# 07 Templates and copy blocks

Copy these into products. Keep the plain style: short sentences, no em-dashes, no emoji. Replace the bracketed fields. Anything marked counsel gets a lawyer's pass before it ships to paying customers.

## AI disclosure (inline, where output appears)

> This was generated by an AI system and reviewed by [you / a Rang & Mall reviewer / nobody yet]. Check it before you rely on it. It can be wrong.

Chat start line:

> You are talking to an AI assistant, not a person. It does not give medical, legal, financial, or immigration advice. For emergencies contact local services.

Regulated variants:

- Health: "General wellness information only. Not medical advice, diagnosis, or treatment. Talk to a clinician about medical concerns."
- Legal and immigration: "This tool provides general information and document organisation. It is not a law firm and is not a substitute for the advice of a licensed attorney [or, in India, an enrolled advocate; in the UK, a regulated immigration adviser]."
- Finance: "Information, not investment advice. Past performance does not predict future results."
- Astrology: "For reflection and entertainment. Not a prediction of events, health, or outcomes."

## Recording and captions consent (Meet)

Pre-join when recording is on:

> This meeting is being recorded and transcribed by the host. By joining you consent to the recording. If you do not consent, leave now or ask the host to stop recording.

Host start prompt:

> Recording and live captions will be visible to all participants. Some regions require every participant's consent. Confirm that everyone has agreed.

Indicator text: "Recording" with a red dot, visible for the whole duration, on every layout.

## Data-room gate (Drive)

> [Owner] will see that you opened this room, which files you viewed, and for how long. Enter your email to continue. Your email is used to identify you to the owner and for nothing else.

## Health-data consent (RM Health)

Per-stream toggles, each with its own line:

> Weight and body measurements: used to calculate your targets and show trends. Stored until you delete them. Never used for advertising or sold.

> Food photos: analysed to estimate what you ate, then discarded unless you save the entry. Not used to train any model.

> Apple Health / Health Connect: steps, heart rate, sleep, HRV are read to adjust your plan. You can revoke this in your phone settings at any time.

Consumer Health Data Privacy Policy link text (US homepage footer): "Consumer Health Data Privacy Policy".

## Grievance Officer page (India, IT Rules and DPDP)

> Grievance Officer: [Name], Rang & Mall Private Limited, D.No 32-10-23/13, Flat No S2, Sai Balaji Enclave, Sheelanagar, Pendurthi, Visakhapatnam 530012, Andhra Pradesh, India. Email: grievance@[product-domain]. We acknowledge complaints within 24 hours and resolve them within 15 days. Data protection requests (access, correction, erasure, consent withdrawal, nomination) go to the same address and are answered within [period]. If you are not satisfied you may approach the Data Protection Board of India.

## UK and EU privacy notice header block

> Rang & Mall Private Limited, a company incorporated in India, is the controller [or processor on behalf of your organisation]. Your data is stored and processed in India. For transfers from the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; for transfers from the EU we rely on the EU Standard Contractual Clauses. Our UK representative is [name, address] (counsel). You may complain to the ICO (UK) or your local supervisory authority (EU) and you have the right to complain to us first at privacy@[domain].

## Subscription pre-purchase block

> [Plan] costs [price] [currency] per [month/year] [plus GST / including VAT / plus applicable tax]. It renews automatically on [date] unless you cancel. Cancel any time from Settings in two clicks; you keep access until the end of the period. [UK and EU: you have a 14-day right to cancel; by ticking this box you ask us to start the service now and acknowledge you lose the right once the service starts.] Refund policy: [link].

## Evidence certificate wording (India, BSA 2023 section 63)

> Certificate under section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023. I, [custodian name], [designation], Rang & Mall Private Limited, state that the electronic record attached was produced by the computer system [system name] during the ordinary course of its operation, that the system was operating properly during the relevant period, that the information was regularly fed into the system in the ordinary course of activities, and that the record reproduces information derived from that system. Hash (SHA-256): [hash]. Export time (UTC): [time]. Signed: [manual or DSC signature], [date].

US federal courts: produce the equivalent under FRE 902(13) and (14) with a qualified-person certification; attach the hash and the process description. (counsel: confirm forms per jurisdiction)

## security.txt

```
Contact: mailto:security@rmmail.in
Expires: 2027-08-21T00:00:00.000Z
Preferred-Languages: en, hi, te
Canonical: https://[product-domain]/.well-known/security.txt
Policy: https://compliance.freedomlabs.in/playbook/02-universal-baseline
Acknowledgments: https://[product-domain]/legal/security
```

## Law-enforcement request policy (short form)

> We disclose user data to authorities only on valid legal process under the law of the requesting jurisdiction, verified by counsel. We notify the user unless prohibited by law or unless notice would create a risk to life. We keep a log of every request and disclosure. Emergency requests are handled by [contact] and confirmed in writing.

## DPA clause list (for our own DPA with business customers)

1. Roles: customer is controller or fiduciary; Rang & Mall is processor.
2. Subject matter, duration, nature, purpose, data types, data subjects (annex).
3. Documented instructions only; notify if an instruction breaks the law.
4. Confidentiality of personnel.
5. Security measures (annex: encryption, access control, logging, backups, testing).
6. Sub-processors: current list, 30-day prior notice, right to object, flow-down of terms.
7. Assistance with data-subject rights, DPIAs, consultations.
8. Breach notification to the customer within [24/48/72] hours of awareness with the required details.
9. Deletion or return at the end, certification, backup purge window.
10. Audit rights: reports first, on-site by agreement, at customer cost.
11. International transfers: UK IDTA or Addendum and EU SCCs incorporated by reference; India annex on DPDP obligations; transfer risk assessment summary available.
12. Liability and order of precedence.
13. Sector annexes where needed: schools (no cross-school training, Fourth Schedule limits), health (HBNR cooperation), hosting (CERT-In record-keeping).

## Retention schedule page (public)

A table with three columns (data, how long, why) generated from the app's data map. Include backups and the deletion propagation window.

## Breach notice to individuals

> Subject: Important notice about your [product] account
>
> On [date] we learned that [what happened]. The information involved was [list]. We [what we did: revoked, rotated, fixed]. We have notified [regulator]. We recommend that you [actions]. We are sorry this happened. Questions: [contact]. This message is not marketing and contains no links to log in; go to the app directly.

## Cookie and tracking layer (UK and EU)

> We use cookies that are necessary for the service. With your consent we also use [analytics] cookies to understand usage. No advertising cookies. Accept all / Reject non-essential / Choose.

Reject must be as prominent as Accept. No pre-ticked boxes. Record the choice in the consent ledger. Honour Global Privacy Control for US visitors as "Do Not Sell or Share".

## Children statement

> [Product] is for people aged 18 and over. We do not knowingly collect data from anyone under 18 [India] / under 13 [US]. If you believe a child has created an account, contact [email] and we will delete it.