results that no longer identify anyone may stay.

12. Security

Encryption in transit (TLS) and at rest, using our providers' standard encryption.
Access limited to the small team that needs it.
Your results open only with your private link or your sign-in.
Research copies are kept apart from your name and email.
Written terms with each provider that handles your data.

If something goes wrong that affects your data, we tell you and the regulators as the law requires. That includes unauthorised disclosure, not only hacking. No system is completely secure, so we cannot promise perfect security.

13. Age: 18 and over

Peritale is for people aged 18 and over. Before the mapping we ask for your birth month and year to confirm this. If you are under 18, we stop and do not keep your answers. If we learn that someone under 18 has used Peritale, we delete their data. We do not run advertising to under-18s.

14. Your rights and how to use them

Depending on where you live, you can ask us to: tell you what we hold about you and give you a copy; correct it; delete it; give it to you in a portable format; stop or limit certain uses; and withdraw a consent you gave. You can also ask how a score about you was worked out. The section for your region lists the rights your law gives you.

How: write to privacy@peritale.online. If you mapped without an account, add the 6-character code shown at the end of your mapping, so we can find your recording. You can also use your privacy choices page.
Checking it is you: we may ask for something that shows the request comes from you. We ask for as little as we can.
When: we answer within 30 days. Where the law allows us more time and we need it, we tell you why.
Cost: free. If we refuse, we tell you why.
Someone acting for you: an authorised agent may write on your behalf with your written permission.

We will not treat you worse for using your rights. If you are not satisfied with our answer, see the section for your state below, or contact your state Attorney General.

15. US state privacy rights

This section is for residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, Washington, Nevada and other states with similar laws as they take effect. We apply it to everyone in the United States.

Your rights: to confirm whether we process your data and to access it; to correct it; to delete it; to get a portable copy; to withdraw consent; to opt out of sale, targeted advertising and profiling (we do none of these, see below); to limit use of sensitive data (we use it only to provide Peritale); to know the providers we give data to by name (the table in Who sees your data); to ask how a score about you was worked out; and to be treated the same whether or not you use your rights.
No sale, no advertising use: we do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use health information for advertising.
Sensitive data: health, face, voice and similar data are sensitive. We process them only with your consent and only to provide the service you asked for.
Global Privacy Control: we treat a Global Privacy Control signal as a valid request to opt out, and as a refusal of analytics cookies.
How to use your rights: email privacy@peritale.online with the subject “Privacy request”. We answer within 45 days, and once more within 45 days if we need more time and tell you why. [TO CONFIRM: second request method such as a web form, if required in a state]
Appeal: if we refuse your request, reply to our answer with the subject “Appeal” within 60 days. We answer within 45 days (60 where state law allows) and explain our decision in writing. If you still disagree, you can contact your state Attorney General.
If something goes wrong: if there is a breach of security of your health information, including an unauthorised disclosure and not only a hack, we notify you and the Federal Trade Commission as the FTC Health Breach Notification Rule requires, without unreasonable delay and no later than 60 days after we discover it, and state authorities as state law requires.
Training of AI models: see AI and automated analysis. We do not use personal data to train general-purpose large language models.

16. California notice at collection

Notice at collection. Over the last 12 months we collected the categories in this table. Retention periods are in the Retention section. We do not sell personal information and we do not share it for cross-context behavioral advertising.

Category	Examples	Source	Purpose	Disclosed to (service providers)	Sold / Shared for ads
Identifiers and contact data	Email, name, sign-in details, IP address, device identifiers	You; your device	Run your account and the service; security	Hosting, sign-in and email providers	No / No
Age	Birth month and year	You	Confirm you are 18 or over	None	No / No
Sensitive: health information	Symptoms, cycle, medications, hormone-therapy history, task results (cognition, hearing, vision), check-ins, scores	You; your device	Build your mapping and report only	Hosting and AI-analysis providers (named above)	No / No
Sensitive: biometric-type information	Measurements from your face and voice recordings	You; your device	Build your mapping only; research only if you say yes	Hosting and image-analysis providers	No / No
Audio and visual data	Face video, photos, voice recordings	You	Build your mapping	Hosting and analysis providers	No / No
Inferences	Scores, stage band, top symptoms	Worked out by us	Show your results and progress	Hosting providers	No / No
Internet activity	Pages visited, cookie choice, analytics events (only after you accept)	Your browser	Improve the site	Analytics providers	No / No
Commercial information	Plan chosen, payment status	You; payment provider	Take payment	Payment provider	No / No
Approximate location	Country, worked out from your IP address. We do not collect precise location.	Your connection	Security and daily counts	Hosting providers	No / No

Sensitive personal information: we use health and biometric-type information only to provide the service you request, so there is no “Limit the Use of My Sensitive Personal Information” link. You can still tell us to delete it.
Your California rights: to know, delete, correct, opt out of sale and sharing (we do neither) and limit sensitive information, without being treated worse. Write to privacy@peritale.online; we answer within 45 days, plus 45 more if we tell you why.
Medical information: California's Confidentiality of Medical Information Act can treat apps like ours as handling medical information. We do not disclose it without your written authorization, which is the separate sharing consent, except as the law allows.
Shine the Light: we do not disclose personal information to third parties for their direct marketing.
Do Not Track: we do not change how the site works in response to Do Not Track signals. Our analytics cookies stay off until you accept, and we honour Global Privacy Control.
Under 16: Peritale is for adults only.

17. Biometric information notice

This section is our biometric notice and retention policy for Illinois, Texas, Washington, Colorado and other states, and we apply it to everyone in the US.

What we record: a face video, photos and voice recordings. Our software measures features of your face and skin. We do not use these measurements to identify you, and we do not compare them with other people's images. Whether such measurements count as biometric identifiers under each state's law is a legal question. Because the answer may differ by state, we treat them with the strictest protection everywhere.
Your written release: before the camera and microphone start, we ask for your separate electronic written release. It states what we collect, why, and how long we keep it.
Why: only to build your mapping and report. Research use happens only if you separately say yes.
Destruction schedule: face and voice recordings, and the measurements stored with them, are deleted 30 days after upload. In the app, selfie scans are deleted when the purpose is met and no later than [TO CONFIRM: 12 months] after your last use. [TO CONFIRM: engineering to confirm whether any face-geometry template or landmark set persists beyond these periods]
No sale or profit: we never sell, lease, trade or otherwise profit from your biometric data.
Disclosure: only to providers who process it for us, to the extent the law requires, or with your consent.
Illinois: [TO CONFIRM: company decision, with the legal basis settled: Illinois law lists a “scan of face geometry” as a biometric identifier, excludes photographs, and lets a person sue (recovery limited to once per person since August 2024). Either full compliance for Illinois users (written electronic release before the camera, a public retention and destruction schedule), or the face and voice steps are not offered in Illinois]

18. Consumer Health Data Privacy Policy (Washington, Nevada, Connecticut)

Our Consumer Health Data Privacy Policy is a separate page, as the Washington My Health My Data Act, the Nevada consumer health data law and the Connecticut consumer health data provisions ask. It covers the consumer health data we collect, why, who we share it with, and how to access it, withdraw consent or ask for deletion. It applies to everyone in the United States and is effective from 22 October 2026.

19. European Economic Area

DRAFT PLACEHOLDER: pending Revital's decision. Remove this box before publishing.

Decision needed: either (A) Peritale is not offered to people in the European Economic Area, and sign-up and payment are blocked there, or (B) Peritale is offered in the EEA and we appoint an EU representative.

If A, publish this sentence: “Peritale is currently offered in Israel, the United Kingdom, the United States, Hong Kong, India and Singapore. It is not offered in the European Economic Area.”

If B, publish this text: “If you are in the European Economic Area, our EU representative is [TO CONFIRM: representative name, address, email]. We process your health information on the basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) of the GDPR) and, for your account and payment, to perform our contract with you (Article 6(1)(b)). You can withdraw consent at any time. Israel is recognised by the European Commission as providing adequate protection; where we use providers elsewhere we use standard contractual clauses. You have the rights of access, rectification, erasure, restriction, portability and objection, and you can complain to the data protection authority of your country.”

20. Changes to this policy

We may update this policy. For a significant change we post a notice on the site and in the app, and the date at the top shows the latest version. If a change needs your consent, we ask for it again.

21. Contact us

Privacy questions and requests: privacy@peritale.online
General contact: hello@peritale.online
Privacy officer: [TO CONFIRM: name or service]

Controller: MARKABLE Ltd., Israel. [TO CONFIRM: registered address]

Contents