Consumer Health Data Policy

1. About This Policy

This Consumer Health Data Policy explains how Nalumi handles “consumer health data” as defined by the Washington My Health My Data Act (RCW 19.373) and similar laws in other U.S. states (for example, Nevada and Connecticut). It supplements our Privacy Policy.

Nalumi is a cosmetic service, not a medical one. Still, some of the information you share — such as photos of your face, how your skin looks, sensitivities or allergies — may be considered health data under these laws, so we treat it as such.

2. Health Data We Collect

• Face photos and scan results — photos you take for a face scan and the cosmetic skin scores, highlighted areas and heat maps produced from them (see our Biometric Data Policy).
• Skin profile — skin type, sensitivity, skin concerns and goals, and any allergies or ingredients to avoid that you choose to tell us.
• Skin diary and check-ins — how your skin feels and notes you add.
• Chat messages with the Nala assistant, where you mention your skin.
• Product use — the products on your shelf and in your routine, which may reveal information about your skin.

3. Where It Comes From

We collect consumer health data directly from you: from your answers to the beauty profile questions (on our website or in the app), from the photos you take and from what you enter or write in the app. We also produce scan results from your photos. We do not buy health data or collect it from other sources.

4. How We Use It

We collect and use consumer health data only with your consent and only to provide the features you ask for:

• to show your face scan results and how they change over time;
• to build your skincare routine and match products to your skin, avoiding ingredients you told us to avoid;
• to answer your questions in the Nala chat;
• to keep your service secure and to meet legal obligations.

We do not use consumer health data for advertising, do not sell it and do not use it to train AI models.

5. Who We Share It With

We never sell consumer health data. We share it only with processors that help us run the Service on our behalf and under contract:

• hosting and infrastructure providers — storage of your data, including face photos;
• OpenAI — text of your chat messages and a short text summary of your skin profile, scan scores and routine, to generate Nala’s replies (never photos);
• Brevo — your email address for service emails (no health data in emails beyond what you request).

We may also disclose data where the law requires it. We do not share consumer health data with advertisers, data brokers or cosmetic brands.

6. Your Rights

You have the right to:

• confirm whether we collect, share or sell your consumer health data, and access it, including a list of all third parties and affiliates we have shared it with;
• withdraw your consent at any time — in the app (face scan consent) or by email;
• have your consumer health data deleted — delete scans or your whole account in Settings → Privacy, or email us.

To make a request, email [email protected] from the address linked to your account. We respond within 45 days, which may be extended once by another 45 days where reasonably necessary; we will tell you if so. If we decline your request, you can appeal by replying to our decision with the subject “Appeal”; we will answer within 45 days. If your appeal is denied, you may contact the Washington State Attorney General.

7. Retention

We keep consumer health data only while you use the Service. Face photos and scans are deleted as set out in our Biometric Data Policy (and no later than 1 year after your last activity). Other data is deleted when you delete your account, as described in our Privacy Policy.

Contact

Questions about this Policy, or a request to access or delete your data? Write to us — we reply within 30 days, and sooner where the law requires.