Photo & AI Notice

This notice applies to Eva-branded and participating-practice public AI Before & After preview pages. On a practice-branded page, the named practice decides to offer the consultation experience and Eva AI operates the preview service for it. The practice may also provide its own privacy notice. This notice does not describe a provider's internal clinical records or Eva's staff-operated planner. The public preview is currently offered only to adults in the United States using a photo of themselves.

You provide your uploaded or captured photo, age, prior aesthetic-treatment experience, whether you are new or returning to a named practice (on a practice-branded page), name, email or phone, selected treatment, preview preferences, optional consultation details, and consent choices. We create the AI preview and related consent, delivery, security, and outcome records. We also receive limited session and device/network information needed to deliver and protect the service; Eva stores a one-way IP hash with consent evidence rather than the raw address in that record. Hosting providers may maintain limited request logs under their service terms.

We collect, process, and store a photo only after you affirm the required photo-processing and consultation choice. Facial features in a photo may be treated as biometric information in some jurisdictions. We use your photo, preview, treatment choices, stated goals, and related session activity to create the preview; summarize what you want and estimate nonclinical consultation readiness from choices, timing, and engagement; support a consultation you request; perform internal quality assurance, safety, security, and debugging; and protect the service—not to identify or authenticate you. Authorized personnel and contracted service providers may access this data only for these stated purposes.

Consultation readiness means nonmedical indicators such as stated interest, goals, timing, and desire to speak with a provider. It does not mean medical eligibility or clinical suitability, and it is not used to deny care or set treatment pricing. The preview and any readiness estimate are consultation aids only. A licensed provider must independently decide whether a treatment is appropriate. The preview is an AI-generated visualization of a possible result. It is not medical advice, and actual results vary and are not guaranteed.

Eva decodes and re-encodes uploaded photos before generation. This removes embedded metadata such as GPS location and EXIF camera details. The sanitized photo and generation instructions are processed with AI to create your preview.

To keep the choice manageable, one required permission covers the photo processing, storage, stated-goal summary, nonclinical consultation-readiness estimate, and consultation support described here. It does not permit model training or fine-tuning. Eva will not use your photo, preview, or related customer data to train or fine-tune AI models unless you separately opt in to a future optional program. If you do not agree, do not upload a photo or use the preview. Promotional email or text messages remain a separate, optional choice. Your source photo and preview are not published or used as advertising creative. Contracted service providers may process data only for Eva's disclosed purposes and may not use it to train their own models.

Stored source photos and generated previews are deleted from active systems when the stated purposes are complete or no later than three years after your most recent saved preview, whichever comes first. Protected backup copies may remain until they age out under documented backup cycles and are not returned to active use. You may request deletion sooner. Lead, consultation, consent, security, billing, and outcome records are not subject to the image limit. They are retained while needed to respond to your request, operate the practice relationship, maintain consent/security evidence, or comply with law, and remain subject to applicable access and deletion rights.

During your preview session, use Delete photos & end session to remove both the source photo and generated preview, withdraw photo and storage consent, and end that preview session. You may also ask whether we hold related data, request access or deletion, or withdraw future consent at any time by emailing privacy@getevaai.com with the email address used for the preview. We may ask for enough information to verify the request. If we deny a request, we will explain why and provide any appeal method required by applicable law. Withdrawing consent does not affect processing already completed before withdrawal.

A clinic does not receive your identifying preview information merely because you opened its page. If you select the separate contact choice required to reveal your preview or request a consultation, Eva shares the contact, treatment, goal, preview, and request information needed for the named practice to respond. The practice may access saved images only for those purposes and only when its saved-image access is enabled. On an Eva-branded page, Eva does not send a practice your data unless you request a consultation or otherwise choose a practice. Eva's contracted service providers process limited data for AI processing, secure hosting and storage, security and abuse prevention, and communications. They may process the data only to provide their contracted services and may not use it for their own purposes or their own model training. Clinic notification emails contain only a generic notice and dashboard sign-in link—never patient details, photos, previews, treatment information, or a direct patient link. A communications provider receives phone and message data only if an approved SMS workflow is enabled. Eva has no affiliate that receives this data merely because of affiliation.

The Eva-branded and practice-branded preview routes do not load Eva's global Google Analytics, Google Tag Manager, Microsoft Clarity, Meta Pixel, or another third-party advertising/behavioral tracker. They retain privacy-minimized first-party operational measurement that excludes source photos and generated previews. If a named practice enables its clinic-owned Meta Conversions API integration, you will see a separate, optional advertising-measurement choice before any event is sent. That limited server-side event may include a platform click identifier and a one-way hashed email or phone number, but never your source photo, generated preview, treatment, age, goals, consultation details, or page query string. Eva does not sell your source photo or generated preview.

Saved images are kept in access-controlled object storage at non-guessable paths. Staff access is authenticated and tenant-scoped. We use encrypted transport, provider-managed encryption at rest, short-lived image access, generation quotas, consent/audit records, and controls designed to keep raw photos out of application logs, analytics, and email.