Effective Date: March 2026

Sthetic AI Inc. (“Sthetic AI,” “we,” “us,” or “our”) operates an AI-powered facial analysis and visualization platform intended to support aesthetic consultation workflows. This Privacy Policy explains how we collect, use, store, share, retain, and protect personal information, including face-related data, when you use our app, platform, and related services.

By using our services, you acknowledge that your information will be handled as described in this

Privacy Policy.

1. Information We Collect

We may collect the following categories of information:

a. Personal Information We may collect personal information such as your name, email address,

phone number, clinic information, account details,and other contact information you provide to us.

b. Face Data As part of providing our services, we may collect and process face-related data (“Face Data”), which may include facial scan data, facial images, facial videos, depth data captured by the device camera or sensors, and related raw scan data used to generate facial analysis results and visualizations.

c. Device and Technical Information We may collect device identifiers, operating system information, app version, log data, IP address, network information, crash reports, and similar technical information related to your use of the platform.

d. Usage Information We may collect information about how users and clinics interact with the

platform, including feature usage, session activity, and other operational data.

2. How We Use Information

We may use collected information for the following purposes:

• to provide, operate, maintain, and improve our services;

• to perform facial scanning, processing, analysis, visualization, and, where applicable, regeneration of results from retained raw scan data;

• to generate consultation support materials and related outputs;

• to communicate with users, clinics, and customers;

• to provide customer support, troubleshooting, quality assurance, and technical support;

• to monitor, protect, and improve the security and integrity of the platform;

• to enforce our agreements, policies, and terms;

• to comply with applicable legal, regulatory, and contractual obligations.

3. Face Data Collection, Storage, Sharing, and Retention

Because our services involve facial scanning and visualization, we provide the following additional disclosures regarding Face Data.

a. Why We Collect Face Data

We collect and process Face Data only as reasonably necessary to:

• capture and process facial scans;

• generate facial analysis results and visualizations requested by the user or clinic;

• regenerate results from retained raw scan data if locally stored results are accidentally deleted within the retention period;

• provide customer support, troubleshooting, quality assurance, and platform security.

b. Whether We Retain Face Data

We retain only certain raw Face Data for a limited period of time as necessary to support the services described in this Privacy Policy. We do not retain Face Data

indefinitely.

c. What Face Data We Retain

We may retain raw facial scan data, including facial images, facial videos, and depth data captured during the scanning process.

We do not retain processed facial analysis results, visualizations, or other generated outputs on a long-term basis. If a user or clinic later needs those results again, we may regenerate them from retained raw scan data, provided the raw scan data is still within the retention period described below.

Raw facial scan data may be retained for up to six (6) months from the date of upload. We retain this raw scan data for this period in order to support service continuity and allow us to regenerate results if a user or clinic accidentally deletes locally stored results within that period. After the six (6) month retention period, the raw facial scan data is deleted or de-identified in accordance with our retention practices, unless a longer retention period is required by law.

d. Where Face Data Is Stored and How It Is Processed

Retained raw facial scan data may be uploaded to and stored in secure cloud storage, including Amazon Web Services (“AWS”) S3.

Face Data may be processed through secure infrastructure operated by us or by trusted service

providers acting on our behalf, solely as necessary to provide, support, secure, and maintain our

services.

e. Sharing of Face Data and Third-Party Storage

We do not sell Face Data. We do not share Face Data with third parties for their own advertising or marketing purposes.

We may share Face Data only with trusted service providers acting on our behalf and only to the extent reasonably necessary to host, store, process, secure, support, and maintain our services.

Trusted service providers that host or process Face Data on our behalf, including cloud infrastructure providers, may store or process retained raw facial scan data only for the purpose of providing services to us and not for their own independent use, marketing, or advertising purposes.

Any such third-party storage or processing of retained raw facial scan data is limited to the retention period described in this Privacy Policy, unless a longer period is required by law.

f. Legal Disclosure of Face Data

We may disclose Face Data if required to do so by law, regulation, legal process, or governmental

request, or when we believe disclosure is reasonably necessary to protect our rights, enforce ouragreements, prevent fraud or misuse, protect users or the public, or maintain platform security.

4. Data Sharing

In addition to the Face Data disclosures above, we may share personal information in the following circumstances:

• with service providers that help us operate our business and platform;

• with affiliated entities or business partners as part of operating the services, where permitted by law;

• in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction;

• where disclosure is required by law or reasonably necessary to protect rights, safety, and security.

We do not sell personal information to third parties for their own marketing purposes.

5. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information and Face Data from unauthorized access, disclosure, alteration, or destruction.

However, no method of electronic transmission, storage, or processing is completely secure, and we cannot guarantee absolute security.

6. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services, maintain records, resolve disputes, enforce agreements, protect platform integrity, and comply with legal obligations.

When personal information is no longer reasonably necessary for these purposes, we delete it, de-identify it, or otherwise dispose of it in accordance with our retention practices and applicable law.

7. Your Rights and Choices

Depending on your jurisdiction and the nature of your relationship with us, you may have rights to:

• request access to personal information we hold about you;

• request correction of inaccurate information;

• request deletion of personal information, including certain Face Data, subject to applicable legal, contractual, security, and operational limitations;

• withdraw consent where processing is based on consent, to the extent permitted by law;

• contact us with questions or concerns regarding our privacy practices.

To exercise applicable rights, please contact us using the contact information below.

8. Children's Privacy

Our services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 without appropriate authorization. If we learn that we have collected personal information from a child in a manner inconsistent with applicable law, we will take reasonable steps to delete it.

9. International Processing

Your information may be processed and stored in jurisdictions outside your province, state, or country, including where our service providers operate. By using the services, you understand that information may be transferred to and processed in other jurisdictions, subject to applicable safeguards and legal requirements.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we may provide

notice through the app, website, or other appropriate means. The “Effective Date” at the top of this

Privacy Policy indicates when the current version became effective.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Sthetic AI Inc.

Email: contact@sthetic.ai