US Privacy Notice

This notice applies to people in the United States. It supplements our Privacy Policy and our Face and Skin Data Notice, which you should read first.

It contains three parts:

1. Your rights under US state privacy laws
2. Our Consumer Health Data Privacy Policy, required by Washington and Nevada law
3. Our Biometric Data Policy, required by Illinois and Texas law

Part 1: State privacy rights

1.1 What we collect and why

We collect this directly from you, and generate some of it through your use of the Service.

1.2 We do not sell or share your personal information

We do not sell your personal information. We have not sold personal information in the preceding twelve months.

We do not share your personal information for cross-context behavioural advertising. We have not done so in the preceding twelve months.

We do not sell or share the personal information of anyone under 16. Our Service is not available to anyone under 16.

1.3 We limit our use of sensitive personal information

We use your facial images, skin analysis results and skin concerns only to provide the Service you asked for. We do not use them to infer characteristics about you beyond the skin attributes we disclose, and we do not use them for advertising, profiling or any secondary purpose.

Because our use is limited to the purposes permitted under California law without a right to limit, we do not offer a separate "Limit the Use of My Sensitive Personal Information" control. You can still delete this data at any time, or withdraw consent entirely.

1.4 Your rights

Depending on where you live, you may have the right to:

• know what personal information we collect, use and disclose;
• access a copy of it;
• correct inaccurate information;
• delete it;
• obtain a portable copy;
• opt out of sale, sharing, or targeted advertising, none of which we do;
• opt out of profiling that produces legal or similarly significant effects, which we do not carry out;
• withdraw consent to processing of sensitive data;
• appeal a decision we make about your request;
• not be discriminated against for exercising any of these rights.

These rights come from laws including the California Consumer Privacy Act as amended, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, the Montana Consumer Data Privacy Act, and equivalent laws in other states.

1.5 How to exercise a right

Most requests you can complete yourself in the app under Settings, Privacy. See Your Data Rights.

Otherwise, email operations@plumped.co.uk.

We will verify you by sending a confirmation link to the email address on your account. We respond within 45 days, and may extend once by a further 45 days where reasonably necessary, in which case we will tell you.

Authorised agents. You may use an authorised agent. We will require written permission signed by you, and we may contact you directly to confirm.

Appeals. If we decline your request, you may appeal by replying to our decision with the word "Appeal" and your reasons. We will respond within 45 days. If we deny the appeal, we will tell you how to contact your state Attorney General.

1.6 California Shine the Light

We do not disclose personal information to third parties for their own direct marketing purposes.

1.7 Notice of financial incentive

We do not offer financial incentives in exchange for personal information.

Part 2: Consumer Health Data Privacy Policy

This part is required by the Washington My Health My Data Act and by Nevada Senate Bill 370. It is linked separately from the homepage of plumped.co.uk as those laws require.

2.1 Consumer health data we collect

We collect the following consumer health data:

• facial images you submit for skin analysis;
• skin attribute scores derived from those images, covering acne, age spot, dark circle, droopy lower eyelid, droopy upper eyelid, eye bag, firmness, moisture, oiliness, pore, radiance, redness, skin type, tear trough, texture and wrinkle;
• an estimated age derived from your facial image;
• skin type, skin concerns and sensitivity level you enter yourself;
• the products you use and the routines generated for you, to the extent these indicate a skin condition.

2.2 Where it comes from

Directly from you, and from automated analysis of images you choose to submit. We do not obtain consumer health data from data brokers, from other companies, or from any public source.

2.3 Why we collect it

Solely to provide the Service you requested: analysing your skin, generating a personalised routine, warning you about ingredient conflicts, and letting you track change over time.

We do not use consumer health data for advertising, for profiling, for research, for product development beyond aggregate and de-identified statistics, or for any purpose you have not agreed to.

2.4 Who we disclose it to

We do not sell consumer health data. We have never sold it and we will not sell it. We do not disclose it to anyone other than the processors above. We do not disclose it to advertisers, insurers, employers, data brokers or law enforcement, except where a valid legal order compels us, in which case we will tell you unless we are legally prohibited from doing so.

2.5 Your rights over consumer health data

You have the right to:

• confirm whether we collect, share or sell your consumer health data;
• access it, including a list of everyone we have shared it with and how to contact them;
• withdraw consent to its collection and to its sharing;
• delete it.

To exercise any of these, email operations@plumped.co.uk or use the controls in Settings, Privacy.

We will respond within 45 days, extendable once by 45 days where reasonably necessary.

On a deletion request we will delete your consumer health data from all of our records, including archives and backups, and will notify our processors to do the same. We will confirm when this is complete.

Appeals. If we decline, you may appeal by replying to our decision. If we deny the appeal, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint, or to the Nevada Attorney General.

2.6 Consent

We ask for your separate, specific and freely given consent before collecting consumer health data, and a separate authorisation before sharing it. Consent is never bundled with the terms of service or with any other permission, and declining does not prevent you from using the rest of the Service.

2.7 Geofencing

We do not use geofencing. We do not collect location data at all, and we never establish a virtual boundary around a healthcare facility, a dermatology clinic, a pharmacy or anywhere else.

Part 3: Biometric Data Policy

This part is required by the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and similar laws.

3.1 Notice

PLUMPED LTD collects and stores photographs of your face, and derives from them numerical scores describing the condition of your skin. Depending on how the analysis works internally, this may involve a scan of face geometry, which some state laws define as a biometric identifier.

We are telling you this in writing before any collection takes place.

3.2 Purpose

The only purpose is to analyse the condition of your skin and generate a skincare routine for you.

We do not use this data to identify you. We do not run facial recognition, we do not match your face against any database, we do not create a template capable of recognising you in another image, and we do not use it for security, authentication, attendance, surveillance or any other identification purpose.

3.3 Duration and destruction schedule

We store your facial images and the derived data until the first of the following:

• you delete the individual photograph in the app;
• you delete your account;
• your account has been inactive for 24 months, after which we notify you by email and then delete;
• three years after your last interaction with us, which is an absolute backstop.

On any of these events, the data is permanently destroyed from our active systems immediately, and from encrypted backups within 30 days.

3.4 Disclosure

We do not sell, lease, trade or otherwise profit from your biometric data. We disclose it only to Hetzner, which stores it, and to Perfect Corp, which analyses it and does not retain it. We will not disclose it to anyone else unless you consent, or unless a valid warrant or subpoena compels us.

3.5 Safeguards

We store and transmit this data using a reasonable standard of care, and in a manner at least as protective as the manner in which we store other confidential and sensitive information. This includes encryption in transit and at rest, strict access controls, logging of administrative access, and regular penetration testing.

3.6 Written release

Before your first scan, the app presents this policy and asks you to give an express, written consent. You must actively agree. Nothing is pre-ticked, and you can decline and use the rest of the Service.

You may withdraw that consent at any time in Settings, Privacy, Skin analysis, and request destruction of everything already collected.

Contact

PLUMPED LTD is a company registered in England and Wales, company number 16204649, and is the entity responsible for the personal information described in this notice.