Privacy Policy

AVAESTA (also described in the app as AVAESTA Health) operates this platform. The operating company is the data controller for the personal data described here. The company's registered name, number and address have not yet been supplied and are flagged above for completion.

You can raise any privacy question or request through our contact page. Do not send medical images by email.

• •Account details: your name, email address, role, and — for clinic users — the clinic you are linked to.
• •Health images and scan data: the photos you capture or upload, the AI analysis produced from them, and any reports generated. These are health data and are treated as a special category of personal data.
• •Wellness and clinical records: scans, consultations, procedures, consent records and any notes entered by you or, where you are a clinic client, by your practitioner.
• •Payment information: if you take out a paid plan, our payment provider processes your card. We do not store card numbers on our systems.
• •Technical data: basic usage and error information needed to keep the service secure and working.

• •To create your account and let you sign in.
• •To capture your images and produce AI-assisted visual wellness observations and reports.
• •To store your scan history so you and, where applicable, your practitioner can review trends over time.
• •To process payments and manage your subscription or scan credits.
• •To keep the platform secure, prevent misuse and meet our legal obligations.

Health images are processed on the basis of your explicit consent, which you give before your first scan. Consent is recorded, can be given separately for each scan session, and can be withdrawn at any time (see "Your choices" below).

Your data is not sold. It is, however, handled by service providers who process it on our behalf, and it may be visible to the practitioner or clinic you are working with. Being clear about this matters more than a blanket promise, so here is the accurate position:

• •Hosting and platform provider: the application, database and file storage run on Base44's platform.
• •AI analysis provider: the images you scan are sent to a third-party AI model to produce the analysis. The result comes back into your account.
• •Payments: Stripe processes card payments and subscription billing. We receive the outcome of the payment, not your card details.
• •Email delivery: transactional emails (verification, reports, reminders) are sent through our email provider.
• •Sign-in providers: if you choose to sign in with Google, Google handles that authentication step.
• •Practitioners and clinics: if you are a clinic client, practitioners at your clinic can see the records, scans and reports linked to that clinic. If you are an individual member, your records are yours unless you choose to share a report.

We do not share your data with insurers, and no insurer-sharing feature is enabled by default. Any future insurer or employer integration would require your separate, explicit consent before anything is shared.

AVAESTA uses AI to produce visual wellness observations from the images you submit. These outputs are informational. They do not diagnose, screen for, predict or rule out any disease, and they are not a substitute for professional medical assessment.

Practitioner review is a separate, optional, paid add-on on individual scans. When you request it, the scan and its AI output are made available to a reviewing practitioner, and their notes are shown to you separately from the AI output. Requesting review is always your choice.

Account data is kept while your account is open. Scan images, reports and clinical records are kept so that trend tracking and clinical documentation remain meaningful. The exact retention periods have not yet been formally set and are flagged above; until they are, we keep records for as long as your account is active and delete or anonymise them following a verified deletion request, subject to any legal or clinical record-keeping obligation that requires us to keep something longer.

• •Withdraw consent: you can withdraw consent for image processing at any time, after which you will not be able to run further scans. Withdrawing consent does not affect scans already processed.
• •Access and export: you can ask for a copy of your data in a structured format.
• •Correction: you can correct inaccurate profile information in your account settings.
• •Deletion: you can initiate deletion of your account from account settings, or ask us to do it for you. Deleting your account removes your profile and personal records, except anything we are legally required to retain.
• •Deleting your account and cancelling a subscription are separate actions. Deleting your account does not automatically cancel a paid plan — cancel the plan in your billing settings first so you are not charged again.

We aim to respond to privacy requests promptly. Some requests may need us to verify your identity before we act on them.

Data is transmitted over encrypted connections and access is restricted by role, so a clinic client, a practitioner and an administrator each see only what their role permits. No system can be guaranteed completely secure, and we do not claim otherwise. If you believe your account has been compromised, contact us immediately.

AVAESTA is not intended for use by children. Accounts must be created by someone old enough to consent to the processing of their own health images.

When this policy changes we will update the date at the top. Material changes affecting how we process health images will be notified in the app.