graftle

Privacy Policy

This Privacy Policy describes how Graftle collects, uses, and protects your personal information when you use our hair assessment platform.

1. Information we collect

When you submit a hair assessment form, we collect the following information:

First name
Phone number
Uploaded photo of your hair/scalp
Hair loss stage selection (Norwood or Ludwig scale)
Qualifying answers (family history, prior transplant, current doctor)
IP address

2. How we use your information

Your information is used for the following purposes:

To analyze your uploaded photo using AI and generate a personalized hair assessment
To deliver your assessment results to you via a one-time SMS message
To share your lead data with the specific clinic whose intake form you submitted, so they can prepare for your consultation

3. SMS and mobile data

We will never sell, share, or disclose your mobile phone number or any mobile opt-in data to third parties or affiliates for marketing or promotional purposes. Mobile information collected as part of the SMS consent process is used solely to deliver your hair assessment results.

For full details on our SMS practices, see our SMS Consent & Communication Policy.

4. Data sharing

Your information is shared only with the specific clinic whose assessment form you completed. That clinic receives your name, phone number, assessment results, and qualifying answers to help them prepare for your consultation.

Graftle does not sell, rent, or trade your personal data to third parties. We do not share your information with any party other than the clinic you submitted your form to.

5. Data retention

Uploaded photos are retained for 90 days and then permanently deleted.
Lead records (name, phone, assessment results) are retained in accordance with each clinic's data retention agreement.
You may request deletion of your data at any time (see Your Rights below).

6. Data security

We take the security of your data seriously. Our infrastructure includes:

AES-256 encryption for data at rest
TLS encryption for all data in transit
HIPAA-aware architecture and access controls
Restricted database access limited to application processes only

7. Your rights

You have the right to:

Request a copy of the personal data we hold about you
Request deletion of your personal data at any time
Opt out of SMS communications by replying STOP to any message

To exercise any of these rights, contact us at support@graftle.com.

Contact us

Email: support@graftle.com

Last updated: March 22, 2026