Privacy Policy

1. Introduction

IridologyHealth ("we", "our", or "us") is committed to protecting your privacy and personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our iris analysis service.

2. Data Controller

The data controller responsible for your personal data is:

• Company: IridologyHealth
• Email: [email protected]

3. Personal Data We Collect

We collect and process the following categories of personal data:

a) Information You Provide:

• Contact Information: Email address when you create an account or make a purchase
• Payment Information: Payment details processed securely through Stripe (we do not store full payment card details)
• Iris Images: Photographs of your iris that you upload for analysis

b) Information Automatically Collected:

• Usage Data: Information about how you use our service, including access times and pages viewed
• Technical Data: IP address, browser type, device information, and cookies
• Session Data: Temporary session identifiers to maintain your login state

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract Performance: To provide the iris analysis service you requested
• Legitimate Interests: To improve our service, prevent fraud, and ensure security
• Consent: For marketing communications (where applicable)
• Legal Obligation: To comply with financial and tax regulations

5. How We Use Your Data

We use your personal data for the following purposes:

• To perform iris analysis and generate health insights
• To process payments and maintain transaction records
• To send you analysis results via email
• To provide customer support and respond to inquiries
• To improve our AI analysis algorithms and service quality
• To detect and prevent fraud or security issues
• To comply with legal obligations

6. Data Sharing and Third Parties

We may share your personal data with the following third parties:

• Payment Processor: Stripe (for secure payment processing)
• Cloud Storage: Cloudinary (for secure image storage and processing)
• Email Service: ZeptoMail (for sending analysis reports)
• AI Provider: OpenAI (for iris analysis - images only, not personal identifiers)

We ensure all third-party processors comply with UK GDPR requirements through appropriate data processing agreements.

7. International Data Transfers

Some of our service providers are located outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office
• Adequacy decisions for countries with equivalent data protection standards

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security assessments and updates
• Staff training on data protection
• Secure backup and disaster recovery procedures

9. Data Retention

We retain your personal data only as long as necessary:

• Iris Images and Analysis: Retained for a reasonable duration to allow for analysis and to provide you the ability to review results.
• Transaction Records: Retained to comply with tax and accounting regulations

10. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Request that we limit how we use your data
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing communications

To exercise any of these rights, please contact us at [email protected]. We will respond within one month.

11. Cookies and Tracking

We use essential cookies to:

• Maintain your login session
• Remember your preferences
• Track daily scan limits for free users

We also use Google AdSense, which may place advertising cookies. You can manage cookie preferences through your browser settings.

12. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on this page
• Updating the "Last updated" date
• Sending an email notification for material changes

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

• Email: [email protected]