Skitii Privacy Policy

Mindful Gurukul Private Limited, operating under the brand name Skitii, respects your privacy and is committed to handling personal data responsibly and securely.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you:

• visit the Skitii website;
• contact us or submit an enquiry;
• request a demonstration, proposal or partnership;
• register for or use a Skitii product, application or service;
• participate in an authorised clinical study, pilot or evaluation involving Skitii; or
• interact with us as a healthcare professional, hospital representative, researcher, vendor, employment candidate or business partner.

This Policy should be read together with any specific privacy notice, informed consent document, clinical study document, hospital policy or contractual notice presented to you.

Skitii is developed and operated by Mindful Gurukul Private Limited, an Indian company developing digital health solutions intended to support the management of anxiety and distress, including anxiety experienced in oncology care settings.

For the purposes of applicable data protection law, Mindful Gurukul may act as a data fiduciary, data controller, data processor or service provider, depending on the circumstances in which personal data is collected and processed.

Where Skitii is provided through a hospital, clinic, research institution or other healthcare organisation, that organisation may independently determine how patient information is collected and used. In such cases, the organisation's privacy notice and consent procedures may also apply.

Depending on how you interact with us, we may collect the categories of personal data described below.

Contact and identity information

• name, email address and telephone number;
• organisation, hospital or institution;
• professional designation;
• city, state and country; and
• information included in an enquiry, message or correspondence.

Account and authentication information

Where account access is provided, we may collect:

• username or registered email address;
• one time password and authentication records;
• account role and permissions;
• login date, time and device information; and
• security and access logs.

We do not retain a one time password after it has served its authentication purpose, except for limited technical or security records where required.

Website and technical information

When you access our website, we may automatically collect:

• Internet Protocol address;
• browser and device type;
• operating system;
• approximate location derived from an Internet Protocol address;
• pages visited and time spent on the website;
• referral source;
• error, performance and security logs; and
• cookie or similar technology identifiers.

Health and biometric information

When an individual uses an authorised Skitii clinical or therapeutic service, we may process information such as:

• heart rate;
• heart rate variability and related parameters;
• session duration and response patterns;
• self reported anxiety, distress, pain, energy or symptom scores;
• pre session and post session observations;
• device or sensor readings;
• patient or participant identifiers assigned by the hospital or research team; and
• other information specifically described in the applicable consent form or clinical protocol.

Health and biometric data is sensitive. We process it only for authorised purposes and with an appropriate legal basis, consent or institutional authorisation.

Skitii does not collect health or biometric data merely because someone visits the public website.

Research and clinical study information

For authorised trials, pilots or clinical evaluations, we may collect or receive data defined in the approved protocol. Wherever reasonably possible, such data will be coded, pseudonymised, de-identified or anonymised.

Participation in research is governed by the relevant informed consent form, ethics approval, clinical protocol and applicable law. If there is any inconsistency, the more specific clinical study documents will apply to study related processing.

Business and professional information

We may collect professional and commercial information relating to hospital demonstrations, institutional purchases, regulatory or scientific collaboration, vendor onboarding, contracts, invoices, events, conferences, partnerships and investment enquiries.

Recruitment information

If you apply for a position with us, we may collect your resume, educational and employment details, contact information, interview records and other information voluntarily submitted by you.

We may collect information:

• directly from you;
• through our website, forms, applications or devices;
• from a hospital, clinic, healthcare professional or research institution;
• from authorised sensors or connected devices;
• from service providers supporting our operations;
• from publicly available professional sources; or
• automatically through cookies, logs and related technologies.

Where another organisation provides your data to us, that organisation is responsible for ensuring that it has the necessary authority, consent or other lawful basis to do so.

We may process personal data to:

• respond to enquiries and requests;
• arrange product demonstrations;
• create, authenticate and administer accounts;
• provide and support Skitii products and services;
• operate therapeutic or clinical sessions authorised by healthcare institutions;
• generate session level measurements and reports;
• maintain the safety, accuracy, reliability and performance of our technology;
• troubleshoot technical problems;
• conduct approved research, pilots and clinical evaluations;
• develop and improve our products and algorithms;
• perform quality management, audit and regulatory activities;
• detect fraud, misuse, unauthorised access and security incidents;
• communicate service, safety or policy updates;
• manage contracts, payments, vendors and institutional relationships;
• consider employment applications;
• comply with legal, regulatory, judicial and governmental obligations; and
• establish, exercise or defend legal claims.

We will not use identifiable patient health information for unrelated advertising. We will not sell identifiable health or biometric data.

Skitii may use software algorithms to analyse physiological measurements and adapt elements of a user's experience, including therapeutic audio or music selection.

Such processing is intended to support the specified use of the product. It does not independently diagnose cancer, prescribe medication or replace the clinical judgement of a qualified healthcare professional.

Where required by law or institutional protocol, appropriate human oversight will be maintained. Users and healthcare institutions may contact us for further information about the general purpose of this processing, subject to intellectual property, safety and security limitations.

Depending on the applicable law and context, we may process personal data on the basis of:

• your consent;
• performance of a contract or steps requested before entering a contract;
• compliance with a legal or regulatory obligation;
• a permitted use recognised under applicable law;
• our legitimate interests, where those interests do not override your rights;
• protection of vital interests;
• scientific or clinical research conducted under applicable safeguards; or
• instructions received from a hospital or institution acting as the responsible data fiduciary or controller.

Where processing is based on consent, you may withdraw that consent. Withdrawal will not affect processing already lawfully completed and may not require deletion of records that must be retained for medical device, research, safety, contractual or legal purposes.

We may share personal data with:

• hospitals, clinics and healthcare professionals involved in your care or authorised session;
• research institutions, investigators and ethics committees;
• technology, hosting, cybersecurity, communications and technical support providers;
• professional advisers, auditors, insurers and accreditation bodies;
• regulatory authorities, courts or government agencies;
• business partners acting under written confidentiality and data protection obligations; and
• a successor organisation in connection with a merger, acquisition, restructuring or transfer of business assets.

Service providers may process personal data only for authorised purposes and subject to appropriate contractual and security obligations.

We may share aggregated or anonymised information that does not reasonably identify an individual for research, statistical, regulatory, product development or scientific purposes.

Some authorised service providers, research partners or institutional customers may operate outside India. Consequently, personal data may be processed in another country.

Where an international transfer takes place, we will use reasonable contractual, technical and organisational safeguards and comply with applicable data transfer restrictions. Additional safeguards may apply under a hospital agreement, clinical protocol or regional privacy law.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including applicable clinical, contractual, regulatory, research, tax, audit, safety and legal requirements.

Retention periods may vary according to the type of information. For example:

• website enquiries may be retained while the enquiry or business relationship remains active and for a reasonable period thereafter;
• account and security logs may be retained for operational, audit and cybersecurity purposes;
• clinical or medical device records may be retained for the period required under applicable healthcare, research and medical device regulations;
• recruitment information may be retained for current or future employment opportunities, subject to applicable law; and
• anonymised data may be retained because it no longer identifies an individual.

At the end of the applicable retention period, information will be securely deleted, anonymised or placed beyond ordinary operational use, unless continued retention is legally required.

We use reasonable administrative, technical and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction.

These safeguards may include:

• role based access controls;
• authentication and access logging;
• encryption in transit and, where appropriate, at rest;
• secure software development and testing practices;
• restricted access to health and research data;
• vendor and service provider controls;
• security monitoring and incident management procedures;
• data backup and recovery measures; and
• staff confidentiality and privacy training.

No electronic system is completely secure. We therefore cannot guarantee absolute security, but we will take reasonable steps to investigate and respond to suspected breaches in accordance with applicable law.

Our website may use cookies and similar technologies to:

• enable essential website functions;
• remember user preferences;
• maintain security;
• measure website performance;
• understand how visitors use the website; and
• improve content and user experience.

Non-essential cookies will be used only where permitted by applicable law and, where required, after obtaining consent.

You can control cookies through your browser settings or the cookie preference tool available on the website. Disabling certain cookies may affect website functionality.

We may send service related messages where necessary to manage an account, respond to an enquiry or provide important product, safety or policy information.

We may send promotional communications where you have consented or where otherwise permitted by law. You may unsubscribe using the link provided in the communication or by contacting us.

Even after opting out of marketing, you may continue to receive necessary transactional, security, contractual or regulatory communications.

The public website is primarily intended for adults, healthcare professionals, institutions and business partners.

Skitii may be used in paediatric settings only under an authorised hospital, clinical or research arrangement and with consent or authorisation from a parent or lawful guardian where required.

We do not knowingly collect personal data directly from a child through the public website without appropriate authorisation. If you believe that a child has submitted personal data without valid consent, please contact us so that we can investigate and take appropriate action.

Subject to applicable law and any lawful limitations, you may have the right to:

• request information about the personal data we process;
• request access to your personal data;
• request correction, completion or updating of inaccurate data;
• request deletion or erasure of data;
• withdraw consent;
• object to or restrict certain processing;
• request portability of eligible data;
• opt out of direct marketing;
• raise a grievance;
• nominate another individual to exercise applicable rights in the event of death or incapacity; and
• lodge a complaint with the appropriate data protection or regulatory authority.

Before acting on a request, we may need to verify your identity and authority.

If your data was collected by a hospital, clinic or research institution, we may refer your request to that organisation because it may be responsible for deciding how the data is handled.

Certain information may not be deleted where retention is necessary for patient safety, research integrity, regulatory compliance, fraud prevention, dispute resolution or another lawful purpose.

When providing personal data to us, you agree to provide accurate, complete and current information. If you provide personal data concerning another individual, you are responsible for ensuring that you have the necessary authority or consent to do so.

Users must keep account credentials confidential and promptly notify us of suspected unauthorised access or misuse.

Our website may contain links to third party websites or services. We do not control those third parties and are not responsible for their privacy practices. You should review their privacy notices before submitting personal data.

We may update this Privacy Policy to reflect changes in our services, technology, business practices or legal obligations. The revised policy will be posted on our website with an updated effective or last updated date.

Where a change materially affects how we use personal data, we will provide an additional notice or obtain consent where required by applicable law.

For privacy related questions, requests, complaints or concerns, please contact:

Please provide sufficient information to verify your identity and clearly describe your request or grievance. We will acknowledge and respond to valid requests within the period prescribed under applicable law.

If you use Skitii through a hospital, clinic or research institution, you may also contact that organisation's privacy officer, grievance officer or principal investigator.