Privacy Policy

2Data controller and Data Protection Officer

The data controller for the processing described in this policy is Sanviau Luxe Essentials Private Limited, a company incorporated in India.

3Definitions

• "Personal data" means any information relating to an identified or identifiable natural person.
• "Health and biometric data" means scalp photographs, hair imagery and any analysis derived from them.
• "Report" means an AI-generated output, including scalp health scores and hair loss assessments.
• "Processing" means any operation performed on personal data, whether automated or not.
• "Clinical Review" means an optional assessment of a Report by a licensed professional.

4Personal data we collect

We collect the following categories of personal data. Where data is provided by you directly, it is collected at the point of registration, scan submission or support contact.

Providing health and biometric data is optional, but the analysis service cannot be delivered without it.

5Purposes of processing and legal basis

We process personal data only where a lawful basis applies. For health and biometric data we rely on your explicit consent under Article 9 of the GDPR, India's Digital Personal Data Protection Act, and equivalent frameworks in the other jurisdictions we serve.

6Health and biometric data

Consent may be withdrawn at any time from your account settings or by contacting our Data Protection Officer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, but will end our ability to generate further Reports.

7Storage, security and retention

We apply technical and organisational measures appropriate to the sensitivity of the data we hold.

No method of transmission or storage is completely secure. While we work to protect your personal data, we cannot guarantee absolute security.

8Disclosure and sharing

We share personal data only in the following circumstances:

• Third-party AI processors, which access images strictly under data processing agreements;
• Clinical reviewers, who receive anonymised Reports;
• Payment providers, for the purpose of processing subscription payments;
• Regulators, law enforcement or courts, where we are legally compelled to disclose.

9International transfers

Where personal data is transferred outside the jurisdiction in which it was collected, transfers are protected by Standard Contractual Clauses, Binding Corporate Rules, or other safeguards equivalent to those required by the GDPR.

10Your rights

Subject to the conditions of applicable law, you may exercise the following rights:

• Access — obtain a copy of the personal data we hold about you;
• Correction — have inaccurate or incomplete data rectified;
• Deletion — request erasure of your personal data;
• Portability — receive your data in a structured, machine-readable format;
• Restriction — limit how we process your data;
• Objection — object to processing carried out on legitimate interests;
• Withdrawal of consent — withdraw consent previously given, at any time.

10.1 Exercising your rights

Requests may be sent to privacy@sanviau.com. We acknowledge rights requests within 72 hours and respond substantively within 30 days. We may ask you to verify your identity before we act on a request.

11Jurisdiction-specific rights

Additional rights and supervisory authorities apply depending on where you are resident.

12Children's privacy

If you believe a minor has submitted personal data to us, contact privacy@sanviau.com and we will delete it.

13Cookies and tracking

14Marketing communications

Where we send marketing communications, you may opt out at any time using the unsubscribe link in any email or from your account settings. Opting out of marketing does not stop transactional messages relating to your account.

15Changes to this policy

We may update this policy from time to time. Updates are posted to this page with a revised effective date. Where a change materially affects your rights, we will provide additional notice.

16Contact and complaints

For any question about this policy or the way we handle personal data, contact privacy@sanviau.com or our Data Protection Officer at legal@sanviau.com. You also have the right to lodge a complaint with the supervisory authority in your jurisdiction.