Privacy policy
hairtrack measures hair loss from photographs you take of your own head. Those photographs, and what they say about your health, are the most sensitive thing you give us. This policy says what we collect, what we do with it, who else touches it, how long it stays, and how you take it back.
hairtrack (the app and hairtrack.ai) is run by Rate Me Inc., a Delaware corporation ("we", "us"). For the purposes of EU and UK data protection law, Rate Me Inc. is the controller of the personal data described here.
Questions, requests and complaints go to support@ratewithai.co.
Only what the measurement needs, plus what it takes to run the app. In full:
We do not collect your contacts, your photo library (beyond photos you pick), or anything from other apps.
Each use, with the legal basis EU and UK law asks us to name:
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to make decisions about you that have legal or similarly significant effects.
Some US state laws, including Illinois (BIPA), Texas and Washington, give special protection to biometric identifiers. This is our written notice and retention policy under them.
Under the EU and UK GDPR, information about hair loss, treatment and surgery is "special category" health data, which is why we ask for explicit consent. Under the Washington My Health My Data Act, Nevada and Connecticut law, the same information is "consumer health data".
We collect it from you and from the photos you take, for the purposes above and nothing else. We share it only with the providers listed below, who act on our instructions, or with someone you choose to send a report to. We do not sell it, and we do not use geofencing around any health facility. You can see it, export it, delete it or withdraw consent at any time (see "Your rights").
Providers that run parts of hairtrack for us. Each is bound by contract to use the data only to provide its service to us:
Beyond them, your data goes only where you send it — a share link, or a report you give a clinic — or where the law requires it, or to a company that takes over hairtrack, which would be bound by this policy.
You choose how long a link lasts: 7 days, 30 days, or until you switch it off. Your photos and your name are left out unless you choose to include them. Anyone who has the link can open it while it is live, so send it only to people you mean to. You can revoke a link from the app at any time.
Deleting your account removes your photographs, then every record tied to you, straight away. Copies in our providers’ encrypted backups age out within 30 days.
Data is encrypted in transit and at rest, access is limited to the people who need it to run the service, and apart from the eye crop, the faces in your photos never reach us unblurred. No system is perfectly secure; if a breach affects your data, we will tell you and the regulators as the law requires.
Rate Me Inc. is a US company, and our providers process data in the United States and other countries. When data leaves the EU, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK addendum to them, or a provider’s certification under the Data Privacy Framework.
From the app’s Privacy and data screen (in the menu), without asking anyone: download your readings and photographs, delete your photos and keep your measurements, or delete your account and everything in it.
By writing to support@ratewithai.co, wherever you live:
EU and UK. You can also complain to your data protection authority — in the UK, the Information Commissioner’s Office.
California and other US states. You have the right to know, access, correct and delete, and to opt out of sale, sharing and targeted advertising — we do none of those. We use sensitive information only to provide the service and, if you opt in, to improve the models. You can use an authorised agent, we will not treat you differently for exercising any right, and if we turn a request down you can appeal by replying to our answer.
We verify requests against the account they concern and answer within 30 days, or tell you why we need longer where the law allows it.
hairtrack is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone younger. If we learn that we have, we delete it.
hairtrack.ai uses Google Analytics with every consent type set to denied, so it sets no cookies and cannot follow you between sites; what we see is aggregate — how many visits, which pages, roughly where from. The only cookies the site sets are the ones that keep you signed in, if you sign in.
When this policy changes, the date at the top changes with it. If a change affects how we use data you have already given us, we will tell you in the app before it applies.