Consumer Health Data Privacy Policy

We don't collect health conditions, diagnoses, medications, reproductive or sexual health information, or precise location related to health services. If you mention health information in a chat with Atti, it's used only to answer you.

• From you: your uploads, the information you type, and your camera and microphone when you use those features.
• Derived by us and our service providers from what you provided, such as geometry, measurements and images we generate.

We don't buy consumer health data or get it from data brokers.

We don't sell consumer health data. If we ever wanted to, we'd first ask for your signed authorization, as the law requires. We don't plan to.

We disclose consumer health data only to:

1. Service providers (processors) that handle it for us under contract, only to provide our service: AI image and video services, safety checking, hosting and storage. They're named on Our service providers (marked “face/body”).
2. People you choose to show your images to: for example, when you post a look with your face, send a share link, or send a card to a stylist. This needs a separate consent from the one to collect, and you can withdraw it anytime.
3. Authorities, when the law requires it.

Categories of third parties: other ATTYR members and people you choose to share with (item 2 above). Affiliates: none; ATTYR has no affiliates that receive this data.

Stores where you use Trial Room don't receive your photos, images, video or measurements.

• Collecting face and body data needs your consent first, given on a separate screen in the app (or at the store, for Trial Room).
• Sharing an image of your face with other people needs a second, separate consent.
• Live try-on, in the app or in a store, needs its own separate consent.

We never treat accepting our Terms, closing a screen, or continuing to use the app as consent.

You can withdraw any of these consents at any time:

• in the app, Settings → Account → Biometric data;
• at the store, tap “Delete everything now”;
• or email privacy@attyr.app.

You have the right to:

• Confirm and access: confirm whether we collect, share or sell your consumer health data, and get a copy. Ask us for a list of every third party and affiliate we've shared it with, with a way to contact each.
• Withdraw consent to collecting or sharing it.
• Delete it. We delete it from our systems and tell our service providers and anyone we've shared it with to delete it. Copies in backups are overwritten within 6 months at the latest.

How:

• In the app: Settings → Account → Biometric data (withdraw and delete), or Settings → Account → Delete account (everything).
• Or email privacy@attyr.app from your account email, with “Health data request” in the subject.
• If you used Trial Room without an account, email us with the store and date of your visit.

What to expect:

• We may need to confirm the request is really from you.
• We respond within 45 days. If we need longer, we'll tell you why and may take up to 45 more days.
• Requests are free, up to twice a year.
• We won't treat you differently for using your rights.

We may create statistics that can't reasonably be linked to you, such as “this brand's medium runs small”. Such data isn't consumer health data. We commit not to try to re-identify it, and we require anyone who receives it to make the same commitment.

If we decline your request, you can appeal. Reply to our decision, or email privacy@attyr.app with “Appeal” in the subject. We respond within 45 days and explain in writing what we did and why.

If we deny your appeal, you can complain to:

• the Washington State Attorney General at atg.wa.gov/file-complaint;
• for Nevada and Connecticut residents, your state Attorney General.

• Only staff and service providers who need consumer health data to provide the service can access it.
• We protect it with reasonable security: encryption in transit and at rest, and access controls.
• We don't use geofences around health care facilities, or anywhere else, to identify, track, collect data from, or send messages to anyone.

We won't collect new categories of consumer health data, or use or share it for new purposes, without first updating this policy and getting your consent.

privacy@attyr.app · ATTYR, Inc., 244 St Pauls Ave, Jersey City, NJ 07306, USA