99 Peaks - Privacy Policy

Effective date: Dec 3rd, 2023

Last updated: March 2nd, 2026

This Privacy Policy describes how 99 Peaks Pte. Ltd., its affiliates, and subsidiaries (collectively, “99 Peaks,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information. This Privacy Policy also tells you about your rights and choices with respect to your personal information, and how you can reach us to get answers to your questions.

We collect information about you in a variety of ways depending on how you interact with us and our websites, mobile applications, and services, including:

• Directly from you when you provide it to us, such as when you register for an account, sign up to receive communications from us, use our services, place an order, or contact us by phone, email, or otherwise.
• Automatically through the use of cookies, server logs, and other similar technologies when you interact with our websites, mobile applications, advertisements, and emails.
• From other sources, including, for example, our affiliates, business partners, service providers, online social media networks, and other third parties, or from publicly available sources. For example, if you elect to order lab work from a third party and elect to share it with our mobile applications.

The following table summarizes the type of information we collect in various contexts and how we use that information.

In addition to the purposes and uses described above, we use information in the following ways:

• To identify you when you visit our websites or mobile applications.
• To provide products and services, including to provide personalized insights, to help you track your progress, to analyze health markers you provide, and give contextual general guidelines on healthy ranges for your age and gender.
• To improve our services and product offerings.
• To conduct analytics.
• To communicate with you, such as to provide you with important updates and notifications, or to respond to and/or follow-up on your requests, inquiries, issues, or feedback.
• To send marketing and promotional materials including information relating to our products, services, sales, or promotions, or those of our business partners.
• To detect and protect against malicious, deceptive, fraudulent, or illegal activity, including violation of our policies and terms and conditions, security incidents, and harm to the rights, property, or safety of our company and our users, employees, or others.
• To debug, identify and repair errors that impair existing intended functionality of our website, mobile applications, and services.
• To comply with our legal or regulatory obligations, to establish or exercise our rights, and to defend against a legal claim.
• For internal administrative purposes, as well as to manage our relationships.
• For such other purposes as you may consent (from time to time).

Although the sections above describe our primary purpose in collecting your information, in many situations we have more than one purpose. For example, if you engage our services, we may collect your information to perform our contract with you, but we also collect your information as we have a legitimate interest in maintaining your information after your transaction is complete so that we can quickly and easily respond to any questions about your transactions. As a result, our collection and processing of your information is based in different contexts upon your consent, our need to perform a contract, our obligations under law, and/or our legitimate interest in conducting our business.

To the extent we maintain and use personal information in a deidentified form, we will not attempt to reidentify the information, except for the purpose of determining whether our deidentification processes satisfy our legal obligations.

In addition to the specific situations discussed elsewhere in this Privacy Policy, we may disclose personal information in the following situations:

• Affiliates and Acquisitions. We may share information with our corporate affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If another company acquires, or plans to acquire, our company, business, or our assets, we will also share information with that company, including at the negotiation stage.
• Other Disclosures without Your Consent. We may disclose information in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws. We may also share your information in order to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our policies, or to comply with your request for the shipment of products to or the provision of services by a third-party intermediary.
• Public. Some of our websites may provide the opportunity to post comments, or reviews, in a public forum. If you decide to submit information on these pages, that information may be publicly available.
• Partner Promotion. We may offer contests, sweepstakes, or other promotions with third party partners. If you decide to enter a contest, sweepstakes, or promotion that is sponsored by a third party partner the information that you provide will be shared with us and with them. Their use of your information is not governed by this privacy policy.
• Service Providers. We may share your information with service providers. Among other things service providers may help us to administer our website, conduct surveys, provide technical support, process payments, and assist in the fulfillment of orders.
• Other Disclosures with Your Consent. We may disclose your information to other third parties when we have your consent or direction to do so.

Some jurisdictions give you a right to make the following choices regarding your personal information:

• Access To Your Personal Information. You may request access to your personal information or confirmation that we have information about you. In certain limited circumstances, you may also request to receive access to your data in a portable, machine-readable format.
• Changes To Your Personal Information. We rely on you to update and correct your personal information. Most of our websites allow you to modify or delete your account profile. If our website does not permit you to update or correct certain information, you can contact us at the address described below in order to request that your information be modified. You may ask us to correct information that is inaccurate or incomplete. Note that we may keep historical information in our backup files as permitted by law.
• Deletion Of Your Personal Information. You may request that we delete your personal information. If required by law, we will grant a request to delete information, but you should note that in many situations we must keep your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another business purposes.
• Opt-out of Targeted Advertising. You may opt-out of online tracking based targeted advertising (e.g., cookies) by clicking the cookie settings link here. Please note that if you change browsers or computers, or if you clear your browser’s cache, you may need to click the link again to apply your preference. We also recognize Global Privacy Control (GPC) signals enabled by customers on their web browser or web browser extension as valid opt-out requests where required by applicable law. Please note that your opt-out preference signal will be applied only to your current browser and device. For more information about GPC, please visit Global Privacy Control.
• Objection to Certain Processing. You may object to our use or disclosure of your personal information by contacting us at the address described below.
• Online Tracking. We do not currently recognize the “Do Not Track” signal.
• Promotional Emails. You may choose to provide us with your email address for the purpose of allowing us to send free newsletters, surveys, offers, and other promotional materials to you, as well as targeted offers from third parties. You can stop receiving promotional emails by following the unsubscribe instructions in emails that you receive. If you decide not to receive promotional emails, we may still send you service related communications.
• Promotional Text Messages. If you receive a text message from us that contains promotional information you can opt-out of receiving future text messages by replying “STOP.”
• Revocation Of Consent. Where we process your personal information based upon consent, you may revoke consent. Please note, if you revoke your consent for the processing of personal information then we may no longer be able to provide you services.

Please note, not all of the rights described above are absolute, and they do not apply in all circumstances. In some cases, we may limit or deny your request because the law permits or requires us to do so, or if we are unable to adequately verify your identity. We will not discriminate against individuals who exercise their privacy rights under applicable law.

You may exercise the rights described above by contacting us as indicated in the “Contact Information” section below. If you disagree with our denial of a request, you may appeal our decision by contacting us with the subject line “Appeal.”

Note that, as required by law, we will require you to prove your identity. We may verify your identity by phone call or email. Depending on your request, we will ask for information such as your name, the last time you transacted with us. We may also ask you to provide a signed declaration confirming your identity. Following a request, we will use reasonable efforts to supply, correct or delete personal information about you in our files.

In some circumstances, you may designate an authorized agent to submit requests to exercise certain privacy rights on your behalf. If you are an authorized agent submitting a request on behalf of an individual, you must attach a copy of a signed and notarized form indicating that you are able to act on another person’s behalf.

We store user data securely on encrypted servers hosted by Amazon Web Services (AWS), using SSL encryption protocols to protect data during transmission and at rest. Note, however, that no method of transmission over the internet, or method of electronic storage, is fully secure. While we use reasonable efforts to protect your personal information from unauthorized access, use, or disclosure, we cannot guarantee the security of your personal information. In the event that we are required by law to inform you of a breach to your personal information we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

Some of our websites permit you to create an account. When you do you will be prompted to create a password. You are responsible for maintaining the confidentiality of your password, and you are responsible for any access to or use of your account by someone else that has obtained your password, whether or not such access or use has been authorized by you. You should notify us of any unauthorized use of your password or account.

We retain your personal information for only as long as necessary to fulfil the purposes outlined in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements, unless a longer retention period is required or permitted by law. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we obtained the information and whether we can achieve those purposes through other means, as well as applicable legal requirements. For example, we typically retain your user-inputted data for twelve (12) months after account deletion unless legally required to retain it longer.

As a multi-national company, we transmit information between and among our affiliates. As a result, your information may be processed in a foreign country where privacy laws may be less stringent than the laws in your country. Nonetheless, where possible we take steps to treat personal information using the same privacy principles that apply pursuant to the law of the country in which we first received your information. By submitting your personal information to us you agree to the transfer, storage, and processing of your information in a country other than your country of residence including, but not necessarily limited to, the United States and/or Singapore. If you would like more information concerning our attempts to apply the privacy principles applicable in one jurisdiction to data when it goes to another jurisdiction you can contact us using the contact information below. You may also request a copy of any Standard Contractual Clauses we use for the transfer of your data outside of the EEA, which includes the categories of information transferred by contacting us using the contact information below.

For your convenience, we may provide links to websites and other third-party content or services that we do not own or operate. The websites and third-party content to which we link may have separate privacy notices or policies. Please note, we have no control over the privacy practices, websites, or services that we do not own. We encourage you to review the privacy policies of any third-party website or application for details about such third party’s privacy practices.

We may change our privacy policy and practices over time. To the extent that our policy changes in a material way, the policy that was in place at the time that you submitted personal information to us will generally govern that information unless we receive your consent to the new privacy policy. Our privacy policy includes an “effective” and “last updated” date. The effective date refers to the date that the current version took effect. The last updated date refers to the date that the current version was last substantively modified. If we make a material change to our privacy notice, we will attempt to notify you through email, in-app notification, and/or through a website pop-up.

Our websites and online services are not intended for children under the age of 18 and we do not knowingly collect personal information from children under age 18. Children under the age of 18 should not provide their personal information to us.

If you have any questions, comments, or complaints concerning our privacy practices, or if you need to access this Privacy Policy in an alternative format due to having a disability, please contact us at the appropriate address below. We will attempt to respond to your requests and to provide you with additional privacy-related information.

• Support Email: support@99peaks.life
• General Queries: hello@99peaks.life
• Address: 99 Peaks Pte Ltd, 8 Nassim Hill, Singapore, 258484, Singapore.

If you are not satisfied with our response, and are in the European Union or United Kingdom, you may have a right to lodge a complaint with your local supervisory authority.