Free UK delivery over £40 · Klarna & Clearpay available

Privacy policy

v1.7 (supersedes v1.6) · Last updated: 9 October 2026 · Effective: 8 October 2026 for new accounts; 22 October 2026 for existing accounts

Controller: CellSync Limited (Company No. 17091767) · privacy@cellsync.co.uk

Contents

Introduction

CellSync Limited (“CellSync”, “we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains who we are, what data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to data collected through our website (cellsync.co.uk), the CellSync mobile application, our AI-powered skin analysis tool, our CELA (CellSync Expert Skin Intelligence Agent) concierge, our Ingredient Scanner, our email and SMS marketing programmes, and our B2B commercial activities.

Please read this policy carefully. If you do not agree with the practices described, you should not use our products or services.

1. Who We Are

CellSync Limited is the data controller responsible for your personal data. We are incorporated and registered in England and Wales.

  • Company Name: CellSync Limited
  • Company Number: 17091767
  • Registered Address: 128 City Road, London, EC1V 2NX, United Kingdom
  • VAT Number: Pending — to be updated prior to launch
  • Data Protection Contact: privacy@cellsync.co.uk
  • General Contact: support@cellsync.co.uk
  • Website: cellsync.co.uk

CellSync is not currently required to appoint a statutory Data Protection Officer (DPO) under UK GDPR Article 37. We have nonetheless designated a Data Protection Contact who handles all privacy enquiries, complaints and rights requests.

2. What Data We Collect

2.1 Account Data

First name, last name, email address, and an encrypted (one-way hashed) representation of your password. If you sign in with Apple or Google, we receive your name and email from the provider.

2.2 Profile Data

Age (integer) and birth year only — we do not store your full date of birth. Gender (optional), city (optional), skin type, primary skin concerns, whether you use prescription skincare, and whether you use SPF daily.

2.3 Skin Scan Data

When you complete a skin scan, we store the following derived data:

  • Overall Sync score
  • Ten individual metric scores: hydration, evenness, lines, pigmentation, pores, redness, blemishes, firmness, dark circles and puffiness
  • Perceived skin age estimate and eye-area age estimate
  • Skin type and skin tone classification
  • Skin concerns, strengths and focus areas identified by CELA
  • Image capture quality checks — for example, whether lighting and framing passed. These are pass/fail results, not images
  • Analysis version (for our internal audit and quality assurance)
  • Personalised protocols
  • CELA's summary note
  • Recommended rescan interval

Important — how your scan photographs are handled

Each skin scan takes three photographs of your face — front, left and right. If your phone does not support our guided camera, we take a single front photograph instead. They are sent securely, with a random account identifier and never your name or email address, to our specialist skin-analysis provider, which processes them on our behalf solely to produce your reading. The provider may use them only on our instructions, as required by our data processing agreement. Your photographs are deleted as soon as your reading is complete, and an automated clean-up removes any that remain within 24 hours at the latest. We do not keep copies on our own servers or in any backup. Only the derived data listed above is kept.

2.4 Derived Skin and Physiological Data

The skin scores, metric scores and age estimates stored in Section 2.3 are derived from visible characteristics in your facial photograph. This data infers information about your physical condition and skin health. Under UK GDPR, data of this nature may constitute special category data under Article 9 (concerning data about health). We therefore process this data on the basis of your explicit consent given when you first use the skin analysis feature.

Note for the avoidance of doubt: we do not use facial recognition, and we do not store any face template or face descriptor. Skin analysis measures the appearance of your skin; it does not identify you, and your photographs are deleted as described in section 2.3.

2.5 Ingredient Scan Data

When you use the Ingredient Scanner: scanned product name and brand, ingredient list, compatibility analysis, routine conflicts, compatibility score, CELA's recommendation, and scan timestamp. Photographs used for ingredient scanning are processed in real time and not retained.

2.6 Feedback and Outcome Data

Product ratings, protocol adherence (self-reported), free-text comments, and outcome data comparing scan scores over time.

2.7 Purchase Data

Billing and delivery address and order details. Payment card data is handled exclusively by our payment processor (Shopify Payments) and is never stored on CellSync systems.

2.8 Usage Data

Screens visited, features used, scan timestamps, and session duration. Used in aggregate to improve the product.

2.9 Authentication Data

Authentication provider, verification status, verification timestamps, login history, and CAPTCHA score from sign-up (used only for fraud prevention).

2.10 Consent Records

All consents granted or withdrawn, with timestamps and the policy version in force at the time. This audit trail is required to demonstrate lawful processing under UK GDPR.

2.11 Location Data

Purpose: we use your location only to show the weather and UV conditions where you are, at city level only.

If you allow it, the CellSync app requests your device’s approximate location when you open the home screen, so we can show the local temperature, humidity and UV index that affect your skin, and so CELA can tailor advice such as SPF and hydration guidance to your climate.

We use this only at city level. Your device rounds the location to roughly 1 km before it is sent to our weather provider, and we store only the resulting city name — for example “Manchester” — against your profile. We do not store your coordinates and we do not build a location history.

This is optional. You are asked for permission before any location is read, the app works normally if you decline, and you can withdraw permission at any time in your device settings. We never access your location in the background — permission is requested for use while the app is open only.

2.12 Device Permissions

The app asks for the following device permissions. Each is requested at the point of use, each is optional, and each can be withdrawn at any time in your device settings.

  • Camera — to take a skin scan, using our guided camera, which checks lighting, angle and framing on your device before each photograph is taken, or to photograph a product’s ingredient list. Skin-scan photographs are handled as described in section 2.3. Ingredient-label photographs are processed for analysis and are not retained.
  • Photo library — to let you choose an existing photograph of a product’s ingredient list. We access only the images you select. Skin scans use the live camera only.
  • Location — to show local skin conditions, at city level only, as set out in section 2.11.
  • Notifications — to send protocol reminders and account notices. Marketing notifications require separate consent.

Some Android builds of the app list a microphone permission. This is included automatically by the camera component we use. CellSync does not record, transmit or store audio, and the app contains no audio recording feature.

2.13 Advertising and Analytics Data

Our website uses the Meta Pixel, a tracking tool provided by Meta Platforms Ireland Limited. Where you consent to marketing cookies, it records the pages you view on cellsync.co.uk, items you add to your bag, and purchases you complete, and associates this activity with your Meta account if you have one. We use it to measure whether our advertising works and to show our ads to people likely to be interested in them.

This data is collected by Meta as an independent controller under its own privacy policy, and we do not receive a copy of your Meta profile. We do not use it for any purpose other than advertising measurement and targeting, and it is never combined with the health, allergy or skin-scan data described in sections 2.3, 2.4 and 2A.

These cookies are optional and are set only after you consent. You can withdraw consent at any time through the cookie banner or the "Cookie Settings" link in our website footer. Retention is governed by Meta’s own policy, not ours. Full detail of the cookies involved, including _fbp and _fbc, is in our Cookie Policy.

2.14 Guided Camera Data

The guided camera used for skin scans is provided by our skin-analysis provider and runs inside the CellSync app. It checks image quality on your device before a photograph is taken. For each scan session we record which quality checks passed or failed (for example, “glasses detected” or “lighting too low”) and how many attempts were needed — no images — so we can improve the scanning experience. We keep this for 180 days. The provider also receives limited technical data from the camera component, such as device type and whether a capture succeeded, to maintain and improve the component; this is processed in the European Union.

2A. Special Category Data — Allergies & Health Information

Why this section exists

Information about allergies, skin sensitivities, medical conditions and medications you take is treated as ‘special category data’ under UK GDPR Article 9. It is given extra legal protection because of its sensitivity. This section explains exactly what we collect, why, and the additional safeguards we apply.

2A.1 What This Category Covers

Through the Allergy Capture feature in the CellSync mobile application, you can voluntarily provide information about:

  • Known allergies — for example: fish allergy, marine ingredient allergy, fragrance sensitivity
  • Skin sensitivities — for example: sensitivity to specific actives or ingredient categories
  • Relevant medications — for example: photosensitising medications that may affect compatibility with light-based therapy
  • Skin conditions you wish CELA to be aware of when making recommendations
  • Medical considerations such as pregnancy, where this affects suitability of certain treatments

Each option is presented from a pre-defined, controlled vocabulary. You cannot enter free-text health information through this feature — this is intentional, to keep what we collect proportionate, accurate and meaningful.

2A.2 Why We Collect This Data

The sole purpose of collecting this information is to ensure that the CELA agent and the broader CellSync platform never recommend a product, ingredient or protocol that is contraindicated for you. This is a safety filter, not a profiling exercise. For example: if you record a horse chestnut allergy, CELA will not recommend our Smoothing Eye Cream to you, because it contains horse chestnut extract. If you record a fragrance sensitivity, CELA will not recommend products that contain added fragrance.

2A.3 Legal Basis

Because this is special category data, we rely on two cumulative legal bases:

  • UK GDPR Article 6(1)(a) — your consent to process your personal data
  • UK GDPR Article 9(2)(a) — your explicit consent to process special category data

You provide both forms of consent when you complete the Allergy Capture screen in the CellSync app. The act of saving your selections constitutes explicit consent. You are not required to provide this data; the feature is entirely optional, and the rest of the app remains usable without it.

2A.4 What We Do Not Do With This Data

  • We do not share allergy or health data with any third party for marketing purposes
  • We do not use this data to profile, segment, target or score you for any commercial purpose beyond product safety recommendations
  • We do not sell this data to anyone, under any circumstance
  • We do not transfer this data outside the United Kingdom or European Economic Area except where strictly necessary for product recommendation processing
  • We do not use this data for B2B partnerships, airline amenity kits, hotel programmes or any commercial integration
  • We do not sync this data to our marketing CRM (Klaviyo) — it remains within our app backend only

2A.5 Retention of Special Category Data

We retain your allergy and health data for as long as your CellSync account is active, or until you withdraw consent, whichever is earlier. When you withdraw consent or close your account, this data is permanently deleted from our systems within 30 days, including from backups within 90 days.

2A.6 Withdrawing Consent

You may withdraw consent at any time:

  • By editing or clearing your entries on the Allergies screen in the CellSync app
  • By emailing privacy@cellsync.co.uk

Withdrawal is immediate. It does not affect the lawfulness of processing carried out before withdrawal. After withdrawal, CELA will no longer have access to your allergy information, and product recommendations will revert to the standard model that does not account for contraindications. This means you may see products you would previously have been protected from. We strongly recommend you re-enter the information if you intend to continue using the platform.

3. How We Use Your Data

We use your data to:

  • Provide and operate the CellSync App and the CELA concierge
  • Generate personalised protocols and product recommendations
  • Track your skin progress over time
  • Generate perceived age estimates from your skin scans
  • Power the Ingredient Scanner and routine compatibility analysis
  • Send scan results and rescan reminders
  • Process orders, handle deliveries and provide customer service
  • Send marketing communications — only with your prior consent
  • Filter recommendations against your allergy and sensitivity profile, where you have provided it
  • Prevent fraud, abuse and security threats
  • Comply with our legal obligations under UK law (e.g. accounting, tax, consumer protection)

4. Legal Basis for Processing

Under UK GDPR, every act of processing requires a lawful basis. We rely on the following:

4.1 Contract — Article 6(1)(b)

Necessary for performing our contract with you: account creation, order fulfilment, customer support, the skin analysis service.

4.2 Legitimate Interests — Article 6(1)(f)

Improving products, preventing fraud, security monitoring and anonymised analytics. We have carried out balancing assessments and concluded that our interests do not override your rights and freedoms in these contexts.

4.3 Legal Obligation — Article 6(1)(c)

Maintaining consent records, retaining order and tax records as required by HMRC and Companies House, and responding to lawful information requests from regulators or law enforcement.

4.4 Consent — Article 6(1)(a)

Marketing emails and SMS, any non-essential cookies (including the advertising and analytics cookies described in section 2.13), and access to your device’s location for local skin conditions. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

4.5 Explicit Consent for Special Category Data — Article 9(2)(a)

Required for processing derived skin and physiological data from skin scans and for processing allergies, skin sensitivities and other health data captured through the Allergy Capture feature. This consent is separate from and additional to the general consent under Article 6(1)(a).

5. Who We Share Your Data With

We share personal data only with processors who need it to provide the service to you, and only on the basis of contractual safeguards including Data Processing Agreements (DPAs) where required.

  • Anthropic — AI model provider powering CELA and the Ingredient Scanner. Receives your derived skin metrics, relevant profile context, CELA conversation messages, and photographs of product ingredient labels you scan. It does not receive your skin-scan photographs. Inputs are processed to generate responses, deleted under Anthropic’s commercial data-retention terms, and not used to train its models.
  • Skin-analysis technology provider — a specialist provider of AI skin analysis and guided-capture technology, based in the European Union and acting as our processor under a data processing agreement. Receives your skin-scan photographs and a random account identifier (never your name, email or contact details) solely to produce your reading, and returns the derived scores to us. Photographs are deleted once your reading is complete (within 24 hours at the latest). The derived scores it holds are deleted when you delete your account, and in any case after 2 years.
  • Shopify — E-commerce and payments platform. Holds order history, delivery addresses and payment processing. Card data is never seen by CellSync.
  • Klaviyo — Email and SMS marketing platform. Does not receive special category health data.
  • MongoDB Atlas — Database hosting in UK/EU region. Stores account, profile, scan metrics, allergy data, conversation history. Encrypted at rest and in transit.
  • Apple and Google — Social sign-in providers. Each operates under its own published privacy policy.
  • Meta Platforms Ireland Limited — Advertising and measurement via the Meta Pixel on our website. Receives browsing and purchase events where you have consented to marketing cookies. Receives no health, allergy, scan or photograph data. Acts as an independent controller for this data.
  • Open-Meteo — Weather data provider for local skin conditions. Receives only an approximate coordinate (rounded on your device to about 1 km) in order to return the forecast for that area. It receives no account details, no name, no photograph and no scan data.

5.1 What We Do NOT Share

  • Your facial photographs with anyone other than our skin-analysis provider, which uses them solely to produce your reading
  • Your password (we don't have it — only a one-way hash)
  • Your allergy or health data — never shared for marketing, advertising or commercial purposes
  • Your data with data brokers
  • Your health, allergy, skin-scan or photograph data with advertisers or social media platforms — the advertising cookies described in section 2.13 carry browsing and purchase activity only, and never this data

5.2 Legal Disclosures

We may disclose personal data where legally required — for example, in response to a valid court order, a regulatory request from the Information Commissioner's Office (ICO), or in connection with the investigation of fraud or other illegal activity. We will not disclose data voluntarily where we are not legally compelled to do so.

6. International Data Transfers

Where possible, your personal data is stored and processed within the UK or European Economic Area (EEA). Where processors are based outside this region, we ensure appropriate safeguards are in place under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Open-Meteo, which provides the local weather data described in section 2.11, is based in Germany and is therefore inside the EEA. Our skin-analysis provider is based in the European Union and processes your scan photographs, derived scores and guided-camera technical data on cloud infrastructure located in the European Union, which the UK recognises as providing an adequate level of data protection. Anthropic, which powers CELA and the Ingredient Scanner, is based in the United States; transfers to Anthropic are covered by the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum. Meta Platforms Ireland Limited, which provides the advertising measurement described in section 2.13, is established in Ireland but transfers data to the United States; those transfers are covered by the UK Extension to the EU-US Data Privacy Framework and by standard contractual clauses. You may request a copy of our standard transfer safeguards by emailing privacy@cellsync.co.uk.

7. Data Retention

We do not keep personal data for longer than necessary. Specific retention periods are set out below.

Data Type Retention Period Basis
Facial photographs (skin scans) Deleted as soon as your reading is complete; automated clean-up within 24 hours at the latest Data minimisation
Derived scores held by our skin-analysis provider Until you delete your account; no longer than 2 years from scan date Service provision
Guided camera quality checks (no images) 180 days Service improvement
Derived skin metrics 2 years from scan date (or earlier if account closed) Service provision
Ingredient scan results 2 years from scan date (or earlier if account closed) Service provision
Feedback and outcome data 2 years from submission (or earlier if account closed) Service improvement
CELA chat history 1 year from message date (or earlier if account closed) Service quality
Allergy and sensitivity data Until consent withdrawn; deleted within 30 days Explicit consent (Article 9)
Account and profile data Account lifetime + 30 days Contract performance
Order and payment records 7 years from order date Legal obligation (HMRC)
Consent records Account lifetime + 3 years Legal accountability
Unverified accounts Deleted after 48 hours Data minimisation
Backups Up to 90 days after primary deletion Disaster recovery

8. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights. We will respond to all valid requests within 30 days. To exercise any of these rights, please email privacy@cellsync.co.uk.

8.1 Right of Access (Article 15)

You may ask us to confirm what personal data we hold about you, and to provide a copy in a structured, commonly-used electronic format.

8.2 Right to Rectification (Article 16)

You may ask us to correct inaccurate or incomplete data. Most account and profile fields can be edited yourself within the app.

8.3 Right to Erasure (Article 17)

You may ask us to delete your personal data, subject to limited exceptions for legal retention (e.g. HMRC accounting records). Note: skin-scan photographs are deleted within 24 hours at the latest, so there is normally nothing left to erase. When you delete your account, we also delete the derived scores held by our skin-analysis provider.

8.4 Right to Restrict Processing (Article 18)

You may ask us to restrict how we use your data while a query is being resolved.

8.5 Right to Data Portability (Article 20)

You may ask us to export your data in a machine-readable format, or to transmit it to another controller.

8.6 Right to Object (Article 21)

You may object to processing based on legitimate interests or for direct marketing. We will stop the relevant processing unless we have compelling lawful grounds to continue.

8.7 Rights Related to Automated Decision-Making (Article 22)

CellSync uses AI for skin analysis and product recommendations. These outputs are advisory — they do not produce legal or similarly significant effects on you in the GDPR sense. You can override CELA's recommendations at any time, and human review is available on request via privacy@cellsync.co.uk.

8.8 Right to Withdraw Consent

Where processing is based on consent — including marketing, derived skin and physiological data, and allergy and health data — you can withdraw at any time. Withdrawal is straightforward through the Profile section of the app or by emailing privacy@cellsync.co.uk. Withdrawal does not require justification.

8.9 Right to Lodge a Complaint

If you believe we have mishandled your data, you can complain to the Information Commissioner's Office (ICO):

We would ask you to contact us first so that we have an opportunity to resolve the matter, but you are not required to do so.

9. Data Security

  • AES-256 encryption at rest
  • TLS 1.2+ encryption in transit
  • Role-based access controls limiting who can view or process personal data
  • Audit logging of access and processing events
  • Automated retention enforcement aligned with the schedule in Section 7
  • Email verification at account creation
  • CAPTCHA verification at sign-up
  • Password hashing using industry-standard one-way functions — we never see your password
  • Incident response procedures aligned with notification obligations under UK GDPR Article 33

Despite our best efforts, no system is perfectly secure. If you believe your CellSync account has been compromised, please email privacy@cellsync.co.uk immediately.

10. Cookies & Tracking

Our website and mobile app use cookies and similar technologies.

  • Strictly necessary cookies — required for the service to function; cannot be disabled
  • Analytics cookies — measure how the service is used; optional, consent-based
  • Marketing cookies — used by marketing partners; optional, consent-based

Our marketing cookies currently comprise the Meta Pixel, described in section 2.13. You can review or change your cookie preferences at any time through the cookie banner, the "Cookie Settings" link in our website footer, or by clearing cookies in your browser. Our Cookie Policy lists every cookie we set.

11. Children

CellSync is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, please contact support@cellsync.co.uk so we can promptly delete the information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our practices, or our services. Where changes are material, we will notify you by email and through an in-app notification at least 14 days before they take effect. Previous versions of this policy will remain available on request. The version history at the top of this document summarises the major changes. The most recent material change (v1.5, 17 September 2026) introduced advertising and analytics processing through the Meta Pixel, described in section 2.13. Version 1.6 (23 September 2026) corrected an illustrative product example in section 2A.2; it made no change to what we collect, how we use it, or your rights, and is not a material change. Version 1.7 (8 October 2026) is a material change: skin scans now use a guided three-angle camera, scan photographs are analysed by a specialist skin-analysis provider acting as our processor, and the metrics we store have changed (sections 2.3, 2.4, 2.12, 2.14, 5, 6, 7 and 8.3). It applies to new accounts from 8 October 2026; existing account holders were notified on 8 October 2026 and it takes effect for them on 22 October 2026.

13. Contact Us

For any questions about this Privacy Policy, your data, or your rights:

This is Privacy Policy version 1.7, dated 8 October 2026. Previous versions are available on request by emailing privacy@cellsync.co.uk.

Your bag