Privacy Notice

1. About this notice

This notice tells you what personal data Bélletique collects, why we use it, who sees it, how long we keep it, and what choices and rights you have under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules).

Who we are. Bélletique ("we", "us", "our") is a skincare education and community platform available at belletique.in and in our app. It is operated by Marlin Medical Assistance Pvt Ltd (CIN: U33110DL2018PTC403930), registered office F 14, Upper Ground Floor, Shaheenbagh, New Delhi 110025. We decide why and how your personal data is used, so we are the "Data Fiduciary" under the DPDP Act.

Who this notice covers.

• Members: anyone aged 13 or above who creates a Bélletique account. If you are under 18, your parent's or lawful guardian's verified consent is needed before your account becomes active.
• Doctors: registered medical practitioners who answer questions and share expert content after we verify their registration.
• Parents and lawful guardians: they do not need a full account. They use a secure one-time link (the Parent Consent Portal) to approve, review or withdraw consent for their child.
• Visitors: people who browse belletique.in without signing up.

Bélletique is not for children under 13. If we learn that a person under 13 has given us data, we delete it.

This is a standalone notice. It is not part of our Terms of Use, and we show it to you before we ask for any consent. Where this notice and the short consent screens in the app differ, the more protective one applies to you.

Effective date: October 12, 2026 · Version: 1.1 · Earlier versions are archived and available on request.

2. Key terms used in this notice

3. Personal data we collect

We collect only what each feature needs. Some of it you give us, some comes from a parent, and a small part is collected automatically.

Things to know

• We do not collect payment card details. Payments are handled by our payment gateway, Payments from product launch: provider to be named before launch, under its own privacy policy.
• If you invite a friend, we use the link you share only to credit your reward. We do not collect your friend's contact details.
• Skin concerns you choose are not medical diagnoses. Please do not share medical records, prescriptions or other people's personal data in posts or questions.
• We do not ask members about disability and we do not infer it.
• Doctors' registration numbers are checked against the relevant medical register and are never shown publicly.

4. Why we use your data and on what basis

Most of what we do rests on your consent, or your parent's or lawful guardian's consent if you are under 18 or have a lawful guardian. Each purpose below has its own notice and its own unticked checkbox, shown when the data is first requested. You can withdraw any of them at any time.

Uses that do not need consent. The DPDP Act allows a few "legitimate uses" under Section 7. We rely on only these:

• sending account, security and service messages that you cannot opt out of, using data you gave us for that purpose;
• keeping records the law requires us to keep, such as tax and order records; and
• responding to a court order, summons or lawful request from an authority.

We do not rely on any other legitimate use. Each one is recorded in our internal Record of Processing Activities with the reason it applies.

What we do not do. We do not sell personal data. We do not use your data for a purpose other than the one you consented to. Our service providers may not use your data for their own purposes, including advertising, profiling or model training. We do not show targeted advertising to anyone under 18; our advertising is aimed at adults and parents.

5. Members under 18 and lawful guardians

We handle the data of members under 18 with extra care. Under Section 9 of the DPDP Act and Rule 10 of the DPDP Rules, we must obtain verifiable consent from a parent or lawful guardian before processing a child's personal data.

How a teen account is set up

1. Every member gives their birth month and year first. We use it only to check whether parental consent is needed. If the result is under 13, we show a neutral "Bélletique isn't available yet" message and store nothing.
2. For members aged 13 to 17, the account stays pending. While pending, we keep only the birth month and year, the teen's email or mobile number, a temporary first name, and the parent's email or mobile number. The teen cannot post, track, ask questions or earn rewards.
3. We send the parent a one-time link, valid for 72 hours, that names Bélletique and the teen's first name and explains why consent is needed.
4. The parent confirms they are an adult through a method allowed by the DPDP Rules. Today this includes a one-time password sent to the parent's mobile number or email. We are moving to age confirmation through a government-backed virtual token such as DigiLocker, where we receive only a "yes, adult" result and not the ID document or ID number. We will update this notice when that changes. A parent's own statement that they are the parent is recorded but is never enough on its own.
5. The parent declares they are the child's parent or lawful guardian, then chooses each feature separately: account and profile, community posts and photos, Ask a Doctor, Journey tracker, rewards, skincare emails and app notifications.
6. If consent is not completed within 7 days, we erase all the pending data.

Our promises for members under 18

• No tracking or behavioural monitoring, and no targeted advertising.
• No product offers and no sale of data.
• Content suggestions are based only on the skin type and concerns the teen chooses, not on browsing behaviour.
• Photos are reviewed by our moderators before they appear publicly. Please do not show faces or identifying features.
• Doctors see a teen's first name and age range only, never contact details.
• Non-essential cookies stay off for teen accounts.
• A parent can ask for a monthly or on-demand summary of the data we hold about their child.

Parent controls. At any time, through the Parent Consent Portal link, a parent or lawful guardian can review the child's data, change any consent choice, withdraw consent for one feature or all of them, or close the account. Full withdrawal closes the account and erases the data as set out in Section 9.

When a member turns 18. On the first login after the 18th birthday we ask the member for their own consent. Until they give it, the parent's consent continues. Parent access ends once the member consents.

Members with a lawful guardian. If a member has a lawful guardian appointed by a court or under the Rights of Persons with Disabilities Act, 2016 or the National Trust Act, 1999, the guardian gives consent and exercises rights in the same way as a parent. We verify the court order or the certificate from the designated authority and keep a reference to it, not a copy of any medical record. To set this up, write to helpdesk@marlinmedicalassistance.com.

6. Your consent and how to withdraw it

How we ask. We ask for consent in a short notice on the screen where the data is first requested. Each notice stands on its own, names the data and the purpose, links to this policy and gives a contact for questions. Each purpose has a separate, unticked checkbox or toggle. We do not bundle consents together or pre-tick them. You can use the free preview before registering without giving consent for any feature.

Withdrawing is as easy as giving. Go to Settings → Privacy & Data → Manage consents. Every consent you gave is listed with a toggle. Parents use the same list in the Parent Consent Portal. You do not need to give a reason.

Parent Consent Portal. Parents use the link we emailed or texted them. Lost it? Email helpdesk@marlinmedicalassistance.com.

Withdraw consent or request account deletion without logging in

What happens when you withdraw. Before you confirm, we show what the choice will cost you:

Our target is to stop the processing within 2 working days and to erase the related data as described in Section 9. Withdrawal does not affect processing that already happened lawfully, and it does not remove data we must keep by law, such as order and tax records. We will tell you what is kept and for how long.

Consent records. We record who consented, to which notice and version, when, and through which channel. For a teen member we also link the parent's consent record. We archive each version of every notice so we can show exactly what you agreed to.

Consent Managers. We do not use a registered Consent Manager today. Our consent records are stored in a structured form so that we can connect to one without asking everyone to consent again.

7. Who sees or receives your data

We do not sell personal data, and we do not share it for anyone else's marketing. Your data is seen by the following.

Our service providers. They act only on our written instructions under a data processing agreement. They may not use your data for their own purposes, may not track or advertise to children, must keep it secure, must tell us quickly about any breach, and must delete it when we tell them to. Current categories are:

• cloud hosting, database and media storage: Lovable Cloud / Supabase (hosting and database)
• email and notification delivery: [EMAIL PROVIDER NAME], Internal Notification
• identity and age verification for parents and Doctors: Twilio
• analytics, for adult users only: Clarity, Google Analytics
• payments, from product launch: provider to be named before launch
• customer support tools: Email

We keep an up-to-date list of provider categories and will give you the named list on request to helpdesk@marlinmedicalassistance.com.

Staff access. Only Bélletique team members who need data for their job can reach it, under role-based access. For example, our verification team sees Doctor credentials, our moderation team sees posts and photos awaiting review, and our support team sees what is needed to help you. Access is logged.

Please be careful in public spaces. Anything you post publicly can be seen, copied or screenshotted by other members. Do not post your full name, school, address, phone number or other people's personal data.

8. Transfers outside India

Some of our service providers store or process data on servers outside India. Under Section 16 of the DPDP Act, we transfer personal data only to countries the Government of India has not restricted, and only to providers bound by a signed agreement that requires equivalent protection.

• Where your data is stored today: USA, Lovable. We update this list when it changes.
• India first. Where a provider offers an India region at a reasonable cost, we prefer it, especially for the data of members under 18.
• Same rules abroad. Every overseas provider is bound by the same limits as in India, including the ban on tracking or advertising to children.
• Change of location. A provider must tell us 30 days before moving data to a new country, and we reassess before we agree.
• If a country becomes restricted. We stop transfers to it, move the data within 30 days, and tell affected users if their data was involved.

We check the Government's list of restricted countries every quarter and whenever a new notification is issued.

9. How long we keep your data and how we erase it

We keep each kind of data only as long as it is needed for the purpose you gave it for, or as the law requires. We then erase it from live systems within 30 days and from backups within 90 days.

Inactive accounts. If you have not logged in for 3 years, we will erase your account. At least 48 hours before we do, we send a notice to you (and to the parent of a teen account) so you can log in to keep it.

Pause for legal reasons. If data is needed for a pending legal claim, an investigation or a court order, we suspend erasure for that data only, and resume when the need ends.

How we erase. We delete records from our live database and media storage, including original and resized photos. We remove them from search indexes, caches and email lists, instruct our service providers to delete their copies and obtain written confirmation, and let backups expire on their normal cycle without restoring erased data. Where full deletion is not possible, we make the data anonymous so that no person can be identified.

10. How we protect your data

We take reasonable security safeguards, as Section 8(5) of the DPDP Act requires, to prevent a personal data breach.

• Encryption of data in transit and at rest.
• Role-based access, so staff see only what their job needs, and multi-factor authentication for staff accounts.
• Access logs, kept for at least one year to detect and investigate misuse.
• Pre-moderation of photos from members under 18 and restricted staff access to children's data.
• Written agreements with every service provider, covering security, confidentiality and breach reporting.
• Training for everyone who handles personal data, and a named person responsible for compliance.

No system is completely secure. Please choose a strong, unique password, do not share your login or one-time codes, and tell us at once if you think your account has been misused.

If something goes wrong. If a personal data breach affects you, we will tell you without delay, in plain language: what happened, what data was involved, the likely consequences, what we have done, and what you can do. For a teen member, we also tell the parent. We report every breach to the Data Protection Board of India, with a detailed report within 72 hours of becoming aware of it.

11. Your rights and duties

You (or your parent or lawful guardian, if you are under 18 or have a lawful guardian) have these rights over your personal data. We charge no fee.

Whatever the request, our final answer will come no later than 90 days after you make it.

How to make a request

Nominate someone

Make a request

• In the app: Settings → Privacy & Data (Download my data, Edit, Delete account, Manage consents, Nominate).
• Parents: through the Parent Consent Portal link.
• Email helpdesk@marlinmedicalassistance.com, or write to Marlin Medical Assistance Pvt Ltd, Registered address: F 14, Upper Ground Floor, Shaheenbagh, New Delhi 110025.

We log every request within 1 working day and send you a ticket number. We confirm it is really you using your logged-in account, a one-time code to your registered email or mobile, or the parent's secure link, and we never ask for more ID than we need. If we cannot do what you ask, we tell you why, and that you can approach the Data Protection Board of India.

Your duties. The law asks you to give accurate information, not to impersonate anyone, not to hide material facts, and not to file false or frivolous complaints. Please enter your real birth month and year.

12. Grievance Officer and the Data Protection Board

For any question about how we use your personal data, or to make a complaint or exercise a right, contact our Grievance Officer:

If you're unhappy with how we handled your data or a request, contact our Grievance Officer: [name, email and postal address]. We reply within [90 days] at most. If we don't, or you're not satisfied with our answer, you can complain to the Data Protection Board of India. [Add the Board's contact details once confirmed.]

Complaint to the Data Protection Board of India. Please contact us first. If you are not satisfied with our response, or we have not replied in time, you may complain to the Data Protection Board of India under the DPDP Act.

13. Cookies, languages and changes to this notice

Cookies. We use only strictly necessary cookies by default, such as keeping you logged in and remembering your cookie choices. Preference, analytics and marketing cookies stay off until you switch them on. For members under 18, and for visitors whose age we do not know, marketing cookies are never offered and analytics cookies stay off. You can change your choice any time through Cookie settings in the footer or Settings → Privacy & Data in the app. Our Cookie Policy lists each cookie, its provider and its lifetime.

Languages and accessibility. This notice and every consent notice are available in English now and in Hindi (more languages from the Eighth Schedule as our user base grows), all languages listed in the Eighth Schedule to the Constitution. You choose your language at sign-up and can change it in Settings. If a translation differs from the English text, tell us and we will correct it. Where the two differ, English governs.

Changes to this notice. We will tell you in the app and by email before any significant change takes effect. If a change needs fresh consent, we will ask for it, and for teen members we ask the parent. Earlier versions are archived and available on request.

Contact. Questions about this notice: helpdesk@marlinmedicalassistance.com. Post: Marlin Medical Assistance Pvt Ltd, F 14, Upper Ground Floor, Shaheenbagh, New Delhi 110025.