Consumer Health Data Privacy Policy

Why this policy exists

Washington's My Health My Data Act (MHMDA) and Nevada's Consumer Health Data Privacy Act (SB 370) each require us to give residents of that state a separate, specific set of disclosures about "consumer health data" — information that identifies your health status or that could reasonably be linked to it — on top of the general disclosures in our Privacy Policy. This page is that disclosure for both laws. It doesn't replace the Privacy Policy; it sits alongside it and covers the same practices in the detail each law requires.

"Consumer health data" is a broad legal category under both laws. For VÉL, the only information that falls into it is the scalp-condition assessment your hair reading can include, and the photos and quiz answers used to produce it.

The two laws differ in one way worth knowing up front: Washington's MHMDA can be enforced through a private lawsuit (under the state Consumer Protection Act), while Nevada's SB 370 is enforced only by the Nevada Attorney General — there is no private right of action under SB 370. Every other disclosure and right on this page applies the same way under both laws.

Consumer health data we collect

• Hair and scalp photos you take in the app for a scan.
• Quiz answers about your hair and scalp (for example concern, wash routine, colour and heat history) that inform the reading.
• The scalp-condition assessment produced from the above — an inference about a bodily condition, which is why both laws reach it even though VÉL is a cosmetic tool, not a medical one.

We do not collect precise location data of any kind — the app never requests location access — so none of your consumer health data is, or could be, derived from where you've been.

How we collect it

Directly from you: the photos you take and the quiz answers you give inside the app, only when you choose to start a scan. We do not buy, license or otherwise obtain consumer health data about you from any other source.

Why we collect it

Solely to produce your hair and scalp reading and the product suggestions that go with it. We do not use consumer health data for advertising, do not build any profile from it beyond the reading itself, and do not use it for any purpose beyond the one you asked for when you started the scan. Starting a scan is your affirmative, voluntary consent to that collection, which both laws require.

Who we share it with

One recipient, for one job: Anthropic, the AI provider that performs the analysis, acting as our processor under its commercial API terms, to provide the reading you asked for — the kind of service-provider disclosure both laws treat separately from a sale or a marketing share. We do not sell consumer health data to anyone, under any circumstance, and we do not share it for advertising or disclose it to any data broker, advertiser or other third party.

Retention

Our server does not keep your photos or the scalp-condition assessment — they are processed to produce your result and discarded. The copy you see afterwards lives in your scan history, stored on your device only, and is removed if you delete the app or your account.

No geofencing

Both MHMDA and SB 370 ban using a geofence around a healthcare facility to identify or track people seeking care, collect their health data, or target them with ads or messages. VÉL doesn't request location access at all, so it cannot and does not do any of this.

Your rights

If you are a Washington or Nevada resident, you have the right to:

• confirm whether we are collecting, sharing or selling your consumer health data (we do not sell it, to anyone, ever);
• access it, including a list of the third parties it has been shared with — for VÉL, that list is Anthropic alone;
• withdraw your consent to its collection or sharing at any time, without losing access to the rest of the app;
• have it deleted;
• appeal a denial of any of these requests.

Deleting your account from Profile in the app exercises the deletion right immediately and completely — there is no server-side copy of your photos or assessment left to remove afterwards. To exercise any of these rights another way, or to appeal a denial, email privacy@velapp.co. We will respond within the time the applicable law requires and will not discriminate against you for making a request.

Nevada's SB 370 is enforced by the Nevada Attorney General rather than through private lawsuits; Washington's MHMDA allows both. Either way, the fastest route to exercising your rights is the same: Profile in the app, or the email address above.

Changes to this policy

If what we collect, why we collect it, or who we share it with changes, we will update this policy and the date at the top.

Contact

Questions or requests under this policy: privacy@velapp.co.