Effective Date: October 5, 2026
This policy explains what personal data PREDICT collects, why, who else sees it, how long we keep it, and what you can ask us to do about it.
It is written to be accurate about what our systems actually do today, rather than to describe an ideal. Where a control is not yet built, this policy says so instead of implying it exists.
PREDICT is a brand owned and operated by Control Age Health Pvt. Ltd., a company incorporated in India.
For the purposes of the Digital Personal Data Protection Act, 2023 (India) we are the Data Fiduciary for the personal data described in this policy. For the purposes of the EU General Data Protection Regulation, where it applies to you, we are the Controller.
Contact for all privacy matters, including grievances:
Website: https://predict.fit
| Surface | What happens there |
|---|---|
| The public website at predict.fit | Marketing pages, the biomarker library, and the waitlist form |
| The waitlist form | Collects a name and an email address so we can tell you when we launch |
| In-clinic bookings | When our staff book an appointment for someone without a PREDICT account yet, they record a name and a phone number and/or email so the appointment can be created — see §4 |
| A PREDICT account | The signed-in product: your profile, uploaded reports, biomarker values, wearable data, appointments and AI conversations |
Your use of PREDICT is also governed by our Terms & Conditions.
This section is the notice required by DPDP §§5–6 and by GDPR Article 13, and it is deliberately specific rather than general.
| Field | Required? | Where it comes from |
|---|---|---|
| Email address | Yes | You type it into the form |
| Name | No — you may leave it blank | You type it into the form |
We do not ask for, and the waitlist form does not collect, any health information. No biomarker value, no medical history, no test result. It is a name and an email address.
One purpose: to contact you about early access to PREDICT and to tell you when we launch. We do not use waitlist data to profile you, to build an advertising audience, or for any purpose other than that contact.
Your email address and name are sent to and stored by Resend, our email service provider, as a marketing contact. Resend processes this data outside India and outside the EEA. Resend stores it on our behalf; it is not sold or licensed to anyone.
Until you ask us to remove it, or until we decide the waitlist has served its purpose and close it — whichever is first. We do not currently run an automatic deletion timetable for waitlist entries. If you want yours gone, ask us and we will remove it.
Email and ask to be removed from the waitlist. We will delete the contact record. Withdrawing is free, requires no account, and no reason has to be given. Marketing emails we send will also carry an unsubscribe link.
India (DPDP): your consent, given by reading this notice and ticking the unticked consent checkbox below it before submitting the form — we record that you agreed, to what notice, and when, and that record is kept even after you withdraw, because withdrawal does not unmake the lawfulness of what we already did while you had agreed. EU/EEA (GDPR): consent under Article 6(1)(a). Because the waitlist collects no health information, we do not treat it as special category data under Article 9 — but joining a waitlist for a health product is context, and if you would rather not be on it, see How to withdraw above.
There is no public enquiry form or advertising-campaign form on predict.fit today. If you are reading this section looking for one, it does not exist — the only way to join our mailing list from the website is the waitlist form described in §3.
The one related flow that does exist is staff-entered, not self-service: if you visit or call one of our clinics and book an appointment before you have created a PREDICT account, our staff record your name and phone number and/or email address in our own database so the appointment can be created and so we recognise you if you later create an account, rather than creating a second record. Purpose: creating and managing that appointment. Basis: your consent, given to our staff at the point of booking.
You can ask us to delete this record at any time by emailing .
If PREDICT ever launches a public enquiry or campaign form, this section will be rewritten to describe it — including any attribution information such a form would collect — before that form ships, not after.
PREDICT asks for your consent before Google Analytics 4 runs, and it never runs on your signed-in dashboard at all, regardless of what you consented to.
A cookie banner appears the first time you visit a marketing or content page — the homepage, this policy, the biomarker library, the blog. It offers exactly two choices, Accept analytics and Reject analytics, equally prominent, one click each. Nothing loads and no cookie is set until you choose. If you leave without choosing, nothing is recorded and you are asked again on your next visit.
What Google Analytics receives, only if you accept, and only on those marketing/content pages: the addresses of the pages you visit, an analytics identifier stored in your browser, your approximate location derived from your IP address, and technical information about your device and browser.
What it never receives, whatever you choose: your name, your email address, your phone number, your uploaded reports, your biomarker values, your wearable data, or anything you type into the Predict AI assistant. We do not send health data to any advertising or analytics provider, and we do not use health data for advertising.
On your signed-in PREDICT dashboard, Google Analytics does not run, ever. We withhold the
tag entirely on every /dashboard, /admin, /doctor, /health-coach, /nutritionist and
/superadmin route, because a consent given on a marketing page does not cover the addresses
of your own biomarker, biological-age and AI-conversation pages being sent anywhere.
Withdrawing is as easy as accepting. Use the Analytics choice link in the footer of any marketing or content page — it reopens the same banner, same two buttons, one click to withdraw. Withdrawing stops the tag and clears its cookies immediately, on the spot, not on your next visit.
We keep a record of each consent decision — what you were shown, what you chose, and when — so we can demonstrate it if asked. That record does not include your IP address or browser identifiers; the record is deliberately less data than the tag it is gating.
Separately, this site stores a small preference in your browser to remember whether you chose light or dark mode, and the two cookies that remember your analytics choice itself (one records your choice, the other is an anonymous identifier used only to look that choice back up). All three are strictly necessary for the site to honour a choice you made and are disclosed, not offered as a choice. Signing in sets a session cookie that keeps you signed in; that cookie is strictly necessary and cannot be turned off while you are using an account.
If you create an account, we collect and hold considerably more, because the product cannot work otherwise.
Your name, email address, and password (stored only as a cryptographic hash — we cannot read it). If you sign in with Google, we receive your name, email address and Google account identifier from Google instead of a password. Your phone number, date of birth, sex, and postal address where you or our staff enter them.
This is the sensitive category, and we treat it as such.
To provide the assessments, reports, insights, consultations and monitoring you asked for; to let clinical and support staff answer your questions; to keep the service secure; and to meet legal and record-keeping obligations.
India (DPDP): your consent for each purpose, and, where applicable, the recognised legitimate uses the Act permits. EU/EEA (GDPR): Article 6(1)(b) for performing our contract with you, together with explicit consent under Article 9(2)(a) for health data, which is a separate and additional basis. If you do not give explicit consent for health data, the health features cannot run.
PREDICT computes results — such as a biological age — from your biomarker values, and offers an AI assistant that explains your own data back to you.
We do not sell personal data. We do not share health data with data brokers or advertisers.
We use the following categories of service provider, each of which processes data on our behalf and only for the purpose we give it:
| Provider or category | What it receives |
|---|---|
| Cloud hosting and database providers | Everything the product stores, because it is stored there |
| Resend (email) | Your name and email address, for waitlist and transactional email |
| Google Analytics | Website usage as described in §5 — no health data |
| Google (sign-in) | Only where you choose to sign in with Google |
| OpenAI, Google (AI models) | The contents of your Predict AI conversations |
| Cloudinary (media storage) | Not currently in the live product — configured but unused outside a one-off internal migration script. Media you upload today is stored with our cloud hosting and database providers above. |
| Cal.com (scheduling) | Appointment booking details |
| WhatsApp / Meta (messaging), where you opt in | Your phone number and the message content we send |
| Open Wearables, where you connect a device | Your device and activity data |
| Diagnostic laboratories and healthcare professionals | The information needed to run a test or provide care |
If you log a red-flag reading and your clinic has assigned you a doctor, that doctor is sent a task to review it in your record; this is not a promise of a reply and never replaces calling 112.
We also disclose personal data where the law requires it, where a court or regulator compels it, or where it is necessary to protect someone's safety.
PREDICT is operated from India. Several of the providers above process data outside India and outside the EEA, including in the United States. Where that happens we rely on contractual protections with the provider.
The location of your health data is decided by where our hosting and database providers run. If data residency in a particular country matters to you, email and ask before you upload anything.
| Data | How long |
|---|---|
| Waitlist entry | Until you ask us to remove it, or the waitlist is closed |
| Enquiry record | Until you ask us to remove it |
| Account and health data | For as long as your account is open, and afterwards only where a law, a medical record-keeping obligation, or an unresolved dispute requires it |
| Website analytics | Per Google Analytics' retention setting for our property |
Stated plainly: we do not currently operate an automatic deletion schedule that removes each category of data on a fixed timetable. Deletion happens when you ask for it, and this policy will be updated when that changes.
Under the DPDP Act you have the right to:
If the GDPR applies to you, you also have the right to object to processing, the right to restrict it, and the right to receive your data in a machine-readable format and have it transmitted to another controller where technically feasible. You may complain to your national supervisory authority.
Email with what you want done. We will respond within 30 days. There is no charge.
Being honest about the mechanics: most of these rights are exercised by writing to us rather than by a button inside the app today. Self-service controls for access, export and deletion are not yet built. Writing to us works, and we will act on it.
One limit, stated rather than hidden: deleting your account removes your ability to sign in and use the service, but some records — for example a clinical record connected to care you received, or an accounting record — may be retained where the law requires it. If you ask us to erase your data we will tell you specifically what was erased and what was kept and why.
You must be 18 or older to create a PREDICT account on your own.
If you are under 18, you may use PREDICT, including connecting a wearable, only with the verifiable consent of your parent or lawful guardian, given before we process any of your data. Your parent or guardian can withdraw that consent at any time; we then stop processing your data and handle it as section 11 describes.
Our guardian-consent process is not live yet. Until it is, we cannot open an account for anyone under 18, and a child's data must not be submitted to PREDICT. We do not direct advertising at children.
If you believe a child's data has reached us without a parent's or guardian's consent, email and we will delete it.
We protect personal data with encryption in transit, access controls that limit what each staff role can see, and authentication on every part of the product that holds your data.
What we will not claim: we hold no security certification we have not earned, and no system is immune to compromise. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as the DPDP Act requires, and supervisory authorities and individuals as the GDPR requires where it applies.
If you are unhappy with how we have handled your personal data, contact us first:
If you are not satisfied with our response, you may complain to the Data Protection Board of India, or — where the GDPR applies to you — to the supervisory authority in your country of residence.
We will update this page when our data practices change, and the effective date above will change with it. Where a change materially affects how we use data you have already given us, we will tell you rather than relying on you noticing.
PREDICT — a brand owned by Control Age Health Pvt. Ltd.
Website: https://predict.fit
Last Updated: October 5, 2026