Privacy Policy

Privacy Policy

Last updated: 01 August 2026 · Previous version: 01 September 2025

InBody (hereinafter, "the Company") complies with personal information protection regulations, and does its best to protect user rights by establishing privacy policies for its body composition analysis system, InBody, and its website LookinBody Web, web-site* and InBody Mobile Application, including https://shop.inbody.in/ (collectively, "Web Services").

*web-site: www.inbody.com, www.inbodyusa.com, https://nl.inbody.com, www.inbodyasia.com, www.inbody.com/jp, http://www.inbody.com/cn, http://www.inbody.in

It is not mandatory for users to provide their personal information and the user has the right to withhold their consent to the collection of their personal information. However, by opting not to provide personal information, certain features may not be available to users, the user’s experience may be negatively affected, and users may not be able to receive support services from the Company.

* EU/EEA: For the purpose of this Privacy Policy, the terms "personal data", "special categories of personal data", "processing", "controller", "processor", "data subject" and "consent" shall have the meaning ascribed to them in the General Data Protection Regulation (EU) 2016/679 ("GDPR"). InBody Europe B.V. (Netherlands) acts as the controller for the personal data of data subjects in the European Economic Area (EEA). Detailed EEA-specific terms, including international transfer arrangements, are set out in the "EEA / GDPR Supplement" at the end of this Privacy Policy.

* India: For the purpose of this Privacy Policy, the terms "personal data", "Data Principal", "Data Fiduciary", "processing" and "consent" shall have the meaning ascribed to them in the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 of India. InBody acts as a Data Fiduciary in respect of the personal data of Data Principals in India. Detailed India-specific terms are set out in the "India – Digital Personal Data Protection (DPDP) Notice" at the end of this Privacy Policy.

* Malaysia: For the purpose of this Privacy Policy, the terms “personal data”, “sensitive personal data”, and “process” shall have the meaning ascribed to it in the Personal Data Protection Act 2010 of Malaysia.

InBody's Privacy Policy covers the following matters:

1. Types of Personal Information Collected and Methods of Collection
2. Collection of Personal Information and Purpose of Use
3. Sharing and Provision of Personal Information
4. Consigned Handling of Personal Information
5. Retention and Usage Periods of Personal Information
6. Procedure and Methods of Destruction of Personal Information
7. Rights of Users and Legal Attorneys and Methods of Exercising the Rights
8. Matters Concerning Installation/Operation of Automatic Personal Information Collecting Mechanism and Refusal Thereof
9. Technical/Administrative Measures for Protection of Personal Information
10. Data Protection Manager and Officers
11. Duty of Notification

1. Types of Personal Information Collected and Methods of Collection

A. Types of Personal Information Collected

Firstly, the Company collects the following personal information through 'Input mobile no.', 'Input ID', ‘Input height’, ‘Input Gender’ or ‘Input age’ during body composition analysis using InBody, or the initial 'Sign Up' in LookinBody Web. This facilitates provision of various services such as member sign-up and efficient customer care.

All InBody Models

• Required: Height, Weight, Body composition analysis results
• Optional: Mobile number, Age, Gender

LookinBody Web

• Required: Gender, Date of birth, Height
• Optional: Name, Body composition analysis results, Address, E-mail address, Medical history, Mobile number

Secondly, during use of LookinBody Web services or during operation of the business, the following types of information may be generated and collected automatically:

• IP address, cookie, date visited, service usage log, error log

Thirdly, information may be collected only from users of additional services, customized services, or services to which the users have given consent to additional personal information collection during the process of participating in promotional events.

InBody Touch

• Required: Email address

* Malaysia:

(1) LookinBody Web — the Company processes the following personal information of users:

• Personal Information: Name, Email address, Address and zip code, Mobile number, Company name, Height, Weight, Age, Gender, Date of birth and other forms of personal data while rendering additional or customized services to users, which users have consented to providing to the Company.
• Sensitive Personal Information: Body composition analysis results, Medical history. Users provide their explicit consent to the processing of their sensitive personal data, with the understanding that the provision of the above sensitive personal data is necessary for the Company to provide the body composition analysis service.

(2) inbodyasia.com — the Company processes the following personal information of users:

• Personal Information: Name, Email address, Phone number, and any other personal information disclosed by users in the “Contact Us” page of inbodyasia.com.

(3) InBody Mobile Application — the Company processes the following personal information of users:

• Personal Information: Name, Email address, Mobile number, Height, Weight, Age, Gender and other forms of personal data while rendering additional or customized services to users, which users have consented to providing to the Company.
• Non-personally identifiable information: IP address, Cookie, Date visited, Service usage log and Error log.

B. Methods of Collecting Personal Information

The Company collects personal information using the following methods.

All InBody Models

• Personal information is collected using 'Input mobile no.', 'Input ID', ‘Input height’, ‘Input Gender’ or ‘Input age’ during InBody test.

LookinBody Web

• Personal information is collected during the sign-up process in LookinBody Web.

* Malaysia: The Company collects personal information in the following ways:

• When users are asked to input their personal data in the course of using the body composition analysis system;
• When users sign up for the Web Services;
• When users contact the Company, send feedback to the Company, post material on the Web Services, complete customer surveys or participate in competitions.

2. Collection of Personal Information and Purpose of Use

The Company collects personal information from users for the following purposes:

A. Provision of Service

Provision of content, provision of specific customized services, delivery of goods or sending of bills, etc., identity authentication, purchasing and payment processing, collection of fees.

B. Member Management

Identity authentication for use of membership-based services or limited identity authentication programs, personal identification, prevention of unauthorized use or abuse by defective members, confirmation of sign-up intent, restriction of sign-up or sign-up attempts, recordkeeping for dispute resolution, handling of complaints and delivery of notices.

C. Use for Development of New Services and Marketing/Advertisements

Development of new services and provision of customized services, provision of services based on statistical characteristics, validation of services, provision of information on promotional events and provision of opportunity to participate, assessing access frequency, statistics on service usage by members.

* Malaysia — D. General Purposes

Monitoring and recording communications (such as telephone conversations and e-mail) for the purpose of improving the quality of the Company’s services, to send users newsletters when users have subscribed for the Company’s newsletter, to comply with the Company’s regulatory and corporate governance obligations, gathering information as part of investigations by regulatory bodies or in connection with legal proceedings or requests, operational reasons such as recording transactions, training and quality control, ensuring the confidentiality of commercially sensitive information, investigating complaints and allegations of criminal offenses, providing customer service, and to give effect to the commercial transactions between the Company and the users.

3. Sharing and Provision of Personal Information

The Company uses personal information of users within the scope notified in “2. Collection of Personal Information and Purpose of Use”, does not use any personal information beyond the above mentioned scope, or disclose any personal information of users to third parties without prior consent of the user. However, the exceptions apply under the following circumstances:

• the user has given prior consent to such disclosure;
• there is a request from an investigational agency pursuant to provisions of laws or through procedures and methods stipulated in laws for investigational purposes; or
• there is a request for personal information from a government agency for providing various services.

* Malaysia:

• there is a need to disclose personal information of users to the Company’s contracted third-party service providers and vendors.

The Company may also disclose personal information of users to:

• other Companies within the InBody group;
• service providers, institutions, or commercial organizations that are collaborating with the Company;
• a third party who acquires the Company or substantially all of the Company’s assets, in which case the personal data shall be one of the acquired assets; and
• other software providers users may request to give users access to users’ InBody device data.

4. Consigned Handling of Personal Information

The Company may consign entry of personal information to personal information processing officers at sites where the program is used. Such officers shall receive adequate training to ensure that the personal information stored is not lost, stolen, leaked, altered, or damaged.

5. Retention and Usage Periods of Personal Information

By general rule, personal information of users is destroyed once its purpose of collection and usage is achieved. However, the following information may be retained for the periods stated for given reasons.

A. Reasons for Retention of Information Based on Company's Internal Policy

• Recordkeeping of information abuse — Reason: prevention of abuse. Period of retention: 1 year.

B. Reasons for Retention of Information Pursuant to Relevant Laws

When retention is required by provisions of relevant laws such as the Commercial Act and the Act on the Consumer Protection in Electronic Commerce, etc., the Company retains member information for a specific period, as stipulated in relevant laws. In such a case, the Company uses the information retained only for the purpose of such retention for the following retention periods:

6. Procedure and Methods of Destruction of Personal Information

By general rule, personal information of users is destroyed once its purpose of collection and usage is achieved. Procedures and methods used by the Company to destroy personal information are as follows.

A. Procedure of Destruction

• Once the purpose of the information is achieved, information entered by the user for member sign-up, etc. is moved to a separate database (separate cabinet in case of information on paper), stored for a specific period in accordance with internal policy and reasons for information protection pursuant to other relevant laws, and destroyed.
• Such personal information is not used for purposes, other than as stipulated in purpose of retention, unless required by law.

B. Method of Destruction

• Personal information printed on paper is destroyed by using a shredder or by incineration.
• Personal information stored in electronic file formats is erased beyond recovery using technical means.

7. Rights of Users and Legal Attorneys and Methods of Exercising the Rights

The user or their legal attorney may, at any time, view and edit registered personal information of the user or the child concerned under the age of 16* and may request cancelation of membership. The user may click 'Edit Personal Information' (or 'Edit User Information', etc.) to view and edit personal information of the user or the child concerned under the age of 16, and may click 'Cancel Membership' to cancel membership (withdraw consent). Once the user completes the identity authentication process, they will be able to view and edit the information or cancel membership on their own.

* The child who requires parental consent, by region — Under 13: Belgium, Denmark, Estonia, Finland, Latvia, Malta, Portugal, Sweden. Under 14: Austria, Bulgaria, Cyprus, Italy, Lithuania, Spain, China. Under 15: Czech Republic, France, Greece, Slovenia. Under 16: Croatia, Germany, Hungary, Ireland, Luxembourg, Netherlands, Poland, Romania, Slovakia. Under 18: California (USA), India. The above is as of July 2026 and may change afterwards.

Alternatively, the user may contact the Data Protection Manager in writing, by phone, or email for immediate action. Once the user has made a request for correction of errors in personal information, such information shall not be used or provided until the corrections are made. Also, if incorrect personal information is already provided to a third party, the Company shall immediately notify the third party of the correction processing results so that the necessary corrections are made.

The Company processes personal information of users which has been canceled or deleted by request of the user or legal attorney in accordance with provisions of “5. Retention and Usage Periods of Personal Information” and ensures that the personal information is not viewed or used for other purposes.

* Malaysia: Users have the option of unsubscribing from the Company’s newsletter and from receiving marketing and advertising-related emails from the Company.

8. Matters Concerning Installation/Operation of Automatic Personal Information Collecting Mechanism and Refusal Thereof

In order to provide personalized and customized services, the Company uses 'cookies' to save and frequently load the user's information. A cookie is a very small text file sent from the server, which is used to run the website, to the user's web browser. The cookie is stored on the hard disk of the user's computer.

A. Purpose of Using Cookies

Cookies are used for analyzing the user's visit and usage patterns, etc. of various services offered on lookinbody.com and other websites, to facilitate the provision of information, optimized for each user.

B. Declination to Installation/Operation of Cookies

The user has the right over the installation of cookies. Therefore, the user can accept all cookies, require a prompt each time a cookie is saved, or reject all cookies by setting options on their web browser. Note, however, that if cookies are not accepted, the user may experience difficulty in using some of the services on nld.lookinbody.com which require signing in.

Configuring cookie installation settings (on Internet Explorer):

1. On the [Tools] menu, select [Internet options].
2. Click the [Privacy] tab.
3. Adjust the [Settings].

C. Cookie Consent for Users in the EEA (ePrivacy Directive 2002/58/EC, Article 5(3))

For users in the EEA, non-essential cookies (performance-related, functional and marketing cookies) are set only after you give your prior consent through the cookie banner displayed on our web services (e.g., LookinBody Web). You may choose 'Accept all cookies', 'Only Required cookies', or customize your settings by category, and you may change your choice at any time via the cookie settings. Strictly necessary (required) cookies do not require consent. For details, please see the Cookie Policy available on the relevant web service. The browser-settings guidance above applies in addition to, not instead of, this consent mechanism.

9. Technical/Administrative Measures for Protection of Personal Information

In handling personal information of users, the Company employs the following technical/administrative measures to secure safety of personal information against displacement, theft, leaks, unwanted alterations or damage.

A. Encryption of Personal Information

The user's password, stored and managed in encrypted form, is only known to the user. Therefore, the password of a user can only be viewed and changed by the user who knows the password. Additionally, mobile numbers, dates of birth, etc. are encrypted to prevent information leaks and amendments to personal information.

B. Measures against Hacking, etc.

The Company does its best to prevent leaks and damage of personal information of the user via hackers, computer virus, etc. The Company regularly backs up the data to minimize damage of personal information, uses the latest anti-virus software to prevent leaks and damage of personal information and data of users, and uses encrypted communications, etc. for safe transmission of personal information on networks. The Company also uses an intrusion prevention system to limit unauthorized access from outsiders and makes an effort to employ all possible technical mechanisms to ensure security of the system.

C. Persons Handling Personal Information

The Company limits handling of personal information to persons specifically assigned to the task, who are assigned separate passwords that are regularly updated for such purpose. Frequent training is provided to persons handling personal information to emphasize the importance of compliance with the Privacy Policy, at all times.

D. Operation of Dedicated Organization for Personal Information Protection

The Company employs a dedicated organization for personal information protection, etc. to monitor implementation of the Privacy Policy, compliance of persons in charge, and to immediately correct and rectify any issues identified.

However, the Company shall not be liable for any issues caused by personal information leaks such as mobile numbers and passwords due to the user's negligence or other Internet-related problems.

10. Data Protection Manager and Officers

You may report all privacy complaints that arise while using the Company's services to the Data Protection Manager or Data Protection Officer of the Company. The Company shall respond to the user's reports promptly and adequately.

11. Duty of Notification

If ever a legal attorney requests insight into, alteration or removal of the personal data of the subject as mentioned under “7. Rights of Users and Legal Attorneys and Methods of Exercising the Rights”, the Company shall notify the subject in writing before complying with this request.

The Company shall report to the supervisory authority within 72 hours from the time it becomes aware of an infringement of personal information in the event of an infringement that may pose a risk to the rights and freedoms of individuals. The data subject must be notified of the infringement without undue delay.

However, if there is a low possibility that the infringement of personal information poses a risk to the individual's freedom and rights, the notification may not be made. If the report to the supervisory body is not made within 72 hours, the reason for the delay must be reported together.

EEA / GDPR Supplement

This EEA-specific supplement applies to data subjects in the European Economic Area (EEA) whose personal data is processed by InBody Europe B.V. ("the controller") under Regulation (EU) 2016/679 ("GDPR"). It sets out the information required under Articles 13 and 14 GDPR. Provisions marked '* Malaysia' or '* India' do not apply to you.

1. Controller

InBody Europe B.V., Gyroscoopweg 122, 1042 AZ Amsterdam, the Netherlands, is the controller responsible for the processing of personal data of data subjects in the EEA as described in this Privacy Policy.

InBody Co., Ltd. (headquarters, Republic of Korea) processes personal data on behalf of the controller — for example, by hosting and maintaining the cloud infrastructure and providing technical and product support — under an intra-group data processing agreement in accordance with Article 28 GDPR. Personal data may be transferred to InBody Co., Ltd. in the Republic of Korea as described in Section 8 below.

1A. Analysis Facilities (Article 14 GDPR)

Your InBody test may be taken at an analysis facility (e.g., a gym, clinic or hospital) that uses our products and services. In some cases the facility enters your personal data into LookinBody Web on your behalf, and your test results are displayed to that facility so that it can provide its services to you. For the processing described in this Privacy Policy, InBody acts as an independent controller: we store your personal data on our servers and process it for the purposes set out in Sections 2 and 3 of this Supplement. The analysis facility acts as a separate controller for its own use of your personal data and is responsible for its own compliance. Where we obtain your personal data from a facility rather than from you directly, this Privacy Policy provides the information required under Article 14 GDPR.

2. Legal Bases for Processing (Article 6)

The Company processes your personal data on the following legal bases, depending on the processing activity:

• Performance of a contract or steps taken at your request prior to entering into a contract (Article 6(1)(b)) – to provide the InBody App, LookinBody Web and related body composition analysis services, to manage your account, and to provide customer support;
• Your consent (Article 6(1)(a)) – for optional features, marketing communications, and the use of non-essential cookies, which you may withdraw at any time;
• Compliance with a legal obligation to which the Company is subject (Article 6(1)(c)) – for example, retention obligations and responding to lawful requests from authorities;
• The Company’s legitimate interests (Article 6(1)(f)) – to secure and improve our services, to prevent fraud and abuse, and to carry out internal administration. Where the Company relies on legitimate interests, it carries out and documents a balancing test, and you may obtain further information by contacting the Data Protection Officer.

2A. Recipients of Personal Data (Article 13(1)(e) GDPR)

The Company may share your personal data with: (i) other companies within the InBody group; (ii) service providers acting as processors on our behalf (cloud hosting and IT service providers); (iii) the analysis facility where you take your InBody test (see Section 1A); (iv) an acquirer or successor in the event of a merger or asset sale; and (v) other software providers you authorise to access your InBody data. Service providers acting as processors are bound by data processing agreements under Article 28 GDPR.

2B. Provision of Personal Data (Article 13(2)(e) GDPR)

Providing your personal data is not a statutory requirement. Some personal data is necessary to perform our contract with you; if you do not provide it, we cannot provide that service. Optional data (for example, marketing preferences) may be withheld without affecting the core services.

3. Health Data and Explicit Consent (Article 9)

Your body composition analysis results, and any medical history you choose to provide, are "data concerning health" and therefore special categories of personal data under Article 9 GDPR. The Company processes such data on the basis of your explicit consent (Article 9(2)(a)). This explicit consent is separate from any other consent and may be withdrawn at any time, with the same ease as it was given, through the InBody App or LookinBody Web account settings or by contacting the Data Protection Officer. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4. Consent (Article 7)

Where the Company relies on your consent, that consent is freely given, specific, informed and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. You may withdraw your consent at any time and as easily as you gave it. Withdrawing consent will not affect the lawfulness of processing based on your consent before its withdrawal.

5. Your Rights as a Data Subject (Articles 15–22)

Subject to the conditions in the GDPR, you have the right to:

• request access to your personal data (Article 15);
• request rectification of inaccurate or incomplete personal data (Article 16);
• request erasure of your personal data ("right to be forgotten") (Article 17);
• request restriction of processing (Article 18);
• receive your personal data in a structured, commonly used and machine-readable format and to have it transmitted to another controller, where technically feasible (Article 20);
• object to processing carried out on the basis of the Company’s legitimate interests, and to object at any time to processing for direct marketing purposes (Article 21);
• not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you (Article 22);
• require us to communicate any rectification, erasure or restriction of your personal data to each recipient to whom it was disclosed (Article 19); and
• withdraw your consent at any time (Article 7(3)).

To exercise any of these rights, please contact the Data Protection Officer. The Company will respond to your request without undue delay and in any event within one month of receipt, extendable by up to two further months where necessary (Article 12(3)). Exercising these rights is free of charge, although a reasonable fee may be charged, or a request refused, where a request is manifestly unfounded or excessive (Article 12(5)).

Automated Decision-Making (Article 13(2)(f) GDPR): The Company does not make decisions producing legal or similarly significant effects concerning you based solely on automated processing, including profiling. Body composition results generated by the InBody device are provided for your information and are not used for solely automated decision-making.

6. Right to Lodge a Complaint (Articles 13(2)(d) and 77)

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EEA Member State of your habitual residence, place of work, or place of the alleged infringement. A list of EEA supervisory authorities is available on the website of the European Data Protection Board (edpb.europa.eu). We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority.

7. Retention of Health Data (Article 5(1)(e))

The Company retains your personal data only for as long as necessary for the purposes for which it was collected. Your body composition analysis results and any medical history you provide are retained for the duration of your account and are erased or anonymised without undue delay when you cancel your membership or withdraw your consent, unless a longer retention period is required or permitted under applicable law.

8. International Transfers (Articles 44–49)

Personal data of EEA data subjects is primarily stored within the EEA (in the Netherlands). Where your personal data is transferred to InBody Co., Ltd. (Republic of Korea), such transfer takes place on the basis of the European Commission's adequacy decision for the Republic of Korea (Commission Implementing Decision (EU) 2021/2305 of 17 December 2021). Where personal data is transferred to any other country outside the EEA that is not covered by an adequacy decision, the controller applies appropriate safeguards such as the European Commission's Standard Contractual Clauses.

9. Children’s Personal Data (Article 8)

Where processing is based on consent and the data subject is a child below the age of digital consent applicable in their EEA Member State (between 13 and 16 years depending on the Member State), the Company will obtain or verify the consent of the holder of parental responsibility.

10. Data Protection Officer / Contact

The controller has designated a Data Protection Officer (Article 37 GDPR), whom you may contact on all issues relating to the processing of your personal data and the exercise of your rights:

India – Digital Personal Data Protection (DPDP) Notice

This India-specific notice applies to Data Principals in India whose personal data is processed by InBody ("the Company" / "Data Fiduciary") under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025.

The consent request presented to you at the point of collection contains, on its own, an itemised description of the personal data and the specified purposes of processing, and can be understood independently of any other document (Rule 3(a), DPDP Rules, 2025).

1. Consent and Withdrawal of Consent

Where InBody relies on your consent to process your personal data, such consent is sought through a clear affirmative action and is free, specific, informed, unconditional and unambiguous, and is limited to the personal data necessary for the specified purpose. Each request for consent is accompanied or preceded by a notice setting out an itemised description of the personal data collected and the specified purposes of processing.

The personal data processed includes: height, weight, gender, age, mobile number, body composition analysis results, and any medical history you choose to provide. The specified purposes are: (i) providing the body composition analysis service and related InBody App / LookinBody Web features; (ii) account and membership management; and (iii) service improvement and development of new services.

You may withdraw your consent at any time, with the same ease as it was given, through the InBody App or LookinBody Web account settings or by contacting the Data Protection Officer below. Following withdrawal, InBody and its data processors will cease processing your personal data within a reasonable time, unless the processing is otherwise permitted or required under applicable law. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

2. Your Rights as a Data Principal

As a Data Principal, you have the right to: (a) obtain a summary of the personal data being processed and the associated processing activities, together with the identities of other Data Fiduciaries and data processors with whom your personal data has been shared; (b) request the correction, completion, updating and erasure of your personal data; (c) have any grievance addressed by InBody through the grievance redressal mechanism below; and (d) nominate another individual to exercise your rights in the event of your death or incapacity. To exercise these rights, please contact the Data Protection Officer below. InBody will acknowledge and respond to your request or grievance within ninety (90) days of receipt (Rule 14(3), DPDP Rules, 2025).

How to Exercise Your Rights – Communication Links (Rules 3(c) and 14(1), DPDP Rules, 2025): You may withdraw your consent or exercise your rights using the following means: (a) the InBody App account settings; (b) your LookinBody Web account settings; or (c) by e-mailing the InBody India office at inbodyindia@inbody.com. When making a request, please provide the identifier needed to locate your records (for example, your registered mobile number, e-mail address or LookinBody Web username).

3. Grievance Redressal and Complaints to the Data Protection Board

If you have any grievance regarding the processing of your personal data, you may contact InBody’s Data Protection Officer, who will address your grievance in the first instance. If your grievance is not resolved to your satisfaction, you may make a complaint to the Data Protection Board of India in the manner provided under the DPDP Act, 2023.

4. Children’s Personal Data

Where a Data Principal is a child (an individual who has not completed eighteen (18) years of age) or a person with a disability who has a lawful guardian, InBody will obtain the verifiable consent of the parent or lawful guardian before processing that person’s personal data. InBody does not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children.

For Data Principals in India, the age threshold for a child is eighteen (18) years; any reference to a lower age (for example, 16) in the 'Rights of Users' section of the main Privacy Policy does not apply to India.

5. Personal Data Breach

On becoming aware of a personal data breach, InBody will inform each affected Data Principal, without delay and through their user account or registered means of communication, of the nature, extent and timing of the breach, its likely consequences, the measures taken to mitigate it, the safety measures you may take to protect your interests, and a point of contact. InBody will also intimate the Data Protection Board of India without delay and provide detailed information within seventy-two (72) hours, or such longer period as the Board may allow.

6. Retention and Erasure

InBody retains your personal data only for as long as necessary for the specified purpose or as otherwise required under applicable law, after which it is erased. Where required under Rule 8(3) of the DPDP Rules, 2025, InBody retains personal data, associated traffic data and other processing logs for a minimum period of one year before erasure, unless longer retention is required under applicable law.

7. Cross-Border Transfer of Personal Data

Personal data collected from India may be stored and processed outside India, including by InBody Co., Ltd. (headquarters, Republic of Korea) and its authorised data processors, for the purposes described in this Privacy Policy. InBody remains responsible for such personal data and imposes contractual safeguards on its data processors.

8. Availability in Indian Languages

Every request for consent is presented in clear and plain language, with the option to access its contents in English or in any language specified in the Eighth Schedule to the Constitution of India, and includes the contact details of the Data Protection Officer set out in Section 9 below (Section 6(3), DPDP Act, 2023).

9. Data Protection Officer / Contact

For any questions, requests or grievances relating to the processing of your personal data in India, please contact:

Malaysia – Personal Data Protection Act (PDPA) Provisions

We reserve the right to update and make amendments to this Privacy Policy from time to time. In the event we update or amend this Privacy Policy, we will inform users by posting the updated Privacy Policy on the Web Services. The updated or amended terms will only apply to personal data that is collected from the date this Privacy Policy is updated or amended.

To comply with Section 7(3) of the Personal Data Protection Act 2010 of Malaysia, a simplified Personal Data Notice based on this Privacy Policy is made available to users in Bahasa Malaysia. In the event of any inconsistencies between the Personal Data Notice and this Privacy Policy, the terms of this Privacy Policy shall prevail.