Consumer Health Data Privacy Policy

Who this policy is for

This Consumer Health Data Privacy Policy is published by [Company legal name] for the LookFlex website and iPhone app. It is written for the Washington My Health My Data Act, Nevada Senate Bill 370 and similar laws, and applies to anyone those laws protect. It supplements our Privacy Policy.

Consumer health data we collect

LookFlex is a wellness and grooming app, not a medical service. Even so, the following may be consumer health data:

• Skin readings: estimates of clarity, texture, evenness, redness, under-eye and oil balance across six skin zones, and flagged concerns such as acne, redness, dark circles or hyperpigmentation.
• What you tell us about your skin: your skin type and skin concerns.
• Wellness habits: how often you use skincare, sunscreen and exercise, and your sleep, water intake and diet.
• Biometric data: face geometry, described in the Biometric Data Policy.
• Photos: your scan photos, which may show skin or other conditions.
• Inferences and messages: your scores, plan and progress, and anything health-related you choose to write to the AI coach.

Where it comes from

• You, through your onboarding answers, photos and coach messages.
• Your device, which computes face geometry and skin readings from your photo.
• Our AI provider, whose analysis adjusts your scores and adds observations when AI analysis is on.

How we use it

We collect and use consumer health data only as necessary to provide the features you ask for:

• to produce your results and explain them;
• to build and adjust your daily plan and track your progress;
• to answer your questions through the AI coach;
• to generate Lab images you request;
• to keep a backup of your answers, results and progress, if you keep backup on;
• to keep the service secure and prevent abuse, and to comply with the law.

We ask for your consent before your first scan. Backup is a separate choice: it is offered when you sign in, and you can turn it off at any time in Profile. We do not collect or use consumer health data for any other purpose without asking for your separate consent first.

Who receives it

Consumer health data stays on your device unless you use an AI feature or keep backup on. Then the categories below are sent to these service providers (processors), which process it only on our instructions to provide that feature:

With backup on, our database holds your profile answers, including skin type, skin concerns and habits, and your scan results, including skin readings. It never holds photos, and coach messages are not backed up. The database host and its region are listed under Service providers in the Privacy Policy.

We do not share consumer health data with affiliates or any other third party. We would disclose it only if the law required it, and we would tell you unless the law prohibited that.

What we never do

• We never sell consumer health data.
• We never use it for advertising, and no third party collects it from our service over time or across other websites.
• We never use geofencing around health care facilities, or anywhere else.
• We do not use it to make decisions about insurance, employment, credit or similar matters.

Your rights

You have the right to:

• confirm whether we collect, share or sell your consumer health data, and access it;
• get a list of all third parties and affiliates with which we have shared it, with their contact details;
• withdraw your consent;
• have your consumer health data deleted, including by our processors;
• appeal if we refuse your request;
• not be discriminated against for using these rights.

How to exercise your rights

You can act on most of your consumer health data right away, in the app:

• Access: Profile, then Export my data. The file includes what our servers hold about your account.
• Correct: Profile, then Edit my answers.
• Stop backup: turn backup off in Profile. This deletes the copy on our servers and leaves the data on your iPhone.
• Delete or withdraw consent: Profile, then Delete account, and do not scan again. This deletes your account and any backup on our servers and erases the app's data on your iPhone.

For anything else, including the list of third parties or deletion by our processors, email [email protected] with “Consumer health data” in the subject. We will respond within 45 days, free of charge for up to two requests a year, and may extend that by another 45 days when reasonably necessary, telling you why. We may need to ask for details that let us find your records, such as the email address you signed in with.

To appeal a decision, reply to it with “Appeal” in the subject. We will respond in writing within 45 days, explaining what we did and why. If you are not satisfied, you can contact the Washington State Attorney General or the Nevada Attorney General.

Retention and security

On your device, consumer health data is kept until you delete it. On our servers, AI requests are processed in memory and never stored. With backup on, the backup is kept until you turn backup off or delete your account, and it is deleted when the account has not been used for 35 months. An anonymous account has no backup, so it holds no consumer health data on our servers, and if it has made no purchases it is deleted after 12 months without use. The retention table in the Privacy Policy has every period. Our processors keep data only for the limited periods in their terms. Security measures are described in the Privacy Policy and Security pages.

Changes and effective date

This policy is effective from the date at the top. We will post changes here, and if we want to collect, use or share consumer health data in a new way, we will ask for your consent first.