Privacy Policy

1. Who we are and what this Policy covers

This Privacy Policy explains how Bien-Etre Diagnostics FZCO (trading as Bien Etre and/or SkinIQ), a company registered in IFZA, Dubai, United Arab Emirates, licence number 66538, with its registered office at DSO-IFZA, Dubai (“Bien Etre”, “SkinIQ”, “we”, “us”, “our”), collects, uses, stores, shares and protects personal data when you download and use the Bien Etre mobile application (the “App”), purchase products through the App, use the SkinIQ Coach, or interact with our website, customer support and communications (together, the “Services”).

We are the data controller of the personal data described in this Policy. Where we operate in the United Kingdom, our UK affiliate Bien-Etre Ltd (company number 14639762, registered office 123 Minories, London EC3N 1NT) acts as our UK representative and, for UK Members, as joint controller. Our Data Protection Officer can be reached at [email protected] or by post at the address above.

This Policy applies in addition to our Terms of Use. By creating an account or using the Services you acknowledge that you have read this Policy. Where we rely on your consent (for example, to process face images and skin readings, or to send data to the AI Coach), we will ask for it separately and clearly, and you may withdraw it at any time as described in Section 12.

2. Summary — the key points

• Face scans. When you take a scan, your photo is sent securely to our specialist skin-analysis provider, which analyses it and returns your skin readings (for example hydration, redness, pores and fine lines). These readings make up your SkinIQ Score. The photo is deleted as soon as the analysis is complete; we keep only the readings. We use your photo only to analyse your skin, and never for facial recognition or to identify who you are.
• Health data. Skin readings are health data. We process them only with your explicit consent, only to provide the Services to you, and never for advertising, credit, insurance or employment purposes. Health data is never sold.
• Where your data lives. Our app servers and database run on a major cloud-hosting provider. Face photos are analysed by our skin-analysis provider and deleted straight afterwards. If you turn on the AI Coach, your Coach messages and skin readings are processed by a third-party AI service. Each of these providers is bound by contract to protect your data to EU GDPR standards, and photos and skin readings are shared only with your explicit consent in the App (see Section 10).
• Who sees it. Trusted service providers who help us run the App — cloud hosting, a third-party skin-analysis provider, a third-party AI service for the Coach (only if you allow it), delivery partners, payment processors and customer-support tools — bound by contract. We share only what each partner needs.
• Your control. You can view, export, correct and delete your data, withdraw consent, and delete your account entirely from inside the App (Profile → Delete account).
• Age. The App is for adults aged 18 and over. We do not knowingly collect data from anyone under 18.

3. SkinIQ is a wellness service, not a medical service

The SkinIQ Score, the individual skin readings, the 30- and 90-day trait forecasts, the SkinIQ Coach and any product suggestions are generated for general wellness, self-awareness and cosmetic skincare purposes. They are not intended to diagnose, treat, cure, mitigate or prevent any disease or medical condition, and they do not create a doctor–patient relationship. If you are worried about your skin, the App will suggest you speak to a doctor or dermatologist; that suggestion is informational only. Never disregard professional medical advice, or delay seeking it, because of something you have seen in the App.

4. The personal data we collect

We collect personal data in the following categories. Items marked with † are sensitive / special-category data (health data or, in some laws, biometric data) and are collected only with your explicit consent.

5. How we use your data and our legal bases

We use personal data only for the purposes below. The “legal basis” column explains the lawful ground we rely on under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”), the UK GDPR / Data Protection Act 2018 and the EU GDPR (together, “GDPR”). Where a purpose involves sensitive data we rely on your explicit consent (PDPL Article 4(1); GDPR Article 9(2)(a)).

Where we rely on legitimate interests we have balanced those interests against your rights and freedoms; you may object to such processing at any time (Section 12). We will not use your data for a purpose incompatible with those described here without telling you first and, where required, obtaining your consent.

6. Face images and skin readings — how we handle them

• Purpose limitation. Your images are analysed solely to derive skin readings, skin type and tone, scores and forecasts, and to show you your progress over time. We do not use them to identify or verify who you are, to create facial-recognition templates, to infer emotion, age for legal purposes, ethnicity or any protected characteristic, or to match against third-party databases.
• How the analysis works. Your photo is analysed by a specialist third-party skin-analysis provider that acts as our data processor under a written data-processing agreement and is subject to the EU General Data Protection Regulation (GDPR). We decide what is collected and why; the provider uses your data only on our documented instructions and never for its own purposes. Your photo is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). The provider receives the photo and an internal account identifier only — never your name, email address or phone number.
• Retention. Our account with the provider is set to delete each photo immediately after it is analysed. Your scan photo is deleted from the provider’s systems as soon as the analysis is complete, normally within about a minute, and it is never stored on our own servers. We keep only the numeric readings and scores derived from it, which cannot be turned back into an image, for the life of your account, so that your history and forecasts work. They are deleted when you delete your account. The provider also keeps the readings it produced and basic technical details of each scan (such as the date and time), so we can show you your results. We can export or permanently delete this data at any time.
• Model improvement. Because scan photos are deleted straight after analysis, they are never used to train or evaluate any model. If you tick the separate “Improve the science” option, only de-identified readings — never images — may be used to improve our analysis. You can turn this off at any time.
• Accuracy limits. Readings depend on lighting, camera quality, make-up and skin tone. They are estimates, not clinical measurements. See the Terms of Use.

7. Apple Health, Health Connect and other health-platform data

The App does not currently connect to Apple Health (HealthKit), Android Health Connect or any wearable device, and does not read any data from them. If we add this in future, we will update this Policy and ask for your permission in the App before any such data is read.

8. Automated processing, AI and the SkinIQ Coach

Skin readings, scores and forecasts are generated automatically by our skin-analysis provider’s models (see Section 6). Product suggestions are generated by matching your readings and stated preferences to product attributes. The SkinIQ Coach is an AI assistant: its replies are written by an AI model that a third-party AI service runs for us. Before you use the Coach for the first time, the App shows you what is sent and to whom, and asks for your permission; you can withdraw it at any time in Profile → Privacy & consent, and the rest of the App keeps working without it. When you use the Coach we send the AI service your messages and the conversation so far, your SkinIQ scores and how they have changed, your skin type and tone, your skincare plan and retest dates, your age range, sex, language and account start date, and anything you have asked the Coach to remember. We never send your name, email address, phone number or photos. The AI service processes this data only to write the Coach’s replies, under data-processing terms that give protection equivalent to this Policy; it does not use it to train its models, and may keep it for a limited period to prevent abuse. None of these processes produces a decision that has a legal or similarly significant effect on you: they do not determine your access to the Services, pricing, insurance, employment or credit, and you always remain free to ignore a suggestion or to contest a reading by contacting support.

9. Who we share your data with

We do not sell personal data, and we never sell or rent health data. We share personal data only as follows:

Each service provider is bound by a written data-processing agreement requiring it to act only on our instructions, to protect the data to a standard equivalent to this Policy, to keep it confidential and secure, and to delete or return it when the engagement ends. A current list of our principal sub-processors is available on request.

10. Transfers of your data

We work with established international service providers (see Section 9). Our cloud-hosting provider, our skin-analysis provider and the AI service behind the Coach are all bound by contract to protect your data to the standard of the EU General Data Protection Regulation (GDPR), wherever they process it.

Your face photos go to our skin-analysis provider, and your skin readings go to the AI service, only with your explicit consent given in the App, which you can withdraw at any time (Section 12).

Any transfer of your personal data is made as Articles 22 and 23 of the UAE Personal Data Protection Law allow: to countries with an adequate level of data protection, under contracts that require the recipient to protect your data to the standard the law requires, or with your consent.

If you use the Services from the UK or the EEA, we protect transfers of your data with the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in our provider contracts, together with encryption. You can ask our DPO for a copy.

11. How long we keep your data

12. Your rights and choices

Subject to the conditions and exemptions in applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy, together with information about how it is processed (PDPL Art. 13; GDPR Art. 15).
• Portability — receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible (PDPL Art. 13; GDPR Art. 20). The App includes an “Export my data” function.
• Rectification of inaccurate or incomplete data (PDPL Art. 15; GDPR Art. 16).
• Erasure of your data (PDPL Art. 15; GDPR Art. 17), including by deleting your account in-App.
• Restriction of processing in the circumstances set out in law (PDPL Art. 16; GDPR Art. 18).
• Object to processing based on legitimate interests, and to direct marketing at any time (PDPL Art. 17; GDPR Art. 21).
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (PDPL Art. 6; GDPR Art. 7). Withdrawing consent to process face images or AI Coach data will mean the related features stop working.
• Not be subject to solely automated decisions producing legal or similarly significant effects, and to request human intervention (PDPL Art. 18; GDPR Art. 22).
• Complain to a supervisory authority: in the UAE, the UAE Data Office (and, for health data, the relevant health authority); in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the data protection authority of your country of residence. We would appreciate the chance to address your concern first.

To exercise any right, use the tools in the App (Profile → Privacy & consent), email [email protected], or write to our DPO. When you ask us to access, export or delete your data, we also carry out your request with our skin-analysis provider, which gives us the tools to export or permanently delete your data from its systems. We may need to verify your identity. We respond within one month (extendable by two further months for complex requests, in which case we will tell you), and we do not charge a fee unless a request is manifestly unfounded or excessive.

13. Deleting your account

You can delete your account at any time from within the App, without contacting support, in line with Apple and Google requirements. Open Profile (your picture at the top left of the Home screen) and tap Delete account; the same option is also under Profile → Privacy & consent → Your rights. You confirm by typing DELETE (حذف in Arabic). If you sign in with Apple, you are asked to confirm with Apple, and we then revoke the App’s access to your Apple ID. Deletion removes your profile, scans, readings, scores, coach history and preferences from our active systems within 30 days. We retain only what we are legally required to keep (for example invoices and order records), in restricted form, and anonymised data that can no longer be linked to you. Deleting the App from your device does not delete your account; deleting your account cancels any Bien-Etre membership immediately, so you are not charged again.

14. Children

The Services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18, and the App asks you to confirm your age at sign-up. If you believe a person under 18 has provided us with personal data, please contact us and we will delete it. In jurisdictions where the applicable age of digital consent differs, we apply the higher of 18 and that age.

15. Marketing, notifications and tracking

• Marketing. We send marketing emails or push notifications only with your consent (or, where permitted, to existing customers about similar products with an easy opt-out). You can opt out at any time via the unsubscribe link, in Settings → Notifications, or by contacting us. We never use your skin readings to target marketing unless you separately and explicitly opt in to personalised offers.
• Push notifications. Used for scan reminders, order updates and, with consent, offers. Control them in your device settings.
• App Tracking Transparency. We do not track you across other companies’ apps or websites for advertising, and we do not share data with advertising networks for cross-app tracking. If this changes, we will request your permission through Apple’s App Tracking Transparency prompt or the Android equivalent.
• Cookies and SDKs. The App uses a small number of third-party software development kits for crash reporting, analytics and customer support. Our website uses cookies as described in our Cookie Notice at https://bien-etre.ai

16. How we protect your data

We apply technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit (TLS 1.2 or higher) and at rest, segregation of health data from other data, role-based access controls and multi-factor authentication for staff, logging and monitoring, regular vulnerability testing, secure development practices, staff confidentiality obligations and training, and vendor due diligence. Our skin-analysis provider runs a formal information-security management system (covering information security, access management, incident management and business continuity), has its systems independently penetration-tested every year, and monitors them continuously for threats. Health data hosted in the UAE is held on infrastructure that meets the requirements of the relevant UAE health authority (including, where applicable, the ADHICS standard in Abu Dhabi and DHA information-security requirements in Dubai). No system is completely secure; if we become aware of a personal-data breach that is likely to result in a risk to you, we will notify the competent authority within the period required by law and inform you without undue delay where the risk is high.

17. Third-party services and links

The App is distributed through the Apple App Store and Google Play, and relies on services provided by Apple and Google (for example sign-in and push notifications). Those companies process data under their own privacy policies. The App may contain links to brand websites or educational content that we do not control; this Policy does not apply to them.

18. Region-specific information

18.1 United Kingdom and European Economic Area

For users in the UK, Bien-Etre Ltd is our UK establishment and representative. For users in the EEA, our representative under GDPR Article 27 is George Skinitis, 4th floor, Akti Miaouli & Skouze 1, Piraeus 185 35 Greece and may be contacted at [email protected]. The legal bases in Section 5, the rights in Section 12 and the transfer safeguards in Section 10 apply. The lead supervisory authority for our UK processing is the ICO.

18.2 California and other US states

If you are a resident of California or another US state with a comprehensive privacy law, you have the rights to know, access, correct, delete and obtain a portable copy of your personal information, to opt out of the sale or sharing of personal information and of targeted advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising your rights. We do not sell or share personal information for cross-context behavioural advertising, and we use sensitive personal information (including health and biometric-adjacent data) only for the purposes permitted by law to provide the Services you request. The categories of personal information we collect, our purposes and the categories of recipients are set out in Sections 4, 5 and 9. You may exercise your rights via the App or [email protected]; an authorised agent may act for you with written permission. We do not knowingly collect data of consumers under 16. Consumer Health Data (for the purposes of the Washington My Health My Data Act and similar laws) is collected and shared only as described in this Policy and with your consent.

18.3 Other countries

If you use the App from a country not listed above, we process your data as described in this Policy and, where local law gives you additional rights, we will honour them to the extent required.

19. Changes to this Policy

We may update this Policy from time to time. We will post the updated version in the App and on our website with a new effective date and, if the changes are material or affect how we use sensitive data, we will notify you in the App or by email and, where required, ask for your consent again before the change takes effect. Continued use after the effective date of a non-material change constitutes acceptance of the updated Policy.

20. Contact us

Bien-Etre Diagnostics FZCO (SkinIQ) — DSO-IFZA, Dubai, United Arab Emirates. Data Protection Officer: [email protected]. Customer support: [email protected]. UK affiliate: Bien-Etre Ltd, 123 Minories, London EC3N 1NT. Website: https://bien-etre.ai

Last updated: 23 September 2026.

SkinIQ is a skin-health and wellness service. It is not a medical device and does not provide medical diagnosis or advice.