Privacy Policy

Harley Doc ("we," "our," or "us") is committed to protecting and respecting your privacy. This Privacy Policy outlines how we collect, use, store, and protect your personal and facial data when you use our services.

By using our services, you agree to the collection and use of information as described in this policy.

This document informs you of our policies regarding the collection, use, and disclosure of personal information when you use our services. We will not use or share your information with anyone except as described in this Privacy Policy.

We use your personal information to provide and improve our services. By using our services, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, terms used have the same meanings as in our Terms and Conditions, accessible here.

1. Types of Data Collected

   • Face Data:

     1. This includes biometric data derived from facial recognition technology, such as facial geometry, features, and expressions. This is powered by Nuralogix's DeepAffex system.

     2. We primarily collect the following metrics from the biometric scan: heart rate, respiratory rate, blood pressure, irregular heartbeat, heartbeat variability, cardiac workload, vascular capacity, mental stress index, anxiety and depression scores, body mass index, waist-to-height ratio, body shape, facial skin age, cardiovascular disease (CVD) risk, stroke risk, heart rate risk, hypertension risk, hypercholesterolemia risk, hypertriglyceridemia risk, type 2 diabetes risk, fatty liver disease risk, HbA1c risk, and blood glucose.

     3. Facial blood flow data is extracted from a 30-second facial image scan and sent to the DeepAffex backend for processing. Facial image scans remain on the user device and are not stored in our system.

     4. Collected facial blood flow records are sent to DeepAffex systems for processing to provide wellness measurement results. Nuralogix handles customer data in compliance with applicable privacy regulations such as HIPAA.

   • Personal Information:

     • Name, contact information (e.g., email address, phone number), address, payment details, identification documents, and other contact details that may be collected in conjunction with face data.

   • Usage Data:

     • We may also collect data on how our services are accessed and used. This may include information such as your computer's IP address, browser type, browser version, the pages of our service that you visit, the time and date of your visit, the time spent on those pages, and other diagnostic data.

2. Collection Methods

   • Direct Interaction: We collect face data through cameras or devices when you use our services, particularly the transdermal optical imaging used in biometric testing.

   • Automated Technologies: We use cookies and similar technologies to collect data automatically as you interact with our services.

1. Purpose of Use

   • Service Provision: To provide and improve our services, including authentication and personalization.

   • Security: To enhance security measures and prevent fraudulent activities.

   • Analytics:

     1. To analyze usage patterns and improve our offerings.

     2. To notify you about changes to our services

     3. To allow you to participate in interactive features.

2. Legal Basis

   • Consent: We will obtain your explicit consent before collecting or using your face data.

   • Legitimate Interest: For purposes such as fraud prevention, provided it does not override your rights and freedoms.

1. Third-Party Service Providers

   1. We may share your face data with third-party service providers to perform services on our behalf, such as hosting, data analysis, and security services.

   2. This is currently arranged through Anura, a company under Nuralogix, which relies on Amazon Web Service (AWS) to host the service in the form of Infrastructure as a Service (IaaS).

   3. US data subject records are processed and stored within the US in line with data localization requirements. Service providers and their employees do not have access to customer data stored on the platform.

   4. Other service providers are:

      • Twilio Inc: Provides emailing services and processes Nuralogix customer data within the US.

      • Maxmind Inc: Provides IP geolocation services and processes US customer data within the US.

2. Legal Requirements

   • We may disclose your face data if required by law or in response to valid requests by public authorities.

We implement appropriate technical and organizational measures to protect your face data from unauthorized access, disclosure, alteration, or destruction.

• We will retain your face data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Facial image scans remain on the user device and are not stored in our system.

• Blood flow data is processed by the DeepAffex backend solely for the creation of your measurement result and is immediately deleted. Additionally, wellness measurement results are retained for as long as required to fulfill contractual obligations with customers.

We collect information that your browser sends whenever you visit our Service. This Log Data may include information such as your computer’s Internet Protocol (“IP”) address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, and other statistics.

You have the following rights regarding your face data:

• Access: Request access to your face data.

• Correction: Request correction of any inaccurate face data.

• Deletion: Request deletion of your face data.

• Objection: Object to the processing of your face data.

Cookies are files with small amounts of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a web site and stored on your computer’s hard drive. We use cookies to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

As aforementioned, we may employ third-party companies and individuals to facilitate our Service, to provide the Service on our behalf, to perform Service-related tasks or to assist us in analyzing how our Service is used. These third parties have access to your Personal Information only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

The security of your Personal Information is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

1. Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.

2. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third party sites or services.

Our Service does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from children under 18. If you are a parent or guardian and you are aware that yourchild has provided us with Personal Information, please contact us. If we discover that a child under 18 hasprovided us with Personal Information, we will delete such information from our servers immediately.

1. We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on our website.

2. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.