LumyIQAesthetic Intelligence
Sign in

Privacy Policy

Last updated: 4 August 2026 · Version 2026-07-15

This page explains what data LumyIQ collects, how we use it, and the rights you have under the UK GDPR. It is maintained by LumyIQ Ltd (the "site", "we", "us"). LumyIQ provides cosmetic skin insights only — it is not a medical device and does not diagnose, treat, or prevent any condition.

1. Who we are

LumyIQ Ltd is a company registered in the United Kingdom. For data-protection purposes, LumyIQ Ltd is the data controller for the information described below.

2. What we collect

  • Account details: first and last name, email address, date of birth (to confirm you are 18+), and optional profile data such as city and country.
  • Facial images: selfies you capture or upload to request a skin analysis.
  • Scan results: the cosmetic analysis produced from your image.
  • Device and usage data: browser, IP address, interactions with the service, needed to secure and operate the app.

3. Special category data & lawful basis

Facial images and the cosmetic analysis derived from them are treated as sensitive personal data. Our lawful basis for processing them under Article 9(2)(a) UK GDPR is your explicit consent, which you give on the "Before you scan" screen and can withdraw at any time in Settings → Manage consent.

4. How your images are used

  • Solely to generate your cosmetic skin analysis.
  • Anonymised improvement use of scan data only if you have separately opted in on the consent screen.
  • We never sell your images. They are not used for advertising and are not used to perform facial recognition of other people.

5. Data retention

  • Face photos: automatically deleted from our storage within 24 hours of upload, unless you have turned on "Save my scan photos to track changes over time" in Settings. That setting is OFF by default.
  • Scan results: the analysis (not the photo) is retained while your account is active so you can see your history. You can delete individual scans, all scans, or your entire account at any time from Settings → Your data.
  • Consent records: kept for as long as required to demonstrate lawful processing, then deleted with your account.

6. Sharing

Your scan results are only shared with a practitioner when you explicitly choose to connect with that practitioner from within the app. We use trusted third-party processors for hosting, database, storage and AI analysis (currently: Cloudflare, Supabase, and Google via a managed AI gateway). Processors act on our instructions under written data-processing terms.

7. Your rights under UK GDPR

  • Access — request a copy of the data we hold about you.
  • Correction — ask us to correct inaccurate data.
  • Deletion — delete your account and all associated data at any time.
  • Withdrawal of consent — turn off any specific consent in Settings.
  • Portability — request an export of your data.
  • Complaint — you have the right to complain to the Information Commissioner's Office at ico.org.uk.

8. Children

LumyIQ is strictly for users aged 18 and over. We do not knowingly collect data from anyone under 18. Accounts declaring an age under 18 are blocked at sign-up.

9. Changes to this policy

If we materially change how we process your facial image or scan data, we will update the version above and ask you to re-consent on your next scan.

10. Contact

Privacy queries: [DPO/PRIVACY CONTACT EMAIL]. See also our Terms of Service.