Privacy Policy — GraftView
Effective
Who we are
GraftView is operated by Yosef Chaim Kaminsky, an individual, at Rabbi Yehuda HaNasi St 3, Petah Tikva, Israel. For anything in this policy, including a request about your own data, write to support@graftview.com.
That person is the data controller for everything described below. A clinic you choose to share with is a
separate controller for what it does with what you gave it (ADR-0156), and this policy does not cover a
clinic's own handling.
What GraftView is, in one paragraph
It photographs the same areas of your scalp under repeatable conditions, stores those photographs against your account, and scores how usable each photograph is and how comparable any two of them are. It is not a medical device. It does not diagnose, does not treat, does not recommend or adjust treatment, and produces no follicle count, density figure or staging.
The legal basis for holding your photographs
Your explicit consent (ADR-0157). Scalp photographs of an identifiable person are sensitive, and we
treat them as such. You can withdraw that consent at any time, and withdrawal is as easy as giving it: it
stops the processing it covered, and it is not the same act as closing your account.
Where consent is not the right basis — keeping a record that a clinic once had access, so that you can later find out who did — the basis is our legitimate interest in an audit trail you can rely on, and the record holds no photographs.
What we hold
| What | Why it exists |
|---|---|
| Scalp photographs and their thumbnails | The product is the durable history |
| Capture conditions, quality scores, calibration | Comparability depends on the conditions of the shot |
| Comparison results | A past verdict has to stay checkable against the two photographs that produced it |
| Your email address and sign-in identity | So the history survives a new phone |
| Profile name, procedure dates, your own notes | Context you entered for your own timeline |
| A private treatment diary, if you keep one | Yours alone — no clinic and no AI provider receives it |
| Sex and date of birth, if you give them | The two things a clinician asks first and cannot read off a photograph |
| Why the automatic shutter declined, and how your head was angled at that moment | A shutter that refuses silently cannot otherwise be explained |
Sex and date of birth are optional, may be withdrawn after being given, and "prefer not to say" is stored as that answer rather than as a blank. Nothing computes your age, sorts or filters by it, and no scoring or comparison reads either field.
About the last row, because it is derived from what is in a photograph. A face detector runs live on the camera preview and records, for the moment you pressed the shutter, three head angles and one rectangle saying where a face was. It says nothing about hair, scalp, coverage or density. No facial landmarks, no contours, no face template or embedding, and no expression classification are computed or stored. Nothing here is a biometric identifier, and nothing is used to recognise you.
What we never do
- No advertising, no analytics on your behaviour, no third-party trackers, no data sold or rented — ever.
- No analysis of photograph content for any purpose other than the comparison you explicitly ask for.
- No profiling, no automated decision producing legal or similarly significant effects about you.
- Nothing is inferred about your health, and no claim is made about a biological change.
Where your data is held
On servers we rent from Contabo GmbH and operate ourselves, in Germany. We do not use a third-party managed database service, so nobody but us administers the database holding your photographs. Because the servers are in the European Union, your data does not leave the EU merely by being stored. Data is encrypted in transit. Access is enforced by the database itself, keyed to your account, rather than by application code alone.
Backups are encrypted and copied to a separate location so a failed machine does not lose your history.
Who else can see it
A clinic, only if you grant it. A grant is per clinic and per profile, given by you and revocable by you. The screen where you give it lists exactly what it covers, and that list is the consent. Revocation stops further access from that moment; it cannot retrieve what was already seen, and the record that access existed is kept so you can always find out who had it.
Our AI provider, only when you ask for a comparison, and per comparison. Before any network call, the consent screen names the two photographs that will be sent. Only those two images and the capture conditions go; your name, your notes, other photographs, your email, device identifiers and location do not. Our server holds the images in memory and keeps no copy. The provider, Anthropic, states that it deletes inputs and outputs from its backend within 30 days. Inside that window there is a copy neither we nor you can reach. We do not claim your photographs are never used to train a model: the provider's documentation answers that only by not saying so, and we would rather tell you that than round it up.
Our own operator. A platform operator — today, the person named at the top of this policy — can read
patient records in order to support and repair the service (ADR-0079). This is disclosed rather than
hidden, it is revocable, and each retrieval of a photograph by a clinic writes an audit event before the
bytes are returned.
Nobody else. There is no other recipient.
International transfer
The service is offered worldwide, so a clinic you grant access to may be in another country, and our AI provider processes data outside Israel. Granting a clinic in another jurisdiction is a transfer, and it happens only because you chose it and only for as long as your grant stands.
How long we keep it
- Your photographs and record: for as long as your account is open.
- Closing your account hides your record from everyone else immediately and starts a 30-day window in which you can come back. After it, the record is erased.
- A revoked clinic grant is kept indefinitely, without any photograph, so that "who had access, and when did it end" always has an answer.
- Backups are kept to the schedule in our operations policy; erasure propagates to them on their own cycle rather than instantly.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or export it in a portable form — the app produces a full archive of your photographs and their record. You can withdraw any consent you gave. You can complain to your local data protection authority.
Write to support@graftview.com. We answer within one month.
Children
GraftView is for adults. It is not intended for anyone under 18, we do not knowingly hold their data, and if we learn that we do, we delete it. This is stricter than the law requires in most countries, and it is deliberate: it removes any question of who may consent on a child's behalf.
Security, honestly stated
Access control is enforced in the database, tested per table and per storage bucket, and treated as absent until it is tested. Photographs on your phone are protected by your device's own lock and, at present, by nothing else the app adds: anyone holding your unlocked phone can open the app and see them.
Changes
If this policy changes in a way that affects what happens to your photographs, you will be told in the app before the change takes effect, not merely by a new date at the top of this page.