Privacy Policy

2.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Date of birth
• Account credentials (password hash — we never store plaintext passwords)
• Profile photograph (optional)
• Preferred language and communication preferences

2.2 Health and Treatment Data

To provide our core Services, we collect and process the following health-related and treatment data, which may constitute sensitive personal data or protected health information under applicable law:

• Skin type and skin assessment results
• Recorded treatment information, including type of procedure, date, provider, and clinical notes
• Injection zones and treatment mapping (specific facial or body areas treated)
• Products used in each treatment (product name, manufacturer, batch/lot number, units or volume administered)
• Product reactions, adverse events, or allergies reported by you or your provider
• Treatment outcome assessments and follow-up records
• Provider-entered clinical observations

We apply safeguards appropriate to sensitive health and treatment data and do not sell, rent, or share this data with third parties for advertising, marketing, or any purpose unrelated to providing the Services.

2.3 Photographs

Our Services allow you and your providers to capture and store before-and-after treatment photographs. With respect to these photographs:

• Photos are uploaded only with your explicit consent or at the direction of your treating provider with your authorization
• All EXIF metadata, including GPS coordinates, is automatically stripped from photographs before they are uploaded to our servers
• Photographs are protected by access controls and may be accessed through authenticated app access or, when you create an active passport-sharing link, by a recipient who possesses that time-limited link
• Photographs are not used for machine learning, model training, facial recognition, or any purpose other than displaying your treatment record

2.4 Biometric Authentication Data

The Apps can use the device operating system's authentication framework, including Face ID or Touch ID on supported Apple devices and Android system biometric or device authentication where supported. Biometric templates are handled by the operating system and device security hardware where available. Aesthetic Pass receives only the authentication result and does not receive, transmit, or store fingerprints, facial geometry, or other biometric templates.

2.5 Device and Technical Information

When you use the App or visit our Website, we automatically collect certain technical information:

• Device type, model, and operating system version
• Platform-provided app or device identifiers where used (for example, IDFV on iOS)
• Apple Push Notification Service (APNs) and Firebase Cloud Messaging (FCM) registration tokens, used for notifications you have enabled
• App version and build number
• IP address and request metadata processed transiently for website delivery, security, and abuse prevention
• Browser type and version (for Website visitors)
• General crash logs and performance diagnostics, including Android diagnostics processed through Firebase Crashlytics

2.6 Location Information

We may request access to your device's location services solely for the purpose of displaying nearby listed aesthetic providers. Location data is used in real-time to return search results and is not persistently tracked, stored on our servers, or associated with your account profile. You may deny or revoke location access at any time through your device settings, though this may limit the functionality of the provider-finder feature.

2.7 Usage Data

We collect anonymized and aggregated information about how you interact with our Services, including:

• Pages and screens viewed
• Features accessed and actions taken
• Session duration and frequency of use
• Navigation paths within the App

This data is used solely to improve the user experience and is not linked to your health or treatment records.

2.8 Payment Information

We do not directly collect or store your full credit card numbers, bank account details, or other financial account information. Payment processing is handled by the following third parties:

• Apple App Store (StoreKit 2) — processes all in-app subscriptions purchased on iOS, including Bio Age Premium Monthly ($14.99/month) and Bio Age Premium Annual ($99/year). Apple sends us subscription status events (purchase, renewal, expiry, refund) via the App Store Server Notifications V2 webhook. We do not receive your payment instrument; we receive only an opaque original transaction ID and the resulting subscription state. Apple's privacy policy is available at apple.com/legal/privacy.
• Google Play Billing — processes in-app subscriptions purchased on Android. Google provides an opaque purchase token, product and order identifiers, and subscription state for server-side verification and access management. We do not receive the payment instrument associated with the user’s Google Play account. Google’s privacy policy is available at policies.google.com/privacy.
• Stripe — processes payments for the web Bio Age Premium subscription ($19.99/month). Stripe receives the payment-related information necessary to process transactions and is PCI-DSS Level 1 certified. Stripe's privacy policy is available at stripe.com/privacy.
• PayPal — processes Pro clinic subscriptions purchased through the web clinic dashboard. PayPal receives the account, payment, and billing information needed to authorize and renew the subscription. PayPal's privacy statement is available at paypal.com/privacy.

We store the following purchase-related metadata in our database to operate the subscription: subscription status (free / active / past_due / canceled / expired / refunded / revoked), expiration timestamp, payment processor (Apple, Google Play, Stripe, or PayPal), and opaque purchase, transaction, subscription, order, and webhook identifiers. We do not store credit card numbers, CVV codes, bank account numbers, or any other primary payment instrument data.

2.9 Bio Age Estimation Data

The Aesthetic Pass app includes an optional Bio Age feature that estimates biological skin age from a facial photograph using an on-device AI model (MiVOLO, converted to ONNX/CoreML). The model runs entirely on your device; we do not upload raw photographs or facial geometry to our servers for inference.

The numerical result of each Bio Age scan (the estimated age in years), the timestamp of the scan, and the model version used are stored in our Supabase database alongside your treatment history. This data is treated as health-related personal data under the GDPR (Art. 9) and is protected with the same encryption and access controls as your treatment records.

Medical disclaimer: Bio Age is a cosmetic estimator for aesthetic guidance only. It is not a medical or diagnostic assessment. Do not rely on Bio Age results for medical decision-making.

2.10 Subscription Auto-Renewal & Right of Withdrawal

Bio Age Premium subscriptions may be purchased through the Apple App Store, Google Play, or the supported web checkout. Renewal and cancellation timing is governed by the seller and terms shown before purchase. Mobile subscriptions can be managed through the applicable Apple App Store or Google Play subscription settings; supported web subscriptions can be managed through the relevant dashboard.

EU Right of Withdrawal (Widerrufsrecht). If you are a consumer in the European Union, applicable law may provide a fourteen-day right of withdrawal, subject to exceptions for digital services or content and to the identity of the seller of record. For a mobile-store purchase, submit the request through Apple or Google Play using the storefront that processed the transaction. For a supported web subscription, contact us at info@drylabs.de with an unequivocal statement of withdrawal.

Loss of withdrawal right: By performing a Bio Age scan beyond the free 3-scans-per-month tier within the 14-day withdrawal window, you expressly request immediate performance of the digital service and acknowledge that you thereby lose your right of withdrawal in accordance with § 356(5) BGB and Article 16(m) Directive 2011/83/EU.

Detailed subscription terms, pricing, refund policy, and cancellation procedures are set out in § 9 of our Terms of Use.

3.1 Providing and Operating the Services

• Creating and managing your Aesthetic Pass account and digital passport
• Recording, storing, and displaying your treatment history and associated clinical data
• Enabling you to share your treatment passport with authorized providers via QR code scan
• Facilitating communication between you and your aesthetic providers
• Processing and managing subscriptions and payments through our third-party processors

3.2 Treatment Reminders and Notifications

• Sending push notifications for treatment touch-up reminders, product lifecycle alerts, and appointment follow-ups
• Delivering system notifications regarding your account, security alerts, or changes to the Services

You may disable push notifications at any time through your device settings or within the App's notification preferences.

3.3 Improving and Personalizing the Services

• Analyzing aggregated, de-identified usage patterns to improve features, interface design, and overall user experience
• Personalizing how records, informational timelines, and optional reminders are displayed based on your settings and recorded data; this is not clinical treatment or dosing advice
• Conducting internal research and analytics (using anonymized data only)

3.4 Safety and Security

• Detecting, preventing, and addressing fraud, unauthorized access, or other illegal activity
• Monitoring for security threats and protecting the integrity of our infrastructure
• Reviewing abuse reports and protecting the integrity of provider and clinic directory information

3.5 Legal Compliance

• Complying with applicable laws, regulations, legal processes, or governmental requests
• Enforcing our Terms of Service and other agreements
• Protecting the rights, property, or safety of Aesthetic Pass, our users, or the public

4.1 With Your Authorized Providers

When you generate and present a digital treatment-passport link to an aesthetic provider, anyone who possesses that bearer link can obtain temporary, read-only access to the available practitioner-recorded passport history while the link remains valid. The current mobile flow creates a reusable link that expires after 24 hours and does not offer record-by-record scope selection, single-use access, or early revocation. Share the link only with the intended recipient. Providers remain bound by their own professional and legal obligations regarding the handling of health information.

4.2 Service Providers and Data Processors

We engage trusted third-party service providers who process data on our behalf under strict contractual obligations, including data processing agreements that require them to protect your information and use it only for the purposes we specify:

• Supabase — provides our database infrastructure, user authentication, and backend services. Supabase processes account data, treatment records, and other information stored within the platform. Data is hosted within the European Union. Supabase's privacy policy: supabase.com/privacy.
• Cloudflare — provides (a) content delivery, web hosting, DDoS protection, and performance optimization for our Website, (b) image hosting via Cloudflare Images for patient before/after photos uploaded inside the app, and (c) cookie-free Web Analytics on an explicit allowlist of public marketing pages. Cloudflare may process IP addresses and technical request data while delivering and protecting the Website. Web Analytics provides aggregate traffic and performance metrics without cookies, local storage, cross-site tracking, or fingerprinting; its browser beacon is not loaded on patient-passport, account, dashboard, admin, authentication, or API routes. On those allowlisted marketing pages, we also record first-party categorical conversion events such as page category, call-to-action placement, language, and selected demo-interest category. These event rows do not include the visited URL, referrer, account or clinic identifiers, or form contents, and are retained for up to three months. Image bytes are stored on Cloudflare's global object store and served from the nearest edge location for performance. Cloudflare Images also processes internal upload metadata used to associate and verify an image, which may include photo, treatment, clinic, practitioner, slot, upload-platform, and categorical photo or treatment identifiers. Authoritative account, treatment, and photo-association records remain in our Supabase West EU (Ireland) database. Cloudflare Workers Ltd. is the contracting party for EU customers and is certified under the EU-U.S. Data Privacy Framework. Standard Contractual Clauses (SCCs) are executed. Cloudflare's privacy policy: cloudflare.com/privacypolicy.
• Resend — transmits demo-request emails from our Website. When you submit the demo form, the name, email address, practice or clinic details, location, selected interest, patient-volume or team-size range, message, language, source-page category, form placement, and available UTM campaign fields you provide are sent through Resend solely so we can receive, attribute, and respond to your request. Resend's privacy policy: resend.com/legal/privacy-policy.
• Google (Google Play, Firebase, and Gmail) — provides Google Play Billing and subscription-status data for Android purchases, Firebase Cloud Messaging for Android notifications, Firebase Crashlytics for Android crash diagnostics, and Gmail for the mailbox that receives demo requests. Google Play provides the opaque purchase and order information described in Section 2.8; notification registration tokens and diagnostic technical data are processed for the relevant app functions. The demo-form and attribution fields described above are delivered to the Gmail mailbox and retained according to our operational correspondence needs and applicable legal obligations. Google's privacy policy: policies.google.com/privacy.
• Stripe — processes payment transactions for the web Bio Age Premium subscription. Stripe receives only the payment-related information necessary to process transactions. Stripe is PCI-DSS Level 1 certified.
• PayPal — processes Pro clinic subscription purchases, renewals, cancellations, and payment-status events. PayPal receives the account and payment information necessary to provide those services. We store only the operational subscription metadata described above, not the underlying payment instrument.
• Apple, Inc. — provides Apple Push Notification Service (APNs) for delivering notifications, and App Store purchase processing for in-app subscriptions (Bio Age Premium iOS). For in-app subscriptions, Apple sends us subscription state events through the App Store Server Notifications V2 webhook; we do not receive payment instrument data. Apple processes data in accordance with its own privacy policy at apple.com/legal/privacy.

4.3 Legal Requirements and Protection of Rights

We may disclose your information if we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or enforceable governmental request
• Respond to valid subpoenas, court orders, or other legal instruments
• Protect the rights, property, or personal safety of Aesthetic Pass, our users, or the public
• Detect, prevent, or otherwise address fraud, security, or technical issues
• Enforce our Terms of Service or other applicable agreements

Where legally permitted, we will make reasonable efforts to notify you before disclosing your information in response to legal process.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Services prior to your personal information being subject to a different privacy policy, and you will have the opportunity to delete your account before such transfer.

4.5 Aggregated and De-Identified Data

We may share aggregated, de-identified, or anonymized information that cannot reasonably be used to identify you for industry research, trend analysis, or public reporting purposes. Such data will never contain personal identifiers, treatment photographs, or information that could be re-identified to a specific individual.

5.1 Encryption

• At Rest: Production database, object-storage, and backup providers apply provider-managed encryption at rest
• In Transit: Supported connections between the Apps, Website, and backend services use HTTPS/TLS encryption in transit
• Certificate Pinning: The iOS App uses certificate pinning as an additional control intended to reduce man-in-the-middle risk

5.2 Access Controls

• Row-Level Security (RLS): Our database infrastructure applies row-level policies to authenticated database access based on the user’s role and active patient-provider or clinic relationships. Time-limited passport access is mediated separately through the bearer-token flow described above
• Principle of Least Privilege: Internal access to production systems is restricted to designated personnel and accounts using role-based access controls
• On-Device Authentication: Supported iOS and Android devices can use operating-system authentication as an additional local app-lock control; Aesthetic Pass receives only the authentication result

5.3 Photo Security

• EXIF metadata (including GPS coordinates, camera model, and timestamps) is automatically stripped from all photographs before upload
• Photos are stored in encrypted object storage with unique, non-guessable identifiers
• Access to photographs is controlled via time-limited, signed URLs that expire after a short period

5.4 Infrastructure Security

• Network-level DDoS protections provided through Cloudflare
• Scheduled database, storage, and infrastructure-configuration backups
• Database backups are encrypted before they are written to backup storage
• Security incidents are handled in accordance with applicable legal and regulatory notification duties

5.5 Limitations

While we implement these safeguards, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. If a personal-data breach occurs, we will notify affected users and relevant authorities when and as required by applicable law.

6.1 Rights Under the EU General Data Protection Regulation (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR and equivalent legislation:

• Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to Rectification (Article 16): You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure (Article 17): You have the right to request deletion of your personal data, subject to certain exceptions (e.g., where retention is required by law or necessary for the establishment, exercise, or defense of legal claims).
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) and to transmit it to another controller.
• Right to Restriction of Processing (Article 18): You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data or object to processing.
• Right to Object (Article 21): You have the right to object to processing based on legitimate interests, including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent (Article 7): Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

Legal Bases for Processing (GDPR Art. 6 & Art. 9): We process your personal data on the following legal bases, mapped to each data category:

• Account information (name, email, DOB): Art. 6(1)(b) — performance of a contract
• Health and treatment data (skin type, treatment history, injection zones, products, reactions): Art. 9(2)(a) — explicit consent for special category data
• Photographs (before/after images): Art. 6(1)(a) — consent
• Device and technical data (device type, IP, crash logs): Art. 6(1)(f) — legitimate interest in service operation and security
• Location data (nearby provider search): Art. 6(1)(a) — consent (revocable via device settings)
• Usage analytics (anonymised interaction data): Art. 6(1)(f) — legitimate interest in service improvement
• Payment data (transaction IDs, subscription status): Art. 6(1)(b) — contract performance; Art. 6(1)(c) — legal obligation (tax records)

6.2 Rights Under the California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the business purposes for collection, and the categories of third parties with whom it is shared.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share (as defined under the CCPA/CPRA) your personal information. Therefore, no opt-out mechanism is necessary; however, if our practices change, we will provide a conspicuous "Do Not Sell or Share My Personal Information" link.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit the use and disclosure of sensitive personal information to what is necessary to perform the Services.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, please contact us at privacy@aestheticpass.com. We will verify your identity before processing your request and respond within the timeframes required by applicable law (generally 30 days for GDPR requests and 45 days for CCPA requests, with extensions as permitted).

6.3 Additional State and International Privacy Rights

Residents of other U.S. states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and others) and residents of other countries with applicable data protection legislation may have similar rights. We are committed to honoring all valid privacy rights requests in accordance with applicable law. Please contact us using the information in Section 12 to exercise your rights.

6.4 Account Deletion

You may request complete deletion of your account and all associated data at any time by contacting us at privacy@aestheticpass.com or by using the account deletion feature within the App (Settings > Account > Delete Account). Upon verification, we will permanently delete your account data, treatment records, photographs, and all associated personal information from our active systems within 30 days. Residual copies may remain in access-restricted disaster-recovery backups until those backup objects are deleted or overwritten under our operational retention schedule. Backups are not used for ordinary processing; if a backup is restored, applicable deletion requests must be reapplied.

7.1 Retention Periods

• Account Information: Retained for the duration of your active account. Upon account deletion, personal data is removed from active systems within 30 days. Residual copies may remain in access-restricted disaster-recovery backups until the relevant backup objects are deleted or overwritten under our operational retention schedule; they are not used for ordinary processing.
• Treatment Records and Health Data: Retained for the duration of your active account. We do not impose a separate retention limit on treatment history, as the core purpose of Aesthetic Pass is to provide a comprehensive, long-term treatment record. All treatment data is deleted upon account deletion.
• Photographs: Retained until you or your authorized provider deletes them, or until account deletion. You may delete individual photographs at any time through the App.
• Usage and Analytics Data: First-party categorical marketing-conversion events are retained for up to three months. Other anonymized aggregate metrics may be retained longer for trend analysis; identifiable usage logs are retained for no more than 12 months.
• Payment Records: Transaction records are retained for the period required by applicable tax and financial regulations (typically 7 years), even after account deletion. These records contain only transaction metadata and do not include full payment instrument details.
• Communication Records: Customer support correspondence is retained for up to 3 years to ensure quality and resolve disputes.

7.2 Legal Holds

Notwithstanding the above, we may retain personal information for longer periods where required by law, regulation, court order, or in connection with pending or anticipated legal proceedings or investigations.

8.1 Primary Data Storage

Our primary database and authentication infrastructure is hosted by Supabase within data centers located in the European Union. Your account data, treatment records, treatment metadata (zones, products, notes), and health information are stored on servers physically located within the EU, benefiting from the protections afforded by EU data protection law.

Photographs are an exception: patient before/after photos and selfie progress photos are hosted by Cloudflare Images, which stores image bytes on a global object store and serves them from the nearest edge location. Cloudflare Image objects also receive internal upload metadata used to associate and verify an image, which may include photo, treatment, clinic, practitioner, slot, upload-platform, and categorical photo or treatment identifiers. We rely on Cloudflare Workers Ltd. (the EU contracting party for Cloudflare's services) and the safeguards described in §8.3 below for these transfers. Authoritative account, treatment, and photo-association records remain in our Supabase EU database, while image bytes and attached upload metadata may be processed outside the EU.

8.2 Content Delivery and Edge Processing

Our Website is served through Cloudflare's global content delivery network (CDN), which routes requests through the nearest edge location to optimize performance. This means that certain technical data (such as IP addresses and request headers) may be transiently processed at Cloudflare edge nodes worldwide. The same applies to images served via Cloudflare Images (see §8.1). Cloudflare is certified under the EU-U.S. Data Privacy Framework and implements appropriate safeguards for international data transfers.

8.3 Transfer Safeguards

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all sub-processors
• Verification that recipients participate in recognized data privacy frameworks (e.g., the EU-U.S. Data Privacy Framework)
• Supplementary technical measures, including encryption, pseudonymization, and access controls

10.1 Storage We Use

• Account and Preference Storage: Public marketing pages do not set first-party session, CSRF, analytics, or preference cookies. Authenticated web features may store account-session data in browser storage, and the clinic dashboard can store its language preference locally. Cloudflare may set a strictly necessary security cookie if it presents a security or bot-management challenge. A third-party checkout or external service you choose to open applies its own storage policy on that provider’s domain.
• Cookie-free Website Analytics: On explicitly allowlisted public marketing pages, we use Cloudflare Web Analytics to understand aggregate traffic and Core Web Vitals. We also record bounded categorical conversion events (page category, call-to-action placement, language, and selected demo-interest category) without storing the visited URL, referrer, account or clinic identifiers, or form contents. These event rows are retained for up to three months. The analytics tools do not use cookies, local storage, cross-site tracking, or fingerprinting. The browser beacon is not loaded on patient-passport, account, dashboard, admin, authentication, or API routes. We do not use Google Analytics, Facebook Pixel, or third-party advertising or behavioural-tracking scripts.

10.2 What We Do Not Use

• No third-party advertising cookies or tracking pixels
• No cross-site tracking or retargeting technologies
• No social media tracking widgets or embedded trackers
• No fingerprinting or supercookie techniques

10.3 Mobile App

The Aesthetic Pass mobile Apps do not use browser cookies. Platform-provided identifiers and notification tokens used by the Apps support account operation, notification delivery, security, and crash diagnostics. We respect Apple's App Tracking Transparency (ATT) framework and do not engage in cross-app or cross-service advertising tracking.

10.4 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling essential cookies may prevent you from using certain features of the Website. For more information about cookies and how to manage them, visit allaboutcookies.org.