Consumer Health Data Privacy Policy

This page explains how K-Beauty Picks handles consumer health data — information that could reasonably identify your past, present or future physical health status — as defined by laws such as the Washington My Health My Data Act (RCW 19.373). We apply the same commitments to every user in the United States, regardless of where you live.

1. Consumer health data we collect

• Skin-appearance metrics produced by our AI from your selfie: scores for oil, moisture, redness, blemishes, wrinkles, elasticity, texture, pores, spots, skin tone and dark circles, a skin-age estimate and an overall skin-health score, plus the skin type derived from them.
• Ingredients you choose to avoid ("allergens"), if you answer that question.
• Optional context you enter: your age range, your gender if you share it, and where breakouts usually occur if you answer that follow-up question.
• AI-written skin report generated from the metrics above (cosmetic guidance only — not medical advice).
• Product-fit results when you use "Check a product": how a product's ingredient list compares with your skin profile.
• Routine information in a DukheeRx kit order, if you buy a kit: the ingredient exclusions you provided, the routine category, the recommendation explanations shown to you, and an analysis reference identifier if supplied. The order record does not contain your photo or your numerical skin scores.

We do not collect your selfie as stored data (it is discarded immediately after analysis), biometric identifiers, precise geolocation, or any medical diagnosis. Our metrics describe how skin looks and feels for cosmetic purposes.

2. Sources

• Directly from you: the selfie you take (processed transiently), the answers you give, and the product photos you choose to check.
• Generated by us: the metrics, skin type and report computed from your selfie and answers.

3. Why we collect it (purposes)

• To show you your skin analysis and AI report.
• To recommend skincare products that fit your skin (Amazon picks) and to assemble a DukheeRx routine if you ask for one.
• To tell you how a product you are holding fits your skin ("Check a product") and to exclude ingredients you asked us to avoid.
• To let you come back to your latest result on the same device without a new selfie, and — only if you sign in to My Skin — to show your history over time and, while you are signed in, to reuse your latest saved result for your result, picks and product checks without a new selfie.
• To email you your results or a DukheeRx kit reservation confirmation, only when you ask for it.
• To keep the service secure and to improve measurement quality using pseudonymous capture-quality numbers.
• To fulfil, ship and support a DukheeRx kit order you placed, including returns, refunds and product-safety follow-up.

4. Where it is stored and for how long

• On your device (browser storage) — only if you choose to. After your first analysis we ask once: "Keep on this device" or "Use for this visit only". If you choose to keep it, your latest result — metrics, skin type, age range, gender if shared, breakout location if answered, the AI report text, the ingredients you avoid, your recommendation style and your last channel choice — is saved in your browser's local storage for up to 90 days from the analysis so you can return to it without a new selfie. Saving this copy does not upload anything by itself; separate actions you take later (requesting an email, signing in to My Skin, reserving a kit) send data as described in this policy. Closing the window does not delete the copy. A new analysis replaces it. After 90 days it is no longer used and is deleted the next time you open the site. You can turn saving off or delete the copy at any time from the "Analysis" tab ("Don't save on this device" / "Delete saved profile") or by clearing your browser data; the current visit keeps working either way.
• On our servers, pseudonymously. For every analysis we keep an operational record of the metrics, age range and gender if shared, linked to a random browser identifier (not your name or email). This record is used for quality improvement and age-group reference statistics.
• On our servers, linked to your email — only with your consent. If you ask for your results by email, sign in to My Skin, or reserve a DukheeRx kit, the data needed for that request is stored with your email as described in the Privacy Policy. My Skin keeps your scores and skin type per analysis. A report you email yourself with one click while signed in is sent but not stored. The full report, product list and questionnaire are stored only when you request the email report through the form and tick the storage consent there.
• DukheeRx kit orders: order records are kept on our own server under a seven-year recordkeeping policy; shipping address and phone number are deleted after that. This policy does not override your deletion rights: health-related information in an order is assessed separately from records kept to meet a specific legal obligation, and deletion covers the order record, related print snapshots and relevant backups.

5. Who we share it with

• Service providers acting on our behalf, under contract, only as needed to run the service, each receiving only what its task needs:
  • Our analysis server (operated by TheKey): your selfie transiently to compute metrics (then discarded), and the pseudonymous operational record described above.
  • Google (Gemini) and Anthropic (Claude): a text profile of your metrics, skin type and answers to write the AI report; and, only if you use "Check a product", the product photo (never your selfie) to read the label. No name or email.
  • Resend (email delivery): when you request results or a reservation email, and when we send transactional messages for a DukheeRx kit order. It processes your email address and the message contents; order confirmations include your name, shipping address, routine category, product codes and quantities, and amounts paid. We do not include your selfie or numerical skin scores in order messages.
  • Stripe (payments): only if you buy a plan — your email address and payment details you enter on Stripe's page; no skin metrics.
  • Stripe, Inc. (payment) and the carrier shown on your tracking number, only for a DukheeRx kit order: Stripe receives checkout contact, shipping, payment and product-description information (product codes and quantities); the carrier receives what is needed to deliver your parcel. Neither receives your skin scores or photo.
  Your selfie is never shared with any AI provider.
• Affiliate: The Key Co., Ltd. (Korea), which designs the service and DukheeRx routines, may access the same categories of consumer health data listed in section 1 for the purposes in section 3, under the same commitments; it does not receive your selfie.
• No one else. We do not sell consumer health data, do not share it for advertising, and do not disclose it to third parties except as required by law.

6. Your rights and how to exercise them

• Confirm, access, and see who received it. Email results@ineedlab.com to ask whether we collect, share or sell consumer health data about you, to receive a copy of it, and to receive the list of third parties and affiliates that received it, with contact details. We respond within 45 days.
• Delete. In the app: "Delete saved profile" (the copy on your device) and "Delete my skin history" in My Skin (server records linked to your email). By email: write to us from the address you used and we will delete your records and notify our service providers to do the same. If you never gave us an email (pseudonymous use only), send us the browser identifier shown at the bottom of this page — we cannot otherwise link a request to a pseudonymous record. Clearing your browser data resets that identifier so future analyses are no longer linked to it, but it does not delete records already on our servers; email us the identifier first if you want those deleted.
• Withdraw consent. Choose "Don't save on this device" in the "Analysis" tab (stops and deletes the device copy), sign out of My Skin (stops saving new analyses to your history; it does not delete existing records or the device copy — use the delete options above), or email us. Withdrawing consent does not affect processing that already happened lawfully.
• No discrimination. We will not deny you the free analysis for exercising these rights.
• Appeals. If we decline a request, we will explain why; you may appeal by replying to our decision email within 45 days. We will answer your appeal within 45 days with the reasons for our decision. If we deny the appeal, Washington residents may submit a complaint to the Washington Attorney General at atg.wa.gov/file-complaint.

7. Contact

TheKey Inc., 12641 Antioch Road, Overland Park, KS 66213, USA · results@ineedlab.com. We may update this policy; the effective date above will change when we do.

Your browser identifier / Tu identificador del navegador: not available in this browser / no disponible en este navegador
Read only from this browser when you open this page; it is not sent anywhere. / Se lee solo desde este navegador al abrir esta página; no se envía a ningún sitio.