Consumer Health Data Privacy Policy
Effective date: 28 October 2026
Last updated: 29 October 2026
This policy applies to consumers who live in Washington or Nevada, and to consumer health data we collect in those states. It explains how Neurex Technologies, Inc. ("Neurex", "we", "us"), which makes Rhia Skin (the Rhia Skin Tracker device, the Rhia Skin app and rhiaskin.com), collects, uses, shares and protects consumer health data as defined in Washington's My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (Nevada Senate Bill 370). Our Privacy Policy covers our other practices.
We apply this policy to the information below whether or not a court would consider it health data, because it describes your skin.
1. Categories of consumer health data we collect
- Skin photos: close-up photos of your forehead and cheeks taken by Rhia Skin Tracker, including the raw files used for measuring. (The day-one face photo stays on your iPhone; we do not receive it.)
- Skin results: measurements derived from your close-ups, such as redness, tone and pores, and how they change over time, including measurements produced by our algorithms.
- Health answers, only if you choose to answer the optional health questions: diagnosed skin conditions (rosacea, eczema or atopic dermatitis, psoriasis), and whether pregnancy or breastfeeding, hormonal changes, menopause or perimenopause, or an autoimmune condition affects your skin.
- Skin type, sensitivity and ingredient reactions: including ingredients you tell us have caused a reaction, so we can leave them out of your suggestions.
- Skin diary: whether you used a product last night, how your skin felt, and the routine steps you ticked.
- Product tests: products you test and how your skin looked during the test.
- Inferences: product suggestions we make from the information above.
We do not collect face photos or biometric data, and we do not create face maps, face templates or other biometric identifiers.
2. Purposes for which we collect and use it
- To provide the Rhia Skin services you request: show your results and how your skin looks over time.
- To compare new scans with your earlier ones, and re-measure earlier scans when our analysis improves so they stay comparable.
- To suggest products and routines that suit you, and to leave out products that may not.
- To run product tests you start.
- To keep the services secure and working, and to comply with law.
- Only with your separate consent: to improve Rhia Skin's analysis and build new skin measurements, using de-identified copies of your close-ups with your skin type, age range and sensitivity, kept for up to 3 years.
We do not use consumer health data for advertising.
3. Sources
- You: your answers, diary, routine and the photos you take.
- Rhia Skin Tracker: the photos and camera details of each scan.
- Our analysis: the results and suggestions we derive from the above.
4. Consent
- To collect: we collect the consumer health data that is necessary to provide the services you request (your photos, results, skin type, sensitivity, ingredient reactions and diary) when you create an account and use them. We ask for your consent before collecting the optional health answers, on a separate screen where you choose to answer them or skip them.
- To use your close-ups to improve our analysis: only with your separate consent, given by switching it on. It starts off.
- To include you in a research study: only with your separate consent for that study.
- To share: we do not share consumer health data with third parties except our processors (section 5). If that ever changes, we will ask for your separate consent first.
- To sell: we do not sell consumer health data. We would not do so without the signed authorization the law requires.
You can withdraw consent at any time in Settings, Your data in the Rhia Skin app, or by emailing contact@rhiaskin.com. We will then stop the processing that relied on it. Because the services cannot work without your skin photos, withdrawing consent to their collection means closing your account.
We will ask for your consent before collecting new categories of consumer health data or using it for a new purpose.
5. Categories of recipients
We disclose consumer health data only to processors that handle it on our behalf, under written contracts that limit their use to the services they provide to us:
| Processor | What they do | Consumer health data they receive |
|---|---|---|
| Supabase | Accounts, database and photo storage | Photos, results, answers, diary |
| Railway | Our analysis server | Photos and results, under a random identifier |
| Dermatologists and image labellers we engage, under confidentiality and data-use agreements | Labelling close-ups | De-identified close-ups only, and only if you switched on improving our analysis |
We have no affiliates that receive consumer health data. We may also disclose consumer health data where required by law, for example in response to a valid court order.
6. Your rights
You have the right to:
- Confirm and access: confirm whether we collect, share or sell your consumer health data, get a copy, and receive a list of all third parties and affiliates with which we have shared or sold it, with their contact information.
- Withdraw consent to our collection and sharing (section 4).
- Delete: have us delete your consumer health data. You can delete your account in the app (Settings, Account, Delete account) or email us. We delete it from our active systems, and from archives and backups, and we notify every processor in section 5 to delete it as well.
How to make a request: email contact@rhiaskin.com from your account email, or use the app. We will verify your request. We respond within 45 days, and may extend this once by 45 days where reasonably necessary; we will tell you if we do and why. Requests are free up to twice a year.
Appeals: if we decline your request, reply with "appeal" within a reasonable time. We will respond in writing within 45 days, explaining our decision. If your appeal is denied, you may contact:
- Washington State Attorney General: https://www.atg.wa.gov/file-complaint
- Nevada Attorney General: https://ag.nv.gov
7. Access within our company
Only personnel who need consumer health data to provide the services you requested, or to perform a purpose you consented to, may access it, and they are bound by confidentiality obligations.
8. Location and geofencing
We do not use geofences around healthcare facilities, and we do not use location to collect or infer health data. The app's approximate location is used only to show the UV index and is not stored.
9. Changes
We will update this policy before we collect new categories of consumer health data or use it for new purposes, and ask for your consent where required.
10. Contact
contact@rhiaskin.com
Neurex Technologies, Inc., 2261 Market Street STE 60587, San Francisco, CA 94114, USA