Privacy policy

• Account details — your email address and first name, handled by our authentication provider. If you sign in with Google, we receive the basic profile information Google returns.
• Profile details you choose to add — age range, gender, general location, goals and any free text you type about previous treatments.
• Consultation answers — the goals, body areas, preferences and optional free text you submit in a consultation, plus the educational guide generated from them.
• Journey entries and progress photos — the notes, dates, ratings and images you choose to upload.
• Feedback — the rating, category and optional comment you submit through the beta feedback controls.
• Product analytics — a small, fixed list of structured events describing which steps and screens were used.

We do not run advertising trackers, we do not sell your data, and we do not share it with providers or clinics.

Progress photos are stored in a private storage area. They are not published, not listed publicly, and not shared with providers. Access is restricted to your own account through short-lived links generated when you view them, and images are limited to 10 MB each.

Your photos are not sent to any AI system and are not analysed by SOMA. They exist only so you can document your own journey. You can delete any photo, or all of your photos, at any time from your profile.

SOMA offers an optional, opt-in feature where a signed-in adult can upload a photo of themselves and request an educational visualisation for an eligible treatment. It is never required to use SOMA.

What we collect: the photo you choose to upload, the treatment you select, the version and timestamp of the consent you gave, and the status of the request. Photos are stored in a private storage area organised under your own account, are never public, are never listed, and are never shared with providers. Access happens through short-lived links generated only for you, and images are limited to 8 MB.

AI processing is now enabled for this feature. When you choose to generate a visualisation, the photo you uploaded is sent from our server to the configured third-party AI image model solely to produce the illustrative image you requested, using a fixed, SOMA-authored instruction tied to the treatment you selected — you never write the instruction, and no visualisation is generated unless you ask for one. The generated image is stored in the same private storage area as your original, under your own account. We do not control and do not make claims about how the third-party model provider handles data on its side beyond its own terms. We do not perform face recognition or identity matching, and we do not infer health or other sensitive traits from your photo.

Any generated image is an AI-created educational illustration. It is not a prediction, not a guarantee of results, not a diagnosis and not medical advice — only a qualified provider can determine candidacy and a treatment plan.

Visualisation photos and records: Your uploaded photo and every visualisation you generate are kept privately in My Journey until you delete them or delete your account — there is no automatic expiry. You can delete a single generated image, or the whole visualisation (original photo included), at any time.

The treatment options in your guide are chosen by a deterministic rules engine, not by AI. For signed-in users, an AI language model is then used to write the explanatory wording around those already-selected options. The AI cannot add, remove or rename a treatment.

What is sent to the model: your selected goals, body areas and preferences, and any optional free text you typed, together with the treatment records already selected. What is never sent: your email, name, photos, or your journey entries. Certain sensitive inputs are removed or cause AI wording to be skipped entirely.

We do not store raw prompts or raw model output. We keep only technical metadata about each generation — model name, prompt version, timing, token counts, validation status and safety flags.

Ask SOMA is a private, educational AI chat. Your conversations and messages are stored under your own account and are visible only to you: they are never public, never shown to providers, and never used to build a profile that is shared with anyone. You can archive or delete any conversation, which permanently removes its messages.

What is sent to the language model on each message: your message, a short window of recent messages in that same conversation, and factual excerpts from SOMA’s public treatment library. Personal Journey context is off by default. When you turn it on for a conversation, SOMA additionally sends a compact summary of your own saved treatments, saved providers, guide history, visualisation status and journal entry titles. Your photos, email address, phone number, precise location and other people’s data are never sent, and you can turn the setting off at any time.

The Concierge is educational only. It does not diagnose, prescribe, interpret symptoms or determine candidacy, and certain urgent or crisis wording produces a fixed, SOMA-authored safety response without involving the model at all.

Journal entries are created only when you explicitly save something and review it first. They are private to your account, editable and deletable by you, and they remain if you delete the conversation they came from. Conversations, messages and journal entries are deleted with your account: Kept until you delete the item or delete your account, subject to any retention we are legally required to apply.

Your SOMA Aesthetic Profile stores stated preferences only — the kind of result you like, how much downtime you'd accept, a broad budget band, and areas or treatments you're curious about or want to avoid. It is not a medical assessment, a diagnosis or a record of your health, it never determines candidacy or suitability, and SOMA does not ask for medical history in it. It is private to your account, editable and deletable by you at any time, and it is used only to tune the emphasis of educational guidance.

When it exists, a short summary of those preferences is included in Ask SOMA requests so answers can emphasise the kinds of options you said you were interested in. It is never shown to providers, never published, and it is deleted with your account: Kept until you delete the item or delete your account, subject to any retention we are legally required to apply.

SOMA does not currently sell placement, ranking, featured slots or advertising, and no provider or brand has paid to appear in this product. Provider results are ordered by educational relevance only. If paid placement is ever introduced, it will be labelled “Sponsored” on the listing itself, excluded from educational ordering, and never used by Ask SOMA.

Provider ordering uses only published listing information — treatments offered, location, listing completeness and SOMA’s stated trust state. It never uses your photos, your journal, your conversations or any payment from a provider.

Analytics events are recorded against a randomly generated session identifier held in your browser, plus your account identifier when you are signed in. Only an explicit allow-list of event names and property names is accepted; anything else is discarded before storage.

We do not record consultation free text, photo paths, feedback comments, prompts, model output, names, emails, phone numbers, precise location, IP addresses, user agents or query strings in analytics.

When you search for clinics near you, SOMA sends only the ZIP code, city or neighbourhood you typed — or, if you explicitly allow it, your device coordinates — to our maps provider (Google) through our own server, so no keys or identifiers about you are exposed to them by your browser.

Your precise location is used in the moment to centre the search. It is not written to your account, not stored in our database, and never recorded in analytics: analytics keeps only whether the search used a typed place or your device location, the distance you chose and how many results appeared.

Clinic names, addresses, opening hours, ratings, reviews and photos shown from the map are fetched live from Google for display only and are not stored by SOMA. Google ratings and reviews belong to Google and are not SOMA reviews or endorsements. The only thing we save is the map identifier of a business an administrator has confirmed matches a SOMA listing.

Consultation prep sheets — the clinic you chose, the treatments you want to discuss, the questions you ticked, your appointment date and your private notes — are stored against your account and readable only by you. They are never shared with a provider unless you print or show the sheet yourself, and they are never used to train any model.

Analytics records only counts and status for prep sheets: how many questions or treatments a sheet contains and whether it is planned, completed or cancelled. Clinic names, dates, question text and notes are never sent to analytics. Delete a prep sheet at any time from Consultation prep, or delete your account to remove them all.

Some listings in this beta are demo records created for testing. They are labelled “Demo provider” and do not represent real clinics. SOMA does not verify clinical quality, licensing, credentials or outcomes, and being listed in SOMA is not an endorsement or a recommendation.

Provider applications and listing claims are submitted by practices, not by consumers. We collect business contact details, public practice information, structured licence references and a public verification link.

We never ask providers to upload credential documents, patient records or clinical data, and we never accept payment for placement or ranking.

Approved listing information is public. Submitter names, internal review notes and claim evidence stay internal to SOMA staff.

A reviewed listing means SOMA checked the public information in it. It is not an endorsement, a credential or licensing guarantee, or a clinical recommendation.

Provider applications and claims: Provider applications and listing claims are retained only for as long as reasonably necessary to review and manage the listing or claim, and for legitimate recordkeeping. Records may be deleted or anonymised once they are no longer needed, subject to legal and business requirements. Providers can contact caiogroupllc@gmail.com with access or deletion requests.

• Product analytics events: 12 months.
• Beta feedback: 12 months.
• AI generation metadata and logs: 90 days.
• Account data, consultations, guides, journey entries and photos: Kept until you delete the item or delete your account, subject to any retention we are legally required to apply.
• Visualisation photos and records: Your uploaded photo and every visualisation you generate are kept privately in My Journey until you delete them or delete your account — there is no automatic expiry. You can delete a single generated image, or the whole visualisation (original photo included), at any time.

Retention is applied operationally during the beta rather than by an automated scheduled job.

• Edit or clear your profile details at any time.
• Delete individual guides, journey entries and photos.
• Delete all of your progress photos in one action from your profile.
• Delete any photo visualisation record from My Journey, which removes the stored photo and the record.
• Delete your account. This removes your stored photos and then deletes your account, which removes your profile, consultations, guides, journey entries, saved items and photo records.
• Request a copy of the data associated with your account by emailing us. Self-service export is not available during the beta.

Feedback and analytics records are pseudonymous or aggregated and may be retained for the periods above after account deletion, with the direct link to your account removed.

SOMA is a beta product. We do not claim certification or formal compliance with any specific regulatory framework, we make no medical-device claims, and we do not make guarantees about security beyond describing the controls above honestly.

For privacy questions, access requests or deletion help, email caiogroupllc@gmail.com.

See also our terms of use.