Who are we?

We are AMR Holding B.V. (“AMR”, “we”, “us” or “our”). We are committed to protecting your personal data and respecting your privacy rights. AMR develops and operates the Hairloss AI application (“the App”). The App uses artificial intelligence technology to provide users with insights related to hair loss patterns and hair health. As the data controller, we are responsible for protecting your personal information. This privacy statement (“Privacy Statement”) explains what personal data is collected and how it is processed.

This Privacy Statement applies to all personal data collected through the App. Our affiliates act as processors of your personal data. Before using the App, please ensure that you have read and understood our Privacy Statement.

The App is offered globally. To address differences in applicable data protection laws across jurisdictions, we have included jurisdiction-specific addendums to this Privacy Statement. The General Data Protection Regulation (GDPR) serves as the baseline framework for this Privacy Statement. Each addendum supplements or modifies this Privacy Statement where required by local law. In the event of any conflict between this Privacy Statement and an applicable addendum, the provisions of the addendum shall prevail for users in the relevant jurisdiction.

How can you contact us?

If you have any questions or concerns regarding our processing of your personal data, please contact us at hello@hairlossai.app. Or you may also reach us at:

AMR Holding B.V.
Oostzaanstraat 8
1013 WK, Amsterdam
The Netherlands

Click on the links below to jump to each section:

• 1 | Scope and applicability
• 2 | What information do we collect about you and for what purposes?
• 3 | Use of Artificial Intelligence
• 4 | Who receives your personal data?
• 5 | Storage of data and transfer of personal data outside the European Economic Area
• 6 | How do we protect your personal data?
• 7 | What are your rights?
• 8 | Changes to this Privacy Statement
• Addendum I – Multistate Privacy Notice
• Addendum II – CCPA Privacy Notice
• Addendum III – UK GDPR Privacy Notice
• Addendum IV – Swiss Federal Act on Data Protection Privacy Notice

1 | Scope and applicability

This Privacy Statement applies when:

• you use the App;
• you interact with the App;
• you use our website;
• you contact us by email, phone, or other means.

This Privacy Statement applies globally and is governed primarily by:

• Regulation (EU) 2016/679 (the General Data Protection Regulation (GDPR)); and,
• where applicable, Regulation (EU) 2024/1689 (the Artificial Intelligence Act (AI Act)).

For individuals located outside the European Economic Area (“EEA”), or where local data protection laws impose additional or divergent requirements, supplementary privacy notices apply as set out in the following addenda, which form an integral part of this Privacy Statement:

• Addendum I – Multistate Privacy Notice (United States)
• Addendum II – California Consumer Privacy Act Privacy Notice
• Addendum III – United Kingdom GDPR Privacy Notice
• Addendum IV – Swiss Federal Act on Data Protection Privacy Notice

As stated before, in the event of a conflict between this Privacy Statement and any applicable addendum, the relevant addendum shall prevail for individuals subject to that specific legal regime.

2 | What information do we collect about you and for what purposes?

We collect personal data directly from you when you submit photographs or scans from your face or scalp. You are not required to create an account, and we do not collect directly identifying information such as identifiers, your email address, your contact details, or your payment information, except where this is strictly necessary to manage subscriptions and provide access to paid features.

The table below provides an overview of the categories of personal data we process, what we do with your data, and for what purposes it is processed.

The App processes photographs of an user, which may qualify as personal data under the GDPR. These photographs are processed solely to provide the App’s core functionality, namely AI-based hair loss analysis and the generation of hair loss insights.

Subscriptions are processed via the Apple App Store and Google Play Store. We do not collect, store, or otherwise process any payment information, as all payment transactions are handled directly by these third-party providers.

Apart from the data described above, we do not collect or retain additional personal data such as your name, profile information, or usage data linked to an individual user. Therefore, no other personal data is collected or retained beyond what is necessary to deliver the services described above. The App does not provide medical advice and is not intended to diagnose, treat, cure or prevent any disease.

3 | Use of Artificial Intelligence

The App uses AI-based systems, such as OpenAI, to analyze uploaded photographs and generate automated insights relating to hair loss patterns.

The AI-processing involves the automated assessment of visual characteristics of the images you upload. The output consists of estimates and pattern-based insights and is provided for informational purposes only. The AI-output provided by the App does not constitute medical advice and should not be used as a substitute for professional medical diagnosis or treatment.

We ensure that:

• the AI-systems are designed, tested, and regularly reviewed to reduce bias, inaccuracies, and technical errors;
• the processing of personal data through AI complies with applicable GDPR principles, including data minimisation, fairness, transparency, purpose limitation, and security;
• appropriate technical and organisational measures are implemented to protect your personal data;
• your personal data is not used for automated decision-making, within the meaning of Article 22 GDPR, that produces legal effects or similarly significant effects for you without your explicit consent; and,
• your uploaded photographs are not used to train or further develop the AI models;
• we are transparent about our use of AI and any AI-generated analyses. Please note that AI outputs may contain errors, and we do not guarantee the accuracy or reliability of the results.

4 | Who receives your personal data?

To provide the App and related services, we share your personal data with third parties that support our services. These parties process personal data only on our instructions and under a data processing agreement.

Personal data may be shared with:

• hosting service providers;
• providers of the AI-infrastructure and analytics tools;
• payment service providers, where applicable;
• professional advisers or authorities, if required by law.

We do not sell your personal data, nor do we or our partners use your data for targeted advertising purposes.

5 | Storage of data and transfer of personal data outside the EEA

Your personal data is processed and stored within the EEA and the United States. Where personal data is transferred from the EEA to the United States, such transfers take place in accordance with the EU–US Data Privacy Framework, which has been recognized by the European Commission as providing an adequate level of protection for personal data.

If your data is not transferred in accordance with the EU-US Data Privacy Framework, your data is transferred on the basis of agreements containing Standard Contractual Clauses (‘SCC’s’) that ensure appropriate safeguards for the protection of your data.

For the AI-tool used as part of our services, personal data is stored and processed exclusively within the EEA.

Any transfers outside the EEA will occur only where necessary and in compliance with applicable data protection laws. Where required by law, additional safeguards or conditions, such as reliance on other legally recognized transfer mechanisms or your explicit consent, will be applied to ensure an appropriate level of data protection.

6 | How do we protect your personal data?

We take the protection of personal data seriously. Because we process as little personal data as possible, our primary method of data protection is data minimisation.

We do not collect or store personal data such as your name, email address, contact details, or account information. Only photographs are used for the intended functionality. These photographs are not stored by us and are processed only temporarily. By intentionally limiting the volume and type of personal data we process, we significantly reduce the risk of loss, misuse, unauthorised access, or disclosure of your personal data.

We have entered into appropriate data processing agreements with OpenAI for their tool that is used in the background, ensuring secure data transmission and that any data processed is deleted after results are generated within the App. In addition, we have taken relevant measures to process the sent photographs on AI-servers within Europe.

Access to photographs within the App is restricted solely to you. Photograph access is not linked to an account but to the specific device on which the App is installed. Consequently, photographs cannot be viewed from any other device, nor can previously captured photographs be retrieved if you switch devices.

Any limited processing that does occur is confined to what is strictly necessary for the relevant purpose and is carried out within a controlled environment. Access to such data is granted only on a need-to-know basis.

If you nonetheless suspect a data breach or security incident, please contact us immediately via hello@hairlossai.app.

7 | What are your rights?

You are granted specific rights regarding the use of your personal data. These include the following.

Right of access

You have the right to receive information from us about how we process your personal data, who the recipients are, and to obtain copies of your personal data. In some cases, exceptions or limitations may apply, meaning that not all information can always be provided.

Right to rectification

You have the right to have your personal data corrected so that it is accurate and up to date. You may also request rectification of personal data that has been provided to us by third parties if you believe it is objectively incorrect or incomplete.

Right to erasure (“right to be forgotten”)

In many cases, you have the right to request that your personal data be (partly) deleted, for example when it is no longer necessary or has been processed unlawfully. However, in some situations we may not be able to fully erase your personal data, for instance due to a legal obligation or because the data is necessary for the establishment, exercise, or defense of legal claims. We will therefore always balance your request against our other legitimate interests.

Right to restriction of processing

Under certain circumstances, you may request that we restrict the processing of your personal data. This may apply, for example, if the accuracy of your data is contested, if the processing is unlawful, or if we no longer need the data for our purposes. In some situations, we may still process your data despite the restriction, for instance for the defense in legal proceedings or to protect the rights of others.

Right to data portability

Under certain conditions, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to have it transmitted directly by us to another organization.

Right to object

Under specific circumstances, you may object to the processing of your personal data by us or by third parties engaged by us, for example for direct marketing purposes. We will assess an objection based on, among other things, the legal basis, your reasonable expectations, the interests and risks for you, us, or third parties, and the availability of less intrusive alternatives. If your objection is found to be justified, we will cease the processing.

Right to withdraw consent

If we process your personal data on the basis of your consent, you have the right to withdraw this consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint

We will always aim to find a solution together with you. If this is not possible, you have the right to lodge a complaint with the supervisory authority responsible for data protection. You may do so in the EU Member State where you reside, where you work, or where the alleged infringement has occurred. For information about the supervisory authority in your country, please click here.

How to submit your requests?

You can submit your request(s) via hello@hairlossai.app. To protect your privacy, we take reasonable measures to verify your identity before processing your request. Only you, or a person legally authorized to act on your behalf, may submit a verifiable request. We may ask you to confirm certain details that are known to us in our records.

We will respond as soon as possible, and in any event within one month of receiving your request. If an extension of up to two additional months is necessary, we will inform you within one month. Submitting a request is free of charge, unless the request is manifestly unfounded or excessive. We may also charge a reasonable fee if you request additional copies in the context of your right of access.

8 | Changes to this Privacy Statement

We may update this Privacy Statement from time to time. The most recent version will always be available within the App. Where changes are significant, we will inform you in an appropriate manner.

Addendum I – Multistate Privacy Notice

This US Multistate Privacy Notice (this “Notice”) supplements our Privacy Statement and applies solely to individual residents (“Covered Individuals”) of US states that have enacted comprehensive consumer privacy laws. These states include, without limitation, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, together with their implementing regulations, as well as any similar state privacy laws that may take effect in the future (collectively, the “State Privacy Laws”).

This Notice explains how we collect, use, disclose, and otherwise process the personal information of Covered Individuals through the App. It also describes the rights available under the State Privacy Laws and explains how those rights may be exercised. Unless otherwise defined in this Notice, capitalised terms have the meanings set out in our Privacy Statement or under the applicable State Privacy Laws.

Collection, Use, and Disclosure of Personal Information

The App is designed to operate with minimal personal data processing. Users are not required to create an account, and we do not collect names, email addresses, phone numbers, persistent identifiers, advertising identifiers, or online activity tracking data.

Personal information is processed only where it is voluntarily provided by the user, and solely for the purpose of generating AI-based hair loss insights and the functionality of the App. The personal data that is shared with third parties should be disclosed under the applicable multistate-laws.

The table below provides an overview of the categories of personal data we process, what we do with your data, who we share your data with and for what purposes it is processed.

Selling or Sharing of Personal Information

We do not sell personal information as defined under applicable State Privacy Laws. We also do not share personal information for targeted advertising, cross-context behavioural advertising, or marketing purposes. The App does not display advertisements, use advertising software development kits, or conduct analytics that rely on personal information.

The only disclosure of personal information is the transmission of photographs to third-party AI-service providers for the sole purpose of processing them on our behalf. This constitutes processing by our service providers and does not constitute the sale or sharing of personal information.

Where we believe it is necessary or appropriate to do so, we may share your personal data with: law enforcement, government agencies or regulators; courts; parties to legal proceedings in which a subpoena or legal request has been propounded to which such information would be responsive. In those circumstances we will make reasonable efforts to disclose only that information that is relevant to the reason for disclosure and to protect the privacy of such information to the extent reasonably possible.

Finally, we may share your personal data with processors. We will only engage processors who adequately implement appropriate technical and organizational measures and who guarantee the protection of your rights. In order to ensure this, we enter into data processing agreements with our processors. This is compulsory under the data protection laws. The data processing agreement regulates, among other things, data security, confidentiality and your rights.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in our Privacy Statement. Photographs submitted for hair loss-analysis are retained by the third-party AI-tool for the sole purpose of abuse-monitoring. Subscription-related information, where applicable, is retained in accordance with applicable financial, accounting, and legal requirements, but at least seven (7) years, and is deleted when it is no longer necessary.

Your Privacy Rights

Depending on your state of residence, you may have certain rights under the State Privacy Laws, subject to verification and applicable legal exceptions. In addition to the rights mentioned in the general Privacy Statement, you have the following rights.

Right to Opt Out of Sale, Sharing, Profiling, and Targeted Advertising

You may opt out of the Sale or Sharing of personal data to third parties, as those terms are defined by U.S. federal, state and local laws. You may exercise this right by contacting us at hello@hairlossai.app.

In addition, we will not discriminate against you if you exercise your privacy rights under any applicable privacy and data protection laws, including by:

• denying you goods or services;
• charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• providing you a different level or quality of goods or services;
• suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

How to Exercise Your Rights

To exercise any applicable privacy rights, you may contact us using the contact details provided in the “How can you contact us?” section of our Privacy Statement. We may need to verify your request before processing it. As the App does not maintain user accounts and does not, itself, retain photographs after processing, the scope of personal information available for access or deletion may be limited.

Authorised Agents

Where permitted by law, you may designate an authorised agent to submit a privacy rights request on your behalf. We may require proof of authorisation and verification of identity before processing such requests.

Right to Appeal

If we deny your privacy rights request, you may appeal our decision by contacting us using the same contact details. We will respond within the timeframe required by the applicable State Privacy Laws.

Children’s Privacy

The App is not intended for children, and we do not knowingly collect personal information from children as defined under the State Privacy Laws. If you believe that a child has provided personal information through the App, please contact us so that we can take appropriate action.

Addendum II – CCPA Notice

This California Privacy Addendum (this “Addendum”) supplements the Privacy Statement and the Multistate privacy notice and applies to individuals who reside in the State of California (“California Consumers”). It describes how AMR Holding B.V. (“AMR”, “we”, “us” or “our”) collects, uses, discloses, and otherwise processes personal information through the Hairloss AI application (the “App”) in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and their implementing regulations (collectively, the “CCPA”).

Certain categories of personal information are excluded from the scope of the CCPA, including information subject to specific sector-specific laws. As a result, this Addendum applies only to personal information that is subject to the CCPA.

Categories of Personal Information Processed and Business Uses

The table below provides an overview of the categories of personal data we process, what we do with your data, who we share your data with and for what purposes it is processed.

In the last 12 months, we have collected or received the following categories of Personal Information, where we have a legitimate interest, legal obligation or consent for processing:

Note: To the extent that photographs of the face and side profiles may be considered Sensitive Personal Information under the CCPA, they are processed solely at the user’s request, for the limited and specific purpose of generating hair-loss analysis results and are not used for any additional or secondary purpose.

Addendum III – UK GDPR

This United Kingdom Addendum applies to you if you are located in the United Kingdom or if the processing of your personal data falls within the territorial scope of the UK General Data Protection Regulation (“UK GDPR”), as incorporated into UK law by the Data Protection Act 2018 and amended from time to time.

Except as expressly stated in this Addendum, all provisions of this Privacy Statement apply equally under the UK GDPR.

Applicable law and regulatory authority

Where UK law applies, references in this Privacy Statement to:

• the “GDPR” shall be interpreted as the UK GDPR; and
• “data protection law” shall include the UK GDPR and the Data Protection Act 2018.

The competent supervisory authority for the United Kingdom is the Information Commissioner’s Office. You can find further information at: https://www.ico.org.uk.

Legal bases for processing under the UK GDPR

When processing personal data within the scope of the UK GDPR, we rely on one or more of the following legal bases, as applicable:

• performance of a contract: where processing is necessary to provide the App and its core functionality;
• consent: where you actively submit photographs or provide age information for AI-based analysis;
• legitimate interests: where strictly necessary to operate, secure, and improve the App, provided that such interests are not overridden by your rights and freedoms.

Where we rely on consent, you may withdraw it at any time in accordance with Section 7 of this Privacy Statement.

Your rights under the UK GDPR

If the UK GDPR applies to you, you have the same rights as described in Section 7 of this Privacy Statement, including:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability;
• the right to object; and,
• the right to withdraw consent at any time.

These rights are exercised and enforced under UK law and subject to the limitations and exemptions set out in the UK GDPR.

Complaints in the United Kingdom

If you believe that we are processing your personal data unlawfully under the UK GDPR, you may contact us so that we can attempt to resolve your concern.

You also have the right to lodge a complaint with the UK Information Commissioner’s office at https://www.ico.org.uk.

Addendum IV – Swiss Federal Act on Data Protection Privacy Notice

The Swiss Federal Act on Data Protection (FADP) applies when the processing has effects in Switzerland. Except as expressly stated in this Addendum, all provisions of the Privacy Statement apply equally under the FADP.

Data transfer to countries outside of Switzerland

We transfer your personal data to the following countries or jurisdictions:

• The United States of America, solely for the purpose of server hosting; and,
• The European Economic Area (EEA), where the third-party AI service provider is located.

Where personal data is transferred outside Switzerland, this will only occur when necessary and subject to appropriate safeguards, such as:

• the Swiss-U.S. Data Privacy Framework (DPF);
• an adequacy decision by the Swiss Federal Council; or,
• the use of standard contractual clauses (SCCs) approved by the Swiss Federal Council.

If no appropriate safeguards are available, transfers will only take place when permitted by law, for example with your consent.

Complaints in Switzerland

If you believe that we are processing your personal data unlawfully under the FADP, you may contact us so that we can attempt to resolve your concern.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch/en.

© 2026 AMR Holding B.V.