Privacy Policy

1. Data We Collect

Account data

When you create an account, we collect your email address and, if you choose to provide it, your full name and skin type preferences. This information is stored securely using Supabase, our database provider.

Purchase data

When you place an order, we collect your delivery address, order contents, and payment reference. Payment card data is processed directly by our payment provider and is never stored on our servers.

AI analysis data

When you use our AI analysis feature, face detection and measurements run in your browser, and your photos are then sent to Anthropic (the provider of Claude, the AI model we use) to generate your analysis. We only keep the analysis results, measurements and your front photo if you choose to save your progress, and only store the photo if you tick the box to do so. Wellness check-in answers are never saved. Style Advisor photos are also sent to Replicate to create the preview. The analysis is only for adults aged 18 and over. See our AI Disclosure for full detail.

Usage data

We collect standard server logs including your IP address, browser type, and pages visited. To prevent abuse of the free analysis, we record a one-way, salted hash of your IP address (never the address itself) for 48 hours. We also record anonymous product events, such as an analysis being completed or a checkout starting, against a random session ID so we can see which parts of the service are working. These events never include your photos, analysis content or health information.

2. Why We Use Your Data

• To create and manage your account
• To process and fulfil your orders
• To deliver your personalised AI analysis and product recommendations
• To send you transactional emails (order confirmations, shipping updates)
• To improve our platform and services
• To comply with our legal obligations

We will only contact you for marketing purposes if you have explicitly opted in. You can withdraw consent at any time by emailing privacy@iammax.co.uk.

3. Legal Basis for Processing

• Contract performance — processing your orders and delivering your purchases
• Legitimate interests — platform security, fraud prevention, improving our services
• Consent — AI analysis of photographs, storing your progress photos, check-in reminder emails and marketing communications
• Explicit consent — the optional wellness check-in, which involves health information
• Legal obligation — tax records, regulatory compliance

4. How Long We Keep Your Data

• Account data is retained for as long as your account is active
• Order records are retained for 7 years for tax and legal compliance
• Photos you don’t choose to save are not retained after your analysis
• Saved analyses and stored photos are kept until you delete them or close your account
• Usage-limit records are deleted after 48 hours; anonymous product events after 13 months
• Marketing consent records are kept for 3 years after last interaction

5. Who We Share Data With

We do not sell your data. We share data only with:

• Supabase — secure database, authentication and data storage
• Anthropic — provider of the Claude AI model used for photograph analysis, under commercial terms that do not permit training on your data
• Replicate — runs the image-editing model for Style Advisor previews
• Stripe — payment processing. Card data is handled entirely by Stripe and never passes through our servers
• Resend — transactional email delivery (order confirmations, account emails)
• Partner clinics — when you send a clinic an enquiry, your name, contact details, message, what you most want to change and the treatments you’re interested in go to that clinic so they can reply. Messages between you and a partner, and any appointment they book, are stored on iammax so you can both see the conversation
• Twilio — sends clinics a text message alert about your enquiry
• Vercel — cloud hosting and serverless infrastructure
• Delivery partners — your name and delivery address are shared to fulfil and ship your orders
• Legal and regulatory authorities — where required by law

All third-party providers are bound by data processing agreements and are required to protect your data to the same standard we do.

6. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”)
• Restrict or object to how we process your data
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time where we rely on consent
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at privacy@iammax.co.uk. We will respond within 30 days.

7. Cookies

We use cookies to keep you signed in and to understand how our platform is used. See our Cookie Policy for full detail.

8. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email if you have an account with us. The date at the top of this page reflects the most recent revision.