Privacy Policy

This Privacy Policy describes how Form8 Life Sciences Pvt Ltd (“Form8”, “we”, “us”, “our”) collects, uses, stores, discloses, and otherwise processes personal data when you visit https://formeight.in, use our waitlists, contact us, or otherwise interact with our services in India. We are committed to handling personal data in line with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), applicable rules issued thereunder, and other laws as they apply to us from time to time.

By using our website or submitting information to us, you acknowledge that you have read this Policy. If you do not agree, please discontinue use of our services. Where the law requires consent for certain processing, we will ask for it in a clear and specific manner before we proceed.

Who we are

The data fiduciary responsible for your personal data is Form8 Life Sciences Pvt Ltd, with its principal place of business at Flat 101, 1st Floor, Malleshwaram, Bengaluru, Karnataka – 560003. For privacy-related questions, you may write to us at info@formeight.in.

Lawful basis and purpose

We process personal data only where we have a lawful basis under the DPDP Act and applicable law. Typical bases include: your consent (for example, when you subscribe to updates or submit optional information); performance of a contract or steps taken at your request prior to entering a contract (for example, processing your name, contact details, and delivery address to fulfil an order once commerce is enabled); and legitimate uses that are necessary for compliance with law or for limited purposes described in the DPDP Act and rules (for example, maintaining records required by consumer-protection or tax law).

We do not sell or rent your personal data. We do not use your data for automated decision-making that produces legal or similarly significant effects concerning you, except where expressly permitted by law and disclosed to you in advance.

Categories of data we collect

Depending on how you interact with us, we may collect identifiers (such as name, email address, phone number), commercial information (such as products you expressed interest in or orders you place once checkout is live), internet or electronic network activity (such as IP address, device type, browser type, pages viewed, and referring URLs), and communications you send to us (including support messages and optional survey responses). We collect only what is reasonably necessary for the stated purposes.

Cookies and analytics (Google Analytics 4)

We use cookies and similar technologies to operate the site, remember preferences where applicable, and understand aggregate traffic patterns. We use Google Analytics 4 (“GA4”) to measure site performance and campaign effectiveness. GA4 may collect online identifiers and usage data subject to Google’s terms and privacy policy. Where required, we will obtain your consent before deploying non-essential cookies or similar trackers, and we will provide a clear way to withdraw consent or manage preferences.

You can control cookies through your browser settings. Blocking certain cookies may affect site functionality.

Storage, security, and retention

We use service providers and cloud infrastructure that may process data in India or, where unavoidable for a given tool, in other jurisdictions with appropriate safeguards as required by law. We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, or misuse. No method of transmission over the internet is completely secure; we encourage you to use strong, unique passwords where accounts exist.

We retain personal data only for as long as necessary for the purposes described in this Policy, including to comply with legal, accounting, and regulatory obligations. As a general matter, customer and transactional records are retained for at least three years where Indian consumer and commercial law so requires, unless a longer period is mandated for a specific category. After retention periods expire, we delete or irreversibly anonymise data where feasible.

Disclosures

We may disclose personal data to trusted service providers who assist us with hosting, email delivery, analytics, payment processing, logistics, fraud prevention, and customer support, strictly on a need-to-know basis and under written contracts that require appropriate confidentiality and security. We may disclose information if required by law, court order, or lawful government request, or to protect the rights, property, or safety of Form8, our customers, or the public.

Your rights as a data principal

Subject to the DPDP Act and applicable rules, you may have the right to access information about personal data we hold about you; request correction of inaccurate or incomplete data; request erasure where retention is no longer necessary for the purpose or where consent is withdrawn and no other lawful basis applies; request restricted processing in prescribed circumstances; and seek grievance redressal as described below. Where the law provides for data portability in a structured, machine-readable format, we will comply to the extent technically feasible and legally required.

To exercise these rights, email info@formeight.in with a clear description of your request and enough information for us to verify your identity. We will respond within the timelines prescribed under law, typically within thirty (30) days unless a shorter period applies or we notify you of a lawful extension.

Grievance officer

In accordance with the DPDP Act and rules, we designate the following grievance officer for India: [Grievance Officer name], [designation]. Contact: info@formeight.in; phone: [phone number]. Grievances will be acknowledged and addressed as required by law.

Children

Our services are not directed to children under eighteen (18) years of age in a manner that requires collection of personal data without verifiable parental consent where such consent is mandated. If you believe we have collected data from a child in error, contact us and we will take appropriate steps to delete it.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. We will post the revised Policy on this page and update the “Last updated” date. Where changes are material and consent-based processing is affected, we will obtain fresh consent as required.