Translation for convenience only. In case of discrepancies, the Polish version prevails.
Privacy Policy
In short. The app uses two AI providers. OpenAI (Ireland) handles the chat, the classification of your messages and the search of our knowledge database; Anthropic analyses face-scan photos and packaging photos. We do not send either of them your e-mail address, name, postal address or account identifier. Scan photos are not stored on our servers or in our backups — only the result of the analysis remains; for the time of the analysis the photos go to Anthropic. Chat content is not written to disk. We process health data only with your explicit consent, which you can withdraw at any time. We use no third-party advertising or tracking tools; we keep our own pseudonymised log of in-app events for 180 days (section 3). Reports sent from the “Help” section are kept for a limited time (section 9). You can download and delete your data yourself in the app.
1. Who is the data controller
The controller of your personal data is Aesthetic Medical Technology sp. z o.o., Aleja Komisji Edukacji Narodowej 36 lok. 112B, 02-797 Warsaw, Poland, NIP PL9512533313, KRS 0000945295, REGON 521011931 — the operator of the ViWell website and app.
Contact on personal data matters: dane@viwell.skin. General contact: kontakt@viwell.skin. We have not appointed a data protection officer — please write to the address above on all data matters.
2. Who the service is for
ViWell is intended for people aged 18 or over. Before any data is collected the app asks you to confirm that you are at least 18, and the questionnaire does not accept an age below 18. We do not direct the service to minors and do not knowingly collect their data.
3. What data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account: e-mail address, password (stored in encrypted form), language, country | Creating and running your account | Art. 6(1)(b) GDPR — performance of a contract |
| Questionnaire: skin type, skin reactions, care habits, age and gender | Selecting care and products | Art. 6(1)(b) GDPR |
| Health data: allergies, contraindications, pregnancy and breastfeeding, skin sensitivity, skin analysis results | Personalising care and product recommendations and blocking ingredients that may harm you | Art. 9(2)(a) GDPR — your explicit consent |
| Face-scan frames (three frames; each analysed in three calls), the age and gender you provide | Analysis of skin features by an AI model (section 5) | Art. 9(2)(a) GDPR — your explicit consent |
| Face-scan result: ratings of skin features in face zones, position of the zones in the frame, date | Showing the result, recommendations, chat answers that refer to your latest scan | Art. 9(2)(a) GDPR — your explicit consent |
| Photo of product packaging (composition scan) | Reading the composition from the packaging and assessing its fit with your profile (section 5) | Art. 6(1)(b) GDPR — performance of a contract (composition scan feature) |
| Composition-scan result: the composition read, its assessment, the list of products shown; the composition remembered from earlier scans | Showing the result, the “Show more” feature, chat answers, faster recognition of the same composition | Art. 6(1)(b) GDPR |
| Orders: name, delivery address (including city and region), phone, e-mail address, products ordered, dates and amounts | Fulfilling and delivering the order, issuing the invoice, handling complaints and returns | Art. 6(1)(b) and (c) GDPR — contract and tax obligations |
| Purchase history, city and region, care plan | Product suggestions in the app, sales analysis (section 6) | Art. 6(1)(f) GDPR — our legitimate interest; you may object |
| In-app events (purchase path): type of event (product suggestions displayed, product card opened, added to / removed from the cart, payment started or cancelled, order paid, payment session expired, scan completed), date and time, product number, where the product was shown (after a scan, in the care plan, in the chat, in the shop), type of label on the product, scan number, order number and amount. Instead of your account identifier we store an encrypted key (a pseudonym) derived from your user number | Checking which suggestions are displayed and lead to a purchase, improving selection and detecting errors | Art. 6(1)(f) GDPR — our legitimate interest; you may object |
| Consent record: date, type of consent, document version, how consent was given and information about the app or browser at that moment | Demonstrating that consent was given lawfully | Art. 6(1)(c) GDPR in connection with Art. 7(1) GDPR |
| Reports from the “Help” section (Settings → Help): topic of the report (scan, advice, chat, product, other), reason, optional description (up to 500 characters), whether you want a reply, language, app version and build number, date and time, report number; for a report about a face scan — the number and date of your last scan (no photo and no result); the version of the instructions and the AI model at the time of the report; our status and decision | Handling the report, replying (if you ask for it), improving recommendations and the scan, demonstrating that we respond to reports | Art. 6(1)(f) GDPR — our legitimate interest (handling reports, evidence of due care); you may object. A reply at your request — Art. 6(1)(b) GDPR. Health data in the description — Art. 9(2)(a) GDPR — your explicit consent (see below) |
| Technical data: IP address in web server logs, request and application logs with the account identifier | Protecting the service and diagnosing errors | Art. 6(1)(f) GDPR — legitimate interest |
| Technical record of AI use: account identifier, date and time of the call, model, number of tokens, estimated cost, call type | Cost control and protection against abuse | Art. 6(1)(f) GDPR — legitimate interest |
Providing account data is needed to use personalisation, and order data to fulfil an order. Providing health data is voluntary. Without the three mandatory consents (section 10) you cannot use the app: you only see the consent screen, and after choosing “Not now” only downloading your data (export), deleting your account and the Privacy Policy are available. The server additionally rejects requests to AI, the catalogue, the care plan, scans and the chat.
The pseudonym in the event log is not your account identifier, but we can link it to your account, so we treat it as personal data (pseudonymisation, not anonymisation). The log contains no e-mail address, name, address, photos, chat content or information about your health and skin profile. We keep events for 180 days and then delete them automatically; we also delete them together with the account.
We do not collect your device identifier and do not use third-party analytics, advertising or tracking tools. We record events only with our database provider (section 8).
Reports from the “Help” section. You send a report voluntarily. We do not accept photos or screenshots in it, do not collect your IP address or device identifier, and do not attach a scan result, chat content or your profile (allergies, pregnancy, skin type). Phone numbers, e-mail addresses, card numbers, IBAN and PESEL in the description are automatically replaced with markers; we do not recognise names or diagnoses, so please do not enter them. We send a reply to your account e-mail only if you tick “I want a reply”. The service owner handles reports; a new report triggers a notification that contains only the report number, topic, reason and language — without the description and without account data.
Skin reaction and health data. If you report a skin reaction after using a product, the description may contain information about your health. Providing it is voluntary. By entering it in the description field, after reading the information next to that field, you give your explicit consent to its processing for the purpose of handling the report (Art. 9(2)(a) GDPR). You can withdraw consent at any time by writing to dane@viwell.skin or by choosing “Delete my data” or “Delete account” — the description is then deleted; withdrawal does not affect the lawfulness of processing before withdrawal. We treat reports about a skin reaction as urgent.
4. What happens to photos
Face-scan frames and packaging photos are sent to our server and then — for analysis — to the AI provider Anthropic (section 5). Photos are not stored by us or in our backups: on our server they are processed in memory only, for the duration of the analysis. After the analysis only the result remains with us — a description of skin features or the composition read, without the image. Raw frames are deleted immediately after the analysis. On your phone the photo from your last scan stays so that you can see the result — until you make a new scan, delete your data or delete your account.
We keep the face-scan result (ratings in zones, position of zones, date) until you delete your data or account, and after you withdraw consent for health data; we keep the last 10 results, older ones are deleted automatically.
5. Artificial intelligence and transfers of data to OpenAI and Anthropic
OpenAI — chat, message classification and knowledge-database search
Chat answers, recognising what your message is about (classification) and searching for information in our knowledge database rely on models provided by OpenAI Ireland Ltd. (Ireland): the gpt-4o-mini model for the chat and classification, and the text-embedding-3-small embeddings model for search. Data may be transferred to OpenAI’s affiliated entities in the United States on the basis of standard contractual clauses approved by the European Commission.
We send OpenAI:
- questionnaire data (including age and gender) and health data relevant to selecting recommendations (allergies, contraindications, pregnancy and breastfeeding);
- the skin-analysis result as a description of features;
- the content of your chat messages and the history of the current conversation;
- the text of the search query when the chat looks up information in our knowledge database (for example about an ingredient) — the query is built from your message and may contain fragments of it.
OpenAI does not use this data to train its models and keeps requests and responses for up to 30 days to detect abuse, after which it deletes them.
What we do not send to OpenAI: photos, e-mail address, name, address data or account identifier.
Anthropic — photo analysis
Photos are analysed by the Claude Sonnet model provided by Anthropic Ireland, Limited (Ireland). We send it:
- for a face scan — three face frames; each frame is analysed in three calls (up to nine requests with photos per scan) — and the age and gender you provided;
- for a composition scan — the photo of the product packaging.
What we do not send to Anthropic: e-mail address, name, address data, account identifier or chat content.
A data processing agreement (DPA) with Anthropic is in force and applies automatically under Anthropic’s commercial terms. Anthropic keeps requests for up to 30 days and does not train its model on this data. Data may be transferred to the United States (including to Anthropic’s affiliated entities) on the basis of standard contractual clauses approved by the European Commission.
Data is passed to either provider only after your consent given in the app; you can withdraw consent in the settings — AI-based features then stop being available.
We do not store chat content on disk or in a database. The conversation is kept only in server memory while it lasts, for at most 45 minutes after the last message.
Recommendations are prepared by an algorithm. They are not medical or cosmetological advice and do not replace consultation with a specialist.
6. Product suggestions and marketing
Suggestions in the app. Based on your care plan and purchase history we may show hints in the app — for example, that a cleansing step is missing from your plan. Suggestions always take your allergies and contraindications into account.
Sales analysis. We analyse order history and the city and region of delivery to understand which products our customers need and where. Health data is not used for marketing purposes.
Commercial messages will be sent only with your separate consent, when such a feature appears in the app; we will then supplement this policy.
7. Profiling and automated decisions
Care selection and product suggestions are based on automated analysis of your data (profiling). We do not make decisions on this basis that produce legal effects concerning you or similarly significantly affect you — you decide whether and which products you use or buy.
8. Who we entrust data to
- Hetzner Online GmbH (Germany) — servers and backups in Finland (Helsinki);
- Supabase Inc. (United States) — authentication and database; data is stored in Frankfurt (Germany);
- OpenAI Ireland Ltd. (Ireland) — chat, message classification and knowledge-database search, scope as in section 5;
- Anthropic Ireland, Limited (Ireland) — photo analysis (face frames, packaging photos), scope as in section 5; data may go to affiliated entities in the United States under standard contractual clauses;
- Stripe Payments Europe Ltd. (Ireland) — payment processing; your card details go directly to Stripe, not to us;
- Google Ireland Ltd. — company e-mail;
- product suppliers and couriers — to the extent needed to fulfil the order.
With providers that process data on our behalf we conclude data processing agreements compliant with the GDPR. Transfers of data outside the European Economic Area are made on the basis of standard contractual clauses approved by the European Commission (for Anthropic, see section 5).
You download the app from the Apple App Store or Google Play — in that respect Apple and Google process data under their own rules, as separate controllers.
9. How long we keep data
- account and questionnaire — while you use the service, until the account is deleted;
- skin analysis results (face scan) — the last 10 results, older ones are deleted automatically; all of them until you delete them or delete the account (section 4);
- composition-scan result (the composition read, assessment, list of products shown) — 24 hours from the scan, at most 10 such results per user; they also disappear when you delete your data or account;
- the composition remembered from earlier scans (speeds up recognising the same composition again) — until your data or account is deleted;
- photos — not stored on our servers or in our backups (section 4); at AI providers: OpenAI receives no photos, Anthropic keeps requests for up to 30 days (section 5);
- chat content — not written to disk; in server memory for at most 45 minutes after the last message; at OpenAI up to 30 days (section 5);
- orders and invoices — for 5 years from the end of the year in which the invoice was issued, in line with tax law, and in case of a dispute until the claims expire, no longer than 6 years; we keep this data also after the account is deleted. After that time order data is anonymised — only the sales information remains, with no link to you;
- record of giving or withdrawing consent — up to 6 years after the account is deleted, as proof of meeting legal obligations; after the account is deleted we keep it as an irreversible hash of the identifier, which does not allow your data to be reconstructed;
- technical logs — up to 30 days (application logs may contain the account identifier); IP address in web server logs and request logs — up to 15 days;
- technical record of AI use — 90 days, then deleted automatically; it is included in the data you download and is deleted with the account (and with “Delete my data”);
- in-app events (purchase path), stored with a pseudonym — 180 days, then deleted automatically; deleted together with the account; included in the data you download;
- reports from the “Help” section — report data (topic, reason, status, decision, dates, scan number, versions) for 3 years from the closing of the report; the description you entered — for 12 months from closing, after which it is deleted; after the account is deleted the description is deleted and the report is detached from you — report data remains without the possibility of identifying you (our legitimate interest — demonstrating due care); “Delete my data” and “Delete account” delete the description immediately;
- backups — encrypted copies are kept for 7 days and their snapshots on the backup server for a further 7 days; after the account is deleted your data disappears from all copies no later than after 14 days.
10. Your rights
You have the right of access to your data, to rectification, erasure, restriction of processing, portability, and to withdraw consent at any time — without affecting the lawfulness of processing before withdrawal.
You also have the right to object at any time to processing based on our legitimate interest, including product suggestions, purchase analysis (section 6), the recording of in-app events and the retention of reports from the “Help” section (section 3) — write to dane@viwell.skin.
You can exercise some of these rights yourself in the app, under Settings → Privacy:
- Download my data — a copy of your data to download (including the technical record of AI use, in-app events and your reports from the “Help” section, section 3);
- Delete my data — deletes the questionnaire and analysis results and the descriptions in your reports, the account stays;
- Delete account — permanently deletes the account and related data, including in-app events; in reports the description is deleted and the link to you is detached (with the exceptions described in section 9);
- consents (Settings → Privacy → Consents): health data, AI analysis and notice that this is not medical advice — you can withdraw each of them.
Withdrawing consent for health data deletes your allergies, contraindications, pregnancy and breastfeeding information, skin sensitivity and face-scan results; age, skin type, city, orders and settings remain. Withdrawing consent for AI analysis or the notice that this is not medical advice brings back the consent screen — until you give them again only the functions described in section 3 are available.
For other matters write to dane@viwell.skin. We will reply within a month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
11. How to delete your account
In the app: Settings → Privacy → Delete account. The account and related data are deleted immediately.
Without the app (for example if it has already been uninstalled): write to dane@viwell.skin from the e-mail address the account was created with, asking for the account to be deleted. We will delete the account and related data within 30 days and confirm this in our reply.
After the account is deleted we keep only order and invoice data, the consent record and report data without the possibility of identifying you — to the extent and for the time described in section 9.
12. Data protection
Data is transmitted over an encrypted connection, only authorised persons have access to it, and operations on data are logged. Backups are encrypted, and the key to read them is not kept on the server. In technical logs we do not record e-mail addresses or chat content. In the event of a personal data breach we will notify the supervisory authority within 72 hours and you — if the breach involves a high risk.
13. Cookies and tracking tools
This website does not use cookies, analytics tools or resources loaded from other companies’ servers. The app contains no third-party advertising, analytics or tracking tools. If analytics or marketing tools appear in the future, we will switch them on only with your consent, which you will be able to change in the settings, and we will supplement this policy.
14. Changes to this policy
We will inform you of material changes in the app, and if the scope of consents changes we will ask for them again. The current version is always available at viwell.skin/privacy.