Privacy

What we collect

The photos you upload, the answers you give during the analysis, the email address and phone number you enter, and basic usage events such as which pages you opened.

Why we collect it

To produce your AI estimate, to show you the clinic packages that fit it, and — only if you asked us to — to contact you about a consultation.

Consent

The analysis does not start until you tick both boxes: one for analysing your photos, one for being contacted. They are separate on purpose, and you can withdraw either at any time.

In the request form, what you type is kept only in your own browser until you send it. If you also tick “If I don't finish, GraftAi may contact me”, we store your name, email, phone and the package you looked at so we can follow up; unticking it deletes that record at once, and the team deletes it after getting in touch or within 30 days.

If you book a call, we keep your name, contact and the chosen time to hold that call. In your account, under Profile, you can download everything we keep about you as one file and delete your account yourself: photos, analyses, check-ins, health questionnaire answers, reviews and your messages are deleted; requests and payments stay without your name, email, phone or notes, as records of deals with clinics.

When your treatment is being arranged, we share with the chosen clinic what it needs for the procedure: your name, age, gender, dates, flight, package, questionnaire answers, the AI estimate and your photos — through a link that expires. Your health questionnaire is included only if you ticked the separate box allowing it. We do not give the clinic your email or phone number.

If you leave your email on the waitlist (“tell me when a package appears”), we store that email with the city, technique and graft range you chose, and write to you only when a matching package appears. Every such email has a one-click unsubscribe link, which deletes the wish from the list.

After the analysis you can separately tick “Send me five short emails”. That is a series of plain explanations — what a graft is, how to take photos, recovery, questions to ask a clinic, what happens after a request — one email every few days. Unsubscribing in any of them stops the series at once.

From your account you can create a read-only link to your trip plan for someone travelling with you. It shows dates, the city, what the package includes and your flight — no health data, no contacts — and it expires; you can revoke it at any time.

Photos of your scalp are health data

A scalp photo says something about your health, so we treat it as a special category of personal data. It is used only for the analysis you asked for. It is not sold, not used for advertising, and not shared with a clinic unless you choose to send an enquiry.

Health questionnaire

After a request, and at any time in your account, you can fill in an optional health questionnaire: blood-thinning and other regular medication, chronic conditions (diabetes, heart, blood pressure, skin conditions of the scalp, bleeding disorders), allergies including to local anaesthetics, smoking, a previous hair transplant, and anything else you want the clinic to know. This is health data, a special category of personal data. We store it only on the basis of your explicit consent (GDPR Article 9(2)(a)), given by ticking a separate box that is never ticked in advance; without that tick nothing is saved. We record which version of the consent text you agreed to and when.

The answers are used only to prepare your treatment. The GraftAi team can read them in order to arrange it. The clinic sees them only if you also tick the second box, “share these answers with the clinic”, and then only as part of the patient card sent through a link that expires. They are never sent to our team chat notifications, never used for advertising and never sent to the AI models.

The answers help the clinic prepare; whether the procedure is suitable for you is decided by the surgeon, and nothing in the questionnaire is a diagnosis. You can change the answers, untick sharing, or delete them at any time in your account — deleting withdraws the consent. They are included in your data download and deleted together with your account.

Where it is processed

The site runs on Cloudflare. Your account, answers and photos are stored using Supabase. Both are processors acting on our instructions.

To produce the estimate and the preview, your photos are sent through the Lovable AI gateway to Google's Gemini models. Photos sent to the free simulator are not stored by us: the preview comes back to your browser and nothing is kept.

Sharing a preview builds the before-and-after card on your device and hands it to your phone's share menu or saves it as a file. Nothing is uploaded to us.

Questions you type into the GraftAi assistant are sent the same way, to Google's Gemini models through the Lovable AI gateway, so they can be answered. We do not store the conversation; it stays in your browser tab until you close it. Please do not type your name, phone or other personal details into the assistant.

Emails about your request — that we received it, that your date is confirmed, and messages from our team — are sent through the email service Resend, which receives your email address for that purpose.

The interactive map on the clinics page loads map tiles from CARTO, so CARTO receives your IP address when you open that page. The dot map on the home page is drawn on your device and contacts no one.

Abuse protection and cookies

To stop the free simulator being misused, we store a salted hash of your IP address (for IPv6, of your network) with a count of previews. The address itself is never stored, and these records are deleted after two days.

If you choose a language, a cookie named lang remembers it so pages open in that language. It is not used for tracking. We use no advertising or analytics cookies.

If the site breaks in your browser, it sends us a short error report: the error text, the page address without its query, and the browser name. It contains no account, email, IP address or photo, and we use it only to fix the error.

How long we keep it

Until you ask us to delete it. You can request deletion at any time on the data deletion page, and we act on the request within 30 days.

Your rights

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, and withdraw consent. The fastest route for all of these is the data deletion page.

Contact

Questions about this page go to the address in the footer.