Policies

PRIVACY POLICY

Beauty Health Index (BHI)

Last updated: September 15, 2026

1. Introduction and Legal Scope

Beauty Health Index ("BHI", "we", "us", "our") is committed to protecting the privacy, confidentiality, integrity, and security of personal data processed through the Beauty Health Index mobile application, website, and any related digital services (collectively, the "Services").

This Privacy Policy sets out in a comprehensive and legally binding manner how BHI collects, processes, stores, uses, discloses, safeguards, and retains personal data, including biometric and facial data, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), applicable data protection law, and applicable international data protection standards.

BHI operates as a biometric wellness and informational platform intended to measure and track facial aesthetic health. The Services are provided strictly for informational, wellness, and self-monitoring purposes. BHI does not provide medical advice, diagnosis, prognosis, treatment, or clinical recommendations, and is not a medical device.

2. Eligibility and Age Restriction

Currently, the Services are available to users of any age. There is no age gate at signup, and users of any age can create an account.

BHI intends to restrict the Services to individuals who are at least eighteen (18) years of age and may implement age verification in the future. In the future, BHI may require users to represent and warrant that they are at least eighteen (18) years old and have full legal capacity to enter into binding agreements.

If BHI implements an age restriction and identifies an account belonging to a person under eighteen (18), BHI may delete that account and associated personal data, subject to legal retention obligations.

3. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• Personal Data: Any information relating to an identified or identifiable natural person, as defined under Article 4 GDPR.
• Biometric Data: Personal data resulting from specific technical processing relating to physical or physiological characteristics of a natural person, including facial features, enabling biometric analysis.
• Facial Scan Data: Images, video frames, or derived representations of a user's face captured through the Services solely for biometric measurement and aesthetic health analysis.
• Sensitive Personal and Health Data: Information you voluntarily provide or connect regarding your health habits, lifestyle, wellness metrics, wearable data, or other health-related information.
• Processing: Any operation performed on personal data, whether or not by automated means, including collection, recording, organization, storage, analysis, transmission, disclosure, or deletion.

4. Categories of Personal Data Collected

4.1 Account and Registration Data

BHI collects information necessary to create, authenticate, administer, and maintain user accounts, including:

• Email address
• Name or username
• Profile photo (optional)
• Password and authentication credentials
• Age or date of birth (required to verify eligibility)
• Gender (required)
• Ethnicity (required at onboarding, for personalization)
• Height and weight (required at onboarding)
• Country and timezone
• Pregnancy or menopause status (if voluntarily provided)
• Device tokens for notifications
• Account preferences and settings

4.2 Facial Scan and Biometric Data (Special Category Data)

Users may voluntarily capture facial scans through the Services using their device camera. Facial scan images, video frames, derived facial landmarks, and the BHI Score and domain scores (collectively, "Scan Data") are processed exclusively for the purpose of calculating the Beauty Health Index and its associated metrics.

Scan data processing: Facial images and video are sent to OpenAI (our processor) only to generate the BHI Score and related insights. OpenAI does not use your Scan Data to train or improve its models.

Not used for identification: BHI does not use facial data for facial recognition, identity verification, identity matching, authentication, surveillance, or any form of personal identification.

Encryption: Scan data transmitted to OpenAI and stored in our AWS infrastructure (S3, database) is encrypted:

• In transit: HTTPS encryption for all connections
• At rest: Encryption in S3 and database as configured in production (KMS for encryption keys, S3 server-side encryption)

Scan data is accessible only to authorized systems and personnel under role-based access controls.

No disclosure: Facial images and biometric data are not sold, rented, licensed, transferred, or disclosed to third parties except as expressly described in this Privacy Policy (OpenAI for processing) or with explicit user authorization.

4.3 Sensitive Personal and Health Data

BHI collects wellness, lifestyle, and health-related information you voluntarily provide or connect through the Services, including:

Connected wearables and health integrations:

• WHOOP: Heart rate, sleep, recovery data accessed via OAuth. You can disconnect WHOOP in BHI Settings at any time.
• Apple Health: Health metrics such as sleep, heart rate, and activity data accessed from your device. You control Apple Health sharing through your phone's Settings.

Manually logged wellness data:

• Sleep, nutrition, hydration, caffeine, alcohol, tobacco, vaping use, supplement intake
• Skincare routines, sun exposure, stress indicators
• Other lifestyle factors you voluntarily log in the Daily Journal

BHI does not use this data for targeted advertising, profiling, or any purpose beyond providing personalized insights through the Services.

You may withdraw consent for wearable integrations by disconnecting them in Settings. You may delete manually logged wellness data at any time or request full account deletion.

4.4 Room and Community Content

The Services include an in-App community feature ("Room") where users can post photographs, captions, comments, reactions, and follow other users. When you post to the Room, the following information is visible to other community members:

• Photographs and images you upload
• Captions and text you post
• Your username and profile photo
• Your BHI Score (if you choose to share it)
• Comments and reactions you make on other users' posts
• Follow relationships

Room data is retained as long as you keep your account and the posts remain available. You may delete individual posts at any time.

4.5 Location Data

BHI may collect your device location (latitude and longitude) for the purpose of providing weather-based context to personalize insights through Open-Meteo (our weather service provider). You may disable location sharing through your device settings.

4.6 Bug Reports and Support Submissions

If you submit bug reports or contact customer support, the information you provide (including text, screenshots, error logs, and diagnostic data) may be collected and stored to investigate issues and improve the Services. You may request deletion of support tickets at any time.

4.7 Technical, Usage, and Diagnostic Data

BHI may automatically collect technical and diagnostic data such as device type, operating system, app version, usage patterns, interaction logs, error reports, and performance metrics for purposes of security, fraud prevention, system integrity, troubleshooting, and service optimization.

Support and operations logs may include user ID and diagnostic information for troubleshooting purposes. This data is not used for targeted advertising or marketing.

5. Purpose Limitation and Use of Personal Data

Personal data is collected and processed solely for explicit, specified, and legitimate purposes, including:

• Calculation and display of the Beauty Health Index
• Generation of personalized insights and reports
• Longitudinal tracking of aesthetic health metrics
• Service operation, maintenance, and security
• Room feature operation (posting, following, interactions)
• Compliance with legal obligations

In the future, you may have the option to share your data with clinics or professionals; if that feature is available, it will require your explicit consent.

Personal data is not processed for purposes incompatible with those described in this Privacy Policy, including advertising, marketing, profiling, or training of AI models.

6. Artificial Intelligence and Model Training

BHI does not use your Facial Scan Data, Sensitive Personal and Health Data, or other personal information to train, fine-tune, or otherwise improve any artificial-intelligence or machine-learning model operated by BHI or any third party.

OpenAI processing: Your Scan Data is sent to OpenAI only for inference — meaning we use OpenAI's models to generate your BHI Score and insights. OpenAI does not retain or use your data to train or improve its own models. This is governed by our processor agreement with OpenAI.

There are no training-data upload paths or model-improvement pipelines using user data.

7. Legal Basis for Processing

Under the GDPR, BHI processes personal data on the following legal bases:

• Explicit consent pursuant to Article 9(2)(a) GDPR for processing biometric and health-related data
• Performance of a contract pursuant to Article 6(1)(b) GDPR where processing is necessary to provide Services
• Compliance with legal obligations pursuant to Article 6(1)(c) GDPR
• Legitimate interests pursuant to Article 6(1)(f) GDPR, strictly limited to platform security, fraud prevention, and service integrity

8. Consent — Biometric Data

In-App users: Before capturing your first facial scan in the mobile app, BHI presents an in-App consent disclosure: "I consent to processing my biometric data (facial scans). BHI processes this data only to provide the Services." You are asked to provide affirmative consent; consent status is stored on your account.

Withdrawal: Users may withdraw consent at any time by contacting support. Withdrawal does not affect processing carried out prior to withdrawal, but biometric-dependent features will no longer be available.

Scan data is retained and deleted in accordance with Section 11 (Data Retention) below.

9. Consent for Health and Wearable Data

By using the Services and connecting wearable integrations (Apple Health, WHOOP) or manually logging health and wellness information (journal entries, skincare routines, etc.), you consent to BHI's collection and processing of that data.

Withdrawal of consent:

• WHOOP: Disconnect in BHI Settings to stop sharing data from BHI
• Apple Health: Turn off sharing in your phone's Settings; BHI's copy remains until account deletion
• Full removal: Delete your account to remove all health data

BHI does not currently have a separate in-App health-data consent checkbox; consent is implied by your use of these features. If you do not wish to share health data, do not connect wearables or use the Daily Journal feature.

10. Data Sharing and Disclosure

BHI does not sell personal data.

Personal data may be disclosed only to:

• Service providers acting as data processors under binding contractual obligations (see Section 13)
• Competent authorities where required by law
• Professional advisors (lawyers, auditors, insurers) under confidentiality obligations
• Room community members: Content you post to the Room (photos, scores, captions, comments, profile) is visible to other community members

All disclosures are limited to the minimum data necessary.

11. Data Retention and Erasure; Facial Scan Data

Scan data retention: Facial scan images, facial scan videos, facial landmarks, and scan records are retained for up to 60 days from the date of each scan.

Automatic deletion: Every night at approximately 3 AM Eastern, the system automatically deletes all scan images, videos, landmarks, and scan records older than 60 days.

Manual deletion: You may request immediate deletion of all scan data using the "Delete my data" tool in Settings. This removes:

• Scan images and videos
• Scan results and streak history
• Facial landmarks and scan records

What is NOT deleted by "Delete my data":

• Your account profile, username, and email address
• Journal entries and manually logged wellness data
• Connected wearable data (WHOOP, Apple Health)
• Room posts, comments, and follows
• Profile photos
• Insights and notifications

To remove all data including account information, delete your account (see Section 12).

12. Data Retention and Erasure — Account Data

Account information (profile, email, journals, wearable data, Room posts, etc.) is retained for as long as your account remains active.

Account deletion process:

Via Settings (in-App): If you delete your account through the Settings menu, your account and associated data are deleted immediately. This deletion is permanent and cannot be reversed.

Via email request: If you request account deletion by emailing support@beautyhealthindex.com:

1. We send a confirmation email with a deletion link
2. The link is valid for 7 days; you must click it to confirm deletion
3. Upon confirmation, your account and associated data are deleted immediately

Deletion audit: We retain a deletion audit (email address and user ID) for security and legal compliance purposes for the duration required by applicable law.

All deletion is permanent and cannot be reversed.

13. Third-Party Service Providers

BHI relies on the following service providers (data processors) to operate the Services:

Core infrastructure:

• Amazon Web Services (AWS): Compute, PostgreSQL database, Redis, S3 object storage for Scan Data and media, KMS encryption key management, CloudWatch and X-Ray monitoring
• OpenAI: Processes Scan Data and lifestyle information (inference only) to generate BHI Score and insights; does not train models on your data

Communications:

• Resend: Sends transactional emails (password resets, confirmations)
• Firebase Cloud Messaging: Delivers push notifications

Authentication:

• Google and Apple: Sign-in services (if you choose to sign in with these providers)

Integrations (optional):

• WHOOP: Wearable health data (heart rate, sleep, recovery); accessed via OAuth
• Apple Health: Health metrics; accessed from your device

Data lookups:

• Open Beauty Facts: Product barcode lookups
• Open-Meteo: Weather data for personalization

Analytics and tracking:

• No third-party analytics, advertising, or marketing SDKs are used in the App

Each service provider operates under binding contractual agreements (Data Processing Agreements) prohibiting use of personal data for any purpose other than providing the Services.

14. Data Security and Risk Acknowledgement

BHI implements technical and organizational measures designed to protect personal data, including:

• Encryption in transit: HTTPS for all connections
• Encryption at rest: Scan Data and sensitive fields are encrypted in S3 and the database as configured in production (KMS, S3 server-side encryption)
• Access controls: Role-based access controls restricting data access to authorized personnel only
• Monitoring: CloudWatch and X-Ray monitoring for security and performance

Not all data fields are encrypted; some application data may be stored in plaintext. While BHI employs reasonable safeguards, no system can be guaranteed to be completely secure, and users acknowledge and accept residual risk.

15. Data Subject Rights

Under applicable data protection laws (GDPR, etc.), you have rights including access, rectification, erasure, restriction, and objection to processing of your personal data. You may exercise these rights by submitting a verifiable request to:

support@beautyhealthindex.com

BHI will respond to verifiable requests within the time required by applicable law, without undue delay.

Available tools in the App:

• Access: View your profile, account data, scan history, journals, and settings
• Deletion: Delete individual scans via "Delete my data" tool; delete your entire account via account settings
• Correction: Update your profile, preferences, and account information directly in Settings
• Disconnect integrations: Disconnect WHOOP in BHI Settings. For Apple Health, turn off sharing in your phone's Settings; BHI's copy of your Apple Health data will remain until you delete your BHI account

Portability: BHI provides users with the ability to download their 7-day and 30-day reports, both individually and collectively, in a machine-readable format.

16. Cookie Policy

Please see our separate Cookie Policy for details on how cookies are used on the BHI Website.

17. Changes to This Privacy Policy

BHI reserves the right to amend this Privacy Policy at any time. Material changes will be communicated through the Services or via email. Continued use following changes constitutes acceptance of the updated Policy.

18. Contact Information

Privacy-related inquiries, requests, or complaints may be submitted to:

support@beautyhealthindex.com

TERMS & CONDITIONS

Beauty Health Index (BHI)

Last updated: [2026]

1. Acceptance of Terms

These Terms and Conditions (“Terms”) govern your access to and use of the Beauty Health Index mobile application, website, and related services (collectively, the “Services”), operated by Beauty Health Index (“BHI”, “we”, “us”, “our”).

By creating an account, accessing, or using the Services, you acknowledge that you have read, understood, and agree to be legally bound by these Terms. If you do not agree, you must not access or use the Services.

2. Eligibility and Capacity

The Services are available only to individuals who are at least eighteen (18) years of age and have full legal capacity to enter into binding agreements. By using the Services, you represent and warrant that you meet these requirements.

BHI reserves the right to suspend or terminate accounts that violate age or eligibility requirements.

3. Nature of the Services

BHI provides a biometric wellness platform designed to measure, quantify, and track facial aesthetic health through the Beauty Health Index (“BHI Score”) and related metrics.

The Services are provided solely for informational, wellness, self-monitoring, and research-oriented purposes. They do not constitute medical advice, medical diagnosis, cosmetic advice, clinical evaluation, or treatment recommendations.

BHI is not a medical device under Regulation (EU) 2017/745 (MDR), U.S. FDA regulations, or any equivalent regulatory framework, and is not intended to replace consultation with qualified healthcare or aesthetic professionals.

4. No Medical, Cosmetic, or Outcome Guarantees

The BHI Score, reports, insights, recommendations, or any other outputs generated by the Services are inherently variable and depend on multiple factors, including measurement conditions, user inputs, and algorithmic models.

BHI makes no representations, warranties, or guarantees regarding aesthetic outcomes, health improvements, treatment efficacy, or cosmetic results. Use of the Services does not guarantee improvement in appearance, health, or any specific outcome.

Users remain solely responsible for any decisions made based on information provided by the Services.

5. User Accounts and Responsibilities

Users are responsible for maintaining the confidentiality of their account credentials and for all activities conducted through their account.

Users agree to provide accurate, current, and complete information and to update such information as necessary. BHI is not responsible for errors, inaccuracies, or outcomes resulting from incorrect or incomplete user-provided data.

6. Facial Scans and User Content

Users may capture facial scans and input information through the Services. By submitting such content, users represent that they have the legal right to do so and that the content does not violate any applicable laws or third-party rights.

Users retain ownership of their personal data. However, users grant BHI a limited, non-exclusive, revocable license to process submitted content solely for the purposes of providing the Services, in accordance with the Privacy Policy.

7. Subscriptions, Payments, and Billing

Certain features of the Services require payment of subscription fees or one-time charges. Pricing, billing cycles, renewal terms, and available plans are disclosed at the point of purchase.

Subscriptions automatically renew unless canceled in accordance with the applicable platform policies. Refunds, cancellations, and billing disputes are governed by applicable law and the policies of the platform through which payment is made.

BHI reserves the right to modify pricing or subscription structures with reasonable notice.

8. Clinics, Professionals, and Third-Party Services

8.1 Informational Discovery Only

Any clinics, professionals, or service providers displayed within the Services are presented for informational and discovery purposes only and do not constitute endorsements, guarantees, or recommendations by BHI.

8.2 Paid Listings and Visibility

Some clinics or professionals may pay fees for listing inclusion, enhanced visibility, verification badges, or promotional placement. Payment does not imply clinical quality, suitability, or endorsement.

8.3 Independent Responsibility

Clinics and professionals operate independently and are solely responsible for their services, advice, treatments, and compliance with applicable laws. BHI does not supervise, control, or assume responsibility for third-party conduct or outcomes.

9. Data Sharing with Clinics and Consent

Users may choose to share certain data with clinics or professionals through explicit consent mechanisms. Such sharing is initiated by the user and limited to the scope of consent granted. Once data is shared, clinics act as independent data controllers. BHI bears no responsibility for third-party data processing practices or compliance.

Users may revoke consent at any time.

10. Intellectual Property Rights

All intellectual property rights in and to the Services, including but not limited to the Beauty Health Index name, trademarks, logos, software, algorithms, scoring systems, reports, and content, are owned by or licensed to BHI.

Nothing in these Terms grants users any ownership or license rights in BHI intellectual property, except for the limited right to use the Services in accordance with these Terms.

11. BHI Certification, Claims, and Standardization

The Beauty Health Index, the BHI Score, and any claims such as “+XBHI” or “BHI-validated improvement” constitute protected proprietary standards.

Unauthorized use, representation, certification, benchmarking, or public claims referencing BHI without a written agreement with BHI are strictly prohibited.

BHI reserves the right to audit, enforce, and take legal action against unauthorized or misleading use of BHI-related claims.

12. Prohibited Uses

Users may not:

• reverse engineer, decompile, or attempt to extract algorithms or models
• use the Services to train competing systems or models
• scrape, harvest, or aggregate data from the Services
• misrepresent BHI outputs or make unauthorized claims
• use the Services for unlawful, deceptive, or harmful purposes

BHI reserves the right to suspend or terminate access for prohibited conduct.

13. Service Availability and Modifications

The Services are provided on an “as is” and “as available” basis. BHI does not guarantee uninterrupted or error-free operation.

BHI may modify, suspend, or discontinue any part of the Services at any time without liability.

14. Limitation of Liability

To the maximum extent permitted by law, BHI shall not be liable for any indirect, incidental, consequential, special, or punitive damages, including loss of profits, data, goodwill, or anticipated benefits, arising out of or related to use of the Services.

BHI’s total liability shall not exceed the amounts paid by the user to BHI in the twelve (12) months preceding the event giving rise to the claim.

15. Indemnification

Users agree to indemnify and hold harmless BHI, its officers, directors, employees, and partners from any claims, damages, liabilities, costs, or expenses arising from misuse of the Services, violation of these Terms, or infringement of third-party rights.

16. Termination

BHI may suspend or terminate access to the Services at any time for violation of these Terms, legal requirements, or platform integrity concerns.

Upon termination, all rights granted to the user cease immediately.

17. Governing Law and Jurisdiction

These Terms and any dispute, claim, or controversy arising out of or in connection with the Services, their interpretation, validity, enforcement, or termination shall be governed by and construed in accordance with the laws of the Hellenic Republic (Greece) and applicable European Union law, without regard to conflict-of-law principles.

Any dispute arising out of or relating to these Terms or the use of the Services shall be subject to the exclusive jurisdiction of the competent courts of Athens, Greece.

Prior to initiating judicial proceedings, the parties shall make reasonable efforts to resolve any dispute amicably.

18. Severability

If any provision of these Terms is found unenforceable, the remaining provisions shall remain in full force and effect.

19. Changes to These Terms

BHI reserves the right to modify these Terms at any time. Continued use of the Services after changes become effective constitutes acceptance of the revised Terms.

20. Contact Information

Legal inquiries may be directed to

SUPPORT@BEAUTYHEALTHINDEX.COM

COOKIE POLICY

Beauty Health Index (BHI)

Last updated: [2026]

1. Introduction

This Cookie Policy explains how Beauty Health Index (“BHI”, “we”, “us”, “our”) uses cookies and similar technologies on the Beauty Health Index website and any related web-based services (collectively, the “Website”).

This Cookie Policy should be read together with our Privacy Policy, which explains how we process personal data more broadly.

2. What Are Cookies

Cookies are small text files that are placed on your device when you visit a website. Cookies allow a website to recognize your device, remember preferences, enable functionality, and collect information about website usage.

Cookies may be session cookies, which are deleted when you close your browser, or persistent cookies, which remain on your device for a defined period or until deleted.

3. Types of Cookies We Use

3.1 Strictly Necessary Cookies

These cookies are essential for the operation of the Website and cannot be disabled in our systems. They enable core functionality such as page navigation, security, and access to secure areas of the Website.

Without these cookies, the Website cannot function properly.

3.2 Functional Cookies

Functional cookies allow the Website to remember choices you make, such as language preferences or region, and provide enhanced and more personalized features.

These cookies are used only to improve usability and user experience.

3.3 Analytics and Performance Cookies

Analytics cookies help us understand how visitors interact with the Website by collecting information such as pages visited, time spent on pages, and error messages.

The information collected is aggregated and used to improve Website performance, stability, and content. Where required by law, analytics cookies are used only with your consent.

3.4 Preference and Customization Cookies

These cookies store user preferences and settings to provide a more consistent experience across visits.

3.5 Third-Party Cookies

Some cookies may be placed by third-party service providers, such as analytics or infrastructure providers. These third parties may process information in accordance with their own privacy policies.

BHI does not control third-party cookies and encourages users to review the privacy policies of third-party providers.

4. Legal Basis for Cookie Use

Under applicable EU law, including the ePrivacy Directive and the GDPR, strictly necessary cookies are placed based on legitimate interest, as they are required for Website functionality. All other cookies are used only with your explicit consent, which may be given or withdrawn through the cookie consent banner or browser settings.

5. Consent Management

When you first visit the Website, you will be presented with a cookie consent banner that allows you to accept, reject, or customize cookie preferences.

You may withdraw or modify your consent at any time by adjusting your browser settings or through any available cookie management tools on the Website.

6. How to Manage or Delete Cookies

Most web browsers allow you to control cookies through browser settings. You may delete existing cookies, block future cookies, or receive a notification before cookies are placed.

Please note that disabling certain cookies may affect Website functionality and user experience.

7. Data Collected Through Cookies

Cookies may collect information such as IP address, device type, browser type, operating system, pages visited, and interaction patterns. This data is processed in accordance with our Privacy Policy and is not used to identify individual users unless required for security or legal purposes.

8. International Data Transfers

Where cookies involve processing by service providers located outside the European Union, appropriate safeguards are implemented in accordance with applicable data protection laws, including Standard Contractual Clauses where required.

9. Changes to This Cookie Policy

BHI reserves the right to update this Cookie Policy at any time. Material changes will be communicated through the Website or cookie banner. Continued use of the Website after changes become effective constitutes acceptance of the updated policy.

10. Contact Information

For questions regarding this Cookie Policy, please contact:

SUPPORT@BEAUTYHEALTHINDEX.COM

Back