Legal

Privacy Policy

Effective Date · 24 September 2026 Last Updated on · 24 September 2026

This privacy policy (“Policy”) explains how BKS Labs Private Limited, a company incorporated under the Companies Act, 2013 (“YouLabs”, “We”, “Us”, “Our”) Processes Personal Data collected from natural persons (“You”, “Your”), as specified in clause 2, as a Data Fiduciary when you subscribe to Our Services and/or use Our Website and/or Platform.

1. Definitions

Capitalized terms not specifically defined herein shall have the meaning ascribed thereto in the Terms.

  1. “Applicable Data Protection Laws” shall mean the Digital Personal Data Protection Act, 2023 (“DPDPA”), Digital Data Protection Rules, 2025 (“DPDP Rules”), and such other sectoral rules, regulations and directives that apply to Us while Processing Your Personal Data.
  2. “Data Fiduciary” means any person who alone or jointly with others determines the purposes and means of processing Personal Data.
  3. “Data Principal” means the individual to whom the Personal Data relates, and where such individual is a child or a person with disability, it includes the parent or lawful guardian acting on behalf of the child or a person with disability.
  4. “Personal Data” means any information relating to an identified or identifiable natural person that is submitted by You or on Your behalf.
  5. “Process / Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  6. “Website(s)” shall mean the websites owned and operated by YouLabs, including https://150.fit/.
  7. “Terms” shall mean the online terms and conditions that govern Your use of the Services available at the Terms of Service.

2. How we collect, use your Personal Data and the legal basis

2.1 Personal Data that you provide us

When You are What Personal Data is collected Purpose of Processing Legal Basis of Processing
Individual who accesses the Platform and is provided with login credentials to log in to the Platform to use the Services. Your name, email address, gender, date of birth, height, weight and phone number.

Creation of Your account on the Platform, verification of Your identity as part of Our security process.

To notify You of any alerts or updates related to the Platform or the Services.

To send You information about any of Our new services, products, events, or programs that may be of Your interest.

Onboarding and creation of Your account: Legitimate Use Section 7(a) of DPDPA.

Marketing or Promotional Purpose: Consent Section 6 of DPDPA.

Individual who fills the YouLabs onboarding form and/or subscribes to the Services. Your name, email address, phone number, residential address, WhatsApp number, age, medical history, health concerns, wellness goals, and any other Personal Data You provide Us in the form.

To onboard You as Our client and to provide the Services You have subscribed to.

To notify You of any alerts or updates related to the Platform or the Services.

To send You information about any of Our new services, products, events, or programs that may be of Your interest.

Onboarding Purpose: Legitimate Use Section 7(a) of DPDPA.

Marketing or Promotional Purpose: Consent Section 6 of DPDPA.

Individual who subscribes to Our services. Your bank account and card details. To initiate payment for Our services. Legitimate Use Section 7(a) of DPDPA.
Individual who is Our client or a Website visitor who provides certain information while (a) filling out a survey about their user experience or feedback; (b) contacting Us or speaking to Our representatives. Information You have provided as part of it.

To improve the Platform and/or Services.

To communicate the feedback to the Physicians and/or Diet Coaches or any other professional who assist Us in providing the Services to You.

To respond to Your comments, queries or questions, if any.

Legitimate Use Section 7(a) of DPDPA.
Our client who raises a customer support request. Your name, email, phone number, WhatsApp number, client reference number and any other information You provide Us as part of the support request.

To respond to Your comments, and questions and provide customer services.

To communicate the feedback to the Physicians and/or Diet Coaches or any other professional who assist Us in providing the Services to You.

Legitimate Use Section 7(a) of DPDPA.
Our client who provides reviews/feedback for Our Services. Information You have provided as part of it.

To improve Our Services.

To publicly display such ratings and reviews/feedback.

Legitimate Use Section 7(a) of DPDPA.
Our client who subscribes to or purchases Our (a) blood check-up services; (b) CGM machine, Wearable band or body composition pod; (c) AI-assisted health profiling service; (d) consultation service with Physicians and/or Diet Coaches; and (e) any other service that We provide, opted in by You. Depending on the Service You have subscribed to, We may collect Your name, client identifier, phone number, email address, appointment details, relevant health history, current medications, allergies, lifestyle inputs, dietary restrictions, blood sample identifiers, lab reports, biomarker data such as gut microbiome data, urine test data, genomic data, epigenetic data, weight, body metrics such as BMI, body fat percentage, muscle mass and any other information You provide Us for availing the Services from Us. To provide You the Services You have subscribed to. Consent: Section 6 of DPDPA
Physician and/or Diet Coaches or any other professional onboarded onto YouLabs to provide the Services to Our clients. Your name, email address, phone number, residential address, educational qualification, past employment details, certifications, bank account, PAN details and any other information required before onboarding You as Our partner.

To evaluate and onboard You as Our partner to assist Us in providing the Services to the clients.

To send client reports to You and appointment details.

To manage Your consultation sessions.

To make payment for the service You provide.

Where Physicians and/or Diet Coaches have voluntarily provided their Personal Data: Legitimate Use Section 7(a) of DPDPA.

In all other instances, the basis of Processing will be: Consent Section 6 of DPDPA.

Vendor or partner representative who is notified to Us as the contact person when We avail the vendor/partner services. Your name, email address, designation, employer name, and phone number. Your bank account details and PAN details, where You are an individual vendor.

To communicate with You regarding the services We are availing from the vendor/partner.

To fulfil our payment obligations to you and to comply with our statutory obligations.

Legitimate Use Section 7(a) of DPDPA.
Individual who applies for an employment opportunity with Us Your contact information such as full name, email address, phone number, details of Your educational qualification and previous employment, and other information You volunteer during the interview or Your interactions with Us and contained in the resume that You submit to Us To evaluate You for any position that You have applied for or that We may consider You at the time that You submitted Your resume or at a later date. Legitimate Use Section 7(i) of DPDPA.

2.2 Personal Data that we collect not provided directly by you

When you are What Personal Data collected Purpose of Processing Legal Basis
Individuals who visit the Website

IP address, device information, browser type, crash logs, interaction logs.

Your browser information such as Your preferences, and settings such as pages viewed, features used, session duration, browsing information collected through first-party and/or third-party cookies on the Website.

Information relating to Your query logs.

To protect Our Platform from threats, violations, and breaches, if any.

To develop, improve, support, and operate the Platform and/or the Website.

Ensuring the proper functioning of the Website.

Detect, prevent, and respond to security incidents, malicious activity, and abuse of the Platform and/or the Website.

Improving or supporting the Platform and/or the Website: Consent: Section 6 of DPDPA.

Processing to protect the security of the Platform and/or the Website and to prevent or investigate any security incident: Exempted under Section 17(c) of DPDPA.

Individual who interacts with Us on WhatsApp Your WhatsApp number, messages shared on WhatsApp, timestamps, read receipts, delivery status, chat identifiers. To communicate with You for providing the Services.

Where You initiate the conversation: Legitimate Use Section 7(a).

Other circumstances: Consent Section 6 of DPDPA.

Client who subscribes to (a) CGM and Wearable monitoring services; (b) Physician or Diet Coach consultation services and/or (c) AI-assisted health profiling services. Wearable Data, YouLabs Wellness Index, consultation reports provided by Physicians and/or Diet Coaches.

To provide the Services to You.

To assist the Physicians and/or Diet Coaches in providing the Services to You.

Consent: Section 6 of DPDPA.

Where the legal basis of Processing is consent, We will obtain Your consent upon providing You with a notice in the manner prescribed under Applicable Data Protection Laws.

If You provide Us with any Personal Data relating to other individuals, You represent that You have the authority to do so, and, where required, have obtained the necessary consent, and acknowledge that it may be used in accordance with this Policy. If You believe that Your Personal Data has been provided to Us improperly, please contact Us by using the information in the Grievance Redressal Section.

3. International transfer

  1. We mainly Process Personal Data in India. However, We may transfer Personal Data outside India only for the purposes referred to in clause 2. We will ensure that the recipient of Your Personal Data offers an adequate level of protection that is at least comparable to that which is provided under Applicable Data Protection Laws.
  2. We will ensure that any international transfer of Your Personal Data will be in accordance with the Applicable Data Protection Laws. We will not transfer Personal Data to any country that is notified as restricted by any Applicable Data Protection Laws or an appropriate government having jurisdiction over Your Personal Data.

4. Security of Personal Data

We use appropriate technical and organizational measures to protect the Personal Data that We collect and Process. The measures We use are designed to provide a level of security appropriate to the risk of Processing Your Personal Data and at a minimum shall include the following:

  1. encryption, obfuscation, masking, or virtual tokens;
  2. access controls to computer resources storing Personal Data;
  3. logging and monitoring to detect and remediate unauthorized access to Personal Data;
  4. measures to ensure continued processing in case of destruction or loss of access to Personal Data;
  5. measures for enabling detection of unauthorised access and measures to prevent recurrence;
  6. retention of relevant logs and data for at least one year; and
  7. measures to review and audit the security safeguards periodically.

5. Retention of Personal Data

  1. We retain Your Personal Data:
    1. for as long as it is necessary to fulfil the purpose for which it was collected or,
    2. where We Process Your Personal Data based on Your consent, until You withdraw Your consent,
    Notwithstanding the above, We will retain Your Personal Data for a longer period if We are required to do so or permitted to do so under applicable law.
  2. In the absence of a need to retain Personal Data We will either delete it or aggregate it, or, if this is not possible then We will securely store Your Personal Data and isolate it from any further Processing until deletion is possible.

6. Your rights and duties

  1. Your Rights: Depending on the legal basis of Processing Your Personal Data, You may be entitled to some or all of the following rights:
    1. You can request access to Your Personal Data.
    2. You can request that We correct inaccurate Personal Data about You.
    3. You can request Us for deletion and erasure of Your Personal Data.
    4. You can nominate any other individual, who shall, in the event of Your death or incapacity, be allowed to exercise Your rights as prescribed under the Applicable Data Protection Laws. When You are nominating any person for the above-mentioned purpose, please share with Us their name, date of birth, gender, height and weight.
    5. If We have collected and Processed Your Personal Data with Your Consent, You are entitled to provide, manage, review or withdraw Your consent. You may withdraw your consent by emailing the grievance officer with the details provided under the Grievance Redressal Section. Withdrawal of Your consent for one purpose will not automatically result in withdrawal of consent for other purposes.
    6. You have the right to register any grievance that You may have in respect of Our collection and use of Your Personal Data.
  2. If You seek to exercise Your rights under this section, please contact Us with the details provided in the Grievance Redressal Section under clause 7. When you reach out to us, we may collect Your name, phone number, email address or client reference number to help us identify You.
  3. We will verify any request before acting on the request We receive from individuals wishing to exercise their data protection rights. We may reject Your request in certain circumstances where We are obligated not to share information with You, where there are exemptions that apply under Applicable Data Protection Laws or where We are unable to verify Your identity (or a nominee’s authority to make the request) and confirm the Personal Data We maintain relates to You.
  4. Your Duties: You as a Data Principal shall comply with the following:
    1. Comply with the provisions of the Applicable Data Protection Laws while exercising Your rights under the Applicable Data Protection Laws.
    2. Ensure that You do not impersonate another person while providing Personal Data to Us.
    3. Ensure that You do not register any false or frivolous grievance or complaint with Us or with the Data Protection Board of India.
    4. Furnish only such information as is verifiably authentic, while exercising Your right to correction or erasure under the Applicable Data Protection Laws.

7. Grievance redressal

Contact Information of our Grievance Redressal Officer and Grievance Redressal Process

Attention: Antara Sara, COO

Address: YouLabs, 11th Floor, The District, Myscape Road, Financial District, Nanakramguda, Hyderabad

Email Address: health@youlabs.co

When You reach out to Us, We may collect Your name, phone number, email address, or client reference number to help us identify You. We will address Your grievance or any data principal rights request within 90 (ninety) days of receiving Your request. If Your grievance is not resolved by Us, You may complain to the Data Protection Board of India in accordance with the Applicable Data Protection Laws.

8. Privacy of children and persons with disability

Individuals below the age of 18 or people with disabilities can sign up to Our Services or request Our Services only with the consent of their parent or a lawful guardian. We will employ measures to verify if an individual requesting our Services is a child or a person with disability. We will Process the Personal Data of a child, or a person with disability, only with the verifiable consent of their parent or lawful guardian, except where such Processing is permitted without consent under Applicable Data Protection Laws. If a parent or guardian becomes aware that his or her child or a person with disability has provided Us with Personal Data, they should write to Us at the email address provided in the Grievance Redressal Section. If We are informed that an individual under 18 or a person with disability has provided Us with Personal Data without obtaining the verifiable consent of the parent or a lawful guardian, We will take steps to delete such data as soon as possible.

9. Third-party websites

Our Website and/or Platform contain links to other websites. Our Policy applies only to Our Website and Platform, so if You click on a link to another website or platform, You should read their privacy policy. We encourage You to review the privacy statements of any such other websites to understand their Personal Data practices.

10. Changes to the Policy

We may update this Policy from time to time in response to changing legal, technical, or business developments. When We update Our Policy, We will take appropriate measures to inform You, consistent with the significance of the changes We make.

You can see when this Policy was last updated by checking the “Last Updated” date displayed at the top of this Policy.

Also see · Terms of Service