FIDDLEFITT LIFE PRIVATE LIMITED

(carrying on business as “FiddleFitt Life”)

1. PURPOSE AND SCOPE

   1. This Information Security Policy is adopted by Fiddlefitt Life Private Limited (the “Company”) as its documented information security programme for the purposes of Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and as the framework through which it will meet its obligations to protect personal data under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”) as those provisions come into force.

   2. Scope: This Policy applies to every director, employee, intern and independent contractor of the Company, and to every vendor or other person who accesses the Company’s information or systems on its behalf (each, a “Covered Person”). It governs all information held by the Company in any form, and all devices, accounts, applications and premises used to create, receive, store, transmit or dispose of that information.

   3. Relationship with Other Documents: This Policy is to be read with the Company’s Privacy Policy, which states the Company’s commitments to clients, and with the Data Breach Response Plan, which governs the handling of security incidents. Any conflict between this Policy and an obligation under applicable law is to be resolved in favour of the law and reported to the Information Security Officer.

2. ROLES AND RESPONSIBILITIES

   1. Board of Directors: The Board approves this Policy, reviews its operation at least once each financial year, and provides the resources required to implement it.

   2. Information Security Officer: The Board shall designate a director or senior employee as the Information Security Officer, who is responsible for implementing and maintaining this Policy, granting, reviewing and withdrawing access, maintaining the asset and vendor registers, conducting the training referred to in Section 11, investigating incidents under the Data Breach Response Plan, and reporting to the Board on compliance.

   3. Grievance Officer: The Grievance Officer named in the Privacy Policy receives and disposes of requests and grievances from clients concerning their personal data, and coordinates with the Information Security Officer where a request requires access to, correction of or erasure of records.

   4. Covered Persons: Every Covered Person is responsible for complying with this Policy, for the security of the devices and accounts allotted to or used by that person for the Company’s work, and for reporting any actual or suspected security incident immediately in accordance with Section 12.

3. CLASSIFICATION OF INFORMATION

   1. Information held by the Company is classified as follows. “Health Information” means client assessment records, diet and lifestyle plans, progress logs, medical and laboratory reports and any other information concerning an individual’s health, and constitutes sensitive personal data or information under Rule 3 of the SPDI Rules. “Restricted Information” means client identity, contact and transaction records, employee and contractor records, and commercial information including pricing and vendor terms. “Internal Information” means plan templates, standard operating procedures and internal correspondence. “Public Information” means material published by the Company on the Website or its social media channels.

   2. Health Information receives the highest level of protection under this Policy. It may be accessed only by the practitioner assigned to the client concerned, by the Information Security Officer, and by such other person as the Information Security Officer specifically authorises for a stated purpose.

4. ACCESS CONTROL

   1. Need to Know: Access to information is granted on the principle of least privilege, that is, only to the extent required for a Covered Person to perform assigned duties, and is withdrawn when that requirement ceases.

   2. Accounts and Authentication: Each Covered Person shall use a distinct account issued in that person’s own name for all work involving the Company’s information. Accounts shall not be shared, and credentials shall not be disclosed to any other person. Two-factor authentication shall be enabled on every account that holds or can access Health Information or Restricted Information, including email, cloud storage, spreadsheets, video conferencing and the website administration console. Passwords shall be unique to the account, of not fewer than twelve characters, and changed immediately if compromise is suspected.

   3. Files and Folders: Client records, including the central lead and client spreadsheet, shall be held in accounts controlled by the Company and not in the personal accounts of any Covered Person. Sharing shall be restricted to named persons; link sharing that permits access to anyone holding the link is prohibited. Editing and download permissions shall be granted only where the role requires them.

   4. Joining, Change of Role and Exit: The Information Security Officer shall maintain a record of the access granted to each Covered Person. On a change of role, access no longer required shall be withdrawn. On the cessation of employment or engagement, all access shall be withdrawn on or before the last working day, Company devices and records shall be returned, and the Covered Person shall confirm in writing that no copy of the Company’s information has been retained. Access permissions shall be reviewed in full at least once every six months.

5. DEVICES AND ENDPOINTS

   1. Every device used for the Company’s work, whether owned by the Company or by the Covered Person, shall have a screen lock with password or biometric authentication, full-disk or device encryption where the operating system supports it, current operating system and application updates, and reputable anti-malware software on desktop and laptop devices.

   2. Health Information and Restricted Information shall be accessed through Company-controlled cloud accounts and shall not be stored locally except where necessary for immediate work, in which case the local copy shall be deleted once it is no longer required. Such information shall not be stored on removable media or in personal cloud accounts, and shall not be printed except where necessary, in which case Section 8 applies.

   3. Devices shall not be left unattended in a state in which the Company’s information is accessible. Loss or theft of a device shall be reported immediately under Section 12.

6. COMMUNICATIONS

   1. Email and Messaging: Client communication shall be conducted through the Company’s official email address and the Company’s designated WhatsApp Business number, and not through the personal accounts of Covered Persons. Where a contractor uses a personal number for client contact, that number shall be recorded with the Information Security Officer, the chats shall be treated as Company records, and the contractor shall delete them on the cessation of the engagement.

   2. Payment Instructions: Payment details shall be communicated to clients only from the Company’s official channels and only in respect of accounts designated by the Board. No Covered Person shall direct a client to remit money to any other account. A request received by email or message to change bank details shall be verified by telephone with the counterparty before it is acted upon.

   3. Video Sessions: Live sessions shall be conducted through the Company’s conferencing account, with access restricted to the invited participants. No session shall be recorded unless every participant has consented in advance, and any recording so made shall be stored and deleted in accordance with Section 9.

   4. Phishing and Social Engineering: Covered Persons shall not act on any instruction to transfer money, disclose credentials or share client records that is received by email, message or telephone without verifying it through an independent channel. Suspected phishing shall be reported under Section 12.

7. VENDORS AND THIRD PARTIES

   1. The Information Security Officer shall maintain a register of every vendor and service provider that processes the Company’s information, recording the service, the categories of data involved, the location of processing and the contractual terms.

   2. Before a new vendor is engaged, the Information Security Officer shall satisfy the Board that the vendor offers security measures appropriate to the data involved. Every vendor shall be engaged under a written agreement containing obligations of confidentiality, processing only on the Company’s instructions, security safeguards, immediate notification of security incidents, assistance with data principal requests, and deletion or return of data on termination.

   3. Independent contractors who deliver Programmes shall execute a confidentiality and data handling undertaking in the form approved by the Board before they are given access to any client record.

   4. Where a vendor stores or processes personal data outside India, the Information Security Officer shall record that fact and confirm that the transfer is permissible under Section 16 of the Digital Personal Data Protection Act, 2023 and Rule 7 of the SPDI Rules.

8. PHYSICAL SECURITY

   1. Access to the Company’s premises shall be controlled, and visitors shall not be left unaccompanied in areas where the Company’s information is accessible. Printed records containing Health Information or Restricted Information shall be stored under lock when not in use and shall be destroyed by shredding when no longer required.

9. RETENTION, DELETION AND BACKUP

   1. Personal data, including Health Information, is retained for three years from the date of its collection and is thereafter erased or irreversibly de-identified, save for invoices and transaction records, which are retained for the periods prescribed under the Companies Act, 2013, the goods and services tax law and the income-tax law. The Information Security Officer shall carry out a deletion review at least once each quarter and shall record the deletions effected.

   2. Backups of client records shall be taken at intervals determined by the Information Security Officer, shall be protected to the same standard as the records themselves, and shall be tested for restoration at least once each year. Deletion under Section 9.1 shall extend to backups in the ordinary backup cycle.

10. LOGGING AND MONITORING

    1. The Company shall enable and retain logs of access to systems holding personal data, and shall maintain the logs of information and communication technology systems for a period of not less than one hundred and eighty days within India, in accordance with the directions issued by the Indian Computer Emergency Response Team under Section 70B(6) of the Information Technology Act, 2000, and for such minimum period as the DPDP Law prescribes. System clocks shall be synchronised to the network time protocol servers notified in those directions.

    2. Monitoring is undertaken for the purposes of security, and not for the surveillance of individuals. Access to logs is restricted to the Information Security Officer and to persons authorised by the Board.

11. TRAINING AND AWARENESS

    1. Every Covered Person shall receive a briefing on this Policy, on the Privacy Policy and on the Data Breach Response Plan before being given access to client records, and a refresher at least once each year. Attendance shall be recorded. The briefing shall cover the classification of information, access discipline, safe communication, recognition of phishing and social engineering, the scope of consent obtained from clients, and the duty to report incidents.

12. REPORTING OF SECURITY INCIDENTS

    1. Every Covered Person shall report to the Information Security Officer, immediately and in any event within one hour of becoming aware of it, any actual or suspected loss, theft, unauthorised access, unauthorised disclosure, alteration or destruction of the Company’s information, any loss of a device, any compromise of credentials, and any incident notified by a vendor. Reporting is required irrespective of whether the incident is believed to be material, and a Covered Person who reports an incident in good faith shall not be subjected to any detriment on that account.

    2. On receipt of a report, the Information Security Officer shall act in accordance with the Data Breach Response Plan.

13. COMPLIANCE, AUDIT AND REVIEW

    1. The Information Security Officer shall assess compliance with this Policy at least once each year, shall record the assessment and any deficiencies identified, and shall report the assessment to the Board together with a plan for remediation. The Board shall review this Policy at least once each financial year and upon any material change in the Company’s operations, systems or applicable law.

    2. The Company adopts the security control objectives of the international standard IS/ISO/IEC 27001 as guidance in implementing this Policy, to the extent proportionate to its size and operations.

    3. A breach of this Policy by an employee may result in disciplinary action, including termination of employment, and by a contractor or vendor in suspension or termination of the engagement, in each case without prejudice to any other remedy available to the Company in law.