Consumer Health Data Privacy Notice

This notice describes consumer health data handled by Eva AI, Inc. through its public and practice-branded AI Before & After preview. “Consumer health data” can include information that identifies or can reasonably be linked to you and relates to your health, treatment interests, or care. This notice supplements Eva's Privacy Policy and Photo & AI Notice.

Depending on how you use the preview, we may collect your source photo, generated preview, facial features produced through image processing, treatment interests, age, prior aesthetic-treatment experience, stated goals, new-or-returning client status, timing and consultation preferences, optional notes, consent records, preview activity, and contact details linked to that information. We do not use the preview to diagnose you or decide whether you are medically eligible or clinically suitable for treatment.

We receive this information directly from you when you use the preview or request a consultation; from the participating practice whose page you chose; from your browser, device, and the link used to reach the page; and from service providers that return or help protect the result you requested. We do not buy patient lists or take photos from a practice's patient gallery for this service.

We use consumer health data to create and securely deliver the preview you request; summarize your stated goals; estimate nonclinical consultation readiness from your choices, timing, and engagement; respond when you ask to be contacted or request a consultation; operate consent, deletion, security, fraud-prevention, quality, safety, and debugging controls; and comply with law. We do not use customer photos, previews, or related customer data to train or fine-tune AI models under the current permission.

Eva uses contracted providers for requested AI image processing, private hosting and storage, authentication, security, and other service operation. They may use the information only to perform Eva's instructions. A clinic does not receive your identifying preview information merely because you opened its page. If you separately ask the clinic to contact you or request a consultation, Eva shares the contact, treatment, goal, preview, and request information needed for that clinic to respond. We may also disclose information when legally required or reasonably necessary to protect a person, the service, or legal rights.

Eva does not sell consumer health data. Eva does not use source photos, generated previews, treatment choices, goals, or consultation details for targeted advertising. The preview routes do not load Eva's global advertising or behavioral-tracking tools. A clinic-owned advertising measurement connection remains off unless the page offers a separate optional choice and you select it; even then, Eva does not send the advertising platform your photo, preview, treatment, age, goals, or consultation details.

Saved source photos and generated previews are deleted from active systems when the stated purposes are complete or no later than three years after your most recent saved preview, whichever comes first. You may delete them sooner with “Delete photos & end session” or by emailing us. Protected backup copies may remain until they age out under documented backup cycles and are not returned to active use. Minimal consent, deletion, security, consultation, billing, or legal records may be kept for their separate required periods.

Depending on the law that applies, you may ask whether Eva holds consumer health data about you; request access to or deletion of that data; ask for the sources and recipients; withdraw future consent; or appeal a denied request. Use “Delete photos & end session” during the preview or email privacy@getevaai.com. We may request enough information to verify you or an authorized agent. We will not unlawfully discriminate against you for making a request.

Send a privacy request or appeal to privacy@getevaai.com. Describe the request and include the email address or phone number used for the preview. We will explain a denial and the available appeal method when required. Security concerns may be sent to security@getevaai.com.