Consumer Health Data Privacy Policy

Last updated: July 23, 2026

This Consumer Health Data Privacy Policy explains how Luni LLC ("we", "our", or "us") collects, uses, and shares consumer health data through the Cadence skincare app. It supplements our general Privacy Policy and is provided to comply with the Washington My Health My Data Act (MHMDA), Nevada SB 370, the Connecticut Data Privacy Act, and similar laws. Where those laws apply, this policy governs consumer health data specifically; our general Privacy Policy governs all other personal information.

What We Mean by "Consumer Health Data"

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. In Cadence, this can include the following, when you choose to provide it:

• Skin type, skin tone, and sensitivity level
• Skin concerns and conditions you disclose (for example, acne, rosacea, hyperpigmentation)
• Your use of topical prescription treatments, including tretinoin — strength, start date, application frequency, and the reaction/irritation levels you log
• Skincare goals and routine preferences derived from the above
• Photos of products you scan with your camera (which may incidentally capture skin)

Your progress selfies and the notes attached to them are stored only on your device. They are never uploaded to our servers, are not included in any account backup, and are not shared with any third party.

Categories of Consumer Health Data We Collect

• Skin profile data — skin type, tone, sensitivity, concerns, conditions, and goals.
• Prescription tracking data — tretinoin strength, schedule, and logged reactions (collected only if you opt into the tretinoin tracker).
• Product and routine data — the products on your shelf, your generated routine, and your completion history, to the extent it reveals health status.
• Scan images — photos captured with the in-app scanner.

How We Collect It (Categories of Sources)

• Directly from you — through the onboarding quiz, your profile, the products you add, the tretinoin tracker, and messages you send to the in-app assistant.
• Automatically from your use of the app — routine completions and other in-app activity that relates to your skin.
• From your device camera — only when you actively use the scan feature.

How We Use Consumer Health Data (Purpose)

• To generate and adjust your personalized skincare routine
• To power the in-app assistant when you ask it questions
• To identify products you scan with your camera
• To provide the tretinoin tracker and its adherence reminders
• To operate, secure, and support your account

We do not use consumer health data for advertising, cross-context behavioral advertising, or profiling for marketing, and we do not use it to train third-party AI models. See "Sharing" below.

Consent

We collect consumer health data only after you affirmatively provide it or opt into the relevant feature, and only for the purposes described above. Features that process consumer health data — the personalized routine, the in-app assistant, product scanning, and the tretinoin tracker — ask for your consent before they collect or process that data. You can withdraw consent at any time by turning off the relevant feature or by deleting your account (see "Your Rights"). Withdrawing consent does not affect processing that already took place.

How We Share Consumer Health Data

We do not sell your consumer health data, and we do not share it for anyone's advertising or marketing. We share it only with service providers (processors) who act on our instructions to operate Cadence, and only as needed to deliver the feature you are using:

• Supabase (cloud database, authentication, and file storage, hosted on AWS in the United States) — stores your account and app data on our behalf.
• OpenAI (routine generation, in-app assistant, and product scanning) — receives the skin profile, shelf, assistant messages, or scan images needed to return a result. OpenAI processes this data as our service provider to return that result and does not retain it to train or improve its models. We do not send your name, email, or other direct identifiers to OpenAI.

We do not sell consumer health data, and we will not sell it in the future without first obtaining your valid written authorization as required by law. We do not use geofences around any health-care facility.

We may disclose consumer health data if required by law, to respond to lawful requests, or to protect the rights, safety, and security of our users and our service.

Your Rights

Depending on where you live, you have the right to:

• Confirm and access the consumer health data we have collected about you, and the categories of third parties with whom we have shared it.
• Withdraw consent to the collection and sharing of your consumer health data.
• Delete your consumer health data, including copies held by our service providers.
• Appeal a decision we make about a request (see below).
• Not be discriminated against for exercising any of these rights.

You can exercise most of these rights directly in the app:

• Access / export: Edit profile → Export my data
• Delete: Edit profile → Delete account (this permanently removes your consumer health data from our active systems within 30 days, and instructs our service providers to delete their copies)
• Withdraw consent: turn off the relevant feature in the app, or delete your account

You may also submit a request, or authorize an agent to submit one on your behalf, by emailing hello@luniskin.com with the subject line "Consumer Health Data Request." We will verify your request against the account information we hold before acting on it, and we will respond within the timeframe required by applicable law.

How to Appeal

If we decline your request, we will tell you why. You may appeal by replying to our decision or by emailing hello@luniskin.com with the subject line "Consumer Health Data Appeal." We will respond to your appeal within the timeframe required by applicable law. If we deny your appeal, Washington residents may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.

Changes to This Policy

We may update this policy. Material changes will be posted here with an updated date, and where required by law we will obtain your consent before collecting or sharing consumer health data for a new purpose.

Contact Us

For questions about this policy or your consumer health data: hello@luniskin.com