Consumer Health Data Privacy Policy
This notice explains how ONE EIGHT EIGHTEEN PTE. LTD., UEN 202644930W (Oleah), handles consumer health data in its app, website and related communications. Our address is 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914. Contact privacy@oleah.skin.
Consumer health data includes information linked or reasonably linkable to you that reveals past, present or future physical or mental health, including inferences. This notice addresses the Washington My Health My Data Act and applicable Nevada consumer-health requirements. Other privacy rights also remain available.
1. Categories and purposes
| Consumer health data | Why we collect and use it |
|---|---|
| Face photos, geometry, measurements, scan results and derived notes | Analyse your skin, align and compare your own scans, display history and personalise requested features. |
| Skin profile, conditions, medicines, allergies, treatments and reproductive or other health facts | Personalise scans, routines and conversations. This includes information entered in questionnaires, earlier records and information shared in chat. |
| Products, routines, responses and health inferences | Provide product information, readings, forecasts and observations about changes in your skin. |
| Messages, photos, transcriptions, website submissions and support correspondence containing health information | Answer requests, provide the requested feature and maintain relevant history and context. Website audio may be retained with a submission; in-app voice messages are retained as text by Oleah. |
| Account, device and usage information that reveals or is linked to health information | Operate and secure the service, connect information to your account and investigate faults. |
We also use relevant data for support, security and legal obligations. With the required permission, authorised personnel and AI tools analyse conversations, results and related health information to understand common questions and improve Oleah. Oleah does not train general-purpose AI models on this data.
2. Sources
We obtain this information from you, your device, your communications and use of our website or app, and analysis of information you provide. We do not intend to, nor do we knowingly, purchase consumer health data from third-party data brokers. If you include other health information in a message, we treat it according to its content even if Oleah did not ask for it.
3. Consent and choices
We collect and process consumer health data with the permission required by law or to the extent an applicable exception permits processing necessary for a feature you request. Where sharing requires consent separate from collection, we obtain that separate consent before sharing. Acceptance of general Terms or this notice is not that consent.
Discretionary improvement is separate from providing your requested analysis. You can decline it or withdraw the relevant consent by emailing privacy@oleah.skin. You may also delete your account in Privacy & my data. Withdrawal does not undo earlier lawful processing. If information is necessary for a feature you request, withholding or withdrawing it can limit that feature; unrelated rights and billing controls remain available. We do not unlawfully discriminate against you for exercising your rights.
4. Recipients and sharing
We do not sell consumer health data or use it for advertising. We share the categories above as needed with:
- cloud hosting and storage providers, which store the account and its content;
- AI services, which process submitted photos, messages and relevant health, product and scan information to provide features or perform permitted internal analysis;
- diagnostics and analytics providers, which process relevant usage and fault information;
- communications, support, transcription and notification services, which handle the content needed to deliver their functions; and
- advisers or public authorities where an applicable legal duty or permitted exception requires disclosure.
Our AI services include Google Gemini for app features. Our hosting uses Supabase on AWS in Mumbai, India; Sentry provides app crash and error diagnostics (no photos or scan content). PostHog processes usage events with fixed event names, screen names, app open and close, rage-taps, scrubbed errors, and from Oleah's server AI call counts, cost and timing. All are keyed to an account ID, with no name or email. No photos, face data, or health content ever go to PostHog. Contact privacy@oleah.skin for a current list and contact details of recipients, including any affiliates that receive your data.
A provider acting on our instructions is subject to the applicable processing arrangement. Our AI providers act strictly as processors/service providers and are contractually prohibited from using your consumer health data for their own independent commercial purposes. Photos sent for AI analysis can include the full image.
We do not deploy third-party tracking cookies, pixels, or similar technologies on website pages that collect or infer consumer health data, except where such services act strictly as our processors under binding data protection agreements and do not use the data for cross-site tracking. Health data is stored in Mumbai, India, and processed in the United States, Singapore and other provider locations described in the Privacy Policy.
5. Retention and rights
We retain health information while needed for your requested service and history, subject to deletion requests, consent withdrawal and legal limits. The Biometric Policy and Agreement adds retention limits for covered face data.
Upon your request for ordinary account deletion, encrypted original photos, other account data, and the analytics profile are deleted within 30 days. Backups age out within about 7 days after that. Signing in during that period cancels ordinary account deletion. A request under consumer-health law is handled under its applicable deadline and is not automatically postponed or cancelled by that recovery process. Necessary administrative records can be retained only where a valid legal exception permits it; this is not blanket permission to retain health content.
Where the applicable law provides these rights, you may confirm whether we collect, share or sell your consumer health data; access it and obtain recipient information; request deletion, including required deletion from recipients and backups; withdraw collection or sharing consent; and appeal a refusal. No new account is required to submit a request.
Email privacy@oleah.skin with your request. We use reasonable identity checks and accept authorised representatives where permitted. We respond without undue delay and within the applicable statutory period. For Washington requests, this is within 45 days of receipt, with one further 45-day extension only where legally permitted and explained within the initial period. Verification does not restart that deadline. Requests are normally free, subject to limited statutory exceptions.
Upon verifying a valid deletion request under applicable consumer health data laws, we will delete your consumer health data from our active systems within the statutory timelines (generally 30 to 45 days, depending on your jurisdiction). Any data retained in secure backups will age out within about 7 days after that, and will not be used for any active purpose during that time. We respond to other Nevada requests within the period required by Nevada law. You may also request correction at privacy@oleah.skin.
We communicate required deletion requests to recipients. Other applicable earlier deadlines remain in force. A provider's routine retention period does not override your statutory deletion rights.
To appeal, reply or email privacy@oleah.skin with Appeal in the subject. We give a written decision within 45 days or any shorter applicable period. If we deny the appeal, we explain how to complain to the appropriate authority, including the Washington Attorney General or Nevada Attorney General.
6. Changes
We publish updated versions and notify you of material changes. A new notice does not itself authorise a new purpose or disclosure. We request fresh consent when required before the change begins.