HairPath ("we", "us", "our") is a hair transplant recovery companion app. We take your privacy seriously. This policy explains what data we collect, why we collect it, how we protect it, and your rights regarding your personal information.
We never sell your personal data. Your information is used solely to support your recovery and coordinate care with your clinic.
| Data Type | Examples | Why We Need It |
|---|---|---|
| Identity | First name, last name, email, phone | To identify you and enable clinic communication |
| Surgery Details | Surgery date, graft count, procedure type, pre-surgery medications | To personalize your recovery timeline and care steps |
| Recovery Progress | Daily check-in scores, medication adherence, comfort levels | To track your healing and alert your clinic if needed |
| Photos | Milestone progress photos (Day 15, 30, 60, etc.) | For your clinic to review healing remotely |
| Messages | Questions to the AI assistant, clinic coordinator messages | To provide recovery guidance and improve the AI assistant |
| Usage | Session duration, sections viewed, language preference | To improve the app experience |
We process your data for the following purposes:
We process your data based on: (a) your consent given during onboarding, (b) our legitimate interest in providing recovery support, and (c) the performance of our service agreement with your clinic.
| Recipient | What They See | Why |
|---|---|---|
| Your Clinic | All your recovery data, photos, messages | Care coordination — they are your treating provider |
| Supabase (database) | All stored data (encrypted at rest) | Secure cloud database hosting |
| Vercel (hosting) | API requests, server logs | App and API hosting |
| Resend (email) | Your email address, email content | Delivering recovery reminder emails |
| Anthropic (AI) | Your questions to the AI assistant (no PII sent) | Powering the Zeki recovery assistant |
We do not sell, rent, or trade your personal data with any third parties for marketing or advertising purposes.
We retain your personal data for the duration of your active recovery period plus one year after your recovery is marked complete. After this period:
Under GDPR, KVKK (Turkish data protection law), and applicable privacy regulations, you have the right to:
To exercise any of these rights, use the "My Data" section in your Profile, or contact us at the address below.
HairPath uses only essential browser storage (localStorage and sessionStorage) to:
We do not use advertising cookies, tracking pixels, or third-party analytics cookies. Google Fonts is loaded for visual styling — Google's privacy policy applies to font delivery.
HairPath is designed for adults undergoing hair transplant procedures. We do not knowingly collect data from anyone under the age of 18. If we learn that we have collected data from a minor, we will delete it promptly.
We may update this privacy policy from time to time. When we make significant changes, we will notify you through the app and update the version number and date at the top of this page. Continued use of HairPath after changes constitutes acceptance of the updated policy.
If you have questions about this privacy policy or your personal data, contact us:
For GDPR-related inquiries, you also have the right to lodge a complaint with your local data protection authority.