Privacy Policy

Last updated: 7 August 2026

Who we are

LumyIQ Ltd ("LumyIQ", "we", "us", "our") is registered in England and Wales as LumyIQ Intelligence Ltd, Company No. 17366470. We are registered with the Information Commissioner's Office (ICO), Registration No. ZC215888. We are the data controller for the personal data described in this policy.

This policy explains what personal data we collect, why we collect it, how long we keep it, and your rights. If you have any questions contact us at fahmida@lumyiq.com.

What data we collect and why

Account data

When you create a LumyIQ account we collect your name, email address and password (stored in encrypted form). We use this to manage your account and provide the service. Lawful basis: performance of a contract.

Scan images

When you use the LumyIQ face scan you submit a photo of your face and, if visible, your neck. This image is processed by artificial intelligence to generate cosmetic skin insights. Lawful basis: your explicit consent, given at the point of scanning. You may withdraw consent at any time by deleting your scan from your dashboard or closing your account.

Scan results and reports

The cosmetic insights, skin scores, zone observations and treatment recommendations generated from your scan are stored in your account so you can access your history and track your skin over time. Lawful basis: performance of a contract (providing the service you requested).

A note on facial images and AI processing

LumyIQ's AI analyses cosmetic characteristics of your skin — texture, pigmentation, hydration, laxity and similar — for the purpose of generating cosmetic insights. It does not perform facial recognition, does not identify you from your image, and is not used to make any automated decision with legal or similarly significant effect on you. We have completed a Data Protection Impact Assessment (DPIA) for our scan feature in line with UK GDPR Article 35.

Usage data

We collect standard usage data (pages visited, device type, browser) to understand how the service is used and to improve it. Lawful basis: legitimate interests.

Communications

If you contact us or make an enquiry through the platform we retain that correspondence. Lawful basis: legitimate interests.

Payment data

If you make a payment through LumyIQ, payment details are processed by Stripe. We do not store card details. We retain records of transactions. Lawful basis: legal obligation (UK tax and accounting law requires retention for 7 years).

How long we keep your data — retention schedule

Data type	How long we keep it	Why
Scan images	Until you delete the scan or close your account	Image is stored to give you ongoing access to your history. Deleted immediately on your request or account closure.
Scan results and reports	Until you delete the scan or close your account	Results are stored so you can track your skin over time. Deleted immediately on your request or account closure.
Account data (name, email)	Until you close your account, plus 30 days	30 day window allows us to process your deletion request and restore the account if closed in error.
Consent records	Duration of account plus 3 years after closure	To evidence your consent if our lawful basis is ever questioned.
Payment and transaction records	7 years from the date of transaction	Required by HMRC and UK tax law. We cannot delete these earlier even on request.
Practitioner vetting documents	Duration of subscription plus 2 years after cancellation	To evidence our vetting decisions if ever disputed.
Usage and analytics data	13 months rolling	Standard analytics retention aligned with ICO guidance.
Support correspondence	2 years from last contact	To maintain a record of issues raised and resolved.

We do not retain scan images or reports beyond your account lifetime. We never sell your data. We never share scan images with practitioners, advertisers or any third party.

AI processing and automated decisions

LumyIQ uses artificial intelligence to analyse your scan image and generate cosmetic skin insights. This processing involves transmitting your image securely to our AI provider, who acts as a data processor under contract with us and is prohibited from using your image for any other purpose, including training their models.

Our AI processing produces cosmetic observations and recommendations. It does not make any automated decision that produces legal effects or similarly significantly affects you. You are always free to ignore the insights, seek a second opinion, or do nothing at all. All treatment decisions remain entirely yours.

We have documented our AI processing in a Data Protection Impact Assessment (DPIA) as required by UK GDPR Article 35.

Your rights

Under UK GDPR you have the right to:

Access your data — request a copy of the personal data we hold about you
Correct your data — ask us to fix inaccurate information
Delete your data — ask us to delete your personal data. You can delete individual scans at any time from your dashboard. To close your account and delete all data contact fahmida@lumyiq.com. Note: transaction records must be retained for 7 years under UK tax law and cannot be deleted on request.
Restrict processing — ask us to pause processing your data in certain circumstances
Data portability — receive your data in a structured, machine-readable format
Object — object to processing based on legitimate interests
Withdraw consent — withdraw consent for scan processing at any time by deleting your scan or closing your account. Withdrawal does not affect the lawfulness of processing before withdrawal.
Complain — complain to the ICO at ico.org.uk or by calling 0303 123 1113. We would welcome the opportunity to resolve any concern directly first — contact fahmida@lumyiq.com.

To exercise any right contact fahmida@lumyiq.com. We will respond within one calendar month.

Sharing your data

We share your data only in these circumstances:

AI processing provider: your scan image is transmitted to our AI provider to generate your insights. They act as our data processor and are contractually prohibited from using your data for any other purpose.
Payment processor: Stripe processes payments on our behalf as our data processor.
Practitioners: when you click to contact or book a practitioner we share the information needed for that enquiry (name, contact details, treatment interest). Practitioners act as independent data controllers for the data they receive.
Legal: where required by law, court order or to protect the safety of users or LumyIQ.
Business transfers: if LumyIQ is acquired or merged, data may transfer as part of that transaction. This policy would continue to apply.

We do not sell personal data. We do not share scan images with any third party other than our AI processing provider for the sole purpose of generating your insights.

International transfers

Where our providers process data outside the UK we use appropriate safeguards recognised under UK GDPR, including the ICO-approved International Data Transfer Agreement or adequacy regulations.

Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, private storage buckets, and row-level security on our database. Scan images are stored in a private bucket accessible only to you and authorised LumyIQ staff. If a breach occurs that is likely to affect your rights we will notify you and the ICO as required by law.

Children

LumyIQ is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we become aware that we hold data relating to a person under 18 we will delete it promptly.

Cookies

We use cookies in line with our Cookie Policy. See our Cookie Policy for full details.

Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in-app before they take effect. The "Last updated" date above will always reflect the current version.

Contact and complaints

Data controller: LumyIQ Ltd
Contact: fahmida@lumyiq.com
ICO registration: [number to be inserted]