This is a courtesy translation. In case of any discrepancy, the original Portuguese version prevails.
This Policy describes the processing of personal data carried out by the Harmy app (“Harmy”, “we”), intended for facial harmonization professionals. By using the app, you agree to the practices described here.
1. Who is the controller
Harmy acts as the controller of the registration data of the professional user. With respect to the images and data of patients entered into the app, the professional is the controller of that data and Harmy acts as the processor, handling it exclusively under the professional's instructions.
Data Protection Officer (DPO) contact: privacidade@harmy.com.br.
2. Data we collect
2.1. Professional (user) data
- Name, email and password (stored in encrypted form).
- Record of consent and minimal technical usage and security data.
- Payment data processed by our payment provider (we do not store card data).
- Clinic data provided by you (name, contact, logo and price list), used to personalize the sharing image and the quote.
- Referral code and the relationship between referred accounts, used to grant the bonuses of the referral program.
2.2. Patient data (entered by the professional)
- Photographs of the patient's face, from different angles.
- Patient name or identification assigned by the professional.
- Selected procedures and generated projection images.
- Photo of the actual result, when you choose to attach it to a projection.
- Link for the patient: when you generate it, the “before” photo and the projection of that session become accessible through a secret address for up to 7 days. The link does not show the patient's name, can be canceled by you in the app and expires on its own.
Facial photographs are sensitive personal data and require specific consent from the patient, which must be obtained by the professional before using the app.
3. Purposes and legal basis
- Authentication and account management: performance of a contract with the professional.
- Marking of anatomical areas and generation of the “after” projection: performance of the service requested by the professional, with the patient's consent.
- History of sessions and patients: performance of the service and legitimate interest in the continuity of care.
- Reminders about your account (by notification and email), such as projections available or results to follow up: legitimate interest. You can turn them off in the app, under Account, Reminders. The same applies to the monthly usage summary sent by notification.
- Security, fraud prevention and service improvement: legitimate interest and compliance with legal obligations.
4. Facial data and how we handle images
The photographs of the patient's face are the only facial data processed by Harmy. The app does not create biometric identifiers (faceprints/templates) and does not use facial recognition to identify people.
- On-device marking: to position the markers of the anatomical areas, the app detects facial contours locally, on the device itself (Google ML Kit). These points/contours are used only in real time to draw the markers and are not stored or transmitted to us or to third parties.
- Generation of the “after” projection: the frontal photo is sent securely (HTTPS/TLS) to our server and processed by a generative AI service (Google Gemini) exclusively to produce the requested image, under our instructions. The images are not used to train models.
- Photo of the actual result: when attached, it is aligned to the “before” photo on the device itself, using only the position of the eyes, without biometric identification. It is not sent to a third-party AI service and is stored in the account history.
- History: the “before” photo and the “after” projection are stored in the professional's account, on restricted-access servers, for reference during care.
- No advertising and no tracking: facial data is never used for advertising, profiling or tracking, and is not sold.
- The generated images are illustrative simulations and do not constitute a promise of clinical results.
5. Sharing
We do not sell personal data. We share data only with:
- Infrastructure and hosting providers that store the data under contract.
- Generative AI service (Google) strictly to generate the requested projection.
- Payment provider, to process subscriptions.
- Authorities, when required by law or court order.
6. Storage and security
- Transmission protected by HTTPS/TLS and passwords stored as hashes (bcrypt).
- Databases and images hosted in a restricted-access environment.
- Adoption of technical and organizational measures to protect the data against unauthorized access.
7. Retention
We keep facial images and associated data while the professional's account is active or for the time necessary for the purposes described and for legal obligations. The professional can delete their own account at any time in the app (Account › Delete my account menu) or through the data deletion page; in that case, the facial data and all other data are deleted or anonymized within the legal deadlines. The facial contours used for marking are not retained, since they are processed only on the device.
8. Your rights (LGPD)
You may, at any time, request:
- Confirmation of the existence of processing and access to the data.
- Correction of incomplete, inaccurate or outdated data.
- Anonymization, blocking or deletion of unnecessary data.
- Portability and information about data sharing.
- Revocation of consent and deletion of the data processed based on it.
To exercise these rights, use the data deletion page or write to privacidade@harmy.com.br.
9. Data deletion
You can request the deletion of your account and associated data through the page harmy.com.br/en/data-deletion. We handle requests within the deadlines set by the LGPD, except where retention is required by law.
10. Children and adolescents
Harmy is intended for professionals and is not directed at persons under 18 as users. When the patient is a minor, the professional is responsible for obtaining the consent of the legal guardian.
11. Changes to this policy
We may update this Policy periodically. The “last updated” date at the top indicates the current version. Relevant changes will be communicated through the app's channels.
12. Contact
Questions about privacy and data protection: privacidade@harmy.com.br.