Privacy Policy

THIS PRIVACY POLICY IS SUBJECT TO AN ARBITRATION AGREEMENT DESCRIBED IN OUR TERMS OF USE, WHICH ARE INCORPORATED INTO THIS POLICY BY REFERENCE.

Beauty Health Index Inc., a Delaware corporation (the “Company,” “we,” “us,” or “our”), respects your privacy. This Privacy Policy (this “Policy”) describes the categories of personal information we collect, how we use and disclose it, and the choices available to you. This Policy applies to https://beautyhealthindex.com (the “Website”), our mobile application (the “App”), the in-App community feature described below (“Room”), and all related content and services we provide (collectively, the “Services”). Capitalized terms not defined in this Policy have the meanings stated in our Terms of Use.

By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must not use the Services. The Services are intended for a worldwide audience; the section “International Users” below describes additional disclosures and safeguards that apply depending on your country of residence.

The Services are intended for individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from an individual under 18, we will delete that information, except where retention is required by law. If you are a parent or guardian and believe your child has provided us with personal information, contact us at legal@beautyhealthindex.com.

We collect the following categories of information from and about users of the Services:

• Identifiers and account data. Your email address, account credentials, unique user identifiers, and sign-in information if you register using Google or Apple Sign-In.
• Personal information. Information you add to your profile or provide during onboarding, such as your age, gender, ethnicity, and your skincare or beauty goals. We collect ethnicity only to help personalize your BHI Score and insights; you are not required to provide it, and declining to do so does not prevent you from using the core Services.
• Facial scan and biometric data. Facial photographs and video you capture through the App’s scanning feature, and the derived facial landmarks, measurements, and the BHI Score and related domain scores generated from that data (collectively, “Scan Data”). Scan Data is described further in “Biometric Data: Notice, Consent, and Retention” below.
• Skincare and lifestyle data. Information you log about your skincare routine and daily habits through features such as the Daily Journal, including sleep, diet (such as added sugar, processed food, and dairy), caffeine, alcohol, tobacco, and vaping use, and supplements taken.
• Health and wearable data. If you choose to connect a wearable or health integration, such as WHOOP or Apple Health, health and fitness metrics made available through that integration, such as heart rate, sleep, and recovery data.
• Calendar and device data. Calendar information, if you connect a calendar; and device and app information, such as device identifiers and notification settings.
• Room and community content. Photographs, captions, comments, reactions, and profile information you choose to post or share through the Room feature, which may be visible to other users of the Services.
• Usage and diagnostic data. Information about your use of the App, system-generated insights, and diagnostic and crash data.
• Communications. Information you provide when you contact customer support or otherwise communicate with us.

We do not use cookies, web trackers, advertising software development kits (SDKs), or similar tracking technologies in the App.

We collect the Scan Data described above to generate your BHI Score and to provide the personalized insights and notifications that are core features of the Services. Before you first use the App’s scanning feature, we require you to affirmatively consent to this collection and processing through an in-App disclosure.

If you choose to connect WHOOP, Apple Health, or a similar integration, we receive and store health and fitness information made available through that integration in order to personalize your BHI insights. In addition, the Daily Journal and similar in-App features let you log lifestyle information directly, such as sleep, diet, alcohol, tobacco, and vaping use, and supplement intake. This information, whether from a connected wearable or logged directly in the App, may constitute “consumer health data” under certain state laws, including the Washington My Health My Data Act, RCW 19.373, or as “special category data” under international laws including the EU GDPR (“Consumer Health Data”). We collect and use Consumer Health Data based on the affirmative consent you provide when you connect an integration or first use these features, we do not sell it, and, as stated in “No Sale or Sharing of Personal Information; No Targeted Advertising” below, we do not use it for targeted advertising. You may disconnect a wearable or health integration and withdraw your consent at any time through the App, and you may request deletion of this information as stated in “Your Rights and Choices” below.

If you connect Apple Health, we will not use information obtained through Apple’s HealthKit framework for advertising, marketing, or other use-based data-mining purposes, and we will not disclose that information to third parties for those purposes, consistent with Apple’s App Store Review Guidelines (Guideline 5.1.3).

We collect information: (i) directly from you, such as when you create an account, complete a scan, connect an integration, post content to the Room, or contact support; (ii) automatically, through your use of the App; and (iii) from service providers, such as our cloud-hosting, artificial-intelligence-processing, and sign-in providers.

We use your information solely to provide and operate and improve the Services, including generating your BHI Score and personalized insights and notifications; operate the Room feature; maintain and secure the Services and detect and prevent fraud and abuse; provide customer support; and comply with our legal obligations and enforce our Terms of Use.

We do not use your information for targeted advertising, and, as stated above, we do not use your Scan Data or other Content to train, fine-tune, or improve any AI model.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral or targeted advertising. We do not use your Scan Data or Consumer Health Data to target advertising to you or to any other individual, or to build an advertising profile about you.

As stated in our Terms of Use, the Company may in the future display general or contextual advertising within the Services, including from third-party business partners. Any such advertising is not selected using your Scan Data, your Consumer Health Data, or other sensitive information described in this Policy. If our advertising practices later come to rely on your personal information in a manner that constitutes a “sale” or “sharing,” or targeted advertising, under applicable law, we will update this Policy in advance of that change and provide the notice and choices required by law before doing so.

We disclose personal information to the following categories of recipients, solely to provide, secure, and improve the Services or as otherwise stated in this Policy. Each third-party recipient identified below has and operates under its own privacy policy and terms, and, where you choose to connect a third-party integration (such as WHOOP or Apple Health), that provider’s own privacy policy and terms govern its handling of your information in addition to this Policy; we are not responsible for a third party’s own privacy or data-handling practices.

• Cloud hosting and infrastructure. For example, Amazon Web Services, for compute, database, object storage (including Scan Data), encryption and key management, and system monitoring.
• Artificial-intelligence processing. For example, OpenAI, to process Scan Data and lifestyle information you provide in order to generate your BHI Score and personalized insights.
• Communications. For example, Resend, for transactional email; Firebase Cloud Messaging, for push notifications.
• Sign-in. Google and Apple, if you choose to sign in using those services.
• Wearable and health integrations. WHOOP and Apple Health, if you choose to connect them.
• Product and context lookups. Open Beauty Facts, for product-barcode lookups; Open-Meteo, for weather-based context.
• Other users. Content you post to the Room may be visible to other users of the Services as configured by your privacy settings.
• Legal and safety. We may disclose information to comply with law, legal process, or a government request; to enforce our Terms of Use; and to protect the rights, property, or safety of the Company, our users, or others.
• Business transfers. We may disclose information in connection with a merger, acquisition, financing, or sale of company assets.
• Professional advisors. Our lawyers, auditors, and insurers, under confidentiality obligations.

We do not sell personal information to any of the recipients above, and each service provider is contractually restricted to using personal information only to provide services to us.

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure, including encryption of data at rest and in transit and role-based access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain personal information only for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Scan Data is retained as stated in “Biometric Data: Notice, Consent, and Retention” above. Account information is retained for as long as your account remains active and for a limited period after deletion to allow for account recovery and to comply with legal and security requirements, after which it is deleted or de-identified.

You may access or delete your personal information directly through the App. To request deletion of your account, your Scan Data, or other personal information beyond what the in-App tool covers, or to correct your personal information or withdraw a consent you previously provided, you can contact us at legal@beautyhealthindex.com. We will respond to verifiable requests within the time required by applicable law, but not later than 45 days. Depending on your country or state of residence, additional rights may be available to you, as stated in “International Users” below. You can also submit an account-deletion request through our delete-account page.

• Delete scan history. The “Delete my data” tool in the App’s Settings deletes your scan reports, streak history, and related scan history; it does not delete your account or account-level information.
• Delete your account. Contact legal@beautyhealthindex.com or use the delete-account page to request deletion of your account and the personal information associated with it.
• Disconnect integrations. You may disconnect any third-party integration, such as WHOOP or Apple Health, at any time through the App.
• Manage permissions. You may manage camera, notification, calendar, and other device permissions at any time through the App or your device settings.
• Correct or update information. You may correct or update your profile and account information directly through the App, or by contacting us.

The Company is based in the United States, and our servers and service providers are located in the United States. The Services are intended for a worldwide audience, and this section describes additional disclosures and safeguards that apply if you access the Services from outside the United States. Wherever you are located, your information will be transferred to, stored, and processed in the United States and in the other countries in which our service providers stated in “Disclosure of Your Information” above operate.

Disputes arising out of or relating to this Policy or our data and privacy practices are subject to the binding arbitration and class-action-waiver provisions stated in our Terms of Use, which are incorporated into this Policy by reference, including the savings clause stated there for consumers resident outside the United States for whom mandatory consumer arbitration is not enforceable under the law of their country of residence.

We may update this Policy from time to time. We will post any changes on this page and update the “Last modified” date above. If we make a material change to how we treat personal information, we will provide additional notice, such as an in-App notice or an email to the address associated with your account.

Beauty Health Index Inc., 3500 South Dupont Highway, Dover, Kent, 19934, Delaware. Questions about this Policy or our privacy practices may be directed to legal@beautyhealthindex.com.