Privacy Policy

Applies to: The Norwood mobile application (the “App”).

Momentum Aksiyon Teknoloji Ltd. Şti. (“Norwood,” “we,” “us,” “our”), operating the App under the Norwood brand, is responsible for your information. This Privacy Policy explains what we collect, how we use it, who we share it with, and your choices. By creating an account or using the App, you acknowledge this Policy.

1. Who the App Is For (18+)

The App is intended for users 18 years of age or older. During onboarding we ask your age. If you indicate you are under 18, you are not the intended user, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact support@aestheticmatch.com and we will delete it.

2. Information We Collect

Account & profile information

• Name and email address (received from your sign-in method, e.g. Sign in with Apple or Google).
• Age (for the age gate and personalization).
• Optional self-provided details such as background/ethnicity (used only to calibrate hairline and density norms), family history, current treatments, and goals you select.

Scan photos and derived hair data (see Section 3 for detail)

• The photos you capture during your baseline scan and check-ins — four angles of your scalp and hairline (front, crown, and both temples). These photos may include part of your face.
• Scores and sub-metric values our system derives from those photos — for example, your Norwood stage, per-zone density (hairline, temples, mid-scalp, crown), hairline contour and maturity, temple recession, and an overall score — along with your proposed protocol.

Protocol and coaching content

• The treatments, routine steps, dose logs, and entries you add.
• Messages you send to, and receive from, the in-app AI coach (“Sam”), and your check-in and progress history.

Subscription and transaction information

• Your subscription status, plan, trial status, and renewal/cancellation events. Payments are processed by Apple (In-App Purchase) and/or Stripe, and we receive confirmation of your subscription and payment status. We do not receive or store your full payment card number.

Usage, device, and analytics data

• App interactions and events (for example, screens viewed, scans captured, doses logged, check-ins completed), device and app version information, and similar diagnostic data.

Notifications

• If you grant permission, a push notification token and your notification preferences.

3. Scan Photos & Biometric-Type Data (Please Read)

The App's core feature requires you to take photos of your scalp and hairline, which may include your face. We want to be clear about how this works:

• On-device face detection (never stored): during capture, Apple’s on-device Vision framework detects the position of your face solely to check framing, distance, and lighting before a photo is taken. This processing happens entirely on your device — no face-detection data is stored or transmitted, and the App does not perform facial recognition or create faceprints or any other biometric template.
• What we capture: the photos you take during each scan, the underlying model output used to generate your scores, and the numeric sub-metric scores and protocol derived from them.
• How your photos are handled: your photos are encrypted at rest, are used only to generate your own scores, coach guidance, and progress timeline, and are never used to train models, never sold, and never used for advertising.
• Who processes them & their data practices: to generate your scores and coach guidance, your photos and related inputs are sent to OpenAI (OpenAI, L.L.C.), our third-party AI provider acting as our service provider under contract, solely to compute your results. Per OpenAI's API terms, data sent through their API is not used to train their models and is retained by OpenAI only transiently for abuse monitoring (up to 30 days) and then deleted. We retain the raw model output ourselves so we can re-score your history if we update our models.
• Your consent: we ask for your permission in the App, with this disclosure, before any photo is captured or sent to our AI provider.
• How long we keep scan data: we retain your photos only while your account is active, so you can see your progress over time — we do not retain scan data indefinitely. It is deleted when you delete it or your account (see Section 8).
• Your control: you can permanently delete your scans and photos at any time by deleting your account in the App (Settings → Privacy & data → Delete everything), which performs a hard deletion of your photos, scan results, and account data (see Section 8).

Depending on where you live (for example, Illinois, Texas, or Washington), data derived from photographs of identifiable individuals may be treated as biometric information with additional consent and retention requirements. Where such laws apply, we rely on the explicit consent you give in the App before any photo is captured, retain this data only as described in this Policy, and honor the deletion rights described in Section 8.

4. How We Use Your Information

We use the information above to:

• Generate your Norwood stage, density breakdown, hairline analysis, and overall score.
• Build and track your protocol, generate your progress deltas, and power the AI coach.
• Personalize guidance, reminders, and check-in cadence.
• Manage your subscription, trials, and access level.
• Send notifications you've enabled.
• Measure, debug, secure, and improve the App.
• Provide support and comply with legal obligations.

5. Automated Processing & AI

The App relies on AI to function. A vision model analyzes your scan photos to produce scores, and a large language model generates your coach responses using your scores, adherence, protocol, and chat history. The coach (“Sam”) is an AI feature for hair-care education and guidance. It is not a medical provider and does not diagnose, prescribe, or treat. Any medication is prescribed only by a licensed provider through telehealth or in person — not by the App. See the App's Terms of Use and the Medical Disclaimer in Section 3 of those Terms.

6. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Service providers. We share information with providers who process it on our behalf, under contract and only to provide their services to us, including: OpenAI (AI analysis of your scan photos and coach responses), Apple and Stripe (subscription payments), RevenueCat and Superwall (subscription management and paywall), and our hosting, infrastructure, and analytics providers. See Section 3 for how OpenAI handles your photos.

We may disclose information if required by law, to enforce our Terms, to prevent fraud or abuse, or to protect the rights and safety of our users or others. If we are involved in a merger or acquisition, information may transfer as part of that transaction, subject to this Policy.

7. Data Security

We use industry-standard encryption (in transit and at rest for photos) and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Data Retention & Deletion

We keep your information for as long as your account is active or as needed to provide the App. You can:

• Permanently delete your scans, photos, and account data by deleting your account in the App (hard delete).
• Delete your account, after which we delete or de-identify your associated personal information within 30 days, except where we must retain limited records for legal, security, or financial compliance.

Lapsed subscribers retain a read-only progress history until they delete it or their account.

9. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to opt out of certain processing, and to not be discriminated against for exercising these rights. California (CCPA/CPRA) residents have rights regarding “sensitive personal information,” which may include data derived from facial images. EU/UK (GDPR/UK GDPR) residents have rights regarding “special category” data and may withdraw consent at any time. Illinois/Texas/Washington residents may have specific biometric rights.

To exercise any right, email support@aestheticmatch.com. We will verify and respond as required by applicable law.

10. International Users & Transfers

The App is operated from Türkiye. If you use it from outside Türkiye, your information will be processed in Türkiye and other countries, which may have different data-protection laws. Our service providers process data primarily in the United States. If you use the App from outside the United States, you understand that your information is transferred to and processed in the United States, and where required by law we rely on appropriate safeguards for such transfers.

11. Changes to This Policy

We may update this Policy from time to time. We will post the revised version in the App and on our site and update the Effective Date. Material changes affecting scan data will be communicated in-app.

12. Contact

Email: support@aestheticmatch.com

Momentum Aksiyon Teknoloji Ltd. Şti.

Arifipaşa Sk. 22/3, Bebek, 34342 Beşiktaş / İstanbul, Türkiye