This notice explains what happens when you scan your face with Plumped. It sits alongside our Privacy Policy and adds detail rather than replacing it.
We have written this separately because your selfie and the skin information we get from it are the most sensitive data we handle, and you deserve a clear explanation before you decide.
The short version
- Your selfie is used to work out the condition of your skin. Nothing else.
- Information about your skin is health information, so we only use it if you say yes, and you can say no or change your mind at any time.
- We do not use facial recognition and we cannot identify you from your face.
- Our analysis provider looks at the image and does not keep it.
- Your photos stay in your account, visible only to you, until you delete them.
- We never use your photos to train AI.
- Saying no to the face scan does not lock you out. You can build a profile by answering questions instead.
1. What we collect
When you use the skin scan we collect:
- the selfie itself, as an image file;
- the results of the analysis, which are numerical scores for each of the attributes listed below;
- an estimated age produced from the image;
- the date and time of the scan, so your progress timeline works.
The attributes we score are:
acne, age spot, dark circle, droopy lower eyelid, droopy upper eyelid, eye bag, firmness, moisture, oiliness, pore, radiance, redness, skin type, tear trough, texture, wrinkle.
You can also tell us your skin type, concerns and sensitivity yourself, without scanning at all.
2. Why this is treated as health data
Some of these attributes describe the condition of your skin. Acne and redness are examples. Under UK and EU data protection law, information about a person's physical health is "special category data" and needs stronger protection than ordinary personal data.
We treat all of your skin analysis results and your self-reported skin profile as health data, even the attributes that are more cosmetic than clinical. That is the cautious approach and we think it is the right one.
The practical consequence is that we rely on your explicit consent. We cannot use a weaker legal ground such as legitimate interests, and we do not try to.
3. What happens step by step
- You take the selfie. The camera is used only while the scan screen is open. We do not record video and we do not access the camera in the background.
- The image is uploaded. It travels over an encrypted connection to our servers, which are operated by Hetzner Online GmbH in Falkenstein, Germany.
- The image is analysed. We send it to Perfect Corp, our skin analysis provider. Perfect Corp runs the analysis and returns the attribute scores. Perfect Corp does not retain a copy of your image after the analysis.
- The image is stored in your account. It sits in your private progress timeline so you can compare weeks and months.
- Your routine is generated. We send your attribute scores and the concerns you selected to OpenAI, which produces a suggested routine. Your photograph is never sent to OpenAI.
- You see the result. The verdict, cadence and conflict warnings appear in the app.
4. What we do not do
We want to be explicit about this, because facial scanning is often used in ways that people find uncomfortable.
| Facial recognition | No. We do not create a face template, we do not match your face against any database, and we cannot use your photo to identify you. |
| Sharing with other users | No. Your photos are private to your account. |
| Human viewing | No. No employee, contractor or partner browses user photographs. |
| Training AI | No. Your images and results are never used to train or fine-tune any model, ours or a provider's. |
| Advertising | No. We do not use your skin data to target advertising, and we do not share it with advertisers. |
| Selling | No. We do not sell this data, ever, under any circumstances. |
| Inferring race or ethnicity | No. We do not infer, record or use race or ethnic origin. |
| Emotion detection | No. We do not analyse facial expression or emotional state. |
5. Only scan your own face
You may only upload photographs of yourself.
Do not upload a photograph of another person, including a friend, a partner, a child or a public figure. If you do, you are giving us someone else's health data without their permission, which neither of us has the right to do. Accounts that do this may be suspended, and we will delete the images.
6. How long we keep your photos
Your selfies stay in your account until:
- you delete an individual photo, or
- you delete your account, or
- your account has been inactive for 24 months, in which case we email you first and then delete everything.
When you delete a photo, it is removed from our active systems immediately and from encrypted backups within 30 days.
Deleting your account deletes your photos, your analysis results and your skin profile. This cannot be undone.
7. How to withdraw consent
You can withdraw your consent to skin analysis at any time. There is no penalty and we do not ask why.
In the app: Settings, then Privacy, then Skin analysis. Turn it off.
By email: write to operations@plumped.co.uk.
When you withdraw consent:
- we stop analysing new images straight away;
- you choose whether to keep or delete your existing photos and results;
- you can carry on using Plumped with a manually entered skin profile;
- analysis that already happened remains lawful, because it was done with your consent at the time.
8. Accuracy and limits
Skin analysis from a photograph is an estimate. Results are affected by lighting, camera quality, angle, makeup, screen glare and skin tone. Estimated age in particular is approximate and should not be treated as a measurement.
Plumped is a cosmetic and wellbeing tool. It does not diagnose any condition and it is not a substitute for a dermatologist or a doctor. Please read the Health Disclaimer.
If you think a result is wrong, you can rescan, override it manually, or ask a person at Plumped to look at it by emailing operations@plumped.co.uk.
9. Your rights
You can ask us at any time to:
- give you a copy of your photos and analysis results;
- correct your skin profile;
- delete your photos, your results, or your whole account;
- pause our use of your skin data;
- send you your data in a portable format.
Write to operations@plumped.co.uk, or use plumped.co.uk/legal/data-rights. We reply within one month.
You can also complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority in your country if you are in the EEA.
10. If you are in the United States
Some US states, including Illinois, Texas and Washington, have specific laws about facial scans and consumer health data. If you are in the United States, please read the US Privacy Notice, which contains the notices and consents those laws require.
11. Contact
Questions about anything in this notice: operations@plumped.co.uk
PLUMPED LTD, 124 City Road, London, England, EC1V 2NX. Registered in England and Wales, company number 16204649.