Privacy Policy

Yvelune is a facial exercise platform that uses your device's camera to guide you through facial exercises. You can use Yvelune in two ways: through a clinic that has prescribed it (your provider monitors your progress), or as an individual subscriber who signs up and pays directly, with or without a clinic connection.

Yvelune is a wellness support tool for informational purposes only. It is not a medical device and does not provide medical advice, diagnosis, or treatment.

During exercise sessions, Yvelune accesses your device's front-facing camera to detect facial landmarks (468 numerical coordinate points) and hand positions. This is how we provide real-time guidance.

Critical privacy facts:

• Your camera feed is processed entirely on your device. No video or images are transmitted, stored, or recorded.
• We use Google MediaPipe, an open-source AI library that runs locally in your browser. It converts your camera feed into numerical coordinates only — not photographs.
• No facial images ever leave your device. Not to us, not to any third party, not to any cloud service.
• When you close the session or navigate away, camera access stops immediately.

We store the following in our secure database (hosted by Supabase, a SOC 2 compliant provider):

• Account information: Your email address, name (provided by your clinic), and encrypted password.
• Session data: When you completed an exercise session, how many reps, your form score (a number, not an image), and duration.
• Scan assessment: The result of your scan — which facial zones were flagged, the exercise tier assigned, and the exercises recommended. Your camera feed is converted to numerical landmark points on your device during the scan; those raw points are discarded when the scan ends. We store only the resulting assessment, never a photograph or the raw coordinates.
• Treatment intake: Information you provide about recent aesthetic treatments (Botox, filler, etc.) so exercises can be adjusted for safety.
• Billing information: If you subscribe as an individual, our payment processor (Stripe) handles your payment. We store only a customer/subscription reference and your plan status — we never see or store your full card number.
• Notification preferences: Whether you've opted into exercise reminders.

We do NOT store:

• Photographs or video of your face
• Camera recordings of any kind
• Raw facial landmark coordinates (discarded on-device after each scan)
• Biometric identifiers — we do not create a faceprint and cannot identify you from a scan assessment
• Your full payment card number

• You can see your own session history, scan results, and protocol.
• Your clinic — only if you are connected to one — can see your session compliance (did you do your exercises), scan results, and exercise data, so your provider can monitor your progress. If you subscribe as an individual with no clinic connection, no clinic can see your data.
• Yvelune staff may access data for technical support purposes only.
• No one else. Your data is never sold, shared with advertisers, or used to train AI models.

Each clinic's data is completely isolated. Clinic A cannot see Clinic B's patients, and vice versa. This is enforced at the database level using Row-Level Security (RLS) policies.

Your data is retained as long as your account is active. If you or your clinic requests deletion, we will remove your data within 30 days. Contact your clinic or email us at privacy@yvelune.com.

Individual subscriptions are processed by Stripe, a PCI-compliant payment provider. When you subscribe, your card details go directly to Stripe — they never pass through or rest on Yvelune's servers. We retain only a subscription reference and your plan status (active, canceled, etc.) so we know whether your account is current. You can manage or cancel your subscription at any time through the billing portal in your account.

Yvelune uses essential cookies for authentication (keeping you logged in). We do not use advertising pixels or sell data to advertisers.

We use privacy-respecting product analytics to understand which features are used and to improve the app (for example, how many people complete a scan or start an exercise). This is strictly limited:

• We never send your scan results, facial geometry, camera data, treatment intake, or any health information to analytics.
• Analytics is not used to build advertising profiles and is never shared with advertisers.
• On pages where clinical or health information is shown, behavioral analytics and session capture are disabled.

Yvelune is not intended for use by anyone under 18 years of age.

If we make material changes to this privacy policy, we will notify affected users via email or in-app notification.

For privacy questions or data deletion requests:
Email: privacy@yvelune.com