Privacy Policy

1. About this policy

This policy explains how PLUMPED LTD collects, uses, shares and protects your personal data when you use the Plumped mobile application, the Plumped website at plumped.co.uk, and any related services (together, the "Service").

Plumped analyses a selfie you take, combines it with information you give us, and produces a personalised skincare routine. Some of this information tells us about your skin health. We treat that information with the extra care the law requires, and we explain exactly how below.

Please read this alongside our Face and Skin Data Notice, which covers the selfie scan in detail, and our Cookie Policy.

2. Who we are

PLUMPED LTD is the data controller for your personal data.

"We", "us" and "our" mean PLUMPED LTD. "You" and "your" mean the person using the Service.

EU representative

If you are in the European Economic Area, you may contact our representative appointed under Article 27 of the EU GDPR:

EU representative to be added

3. The personal data we collect

3.1 Data you give us

3.2 Data generated by the Service

3.3 Data we do not collect

To be clear about what we do not do:

• We do not use facial recognition. Plumped never matches your face against any other face, never builds a face template for identification, and cannot identify you from your photograph.
• We do not collect your GPS location or any location data from your device.
• We do not collect payment card details. The Service is currently free.
• We do not buy personal data from data brokers.
• We do not sell your personal data to anyone, and we do not share it for cross-context behavioural advertising.
• We do not use your selfies, your skin analysis results or your routines to train any artificial intelligence model, ours or anyone else's.

4. Special category data: your skin information

4.1 Why this matters

Under Article 9 of the UK GDPR and the EU GDPR, information about your health is "special category data" and gets stronger protection. Information about your skin condition, such as acne or redness, is health data.

This means we only process it where you have given us your explicit consent, and you can withdraw that consent at any time.

4.2 What we derive from your selfie

Our skin analysis provider returns scores for the following attributes:

acne, age spot, dark circle, droopy lower eyelid, droopy upper eyelid, eye bag, firmness, moisture, oiliness, pore, radiance, redness, skin type, tear trough, texture, wrinkle.

It also returns an estimated age.

4.3 What happens to your selfie

1. You take a selfie in the app.
2. The image is transmitted over an encrypted connection to our servers, which are located in Germany.
3. The image is sent to Perfect Corp, our skin analysis provider, which analyses it and returns the attribute scores. Perfect Corp does not retain a copy of your image.
4. The image is stored in your private account area so you can build a progress timeline.
5. Your attribute scores and self-reported profile, without your photograph, are sent to OpenAI to generate a routine.

Your selfies are visible only to you. No member of our staff, no contractor and no third party browses, reviews or looks at user photographs. Access is restricted by technical controls, and any access for a genuine technical or security reason is logged.

Full detail is in the Face and Skin Data Notice.

5. Our lawful bases

We must have a lawful basis for each thing we do with your data. Where health data is involved, we need a basis under Article 6 and a separate condition under Article 9.

Where we rely on legitimate interests, our interest is in keeping the Service secure and working, understanding whether it works, and running our business. We have balanced this against your rights and you can object at any time using section 10.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that already happened.

6. Automated processing and AI

Plumped is built on automated analysis. We want you to understand this clearly.

• Skin analysis. An automated system produced by Perfect Corp assigns scores to your skin attributes and estimates your age from your selfie. This is a form of automated classification based on a facial image.
• Routine generation. A large language model provided by OpenAI turns your attribute scores and stated concerns into a suggested routine, cadence and set of ingredient conflicts.

These systems can be wrong. An attribute score is an estimate, not a measurement, and a generated routine is a suggestion, not a prescription. You are always free to ignore, edit or delete any recommendation.

Plumped does not make decisions that produce legal effects for you or similarly significantly affect you. You can ask a person at Plumped to look at any result you disagree with by writing to operations@plumped.co.uk.

More detail is in our AI Transparency Notice.

7. Who we share your data with

We do not sell your data. We share it only with the service providers listed below, only for the purposes shown, and only under a written contract that requires them to protect it.

The current list is maintained at plumped.co.uk/legal/sub-processors.

We may also disclose personal data where we are required to by law, by a court order, or by a regulator, and where it is necessary to investigate or prevent fraud, abuse or a threat to someone's safety. If our business is sold or reorganised, data may transfer to the buyer, who will remain bound by this policy.

8. International transfers

Our servers are in Germany. Some of our providers are outside the United Kingdom and the European Economic Area, mainly in the United States and Taiwan.

Where data leaves the UK or the EEA, we rely on one or more of the following safeguards:

• the European Commission Standard Contractual Clauses, together with the UK International Data Transfer Addendum, where no adequacy decision applies. This is the safeguard we rely on for transfers to Taiwan, which has no adequacy decision from the UK or the EU;
• the UK Extension to the EU-US Data Privacy Framework, and the EU-US Data Privacy Framework, where the recipient is certified;
• the UK International Data Transfer Agreement.

We assess the risk of each transfer before it begins and keep those assessments under review. You can ask us for information about the safeguards that apply to a particular transfer by writing to operations@plumped.co.uk.

9. How long we keep your data

Where we must keep something longer because the law requires it, or to establish or defend a legal claim, we keep only what is necessary for that purpose.

10. Your rights

You have the following rights over your personal data:

• Access. Ask for a copy of the personal data we hold about you.
• Rectification. Ask us to correct data that is wrong or incomplete.
• Erasure. Ask us to delete your data. You can delete individual selfies, or your whole account, from within the app at any time.
• Restriction. Ask us to pause our use of your data in certain circumstances.
• Portability. Ask for your data in a structured, commonly used, machine-readable format, or ask us to send it to another provider.
• Objection. Object to processing we carry out on the basis of legitimate interests, and object to direct marketing at any time, without giving a reason.
• Withdraw consent. Withdraw any consent you have given, at any time, including your consent to skin analysis.
• Human review. Ask a person to review an automated result.
• Complain. Complain to us, and to a supervisory authority.

To exercise any right, write to operations@plumped.co.uk or use the form at plumped.co.uk/legal/data-rights. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you if we do.

If we need more information to identify you or to understand what you are asking for, we will ask, and the time limit pauses until you reply.

Complaining to us

You can complain to us about how we handle your personal data by emailing operations@plumped.co.uk or using the form at plumped.co.uk/legal/data-rights. We will acknowledge your complaint, investigate it, and tell you the outcome.

Complaining to a regulator

If you are not satisfied, you can complain to a supervisory authority.

In the United Kingdom: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone 0303 123 1113. Website ico.org.uk.

In the European Economic Area: the data protection authority in the country where you live, work, or where you think the problem happened. A list is published by the European Data Protection Board at edpb.europa.eu.

You do not have to complain to us first, although it usually helps.

11. Security

We protect your data using:

• encryption of data in transit using TLS, and encryption of stored data at rest;
• strict access controls, so that your selfies are visible only to you and are not browsable by our staff;
• logging of administrative access;
• regular backups, held encrypted;
• penetration testing of our systems;
• an incident response arrangement with a specialist third party, OctiCode.

No system is completely secure. If a personal data breach happens and it is likely to result in a risk to your rights and freedoms, we will report it to the relevant supervisory authority within 72 hours of becoming aware of it. Where the risk is high, we will tell you directly and without undue delay.

If you believe you have found a security problem, please see our Responsible Disclosure Policy.

12. Children

Plumped is not for anyone under 16. You must be at least 16 to create an account.

If you are between 16 and 18, you are still a child under UK data protection law, and we apply additional protections:

• we do not profile you for marketing purposes;
• we do not use your data to build advertising audiences;
• optional data collection is switched off by default;
• we do not use design techniques intended to encourage you to share more data than you need to.

If we learn that we hold data about someone under 16, we will delete the account and the data. If you are a parent or guardian and believe we hold data about a child under 16, write to operations@plumped.co.uk and we will act promptly.

See our Children and Age Policy.

13. Marketing

We will only send you marketing emails or marketing push notifications if you have opted in.

Every marketing email has an unsubscribe link. You can turn push notifications off in your device settings or in the app. You can change your preferences at any time in the app, or by emailing operations@plumped.co.uk.

Service messages, such as a password reset, a security alert or a change to these terms, are not marketing, and you will continue to receive them while you have an account.

14. Cookies and similar technologies

The website and the app use cookies, software development kits and similar technologies. We ask for your consent before using any that are not strictly necessary. Full detail, including the specific cookies and the providers behind them, is in our Cookie Policy.

15. Affiliate links

Plumped earns commission when you buy products through some of the links we show. This does not change the price you pay, and it does not change what we recommend. See our Affiliate Disclosure.

16. If you are in the United States

Residents of some US states have additional rights, and we provide a separate notice covering consumer health data, biometric identifiers and state privacy rights. See the US Privacy Notice.

17. Links to other sites

The Service links to retailer and brand websites. We do not control those sites and we are not responsible for their privacy practices. Read their policies before giving them your data.

18. Changes to this policy

We may update this policy. If the change is significant, we will tell you in the app or by email before it takes effect, and where the change concerns something you consented to, we will ask for your consent again.

The version number and date at the top of this page tell you which version you are reading. We keep previous versions and will provide one on request.

19. Contact