1. Product status
Phimetra is an informational decision-support tool for aesthetics. It is not a medical device within the meaning of Regulation (EU) 2017/745 (MDR). The results provided are indicative algorithmic estimates and never replace the advice of a qualified practitioner.
The system makes no medical diagnosis, prescription or therapeutic recommendation. Biometric scores (facial symmetry, golden triangle, youth vectors) are statistical measurements, not medical assessments.
2. GDPR · Biometric data (Article 9)
Morphological analysis involves processing data that may be classified as biometric within the meaning of Article 9 GDPR. This processing relies on the user's explicit consent, collected before each analysis via a dedicated consent form.
- Photos kept for up to 30 days on our servers in France, restricted access, then automatically deleted.
- Analysis results are kept for a maximum of 12 months, then automatically deleted.
3. GDPR · Data protection principles (Article 35)
Phimetra applies the data-protection principles set out in the GDPR for image processing: data minimisation, encryption in transit and at rest, limited retention period (30 days) and automatic deletion.
- The necessity and proportionality of biometric processing
- Risks to the rights and freedoms of data subjects
- Technical and organisational security measures in place
- Automated data-deletion mechanisms
4. EU Artificial Intelligence Regulation (AI Act)
Phimetra is self-classified as a limited-risk AI system within the meaning of Regulation (EU) 2024/1689. In accordance with Article 50 (transparency obligations), we inform users that:
- Results are generated by artificial intelligence
- The system makes no autonomous decision affecting users' rights
- A clear notice is displayed before and after each analysis
- The system is not a medical device and is not intended for diagnostic use
5. Data location and security
- Hosting: OVHcloud, server located in Strasbourg (France)
- Photos: automatically deleted no later than 30 days after capture
- Analysis results: kept for a maximum of 12 months
- Encryption: TLS (HTTPS) in transit; at rest, LUKS2 encrypted volume (AES-256-XTS) whose key is not stored on the server
- The application and database are hosted at OVHcloud in Strasbourg (France). Photo analysis is performed by Scaleway in Paris. For a signed-in account, the visual simulation is produced by fal.ai (United States), unless the practitioner checks Medical privacy: the photo then stays in the European Union, that choice is recorded, and it is not sent to fal.ai. With a paid subscription in force, Germany is used if that engine answers; otherwise the calculation stays in France. Without that subscription, the calculation stays in France. The public path without an account is computed on the server in France. The link sent to the patient stays in the European Union, unless the clinic has allowed processing outside the EU and the patient has consented. Stored photos stay in France, for 30 days at most. Encrypted in transit and at rest.
- Log of access to patient records, kept for 12 months
Sub-processors, security measures and contractual documents: /legal/security
6. Your rights
Under the GDPR you have the following rights:
- Right of access: obtain a copy of your personal data
- Right of rectification: correct inaccurate data
- Right of erasure: request deletion of your data
- Right to object: object to the processing of your data
- Right to portability: receive your data in a structured format
To exercise these rights, contact us at: privacy@phimetra.com
You may also lodge a complaint with the CNIL (French data-protection authority): www.cnil.fr