1. Who We Are

This Privacy Policy explains how Shape Labs, Inc. dba ShapeScale and its affiliates collect, use, disclose, and protect personal information when you use ShapeScale products and services.

This policy applies to home users and to users who access ShapeScale through a business customer account, including clients and patients of business customers.

Company: Shape Labs, Inc. dba ShapeScale

Privacy contact: privacy@shapescale.com

Mailing address: 179 11th St, San Francisco, CA 94103

2. Scope and Role Context

This policy applies to ShapeScale websites, mobile apps, connected-device workflows, cloud services, support channels, and service communications.

In some deployments, ShapeScale and the business customer each act as independent businesses for different processing activities. A business customer may publish separate privacy terms for its own practices.

3. Categories of Personal Information We Collect

Depending on how you use services, we may collect:

• Identifiers, such as name, email, phone, account ID, device ID, and IP address
• Account and profile data, such as age range, sex, height, and account preferences
• Scan and measurement data, such as body scans, body measurements, and composition outputs
• Biometric data used for account matching, such as face feature vectors generated from scan images
• Device and network data, such as app version, OS, diagnostics, and crash data
• Usage data, such as scan events, feature interactions, and activity logs
• Support and communication data, such as email, chat, and support attachments
• Commercial data, such as order history and subscription status
• Business relationship data, such as links between end-user accounts and business-customer locations
• Inferences derived from service usage

4. Sources of Personal Information

We collect information:

• Directly from you
• Automatically from your use of services
• From business customers in managed-account flows
• From vendors and service providers that support payments, communications, support, and infrastructure

5. How We Use Personal Information

We use personal information to:

• Deliver and operate services
• Process scans and present results
• Match scans to the correct user account
• Authenticate users and protect accounts
• Support troubleshooting and customer support
• Improve product quality and reliability
• Send service and account communications
• Comply with legal obligations
• Prevent fraud and abuse

We may create deidentified and aggregated information for analytics, reliability, and product improvement.

6. How We Disclose Personal Information

We do not sell personal information for money.

We may disclose personal information to:

• Service providers and contractors under data protection terms
• Business customers in managed-account workflows where account settings allow access
• Payment and transaction processors
• Marketing and customer communication providers
• Productivity and operations providers
• Professional advisors under confidentiality obligations
• Authorities when required by law
• Parties in merger, financing, acquisition, or asset transfer transactions

Current examples of service providers include ActiveCampaign for customer communication workflows and Notion for internal operations records.

7. Advertising, Analytics, and Privacy Choices

We use analytics and similar technologies to understand product use and improve service performance.

We do not use health-adjacent or biometric data for cross-context behavioral advertising.

7.1 Sale or Sharing Opt-Out Rights

You may request that ShapeScale not sell or share your personal information by emailing privacy@shapescale.com with subject line Do Not Sell or Share Request, or by submitting a request at shapescale.com/legal/do-not-sell.

ShapeScale will honor applicable Global Privacy Control signals where legally required.

7.2 Sensitive Personal Information — Limit-Use Rights

ShapeScale currently uses sensitive personal information for permitted business purposes, including service delivery, security, fraud prevention, and legal compliance.

If ShapeScale uses sensitive personal information beyond permitted purposes under applicable law, ShapeScale will provide a Limit the Use of My Sensitive Personal Information method and describe it in this policy and in app settings.

8. Data Retention Schedule

We retain personal information only as long as needed for service, legal, and operational purposes.

Retention periods:

Face feature vectors used for account matching: deleted no later than 3 years after your last interaction with ShapeScale, or earlier if account deletion is completed or the purpose for collection is fulfilled first

Account profile data: retained while the account is active and for as long as needed for legal compliance, dispute resolution, fraud prevention, and business record purposes. Upon receipt of a verified deletion request, ShapeScale will delete or de-identify account data within the timeframe required by applicable law.

Scan and measurement data: retained to support your access to scan history, legal obligations, and dispute resolution. You may request deletion of your scan data at any time by submitting a request to privacy@shapescale.com or at shapescale.com/legal/privacy-request.

Support records: up to 3 years after the support interaction closes

Security and audit logs: retained according to security and legal requirements

Backups: data deleted from active systems may persist in encrypted backup archives. Backup archives are accessed only for disaster recovery and are not used to restore data that has been deleted in response to a deletion request.

9. Biometric Notice for Account Matching

ShapeScale uses facial geometry processing and face feature vectors for account matching and scan assignment.

How it works:

During scan workflows, an image may be processed with AWS Rekognition IndexFaces and stored in a face collection as a face feature vector

Purpose is account matching and authentication in repeated scan sessions

Face feature vectors are retained under the retention schedule in Section 8

You can request deletion by completing our Privacy Request Form.

By accepting this Privacy Policy at account creation or first use of ShapeScale services, you acknowledge that you have read this biometric notice and consent to the collection, storage, processing, and use of your face feature vectors as described in this section. This acknowledgment constitutes the disclosure and consent required under the Illinois Biometric Information Privacy Act (740 ILCS 14/15(b)), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code §503.001), and applicable provisions of the California Consumer Privacy Act as amended by the CPRA.

For accounts created on your behalf by a business customer, your business customer is responsible for ensuring you have had an opportunity to review this Privacy Policy before your first scan. ShapeScale does not collect your biometric data until a scan session is initiated.

10. US Privacy Rights

Depending on your state of residence and applicable law, you may have rights to:

• Know and access personal information
• Correct inaccurate personal information
• Delete personal information, subject to exceptions
• Obtain a portable copy where applicable
• Opt out of sale, sharing, targeted advertising, or certain profiling where applicable
• Appeal a denied request where required by law
• Non-discrimination for exercising rights

11. How to Submit Requests and Appeals

Submit privacy rights requests by completing our Privacy Request Form.

Appeals

• If your request is denied, you may appeal by emailing privacy@shapescale.com with subject line: Privacy Appeal
• ShapeScale will review and respond within the period required by applicable law, typically within 60 days
• If an appeal is denied, where required by law, we will provide information on how to contact your state Attorney General

12. California Supplemental Notice

For California residents, this section supplements this policy under the CCPA as amended by CPRA.

12.1 Categories Collected in the Last 12 Months

In the preceding 12 months, ShapeScale has collected the following categories of personal information:

• Identifiers such as name, email address, phone number, account ID, device ID, and IP address
• Customer records and account profile data such as age range, sex, and height
• Commercial information such as subscription status and order history
• Internet and network activity information such as app usage logs and feature interactions
• Geolocation data derived from IP address at a coarse level
• Inferences drawn from usage behavior to understand product engagement
• Sensitive personal information including biometric identifiers (face feature vectors) and health-adjacent scan and measurement data

12.2 Purposes for Collection and Use

ShapeScale collects and uses these categories for the business and commercial purposes described in Section 5, including service delivery, scan processing, account matching, authentication, security, fraud prevention, legal compliance, support, diagnostics, and service communications.

12.3 Categories of Third Parties Receiving Disclosures

ShapeScale discloses personal information to the categories of recipients described in Section 6, including service providers and contractors, business customers in managed-account workflows, and professional advisors and authorities where required by law.

12.4 Retention

Retention periods and criteria are listed in Section 8.

12.5 California Rights and How to Exercise Them

California residents may request:

• Access to personal information collected about them
• Correction of inaccurate personal information
• Deletion of personal information, subject to legal exceptions
• Portability of personal information in a usable format where applicable
• Opt-out of sale or sharing of personal information (see Section 7.1)
• Limit use and disclosure of sensitive personal information where applicable (see Section 7.2)
• Non-discrimination for exercising applicable privacy rights
• Appeal of a denied request

Request methods:

• Privacy rights and Do Not Sell or Share requests: privacy@shapescale.com or shapescale.com/legal/privacy-request
• Appeals: privacy@shapescale.com with subject line Privacy Appeal

ShapeScale will respond to verifiable consumer requests within 45 days of receipt. If additional time is required, ShapeScale will notify you and may extend the response period by up to an additional 45 days. If a request is denied, you will receive a written explanation. If your appeal is also denied, ShapeScale will provide information on how to submit a complaint to the California Privacy Protection Agency.

ShapeScale will not discriminate against you for exercising applicable privacy rights.

13. Minors

Services are not directed to individuals under 13. Users between the ages of 13 and 17 must have parental or guardian consent to use ShapeScale services.

If we learn that personal information was collected from an individual under 13 in violation of this policy or applicable law, we will take reasonable steps to delete that information as required by law.

14. HIPAA and Medical Boundary

ShapeScale services are intended for wellness and fitness contexts and are not a substitute for medical diagnosis or treatment.

This policy does not represent that ShapeScale is a HIPAA covered entity in all contexts. Where healthcare-specific agreements are executed, additional terms may apply.

15. Security

We use administrative, technical, and physical safeguards designed for the sensitivity of the data we process.

No system is perfectly secure. We cannot guarantee absolute security.

16. Changes to This Policy

We may update this policy from time to time.

We will post the revised version and update the effective date. If changes are material, we may provide additional notice.

17. Contact

privacy@shapescale.com

Shape Labs, Inc.

179 11th St, San Francisco, CA 94103