Privacy Policy

1. Who we are

This website (calmside.app, the “Site”) and the Calmside programme are operated by Modner Technologies Private Limited (“Modner”, “we”, “us”, “our”), a company incorporated in India.

We are the Data Fiduciary for the personal data described in this policy, within the meaning of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”).

2. What this policy covers, and what stage we are at

Calmside is in development. It has not been launched as a commercial product.

Right now the Site does three things:

1. Collects expressions of interest from people living with migraine, through a form where you can tell us about your migraine experience, your concerns and your questions.
2. Schedules and conducts research interviews with some of the people who fill in that form.
3. Will, at a later stage, invite a limited number of participants to use a pre-release version of the Calmside app free of charge for a defined evaluation period (currently intended to be 30 to 90 days) so that we can collect feedback and improve the product before any public launch.

This policy covers all three. Where the free evaluation programme introduces additional data handling, we will give you a separate, specific notice and ask for your consent again before you join it — this policy does not, by itself, authorise us to collect in-app health data from you.

Important: Calmside is not a medical device, is not approved or cleared by the Central Drugs Standard Control Organisation (CDSCO) or any other regulator, and is not a substitute for medical care.

3. The personal data we collect

3.1 Information you give us directly (the interest form)

Anything you type into a free-text box is up to you. Please do not share more clinical detail than you are comfortable with, and please do not send us documents, prescriptions, scan reports or lab results unless we specifically ask you for them in writing.

3.2 Information from research interviews

If you agree to an interview, we may collect:

• Notes taken during the conversation.
• An audio or video recording and a transcript — only if you give separate, explicit consent at the start of the session. You can decline the recording and still take part, and you can ask us to stop recording at any point.
• Your answers about your migraine history, treatment experience, daily impact and what you would want from a product.

3.3 Information collected automatically

The Site is built to be light on tracking. We use strictly necessary cookies and equivalent technologies only — see Section 9. Our hosting and database providers automatically process limited technical data (IP address, browser and device type, pages requested, timestamps) in server and security logs, which is necessary to serve the Site and protect it from abuse.

We use Vercel Web Analytics and Vercel Speed Insights, provided by our hosting provider, to count page visits and measure how quickly pages load. They are cookieless, do not identify you, and do not follow you across other websites.

We do not run advertising pixels, marketing trackers, cross-site tracking, or any cookie-based analytics on the Site as at the effective date above. If that changes, we will update this policy and ask for your consent through a cookie banner before setting any non-essential cookie.

3.4 What we do not want and do not knowingly collect

• Government ID numbers (Aadhaar, PAN, passport, driving licence).
• Payment card or bank account details — the programme is free and we will never ask you to pay.
• Biometric identifiers.
• Full medical records, hospital files or insurance documents.

If you send us any of the above unprompted, we will delete it rather than store it, unless we are legally required to keep it.

4. Why we use your data, and our lawful basis

Under the DPDP Act, we process your personal data on the basis of your consent, which you give when you submit the form and, separately, when you agree to an interview or to the evaluation programme.

We do not sell your personal data. We do not share it with advertisers. We do not use it to train publicly available AI models.

4.1 How research findings are used

Insights from your form responses and interviews inform product design. When we write up or present findings — internally, to advisors, to investors, or in any publication — we use them in aggregated or de-identified form, with direct identifiers removed. We will not quote you by name or in any way that identifies you without asking you separately and getting your written agreement.

Please note that de-identified data can, in some circumstances, still be linked back to a person, so we continue to treat it carefully rather than calling it “anonymous”.

5. Children and young people

Migraine affects children and adolescents, and we recognise that a young person may want to take part.

Under the DPDP Act, anyone under 18 is a Child, and we must obtain verifiable consent from a parent or lawful guardian before processing their personal data. We must also not track or behaviourally monitor children, or direct advertising at them — which we do not do for anyone.

Accordingly:

• The interest form asks you to confirm you are 18 or over.
• If you are under 18, please do not submit the form yourself. Ask a parent or guardian to write to us at connect@modnertech.com and we will handle consent properly before collecting anything.
• If we discover that we have collected a young person’s data without verifiable parental consent, we will stop processing it and delete it.
• A parent or guardian may contact us at any time to withdraw consent and have their child’s data erased.

6. Who we share your data with

We keep the circle small. Your data may be handled by:

Each provider is engaged as a Data Processor under contract, may use your data only on our instructions, and may not use it for their own purposes.

Clinical collaborators: Modner has an investigational clinical collaboration with a hospital partner. Data collected through this Site is not shared with that partner and is not used as clinical trial data. Any clinical study is a separate activity with its own ethics-committee-approved consent process, which you would join only by signing a separate informed consent form.

7. Where your data is stored and processed

Form submissions are stored in a database hosted in India (Mumbai region). Some of our service providers may process limited data (for example, email in transit, or log data) outside India. Where that happens, we require contractual protections and rely on providers operating under recognised security standards. We do not transfer personal data to any country or territory that the Central Government has restricted under Section 16 of the DPDP Act.

8. How long we keep it

We will delete your personal data sooner if you withdraw consent or ask us to erase it, unless we are required to retain it for a legal purpose.

9. Cookies and similar technologies

9.1 What we use

As at the effective date of this policy, the Site uses only strictly necessary cookies and equivalent storage:

Strictly necessary cookies and storage do not require your consent, because the Site cannot function properly without them. They do not profile you or follow you across other websites.

9.2 Analytics

We use Vercel Web Analytics and Vercel Speed Insights, which set no cookies and do not track you across websites (see Section 3.3). We do not use Google Analytics, Meta Pixel, or any other cookie-based analytics or advertising tool. If we introduce one, we will:

1. Update this section and the “last updated” date;
2. Show a cookie consent banner with a genuine “Reject all” option that is as easy to use as “Accept”;
3. Set no non-essential cookie until you actively accept; and
4. Give you a way to change your mind at any time.

9.3 Controlling cookies

You can block or delete cookies and site storage in your browser settings. Blocking essential cookies may stop the form from working.

10. Your rights

Under the DPDP Act, you have the right to:

• Access — get a summary of the personal data we hold about you and how we process it.
• Correction, completion, updating and erasure — have inaccurate data fixed or your data deleted.
• Withdraw consent — at any time, as easily as you gave it. Withdrawal does not affect processing already carried out lawfully.
• Grievance redressal — complain to us first, and receive a response.
• Nominate — name someone to exercise your rights if you die or become incapacitated.
• Complain to the Data Protection Board of India if you are not satisfied with our response.

You also have a duty, under the Act, to provide authentic information and not to file false or frivolous grievances.

How to exercise a right

Email connect@modnertech.com with your request and the email address you used on the form. We will verify it is you, and respond within 30 days.

To leave the programme entirely, one line — “please delete my data” — is enough. We will confirm once it is done.

11. Grievance officer

If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India.

12. How we protect your data

• Data stored in a managed database in India with row-level security so that a record is only reachable by authorised server-side processes.
• Service credentials held server-side only, never exposed in the browser.
• Encryption in transit (HTTPS/TLS) and at rest, as provided by our infrastructure providers.
• Access limited to the Modner team members who need it for the programme.
• Spam and bot protection on the form.

No system is perfectly secure. If a personal data breach occurs, we will notify each affected person and the Data Protection Board of India in the manner and within the timelines required by the DPDP Rules.

13. Regulatory context

The DPDP Act, 2023 and the DPDP Rules, 2025 are being brought into force in phases, with the substantive obligations relating to notice, consent, children’s data, security safeguards and breach reporting applying from 13 May 2027. We have chosen to align with those requirements now rather than wait, because we are asking people to share sensitive information about their health.

14. Changes to this policy

If we make a material change — new purposes, new recipients, new cookies — we will update this page, change the “last updated” date, and, where the change affects data we already hold, email registered participants before it takes effect. Where the law requires fresh consent, we will ask for it.

15. Contact

Modner Technologies Private Limited
Ward No. 4, Rosera, Prabhu Thakur Mohalla, Rosera, Samastipur, Bihar 848210
General and privacy / data rights: connect@modnertech.com