This Privacy Policy describes how Grovy Health Inc., a Delaware corporation (“Grovy Health,” “Grovy,” “Hairy,” “we,” “us,” or “our”), collects, uses, processes, stores, discloses, and otherwise handles information in connection with the Hairy mobile application, websites, software, artificial-intelligence features, communications, and related products and services (collectively, the “Service”).
Hairy is operated by Grovy Health Inc.
This Privacy Policy applies when you access or use the Service, create an account, upload photographs or other information, communicate with us, purchase a subscription, participate in research or surveys, or otherwise interact with Hairy.
Our Terms of Service govern your use of Hairy and are incorporated by reference where applicable.
Please read this Privacy Policy carefully.
Grovy Health Inc. is not a healthcare provider, and Hairy does not provide medical care, medical advice, diagnosis, prognosis, or treatment.
Hairy is a consumer technology product intended to help users photograph, visualize, analyze, and track aspects of their hair and scalp appearance.
Information generated through Hairy, including information generated using artificial intelligence or machine learning, is provided for informational, educational, cosmetic, wellness, and tracking purposes.
Hairy is not a substitute for a physician, dermatologist, or other qualified healthcare professional.
You should not use information provided through Hairy as the sole basis for making medical or treatment decisions.
Grovy does not operate Hairy as a healthcare provider, health plan, or healthcare clearinghouse.
Accordingly, information that you provide directly to Hairy is generally not protected by the Health Insurance Portability and Accountability Act (“HIPAA”) merely because it relates to your hair, scalp, appearance, or health.
Other federal, state, international, and consumer-protection laws may nevertheless apply to such information.
If Grovy later offers a product or service in partnership with a healthcare provider or another HIPAA-regulated entity, additional privacy notices or agreements may apply to that particular service.
The information we collect depends on how you use Hairy, the features you use, the permissions you grant, your device, and the information you choose to provide.
We may collect the following categories of information.
Hairy’s core functionality may require or permit you to upload, capture, submit, or store photographs or other images.
These may include photographs showing:
We may collect the original image as well as information generated from or associated with that image.
Such generated information may include:
Depending on applicable law and how information is processed, photographs and information derived from photographs may be considered sensitive personal information, consumer health data, biometric information, or another specially protected category of information.
Hairy is not designed to use facial-recognition technology to authenticate your identity unless we expressly disclose such a feature to you and obtain any consent required by applicable law.
However, the fact that Hairy is not designed for facial identification does not necessarily mean that photographs or information derived from them will never be considered biometric or sensitive information under applicable law.
You may choose to provide information concerning your hair, scalp, appearance, habits, goals, or experiences.
Depending on the features available, this may include information such as:
Some of this information may constitute health information, consumer health data, or sensitive personal information under applicable laws.
We collect and store information generated when you use Hairy’s analysis features.
This may include:
AI-generated information may be associated with your account or other information about you.
If you create an account, we may collect information such as:
If you create or access your account using Apple, Google, or another third-party authentication provider, we may receive information that provider makes available to us according to your settings and the provider’s policies.
We generally do not receive the password for your Apple, Google, or similar third-party account.
If you purchase a subscription or another paid product, we may collect information concerning:
Payments made through Apple App Store, Google Play, Stripe, or other payment providers are processed by those providers.
We generally do not directly store complete payment-card numbers unless expressly disclosed.
When you communicate with us, we may collect:
When you use Hairy, we and our service providers may automatically collect technical information such as:
We may collect information concerning how you interact with Hairy, including:
We may infer an approximate geographic location, such as country, state, or city, from your IP address.
Unless a feature specifically requires it and we disclose it to you, Hairy does not require precise GPS location to perform its core hair-analysis functionality.
We may receive information from third parties, including:
The information we receive depends on the third party, your settings, and your interaction with that service.
We may use information for the following purposes.
We use information to:
We may use information collected through Hairy, including photographs, image-derived information, questionnaire information, usage information, analysis results, and other User Content, to develop, train, fine-tune, validate, test, benchmark, evaluate, improve, and operate artificial-intelligence, machine-learning, computer-vision, statistical, and other computational models and systems.
These activities may include:
Where applicable law requires consent or another specific legal basis for a particular use of personal information for AI development, we will seek such consent or otherwise comply with applicable law.
We may use information to:
We may use information collected through Hairy for research and development.
Research may relate to topics including:
Research may be conducted:
Where required by applicable law, we will obtain additional consent or authorization before using or disclosing personal information for a particular research purpose.
We may publish, disclose, license, commercialize, or otherwise use research findings, statistical results, or other research outputs that do not identify you, subject to applicable law.
We may use information to create:
To the extent permitted by applicable law, we may use such information for research, analytics, model development, commercialization, benchmarking, product development, publication, and other lawful purposes.
Where applicable law requires us to maintain information represented as de-identified in de-identified form, we will do so and will not attempt to reidentify that information except as permitted by law.
We may use information to:
We may use your contact information to send:
Where permitted by law, we may also send marketing or promotional communications.
You may opt out of marketing communications as described below. You may continue receiving non-marketing communications necessary to administer your account or the Service.
We may use information to:
Hairy uses or may use artificial intelligence, machine learning, computer vision, image processing, generative AI, and other automated systems.
These systems may analyze photographs and information you provide to produce automated outputs.
You should understand that:
We may use internally developed AI systems, third-party AI systems, or a combination of both.
When we use a third-party provider to process information on our behalf, information necessary to provide that functionality may be transmitted to and processed by that provider.
We may change AI providers, models, cloud infrastructure, or technical architecture as the Service evolves.
Information you provide to Hairy may be used to train and improve Grovy’s own artificial-intelligence and machine-learning systems, as described above.
This may include photographs and information associated with those photographs.
Information may be processed to create training examples, labels, annotations, mathematical features, embeddings, model parameters, statistical relationships, or other derived information.
Deleting your account or source information may not make it technically feasible to remove the influence of information that was previously used to train a model.
For example, once training has occurred, individual training examples generally cannot simply be extracted from model weights.
Accordingly, where permitted by applicable law, deletion of your personal information does not require Grovy to:
This does not limit any deletion, withdrawal-of-consent, objection, or other rights you may have under applicable law.
Where applicable law gives you a right to withdraw consent or restrict future use of personal information for model training, we will honor that right as required by law.
Hairy is a cloud-based service.
Your photographs and other information may be uploaded from your device and stored on servers operated by Grovy or our cloud infrastructure and service providers.
We currently use or may use cloud computing providers such as Amazon Web Services (“AWS”) to host, store, process, transmit, back up, or secure information.
Cloud storage means photographs may continue to exist on remote infrastructure after the immediate analysis has been completed.
Depending on your settings, our retention practices, and the functionality you use, we may retain photographs so that you can:
We may also retain photographs and other information for AI development, research, security, legal compliance, or other purposes described in this Privacy Policy, subject to applicable law.
We may disclose personal information to the categories of recipients described below.
We may disclose information to vendors, contractors, and service providers that perform services for us.
These may include providers of:
Depending on the service they provide, these providers may process photographs, account information, usage information, technical information, or other personal information.
We may disclose or transmit information to third-party artificial-intelligence, machine-learning, computer-vision, cloud-computing, or technology providers that assist us with operating Hairy.
Where appropriate, we use contractual, technical, or organizational measures designed to limit how service providers use information they process on our behalf.
We do not promise that Hairy will always use the same AI model or technology provider.
Subject to applicable law, we may disclose information to research and development collaborators, including:
Where reasonably practicable and appropriate for the research purpose, we may use aggregated, coded, pseudonymized, or de-identified information.
Where applicable law requires your consent or authorization before identifiable or consumer health information may be disclosed for research, we will obtain the required consent or authorization.
We may disclose information among Grovy’s current or future parents, subsidiaries, or affiliates for purposes consistent with this Privacy Policy.
We may disclose information where reasonably necessary to:
If Grovy is involved in or evaluates a:
information may be disclosed to actual or prospective counterparties, investors, purchasers, advisors, lenders, and other participants.
Personal information may be transferred as part of such a transaction where permitted by law.
A successor entity may continue processing information subject to this Privacy Policy or another privacy notice provided in accordance with applicable law.
We may disclose information if we believe in good faith that disclosure is appropriate or necessary to:
We may disclose information where you direct us to do so or where you otherwise provide consent.
Privacy laws use words such as “sell,” “sale,” “share,” and “targeted advertising” in specialized ways that do not necessarily require money to change hands.
Our practices may evolve as Hairy develops.
If we engage in activities that constitute a “sale” or “sharing” of personal information or targeted advertising under applicable privacy laws, we will provide any notices, consent mechanisms, authorizations, or opt-out rights required by those laws.
We will not sell consumer health data where applicable law prohibits doing so without your valid authorization.
Where applicable law requires affirmative consent before consumer health data may be shared with another entity for a particular purpose, we will seek that consent.
Grovy may disclose information to service providers, processors, contractors, research collaborators, and other parties as described in this Privacy Policy. Whether a particular disclosure legally constitutes a “sale,” “share,” or other regulated transfer depends on applicable law and the circumstances of the disclosure.
Our websites and portions of the Service may use:
These technologies may help us:
Some technologies may be provided by third parties.
Where required by law, we will provide appropriate choices regarding non-essential tracking technologies.
We may advertise Hairy on third-party websites, apps, social-media platforms, or other services.
We and our advertising or attribution providers may process certain device, usage, advertising, or account information to:
We will not use photographs or consumer health data for targeted advertising in ways prohibited by applicable law.
Where applicable law requires consent or provides an opt-out right for targeted advertising, cross-context behavioral advertising, sale, or sharing, we will provide the required choice.
We may transform personal information into information that is aggregated, de-identified, anonymized, or otherwise not reasonably linkable to you.
Subject to applicable law, we may use and disclose such information for purposes including:
Where required by applicable law, we will maintain information represented as de-identified in de-identified form and will not attempt to reidentify it except for purposes permitted by law, such as evaluating our de-identification processes.
We retain information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy unless a longer or shorter period is required by law.
Retention periods depend on factors including:
Accordingly, we do not promise that photographs are automatically deleted immediately after an analysis is completed.
Photographs may remain stored in our active systems to provide Hairy’s tracking functionality and for other purposes described in this Privacy Policy.
Information may also temporarily remain in:
after deletion from active user-facing systems.
We may retain information where necessary to:
We may retain de-identified, aggregated, and derived information for longer periods where permitted by applicable law.
As described above, deleting source information does not necessarily require deletion or retraining of AI models that were previously trained using that information, to the extent permitted by applicable law.
Where available, you may request account deletion through the Service or by contacting us.
When we process a valid deletion request, we will delete, de-identify, or otherwise handle personal information subject to applicable law.
Deletion requests may be subject to exceptions.
For example, we may retain information if reasonably necessary to:
Information may remain temporarily in backups or archives before being overwritten in accordance with our ordinary retention processes.
Deleting your account may not result in deletion of information that has previously been properly de-identified, aggregated, incorporated into research that no longer identifies you, or used to train AI models, where continued retention is permitted by applicable law.
We use administrative, organizational, physical, and technical safeguards designed to protect personal information against unauthorized access, destruction, loss, alteration, or disclosure.
Depending on the context, these safeguards may include measures involving:
However, no method of transmission over the Internet, cloud-storage system, database, or electronic security system is completely secure.
We therefore cannot guarantee absolute security.
You are responsible for maintaining the confidentiality of your account credentials and for securing devices through which you access Hairy.
If we discover a security incident involving personal information, we will investigate and respond as appropriate.
Where applicable law requires us to notify affected individuals, regulators, governmental authorities, or others of a breach, we will provide such notification in accordance with applicable legal requirements.
Hairy is intended for adults.
You must be at least 18 years old to create an account or use Hairy unless Grovy expressly makes a version of the Service available to younger users in accordance with applicable law.
We do not knowingly collect personal information through Hairy from children under 13.
If we learn that we have collected personal information from a child in violation of applicable law, we will take appropriate steps to delete or otherwise address the information.
If you believe a child has provided us personal information improperly, please contact us using the information below.
Depending on where you live, applicable law may provide rights concerning your personal information.
These may include rights to:
These rights vary by jurisdiction and are subject to legal exceptions.
To exercise an applicable privacy right, contact:
or use any privacy-request mechanism made available through Hairy.
We may need to verify your identity before completing a request.
Depending on applicable law, an authorized agent may be permitted to submit a request on your behalf. We may require evidence that the agent is authorized to act for you.
If we deny a privacy request, residents of certain jurisdictions may have a right to appeal that decision. Instructions will be provided where required.
Certain processing activities may rely upon your consent where required by applicable law.
If we rely upon consent, you may withdraw that consent as provided by applicable law.
Withdrawal of consent will not affect the lawfulness of processing that occurred before withdrawal.
Withdrawal may prevent us from providing a feature where the relevant information is necessary to provide that feature.
Where consent is required for future AI training, research, consumer-health-data processing, or disclosure, withdrawal will apply prospectively as required by law.
Withdrawal generally does not require Grovy to undo processing lawfully performed before withdrawal, including retraining previously developed models, except where applicable law requires otherwise.
Residents of certain U.S. states may have additional privacy rights.
Applicable state privacy laws may include laws governing:
We will provide additional state-specific notices where required.
California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), subject to applicable thresholds, definitions, and exemptions.
Depending on applicability, these rights may include:
For purposes of California law, the categories of personal information we may collect are described throughout this Privacy Policy.
Depending on your use of Hairy, these categories may include:
We may disclose these categories to the recipients and for the purposes described in this Privacy Policy.
Hair photographs, scalp photographs, questionnaire information, inferences concerning hair loss, and related information may constitute “consumer health data” under certain state laws even though Grovy is not a medical provider.
Where such laws apply, we will comply with applicable requirements concerning collection, consent, disclosure, authorization, deletion, and other consumer rights.
Where required, we may provide a separate Consumer Health Data Privacy Policy governing such processing.
Washington residents and certain individuals whose consumer health data is collected in Washington may have rights under the Washington My Health My Data Act.
Where the Act applies to Grovy, we will provide the notices, consent mechanisms, authorizations, and rights required by that law.
This may include rights relating to:
Where required by law, our Consumer Health Data Privacy Policy will be provided separately from this general Privacy Policy.
Hairy processes photographs to provide image-analysis functionality.
Certain jurisdictions regulate biometric identifiers or biometric information.
Hairy is designed to analyze characteristics relevant to hair and scalp tracking rather than to authenticate your identity through facial recognition.
Nevertheless, applicable law may characterize certain image-derived information differently depending on how that information is created or used.
Where our processing falls within an applicable biometric privacy law, we will obtain consent, provide notices, implement retention requirements, or take other measures required by that law.
We do not authorize third parties to use Hairy photographs for independent biometric identification of users except as separately disclosed and permitted by applicable law.
Grovy is based in the United States.
If you access Hairy from outside the United States, your information may be transferred to, stored in, or processed in the United States and other jurisdictions where Grovy or our service providers operate.
Data-protection laws in these jurisdictions may differ from those in your country.
Where applicable law requires a particular transfer mechanism, contractual safeguard, adequacy determination, or other protection for international transfers, we will implement appropriate measures.
If the General Data Protection Regulation, UK GDPR, Swiss data-protection law, or similar legislation applies to our processing of your personal information, additional requirements and rights may apply.
Depending on the particular processing activity, our legal bases may include:
We may process information where necessary to provide a Service you request.
We may rely on consent for processing where consent is legally required, including certain processing of special-category information.
We may process information where necessary for legitimate business interests such as:
provided those interests are not overridden by applicable rights.
We may process information where necessary to comply with law.
To the extent photographs, questionnaire information, or information inferred by Hairy constitutes health data or another special category of personal data under applicable law, we will rely upon an appropriate lawful basis and Article 9 condition, such as explicit consent, where required.
Users in applicable jurisdictions may have rights including:
If we make a decision producing legal or similarly significant effects based solely on automated processing, additional rights concerning automated decision-making may apply.
Hairy’s ordinary informational hair-analysis functionality is not intended to make decisions producing legal or similarly significant effects concerning you.
Hairy may contain links to websites, applications, products, or services operated by third parties.
This Privacy Policy does not govern those third parties.
We are not responsible for their privacy, security, or data-processing practices.
We encourage you to review their privacy policies before providing them personal information.
If you interact with Grovy or Hairy through a social-media service, the social-media provider may collect information about your interaction.
We may receive information that you choose to make available to us or that the platform makes available under its policies.
Your interactions with the social-media provider are governed by that provider’s privacy policy.
If you download or purchase Hairy through Apple App Store, Google Play, or another platform, that platform may independently collect information concerning:
Such processing is governed by the platform provider’s privacy policy.
Hairy and our privacy practices may change over time.
We may update this Privacy Policy periodically to reflect:
When we update this Privacy Policy, we will revise the “Last Updated” date.
Where required by law, we will provide additional notice, request consent, or otherwise obtain authorization before applying material changes to certain information or processing activities.
We encourage you to review this Privacy Policy periodically.
If you have questions, concerns, or requests concerning this Privacy Policy or our privacy practices, contact:
Grovy Health Inc.
251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808, United States
Support Email: team@hairy.app
For requests involving consumer health data, please include “Consumer Health Data Request” in the subject line.
For other privacy-rights requests, please include “Privacy Request” in the subject line where possible.