99 Peaks - Privacy Policy

Effective date: Dec 3rd, 2023

Last updated: June 10th, 2026

This Privacy Policy describes how 99 Peaks Pte. Ltd., its affiliates, and subsidiaries (collectively, “99 Peaks,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information. This Privacy Policy also tells you about your rights and choices with respect to your personal information, and how you can reach us to get answers to your questions.

We collect information about you in a variety of ways depending on how you interact with us and our websites, mobile applications, and services, including:

• Directly from you when you provide it to us, such as when you register for an account, sign up to receive communications from us, use our services, or contact us by phone, email, or otherwise.
• Automatically through the use of cookies, server logs, and other similar technologies when you interact with our websites, mobile applications, and emails.
• From other sources, including our affiliates, business partners, service providers, online social media networks, and other third parties, or from publicly available sources. For example, if you elect to share lab work results from a third party with our mobile application.

The following table sets out the types of information we collect and our primary purpose for doing so.

In addition to the purposes and uses described above, we use information in the following ways:

• To identify you when you visit our websites or mobile applications.
• To provide products and services, including to provide personalised insights, to help you track your progress, to analyse health markers you provide, and to give contextual general guidelines on healthy ranges for your age and gender.
• To improve our services and product offerings.
• To conduct analytics.
• To communicate with you, such as to provide you with important updates and notifications, or to respond to and/or follow up on your requests, inquiries, issues, or feedback.
• To send marketing and promotional materials including information relating to our products, services, sales, or promotions, or those of our business partners.
• To detect and protect against malicious, deceptive, fraudulent, or illegal activity, including violation of our policies and terms and conditions, security incidents, and harm to the rights, property, or safety of our company and our users, employees, or others.
• To debug, identify, and repair errors that impair existing intended functionality of our website, mobile applications, and services.
• To comply with our legal or regulatory obligations, to establish or exercise our rights, and to defend against a legal claim.
• For internal administrative purposes, as well as to manage our relationships.
• For such other purposes as you may consent to from time to time.

Although the sections above describe our primary purpose in collecting your information, in many situations we have more than one purpose. As a result, our collection and processing of your information is based in different contexts upon your consent, our need to perform a contract, our obligations under law, and/or our legitimate interest in conducting our business.

To the extent we maintain and use personal information in a deidentified form, we will not attempt to reidentify the information, except for the purpose of determining whether our deidentification processes satisfy our legal obligations.

In addition to the specific situations discussed elsewhere in this Privacy Policy, we may disclose personal information in the following situations:

• Affiliates and Acquisitions. We may share information with our corporate affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If another company acquires, or plans to acquire, our company, business, or our assets, we will also share information with that company, including at the negotiation stage.
• Other Disclosures without Your Consent. We may disclose information in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws. We may also share your information in order to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our policies.
• Service Providers. We may share your information with service providers who assist us in administering our website and App, conducting surveys, providing technical support, processing payments (in connection with Marketplace transactions), and assisting in the fulfilment of orders. These service providers are contractually required to protect your personal information and may only use it for the purposes for which it was disclosed.
• Partner Promotion. We may offer contests, sweepstakes, or other promotions with third-party partners. If you decide to enter a promotion sponsored by a third party, the information you provide will be shared with us and with them. Their use of your information is not governed by this Privacy Policy.
• Other Disclosures with Your Consent. We may disclose your information to other third parties when we have your consent or direction to do so.

Some jurisdictions give you a right to make the following choices regarding your personal information:

• Access to Your Personal Information. You may request access to your personal information or confirmation that we hold information about you. In certain circumstances, you may also request to receive access to your data in a portable, machine-readable format.
• Changes to Your Personal Information. We rely on you to update and correct your personal information. If our App does not permit you to update or correct certain information, you can contact us using the details below. Note that we may keep historical information in our backup files as permitted by law.
• Deletion of Your Personal Information. You may request that we delete your personal information. If required by law, we will grant a request to delete information, but you should note that in many situations we must keep your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another business purpose.
• Opt-out of Targeted Advertising. You may opt out of online tracking-based targeted advertising by adjusting your cookie settings. We also recognise Global Privacy Control (GPC) signals where required by applicable law. For more information about GPC, please visit Global Privacy Control.
• Objection to Certain Processing. You may object to our use or disclosure of your personal information by contacting us at the address described below.
• Promotional Emails. You may choose to provide us with your email address for the purpose of allowing us to send newsletters, surveys, offers, and other promotional materials. You can stop receiving promotional emails by following the unsubscribe instructions in those emails. If you decide not to receive promotional emails, we may still send you service-related communications.
• Promotional Text Messages. If you receive a text message from us that contains promotional information, you can opt out of receiving future text messages by replying “STOP.”
• Revocation of Consent. Where we process your personal information based upon consent, you may revoke consent at any time. Please note that if you revoke your consent for the processing of personal information, we may no longer be able to provide you with the Services.

Please note that not all of the rights described above are absolute, and they do not apply in all circumstances. In some cases, we may limit or deny your request because the law permits or requires us to do so, or if we are unable to adequately verify your identity. We will not discriminate against individuals who exercise their privacy rights under applicable law.

You may exercise the rights described above by contacting us as indicated in the “Contact Information” section below. If you disagree with our denial of a request, you may appeal our decision by contacting us with the subject line “Appeal.”

As required by law, we will require you to prove your identity. We may verify your identity by phone call or email. Depending on your request, we will ask for information such as your name and the last time you interacted with us. We may also ask you to provide a signed declaration confirming your identity.

In some circumstances, you may designate an authorised agent to submit requests to exercise certain privacy rights on your behalf. If you are an authorised agent submitting a request on behalf of an individual, you must attach a copy of a signed and notarised document indicating that you are able to act on that person’s behalf.

We store user data securely on encrypted servers hosted by Amazon Web Services (AWS) in the United States, using SSL/TLS encryption protocols to protect data during transmission and at rest. Note, however, that no method of transmission over the internet, or method of electronic storage, is fully secure. While we use reasonable efforts to protect your personal information from unauthorised access, use, or disclosure, we cannot guarantee the security of your personal information. In the event that we are required by law to inform you of a breach to your personal information, we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

You are responsible for maintaining the confidentiality of your account password, and for any access to or use of your account by someone else who has obtained your password. You should notify us immediately of any unauthorised use of your password or account.

We retain your personal information for only as long as necessary to fulfil the purposes outlined in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements, unless a longer retention period is required or permitted by law. For example, we typically retain your user-inputted data for twelve (12) months after account deletion unless legally required to retain it longer.

As a company that operates internationally, we may transmit your personal information to countries other than your country of residence, including to the United States where our servers are hosted. Privacy laws in those countries may differ from the laws in your country.

Where we transfer personal information internationally, we take steps to ensure that appropriate safeguards are in place to protect your information, consistent with the applicable legal requirements of your jurisdiction. These safeguards may include standard contractual clauses, contractual protections with our service providers, or other legally recognised transfer mechanisms. Where required by local law, we obtain your consent to such transfers.

By using the Services, you acknowledge that your personal information may be transferred to, stored, and processed in a country other than your country of residence. If you would like more information about the safeguards we apply to international data transfers, please contact us using the details below.

The Services enable you to input and store sensitive health data, including biomarker results, medical reports, physical measurements, and other health information (“Health Data”). We treat Health Data with additional care and apply heightened security measures to its storage and processing.

Health Data is used solely to provide and improve the Services as described in this Privacy Policy. We do not sell Health Data to third parties. We do not use Health Data for advertising purposes.

Where you upload medical reports or clinical results, you are solely responsible for the accuracy of that data. The Services do not independently verify such data, and nothing in the Services constitutes medical advice.

In jurisdictions where Health Data constitutes sensitive personal data or sensitive personal information under applicable law, we process such data only on the basis of your explicit consent given at account registration and continued use of the Services, or as otherwise permitted by applicable law.

For your convenience, we may provide links to websites and other third-party content or services that we do not own or operate. The websites and third-party content to which we link may have separate privacy notices or policies. We have no control over the privacy practices of websites or services that we do not own, and we encourage you to review the privacy policies of any third-party website or application.

Our App and Services are not intended for children under the age of 18 and we do not knowingly collect personal information from children under the age of 18. If you are under 18, you must not provide your personal information to us.

We may update this Privacy Policy from time to time. To the extent that our policy changes in a material way, the policy that was in place at the time that you submitted personal information to us will generally govern that information unless we receive your consent to the new privacy policy. If we make a material change to this Privacy Policy, we will attempt to notify you through email, in-app notification, and/or a website pop-up.

If you have any questions, comments, or complaints concerning our privacy practices, please contact us at:

• Address: 99 Peaks Pte Ltd, 8 Nassim Hill, Singapore, 258484, Singapore.
• Support Email: support@99peaks.life
• General Queries: hello@99peaks.life
• Data Protection Officer (Singapore PDPA): support@99peaks.life — subject line: “Data Protection Officer”
• Privacy Officer (Philippines DPA): support@99peaks.life — subject line: “Privacy Officer — Philippines”

Appendices — Jurisdiction-Specific Privacy Rights

This Appendix applies to users whose primary residence is in Australia, and supplements the main Privacy Policy. In the event of any conflict specific to Australian law, this Appendix prevails.

We handle personal information in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). Health information is sensitive information under the Privacy Act and is afforded additional protections. We collect health information only with your consent and only for the purposes described in this Privacy Policy.

We may disclose your personal information to overseas recipients, including our service providers in the United States. Before doing so, we take reasonable steps to ensure that overseas recipients do not breach the APPs in relation to your personal information, in accordance with APP 8.

Under the Privacy Act, you have the right to:

• access personal information we hold about you;
• request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading;
• lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au if you are not satisfied with our handling of your personal information.

To exercise these rights, contact us at support@99peaks.life.

The Services are not a medical device and are not provided by a registered health practitioner. The Services do not provide medical advice. For clinical matters, consult a registered health practitioner regulated under the Health Practitioner Regulation National Law.

This Appendix applies to users whose primary residence is in the United States of America, and supplements the main Privacy Policy.

Unless expressly agreed in a separate Business Associate Agreement (BAA), 99 Peaks is not a HIPAA covered entity or business associate in connection with your consumer use of the Services. The Services are not intended for transmitting Protected Health Information in a HIPAA-regulated context.

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, disclose, and sell.
• Right to delete personal information we have collected from you, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell or share your personal information.
• Right to non-discrimination for exercising your privacy rights.

To exercise these rights, contact us at support@99peaks.life. California residents may also reach the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs by mail at 1625 North Market Blvd., Sacramento, CA 95834, or by telephone at (916) 445-1254 or (800) 952-5210.

Some US states provide additional privacy rights regarding access, correction, deletion, and portability of personal data. Those rights are preserved where mandatory under applicable state law.

This Appendix applies to users whose primary residence is in Singapore, and supplements the main Privacy Policy. In the event of any conflict specific to Singapore law, this Appendix prevails.

We collect and process your personal data, including Health Data and medical reports, under the Singapore Personal Data Protection Act 2012 (“PDPA”) on the following bases:

• Consent: given at account registration and continued use of the Services.
• Legitimate interests: to provide, maintain, and improve the Services.
• Legal obligation: where required by Singapore law.

We have appointed a Data Protection Officer (“DPO”) as required under the PDPA. You may contact our DPO at support@99peaks.life with the subject line “Data Protection Officer.”

Your personal data is stored on AWS servers in the United States. We ensure that this transfer is subject to contractual protections at least equivalent to the PDPA standard, in compliance with the Transfer Limitation Obligation under section 26 of the PDPA and applicable PDPC guidelines.

In the event of a notifiable data breach under the PDPA, we will notify the Personal Data Protection Commission (PDPC) and affected users within three (3) business days of assessing that the breach is notifiable, as required under the PDPA Amendment Act 2020.

Under the PDPA, you have the right to:

• access personal data we hold about you;
• correct inaccurate or incomplete personal data;
• withdraw consent to the processing of your personal data (noting that this may affect your ability to use the Services);
• request information about the ways your personal data has been used or disclosed in the past year.

To exercise these rights, contact us at support@99peaks.life.

The Services are not regulated as a medical device under the Health Products Act (Cap. 122D) or HSA guidelines. Content in the Services does not constitute medical advice. Consult a licensed healthcare professional for any health concerns.

This Appendix applies to users whose primary residence is in Malaysia, and supplements the main Privacy Policy. In the event of any conflict specific to Malaysian law, this Appendix prevails.

We collect and process your personal data, including Health Data, under the Malaysian Personal Data Protection Act 2010 (“PDPA Malaysia”). Health Data constitutes sensitive personal data under PDPA Malaysia. By accepting these terms and using the Services, you give your explicit consent to our processing of your Health Data and medical reports for the purposes described in this Privacy Policy.

Your personal data is stored on servers in the United States. By using the Services, you expressly consent to this transfer. We ensure that appropriate contractual safeguards are in place with our service providers to protect your personal data to a standard consistent with PDPA Malaysia requirements.

Under PDPA Malaysia, you have the right to:

• access personal data we hold about you;
• correct inaccurate, incomplete, misleading, or not up-to-date personal data;
• withdraw consent to the processing of your personal data (noting that this may affect your ability to use the Services);
• prevent processing of your personal data for direct marketing purposes.

To exercise these rights, contact us at support@99peaks.life.

Malaysian users retain all non-waivable rights available under Malaysian consumer protection and data protection laws, including the Consumer Protection Act 1999, notwithstanding any other provision of this Privacy Policy.

The Services are not regulated as a medical device or controlled health product under Malaysian law. Nothing in the Services constitutes medical advice. Consult a registered medical practitioner for any health concerns.

This Appendix applies to users whose primary residence is in the Philippines, and supplements the main Privacy Policy. In the event of any conflict specific to Philippine law, this Appendix prevails.

We collect and process your personal data, including Health Data and medical reports, in compliance with the Philippine Data Privacy Act 2012 (“DPA”) and its Implementing Rules and Regulations, as administered by the National Privacy Commission (“NPC”). Health Data constitutes sensitive personal information under the DPA. We process such data on the basis of your explicit consent given at account registration and continued use of the Services.

We have designated a Privacy Officer responsible for ensuring our compliance with the DPA. You may contact our Privacy Officer at support@99peaks.life with the subject line “Privacy Officer — Philippines.”

Your personal data, including Health Data, is stored on servers in the United States. We ensure that such transfers comply with Section 21 of the DPA and applicable NPC issuances by implementing contractual safeguards with our data processors. By using the Services, you consent to this transfer.

In the event of a personal data breach that may result in serious harm to you, we will notify the NPC and affected users within seventy-two (72) hours of discovery, in accordance with NPC Circular No. 16-03.

In accordance with NPC Advisory No. 2017-03, we have conducted a Privacy Impact Assessment covering the processing of sensitive personal information (Health Data and medical reports) within the Services.

Under the DPA, you have the right to:

• be informed of how your personal data is processed;
• access personal data we hold about you;
• object to the processing of your personal data;
• rectify inaccurate or incomplete personal data;
• erase or block personal data that is incomplete, outdated, false, unlawfully obtained, used for an unauthorised purpose, or no longer necessary for the purpose for which it was collected;
• data portability — to receive your personal data in a structured, commonly used electronic format;
• lodge a complaint with the NPC at complaints@privacy.gov.ph.

To exercise any of these rights, contact us at support@99peaks.life.

The Services are not registered as a medical device with the Philippine Food and Drug Administration (FDA). Nothing in the Services constitutes medical advice, diagnosis, or treatment. Consult a licensed physician or healthcare professional for any health concerns.