Tracky Privacy Policy New Phone Generation 1. INTRODUCTION This Privacy Policy (“Privacy Policyˮ or “Policyˮ) explains how Drstore Healthcare Services India Pvt. Ltd. (“DrStoreˮ, “weˮ, “usˮ, or “ourˮ) collects, receives, uses, stores, processes, protects, shares, and otherwise handles personal information and health-related information through its Tracky brand and the Tracky Health App. Tracky is a brand owned and operated by DrStore. Tracky is not a separate legal entity from DrStore. The Tracky Health App is a digital health application made available by DrStore under the Tracky brand. The App may enable users to record, monitor, manage, and access information relating to health and wellness, including information received from compatible connected devices. This Privacy Policy applies to information collected through the Tracky Health App and associated services, including the Tracky Health Cloud, which is used to store and process information associated with the Tracky Health App. By accessing, registering for, or using the Tracky Health App, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, storage, processing, and disclosure of information as described herein, subject to applicable law and your rights under such law. 2. Definitions For this Privacy Policy, “DrStoreˮ refers to Drstore Healthcare Services India Pvt. Ltd., the legal entity responsible for the Tracky brand, Tracky Health App, and related Tracky health technology services, with its registered/business address at SA 44, 2nd Floor, Lake City Mall, Ghod Bunder Road, Kapurbawdi, Thane, Maharashtra, India – 400607. “Trackyˮ refers to the healthcare technology brand owned and operated by DrStore, including its digital health products, services, platforms, and technologies. Tracky is not a separate legal entity from DrStore. “Tracky Health Appˮ or “Appˮ refers to the mobile application provided by DrStore under the Tracky brand for health management, monitoring, recording, and related functionalities. “Userˮ, “youˮ, or “yourˮ refers to any individual who accesses, registers for, or uses the Tracky Health App. “Personal Informationˮ means information that identifies or can reasonably be associated with an identifiable individual. “Health Informationˮ means information relating to an individualʼs health, medical condition, physical or physiological characteristics, health status, treatment, monitoring, or wellness. “Biometric/Health Dataˮ may include information such as blood pressure, heart rate, weight, height, glucose levels, respiratory rate, oxygen saturation, body temperature, food logs, activity information, and basic clinical or medical history, to the extent such information is collected or provided through the Tracky Health App or compatible devices. 3. DrStore, Tracky and Tracky Health App Drstore Healthcare Services India Pvt. Ltd. (“DrStoreˮ) owns and operates the Tracky brand and provides the Tracky Health App and associated Tracky Health services. Tracky is the brand, while the Tracky Health App is the mobile application provided by DrStore under that brand, and the Tracky Health Cloud refers to the cloud environment used in connection with the App. References to “Trackyˮ in this Privacy Policy may refer to the Tracky brand, products, services, or technology operated by DrStore. All legal, data-protection, privacy, user-rights, complaint, consent, and related responsibilities described in this Policy rest with DrStore, subject to applicable law. Last Updated: September 2026

New Phone Generation 4. Legal Statement and Intellectual Property Rights The DrStore, Tracky, and Tracky Health names, logos, designs, trademarks, software, content, documentation, graphics, and other intellectual property are owned by DrStore or their respective rights holders. This Privacy Policy does not grant users any ownership, licence, or other rights to such intellectual property except where expressly permitted by law or an applicable agreement. Materials made available through the Tracky Health App, Tracky Health Cloud, or associated services are owned, licensed, or lawfully provided by DrStore or the relevant rights holder. Any unauthorised reproduction, modification, distribution, publication, transmission, display, commercial use, or other use of such intellectual property is not permitted. 5. Background and Purpose The Tracky Health App is designed to help users record, monitor, organise, and access health-related information. The App may connect with Bluetooth-enabled Continuous Glucose Monitoring (CGM), Body Composition Scale (BCA), Blood Pressure Monitor (BP), Pulse Oximeter and Thermometer devices and other compatible health or vital-sign devices. Depending on the features available, users may enter information such as blood glucose levels, blood pressure, heart rate, weight, height, food and nutrition, physical activity, and other health or medical information. This information may be transmitted to and stored in the Tracky Health Cloud. Where healthcare-provider functionality is available, authorised healthcare professionals may access relevant user or patient information in accordance with applicable permissions, account settings, contractual arrangements, and applicable law. 6. No Medical Advice The Tracky Health App and associated Tracky services are intended to support health monitoring and information management and are not a substitute for professional medical advice, diagnosis, treatment, or care. DrStore does not act as a medical provider solely through the provision of the App or related technology services. Users are encouraged to consult a qualified healthcare professional regarding medical conditions, diagnosis, treatment decisions, medication, or changes in health status. Unless specifically provided as part of a separate service or agreement, DrStore does not independently notify healthcare professionals of changes in a userʼs health information. 7. Unauthorised Third-Party Products and Devices The Tracky Health App may support certain compatible devices, products, and services. DrStore is not responsible for health information generated by unauthorised, unsupported, modified, counterfeit, defective, or incompatible third-party devices. Compatible products should be used in accordance with the relevant manufacturerʼs instructions. Third-party products and services may also have their own privacy policies and terms governing how they collect and process information. 8. Scope of This Privacy Policy This Privacy Policy applies to personal and health-related information submitted through the Tracky Health App, collected through its supported features, received from compatible connected devices, stored or processed through the Tracky Health Cloud, or otherwise processed by DrStore in connection with Tracky Health services. Other DrStore websites, applications, products, or services may be governed by separate privacy notices.

New Phone Generation 9. Information We Collect Depending on the features used and permissions provided, DrStore may collect account information such as your name, date of birth, country, email address, and authentication details. The App may also collect health and biometric information, including blood glucose, blood pressure, heart rate, weight, height, respiratory rate, oxygen saturation, body temperature, food and activity information, and other health or medical information. Technical and usage information, such as device type, operating system, App version, connectivity, diagnostic information, and App interactions, may also be collected to support and improve the service. 10. How Information Is Collected Information may be collected when you create or update your account, enter information manually, connect compatible health devices, receive data from connected devices, use App features, communicate with customer support, or interact with authorised healthcare providers or organisations. Certain technical, analytics, SDK, cookie, or similar technologies may also collect information where applicable and permitted by law. 11. Device Permissions Certain Tracky Health App features may require permissions such as Bluetooth, notifications, internet or network access, device storage, camera access, and health-related device integrations. The permissions required may vary depending on your device, operating system, App version, and the features you use. These permissions can generally be managed through your device settings, although restricting them may affect certain App features. 12. How We Use Personal Information DrStore may use personal and health-related information to provide and manage the Tracky Health App, record and display health information, connect compatible devices, support authorised healthcare access, provide customer support, improve the App and Tracky Health Cloud, resolve technical issues, maintain security, conduct analytics and quality activities, support research and service improvement, and comply with legal or regulatory requirements. Information may also be used for other purposes permitted by applicable law or communicated to users. 13. Data Analysis, Research and Improvement DrStore may analyse information to improve Tracky products and services, enhance health-data management, develop software and system updates, improve security and reliability, understand trends and usage patterns, and support research and innovation relating to health and wellness. Where appropriate, information may be de-identified, pseudonymised, aggregated, or anonymised for these purposes and may be shared with permitted researchers, healthcare entities, service providers, or other authorised recipients in accordance with applicable law. 14. Separation of Account and Health Information DrStore maintains appropriate technical and administrative measures to help separate account-related information from health-related information where required. Information may nevertheless be associated when necessary to provide App functionality, maintain security, provide support, comply with legal requirements, or carry out authorised processing. 15. Healthcare Provider Access Certain Tracky Health App features may allow authorised healthcare professionals or healthcare organisations to access relevant user information. Such access is subject to applicable permissions, account settings, contractual arrangements, and legal requirements. Healthcare providers and organisations may also have their own privacy obligations and policies.

New Phone Generation 16. Legal Basis and User Authorisation DrStore may process personal information based on applicable legal grounds, including user consent, providing requested services, complying with legal or regulatory obligations, protecting vital interests, legitimate purposes permitted by law, public-health purposes, and other lawful grounds. Where consent is required by applicable law, it will be obtained through an appropriate process. 17. Sharing of Information DrStore may share personal information were permitted or required by applicable law, including with authorised healthcare professionals or organisations, service providers, technology and cloud providers, security and analytics providers, professional advisers, and permitted affiliates. Information may also be disclosed in connection with corporate transactions, legal or regulatory requirements, or to protect the rights, property, safety, and security of DrStore, users, or others. Third parties receiving information may be subject to appropriate confidentiality and security obligations. 18. Public Disclosure DrStore does not intentionally make personal health information publicly available unless the User has authorised the disclosure, the information has been appropriately anonymised, aggregated, or de- identified, disclosure is required or permitted by applicable law, or another legally recognised exception applies. 19. Circumstances Where Consent May Not Be Required Where permitted or required by applicable law, DrStore may process or disclose information without separate consent for purposes such as national security, public security or health, legal or regulatory compliance, criminal investigations, court orders, protection of life or safety, or other legally recognised purposes. This may also apply to information voluntarily made public by the User or information lawfully available to the public. 20. Data Retention DrStore retains personal information for as long as reasonably necessary to provide Tracky Health services, maintain accounts, fulfil the purposes for which the information was collected, meet legal and regulatory obligations, resolve disputes, enforce agreements, and protect legitimate business interests. Following account deletion, applicable information may be deleted or anonymised, while information that is aggregated, anonymised, de-identified, or required to be retained by law may continue to be retained. 21. Information Security DrStore maintains reasonable administrative, technical, organisational, and physical safeguards designed to protect personal and health-related information from unauthorised access, disclosure, loss, misuse, alteration, destruction, or other unauthorised processing. These measures may include access controls, authentication, encryption, monitoring, secure infrastructure, and confidentiality requirements. While appropriate safeguards are maintained, no electronic transmission or storage system can be guaranteed to be completely secure. Users are also responsible for maintaining the security of their account credentials and devices. 22. Tracky Health Cloud and AWS The Tracky Health Cloud may use infrastructure provided by Amazon Web Services (AWS). Under the current setup, applicable cloud data is intended to be stored in regional infrastructure located in India, subject to the applicable service architecture, legal requirements, and operational needs. AWS maintains various security certifications and compliance programmes, including ISO 27001, ISO 27017, ISO 27018, PCI DSS Level 1, SOC 1, SOC 2, and SOC 3. These certifications apply to the relevant AWS infrastructure and do not constitute certification of DrStore, Tracky, or the Tracky Health App.

New Phone Generation 23. International Storage and Transfer Where personal information is transferred, accessed, processed, or stored outside India, DrStore will take reasonable measures to comply with applicable privacy and data-protection requirements. Such transfers may occur through cloud infrastructure, technology or service providers, business operations, corporate transactions, or other lawful activities. Where required by applicable law, appropriate consent, safeguards, contractual protections, or other transfer mechanisms will be applied. 24. Data Breach and Security Incidents DrStore maintains processes to identify, assess, investigate, contain, and respond to suspected security incidents involving personal information. Where applicable law requires notification of a data breach, the relevant regulatory authorities and/or affected individuals will be notified within the applicable timeframe and in accordance with legal requirements. Depending on the circumstances, DrStore may also take measures such as containing the incident, investigating its cause, restricting access, resetting credentials, implementing additional safeguards, and providing relevant guidance to affected Users. 25. Marketing and Promotional Communications Subject to applicable law and consent requirements, DrStore and its affiliates may communicate with Users about Tracky products and services, health-management products, surveys, newsletters, offers, promotions, and related services. Where required, appropriate consent will be obtained. DrStore does not sell personal health information for direct marketing purposes. Users may opt out of marketing communications through the available unsubscribe option or by contacting info@drstore.in. Service, security, transactional, regulatory, and other necessary communications may continue where required. 26. Children and Paediatric Users The Tracky Health App may process information relating to children where the service is intended or permitted for paediatric health management. Where required by applicable law, appropriate consent or authorisation may be obtained from a parent or legal guardian. A parent or legal guardian may contact DrStore regarding access, correction, or deletion of a child's information, subject to applicable law and appropriate verification. Aggregated, anonymised, or de-identified information may continue to be retained where legally permitted. 27. Cookies, SDKs and Analytics Technologies The Tracky Health App and associated services may use cookies, SDKs, analytics technologies, logs, and similar technologies for purposes including App functionality, authentication, security, performance monitoring, error reporting, service improvement, analytics, and understanding usage patterns. Where required by applicable law, appropriate notice and/or consent will be provided. Third- party analytics and technology providers may process limited technical information subject to applicable contractual and legal requirements. 28. Your Privacy Rights Subject to applicable law, Users may have rights relating to their personal information, including the right to access, correct, delete, or request information about its processing, withdraw consent where applicable, request data portability where legally available, object to or restrict certain processing, and lodge a complaint with the relevant authority. The availability and scope of these rights may vary depending on the applicable law and circumstances. 29. Access to Personal Information Users may access certain account information through the Tracky Health App. Where information is not directly accessible through the App, requests may be submitted to info@drstore.in. DrStore may request reasonable information to verify the identity of the person making the request.

New Phone Generation 30. Correction of Information Users may update certain account information through the App settings. Where health or biometric information cannot be corrected directly through the App, Users may contact info@drstore.in for assistance. Reasonable identity verification may be required before information is updated. 31. Withdrawal of Consent and Permissions Where processing is based on consent, Users may withdraw their consent subject to applicable law and any relevant contractual or technical limitations. Device permissions can also be managed through device settings. Withdrawing consent or permissions may affect certain Tracky Health App features, but will not affect processing that DrStore is legally permitted or required to continue. 32. Deletion of Personal Information Users may request deletion of their personal information by contacting info@drstore.in. Deletion requests may be considered where information is no longer required, processing is unlawful, consent has been withdrawn where applicable, or where a right to deletion is provided by law. Deletion may remain subject to legal, regulatory, security, contractual, or legitimate retention requirements, and certain deleted information may not be recoverable. 33. Account Cancellation Users may cancel their Tracky Health account through the available account-management options. Where supported by the App, the cancellation pathway may be Tracky Health App → Left Pull Menu → About → Cancel. The exact navigation may change with future App versions. Account cancellation does not necessarily result in immediate deletion of information that DrStore is required or permitted to retain under applicable law. 34. Tracky Health Account Deletion Account deletion may result in the deletion or de-identification of applicable personal and health- related information, subject to legal and operational requirements. Following deletion, DrStore and authorised healthcare providers may no longer be able to access information through the deleted account. Deleting a Tracky Health account does not necessarily affect separate accounts, patient profiles, healthcare relationships, or services maintained by healthcare providers or other organisations. 35. Data Portability Where required by applicable law and technically feasible, Users may request their personal information in a structured, commonly used, and machine-readable format. The scope of portability depends on applicable law, the type of information, security requirements, and technical capabilities. Appropriate identity verification may be required before fulfilling a request. 36. Third-Party Services and Links The Tracky Health App may interact with third-party services, devices, platforms, healthcare providers, or websites. These third parties may have their own privacy policies and terms. DrStore is not responsible for the privacy practices of independent third parties that it does not control, and Users are encouraged to review the relevant privacy notices before providing information to them. 37. HIPAA, PIPEDA, HIA and Other Privacy Laws Depending on the User, service, processing activity, healthcare organisation, and applicable jurisdiction, information processed through Tracky Health may be subject to relevant privacy and health-information laws, including the Information Technology Act, 2000, SPDI Rules 2011, Digital Personal Data Protection Act, 2023, HIPAA, PIPEDA, applicable Health Information Acts (HIA), and other applicable privacy, data-protection, health-information, cybersecurity, and consumer-protection laws.

New Phone Generation The applicability of any particular law depends on the relevant jurisdiction, activity, entity, contractual relationship, and legal requirements. Where applicable, DrStore will implement appropriate processes and safeguards consistent with the relevant requirements. 38. Business Associates and Healthcare Organisations Where DrStore provides Tracky technology or services to healthcare organisations or other regulated entities, separate agreements may govern matters such as data processing, confidentiality, security, health information, and regulatory obligations. Where applicable, these arrangements may include requirements relating to HIPAA, business associates, data processors, or similar legal relationships and may establish additional obligations beyond this Privacy Policy. 39. Government, Public Health and Legal Requests DrStore may disclose personal or health-related information where required or permitted by law, including in response to court orders, legal processes, regulatory or government requests, law- enforcement requirements, public-health requirements, national security matters, or other legally authorised requests. Where legally permitted, affected Users may be notified. Information may also be disclosed where reasonably necessary to protect the life, safety, property, rights, or security of Users, DrStore, or others. 40. User Account Security Users are responsible for maintaining the confidentiality and security of their account credentials, passwords, authentication information, devices, and other account-security information. Users are encouraged to contact DrStore promptly if unauthorised access is suspected. To the extent permitted by applicable law, DrStore is not responsible for security incidents resulting solely from a userʼs failure to maintain reasonable security over their account or device. 41. Marketing Opt-Out Users may opt out of marketing communications through the unsubscribe option, available communication preferences, applicable account settings, or by contacting info@drstore.in. Opting out of marketing communications does not prevent DrStore from sending necessary service-related, security, transactional, legal, or other non-marketing communications. 42. Privacy Requests and Grievance Redressal Users may contact DrStore regarding privacy concerns, access or correction requests, deletion requests, consent withdrawal, data-security concerns, questions about data processing, complaints, or other privacy-related matters at info@drstore.in. Requests will be reviewed and addressed in accordance with applicable law and applicable statutory or reasonable timelines. DrStore may request information necessary to verify the identity or authority of the person making the request. 43. Contact Information Drstore Healthcare Services India Pvt. Ltd. SA 44, 2nd Floor, Lake City Mall, Ghod Bunder Road, Kapurbawdi, Thane, Maharashtra, India – 400607 Email: info@drstore.in For privacy-related matters, Users are encouraged to provide sufficient information to help DrStore understand and process their request.

New Phone Generation 44. Changes to This Privacy Policy DrStore may update this Privacy Policy from time to time to reflect changes to the Tracky Health App, Tracky services, technology, business operations, applicable laws, or privacy and security practices. Updated versions will be made available through the Tracky Health App or other appropriate channels. Where required by law, additional notice or consent will be provided before material changes take effect. Users may also be notified through email, in-app notifications, or other appropriate methods. 45. Governing Law and Jurisdiction This Privacy Policy is governed by the laws of India, except where mandatory laws of another jurisdiction apply to a particular User or processing activity. Subject to applicable law, disputes relating to this Privacy Policy will be subject to the jurisdiction of the competent courts having jurisdiction over DrStore's applicable place of business. Nothing in this section limits any mandatory consumer, privacy, data-protection, or health-information rights that cannot legally be excluded or restricted. 46. Severability If any provision of this Privacy Policy is determined to be invalid, unlawful, or unenforceable by a competent authority, the remaining provisions will continue to apply to the fullest extent permitted by law. The affected provision may be interpreted or modified as necessary to make it legally enforceable while preserving its intended purpose as far as legally permissible. 47. Entire Privacy Notice This Privacy Policy, together with any applicable terms, notices, consents, and agreements referenced herein, governs the processing of personal information through the Tracky Health App and associated Tracky Health services, unless a separate privacy notice or agreement applies. Where DrStore has entered into a separate agreement with a healthcare organisation, business customer, or regulated entity, that agreement may include additional privacy and data-protection obligations. 48. Document Control Policy Name: Tracky Privacy Policy Brand: Tracky Application: Tracky Health App Parent / Legal Entity: Drstore Healthcare Services India Pvt. Ltd. Associated Cloud Service: Tracky Health Cloud Version: 1.0 Effective / Last Updated: September 2026 Important Clarification For clarity, Drstore Healthcare Services India Pvt. Ltd. is the legal entity responsible for the services described in this Policy. Tracky is a brand owned and operated by DrStore, while the Tracky Health App is an application provided by DrStore under the Tracky brand. Tracky Health Cloud refers to the associated cloud environment or service used by DrStore in connection with the App. Nothing in this Privacy Policy establishes Tracky or the Tracky Health App as a separate legal entity from DrStore. © Drstore Healthcare Services India Pvt. Ltd. All rights reserved.

SHOP

TRACKY APP

COMPANY

SUPPORT

LEGAL

SHOP

TRACKY APP

COMPANY

SUPPORT

LEGAL