About this policy
This policy explains how SoftMaxx AI (softmaxx.io), run by SOFTMAXX, a business registered in Ontario, Canada (BIN 1001665584) ("SoftMaxx", "we"), handles consumer health data: information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. That includes biometric data such as imagery of your face, and information we infer about your body from it. It is written to meet Washington's My Health My Data Act (RCW 19.373), Nevada's consumer health data law (NRS 603A.400 to 603A.550) and Connecticut's consumer health data provisions (CGS 42-515 and following). Everything else about your data is in our Privacy Policy.
1. Consumer health data we collect
Today
- Face-scan biometric data. The selfie you upload for a scan, and the facial proportion measurements computed from it (478 landmark points located in your browser, sent to us only as numeric ratios). Washington law counts imagery of the face from which an identifier template can be extracted as biometric data. We do not use it to identify you.
- Health status inferred from your scans. Readings our analysis derives from your photo that describe your body, such as skin readings (texture, breakouts, redness, under-eye darkness), hairline, and the scores and plan items built from them.
- Lifestyle answers (optional). If you fill in the lifestyle questionnaire: sleep hours, a body-fat estimate, smoking, sunscreen use, alcohol use, height and weight.
- What you tell the coach. Messages you send to the SoftMaxx AI coach, which may include health information you choose to share.
- Journal notes (Elite). Notes you write about a scan. Journal photos stay on your device and never reach our servers.
When the tracker launches (not collected today)
If we launch the peptide and medication tracker, it will store, only after you give a separate opt-in consent: the substances, amounts and times you log, injection sites, vial details, side effects and notes. Photos you add to it will stay on your device. It will not collect your location. This section will be updated before the tracker opens.
Not collected
Our peptide education pages collect no health data. Our peptide calculators do the math in your browser; we do not store what you type into them.
2. Why we collect it
- To run the scan you ask for and show you your results.
- To build your plan and answer your coach questions.
- To keep your scan history so you can compare rescans and see trends.
- To send the emails you asked for (your results, reminders, your monthly recap), each with an unsubscribe link.
- To keep the service secure and stop abuse.
- When the tracker launches: to show you your own log and send the reminders you set.
We do not use consumer health data for advertising, we do not sell it, and we do not use your photo to train AI models.
3. Where it comes from
- You: the photo you upload, the answers you give, the messages you send and (when the tracker launches) the entries you log.
- Your device: the facial measurements your browser computes from your photo, and the anonymous identifier our pages create in your browser.
- Our analysis: readings and scores derived from the above by our scoring and by our AI provider (OpenAI) on our behalf.
We do not buy health data and do not receive it from other companies.
5. Our processors, what each receives, and how to contact them
| Processor | Consumer health data it receives | Contact |
|---|---|---|
| Vercel Inc. (hosting, United States) | Every request to SoftMaxx passes through Vercel, including your photo during a scan (held in memory for that request only, never written to storage), your coach messages and your results, plus standard request logs (IP address, device). | privacy@vercel.com · vercel.com/legal/privacy-notice |
| Upstash, Inc. (Vercel KV database, United States) | Your derived scores and scan history, lifestyle answers, coach chat history and memory, and journal notes, keyed to an anonymous identifier. When the tracker launches, its entries. | privacy@upstash.com · upstash.com/trust/privacy.pdf |
| OpenAI, L.L.C. (AI provider, United States) | Your photo and facial measurements, for one scoring request each scan; your coach messages with a summary of your scan, to write coach answers. OpenAI states that data sent through its API is not used to train its models. | openai.com/policies/privacy-policy |
| Resend (email delivery, United States) | Your email address and the contents of the emails we send you, which can include your scores and plan items. | support@resend.com · resend.com/legal/privacy-policy |
| Stripe, Inc. (payments, United States) | Billing only: your email, payment details and subscription status. No scan, coach or tracker data. | privacy@stripe.com · stripe.com/privacy |
| PostHog, Inc. (product analytics, United States) | No photo, no facial measurements, and no coach messages as data; when a scan finishes, only a low / mid / high band of your overall score. On our peptide pages and calculators there is no session recording and no click capture, and peptide names and amounts are removed from every event before it is sent. On the app pages a session recording masks what you type and blocks all images, but text shown on the screen, such as your scores and readings, can appear in it. PostHog is not loaded at all if your browser sends Global Privacy Control or Do Not Track. | privacy@posthog.com · posthog.com/privacy |
6. Your rights
- Confirm and access. Ask us to confirm whether we collect, share or sell your consumer health data, get a copy of it, and get a list of the third parties we have shared it with, with their contact details (the processors in Section 5).
- Delete. Ask us to delete it. We delete it from our live systems and from archived or backup systems, and we tell every processor that holds it to delete it too. Where a backup cannot be edited, we make sure it expires and is never restored; our reply tells you when.
- Withdraw consent. Withdraw any consent you gave, as easily as you gave it. Today: stop scanning and use "Delete my data". When the tracker launches, a switch in your Account will stop health-data processing and delete your tracker data.
- Appeal. If we decline your request, you can appeal (Section 7).
Using these rights is free of charge and never changes the price or quality of what you get from us.
7. How to use your rights
- In the app: the "Delete my data" button on your Account page deletes your stored scores, scan history, lifestyle answers, journal entries, chat memory and coach-persona choice, and the copies kept in that browser.
- By email: write to privacy@softmaxx.io with the subject "Consumer health data request". To find your data we may ask for the anonymous identifier from your browser, your Stripe Customer ID or the email you used at checkout.
We answer within 45 days. If we need longer, we may extend once by another 45 days and will tell you why within the first 45.
Appeal. If we decline all or part of your request, reply to our decision with the word "Appeal". We will answer within 45 days and explain the outcome in writing. If we still decline, you can contact your state Attorney General: Washington, Nevada or Connecticut.
8. No sale
We do not sell consumer health data. We would never do so without the separate, signed authorization the law requires, and we have no plan to.
9. No geofencing
We do not set up geofences around health care facilities, or anywhere else, to identify, track, collect data from or send messages to anyone. The tracker will not collect your location.
10. How long we keep it
- Your scan photo: destroyed on our side when the analysis request ends (typically within 60 seconds); copies stay in your own browser until your next scan replaces them or you delete them.
- Derived scores and scan history: up to 12 months, then deleted automatically.
- Lifestyle answers: 90 days.
- Journal notes (Elite): 12 months.
- Coach chat history: until you delete it with "Delete my data"; it has no automatic expiry today.
- Tracker entries (when the tracker launches): kept while you are subscribed and for 90 days after you cancel, then deleted automatically. On a free account, they are deleted after 12 months without use.
You can delete any of it sooner (Section 7).
11. Washington residents
Under the My Health My Data Act (RCW 19.373) you have the rights in Section 6. We collect consumer health data only as needed to provide the service you ask for, or with your consent, and we share it only with our processors. Face-scan imagery is biometric data under RCW 19.373.010. Our biometric disclosure under RCW 19.375 is in our Privacy Policy. You can contact the Washington Attorney General at atg.wa.gov.
12. Nevada residents
Under NRS 603A.400 to 603A.550 you have the rights in Section 6, answered within 45 days. We collect consumer health data only with your consent or as needed to provide the service you ask for, share it only with our processors, do not sell it and do not geofence.
13. Connecticut residents
Under CGS 42-515, 42-520 and 42-526 consumer health data is sensitive data. We process it only with your consent or as needed to provide the service you ask for, do not sell it, and do not use a geofence within 1,750 feet of any health care facility (or anywhere else). You have the rights in Section 6, including the appeal in Section 7.
14. Contact and changes
Consumer health data requests and questions: privacy@softmaxx.io.
If we change this policy, we update the date at the top, and for a material change we email you if we have your address. We will not use consumer health data in a new way without asking you first.