Privacy Policy

01Scope of This Privacy Policy

91 ENTERPRISE LLC is the entity responsible for determining the purposes for which personal information is processed, except where another party independently determines how it processes information. By using ROOTÉ, you acknowledge that your personal information will be handled as described in this Privacy Policy. Where consent is legally required for a particular use, ROOTÉ will request that consent separately.

This Privacy Policy applies to personal information collected through:

• the ROOTÉ website
• the ROOTÉ hair-analysis experience
• ROOTÉ applications
• hair and scalp questionnaires
• photo-upload and camera features
• AI-assisted analysis
• personalized reports
• customer accounts
• purchases and subscriptions
• progress tracking
• customer support
• ROOTÉ Coach or chat functionality
• email, SMS and other communications
• and related ROOTÉ services

Separate privacy notices may apply to clinical, telehealth or prescription services provided by independent healthcare professionals.

02Identification and Contact Information

The information we collect depends on the services you choose to use. We may collect:

• first and last name
• email address
• telephone number
• account identifiers
• login information
• shipping address
• billing address
• country
• language preference
• and other contact details

03Hair and Scalp Photographs

When you use the ROOTÉ hair-analysis or progress-tracking features, you may provide photographs showing:

• your hair
• scalp
• hairline
• temples
• crown
• top of the head
• face or portions of your face
• and other visible physical characteristics

These photographs may be considered personal information and, depending on context and applicable law, may involve sensitive or health-related information.

04Hair and Health-Related Information

ROOTÉ questionnaires may request information concerning:

• hair-loss history
• areas of thinning
• duration of hair loss
• scalp symptoms
• previous treatments
• current hair-loss treatments
• medication use
• allergies or sensitivities
• medical conditions
• family history
• prior hair procedures
• treatment goals
• adverse reactions
• and other health-related information where relevant

Some of this information may constitute sensitive personal information or specially protected information under applicable law. Israeli law now distinguishes information of special sensitivity and imposes additional obligations in certain circumstances; under Amendment 13, certain large databases containing such information may also be subject to specific notification requirements.

05AI-Generated and Derived Information

ROOTÉ or its technology providers may generate information from your photographs and questionnaire responses. This may include:

• hair-pattern observations
• hair-loss stage
• density-related indicators
• scalp-visibility measurements
• hairline characteristics
• crown-related measurements
• image-quality scores
• confidence scores
• personalized recommendations
• treatment/program suggestions
• progress indicators
• comparison results
• and similar inferred or derived information

The exact measurements available depend on the technology used at the time.

06Transaction and Program Information

If you purchase a product or program, we may collect information such as:

• products ordered
• program duration
• subscription status
• billing status
• shipment history
• returns
• refunds
• discounts
• order number
• fulfillment status
• program start date
• routine or adherence information
• and progress history

Payment information is generally processed by independent payment processors. ROOTÉ does not intend to store full credit-card numbers or CVV/security codes on its own systems. We may retain masked payment references, such as card type, last four digits, expiration information, and payment-processor transaction identifiers.

07Technical and Device Information

When you use ROOTÉ, we may automatically collect information such as:

• IP address
• device type
• browser
• operating system
• screen size
• language
• approximate location derived from IP
• referring website
• session identifiers
• website activity
• technical logs
• security events
• and cookie or local-storage identifiers

ROOTÉ may use IP-derived location to select an initial market or language experience. It should not be treated as a definitive determination of your citizenship, residence or medical eligibility.

08Communications

We may collect information contained in communications with us, including customer-support requests, emails, chat messages, ROOTÉ Coach interactions, survey responses, complaints, feedback, refund requests, and communications regarding your program. If you communicate with a healthcare professional through a separate clinical service, additional privacy terms may apply.

09How We Use Personal Information — Provide the Service

ROOTÉ may process personal information in order to, for example:

• perform your hair analysis
• review submitted photographs
• process questionnaire answers
• generate a personalized report
• build a recommended program
• maintain your account
• provide progress tracking
• compare follow-up photographs
• and display your history

10Fulfill Purchases

Including processing orders, payments, shipping, refunds, subscription management, and customer service.

11Personalize Your Experience

For example, by displaying relevant content, adapting questionnaire paths, tailoring recommendations, and remembering your preferences.

12Improve Safety

We may use information to detect invalid images, identify technical errors, detect potential misuse, identify safety flags, and determine when a user should be directed toward professional medical evaluation.

13Communicate With You

Including sending your report, order notifications, delivery updates, account alerts, routine reminders, progress reminders, and customer-support responses.

14Improve ROOTÉ

We may use appropriately protected information to improve user experience, improve internal systems, measure product performance, debug software, improve recommendation logic, and develop new features. Any use of identifiable hair/scalp photographs for model training should be handled separately as described in the section on AI Model Training and Product Development below.

15Comply With Law

ROOTÉ may process information where necessary to comply with legal obligations, keep required business records, respond to lawful requests, investigate fraud, protect users, protect ROOTÉ's legal rights, and manage disputes.

16Hair Photographs and AI Analysis

Photographs submitted for hair analysis may be processed by ROOTÉ and/or authorized technology providers. Where enabled, ROOTÉ may use HairHealth.ai or another AI hair-analysis provider. The processing may include:

• automated image-quality assessment
• segmentation
• detection of hair/scalp regions
• analysis of visible characteristics
• calculation of measurements
• classification
• confidence scoring
• and generation of structured analysis results

AI results are estimates and may contain inaccuracies. Photographic variables such as lighting, distance, hair style, hair length, angle, camera quality, and scalp visibility can materially affect the result. ROOTÉ's AI hair analysis does not by itself constitute medical diagnosis.

17AI Model Training and Product Development

ROOTÉ will not intentionally use identifiable customer hair or scalp photographs to train AI models unless the customer has separately agreed to that use, or another lawful basis exists and the use has been clearly disclosed as required by applicable law. Consent to receive a ROOTÉ hair analysis should not automatically be treated as consent to unrelated AI-model training.

Where ROOTÉ uses third-party AI providers, ROOTÉ will seek contractual terms addressing:

• permitted processing purposes
• retention
• confidentiality
• deletion
• security
• model-training use
• subprocessors
• and data ownership

Some AI service providers may retain de-identified or anonymized derived metrics or image-related data for service improvement where permitted by applicable law and the applicable service agreement. ROOTÉ does not authorize the use of identifiable customer hair or scalp photographs for unrelated AI-model training without separate authorization where such authorization is required or promised.

18Before-and-After and Progress Tracking

If you choose to use ROOTÉ's progress-tracking features, we may retain repeat hair/scalp photographs so that they can be compared over time. ROOTÉ may store:

• baseline photographs
• follow-up photographs
• scan dates
• analysis results
• comparison measurements
• adherence information
• and progress history

These records may remain associated with your account unless you request deletion or until the applicable retention period expires. Cancellation of a subscription does not automatically mean deletion of your analysis or progress history. You may separately request deletion subject to applicable legal exceptions.

19How We Share Information

ROOTÉ does not sell personal information for money. We may disclose information to service providers where reasonably necessary to operate ROOTÉ, including:

• AI and analysis providers — for example, HairHealth.ai, where enabled
• cloud and hosting providers — used to operate websites, applications, databases and storage
• CRM providers — including HubSpot, where used
• payment providers — to process purchases and subscriptions
• fulfillment and shipping companies — to deliver orders
• email, SMS and messaging providers — to send service communications and, where permitted, marketing communications
• customer support providers — to assist customers
• analytics and security providers — to understand website performance and protect ROOTÉ
• professional advisers — including lawyers, accountants, auditors, insurers, and compliance consultants
• medical or telehealth providers — if ROOTÉ provides access to prescription or clinical services; such providers may independently be subject to professional privacy duties

20Service Data vs Marketing Data

Information provided for a hair analysis should not automatically be treated as permission to send unrelated advertising. ROOTÉ distinguishes between service communications (for example: your analysis is ready, order confirmation, shipment status, security notices, program reminders, and required service information) and marketing communications (for example: discounts, promotions, new products, commercial offers, newsletters).

Where applicable law requires consent to promotional marketing, ROOTÉ will request it separately. Marketing consent is optional. Declining promotional marketing should not prevent you from receiving a hair analysis or completing a purchase.

21HubSpot and CRM Use

ROOTÉ may use HubSpot or a similar CRM platform to manage customer accounts, leads, support requests, program communications, customer relationships, and marketing preferences. ROOTÉ limits the transfer of hair-analysis photographs and sensitive health information into CRM systems to information reasonably necessary for the relevant operational purpose and applies appropriate protections. ROOTÉ follows a data-minimization principle, meaning that a CRM should receive only information reasonably necessary for its intended purpose.

22No Sale of Sensitive Hair or Health Data

ROOTÉ does not intend to sell customer hair photographs, scalp photographs, questionnaire health information or AI analysis results to data brokers or advertisers. ROOTÉ will not intentionally disclose identifiable sensitive hair/health information to advertising platforms for behavioral-advertising purposes.

23Advertising Platforms

ROOTÉ may use platforms such as Meta, Google, TikTok, or similar advertising providers to advertise ROOTÉ. Where advertising technologies are used, ROOTÉ configures them to avoid intentionally transmitting raw scalp photographs, health questionnaire answers, medical information, or other sensitive health information as advertising-event data.

If ROOTÉ begins engaging in activity that legally constitutes “sale” or “sharing” of personal information under California law, appropriate notices and opt-out mechanisms must be provided. California law provides qualifying consumers rights including access, deletion, correction, opt-out of sale/sharing and, in some cases, limits on use of sensitive personal information.

24International Data Transfers

ROOTÉ is operated by a U.S. company and may serve customers in Israel and other countries. Your information may therefore be processed or stored in the United States, Israel, the United Kingdom, the European Economic Area, or other jurisdictions in which ROOTÉ's service providers operate.

Where personal information is transferred from Israel to another country, ROOTÉ will use a legally appropriate mechanism and appropriate safeguards where required. Israeli regulations impose specific conditions on transfers of database information abroad and generally require appropriate protections by the recipient.

Where an overseas provider processes information on behalf of ROOTÉ, ROOTÉ may use contractual data-protection obligations addressing:

• authorized use
• confidentiality
• security
• onward transfers
• subprocessors
• deletion
• and return of information

25Legal Bases for Processing

Where applicable privacy law requires a legal basis, ROOTÉ may process personal information based on one or more of the following: your request/contract (for example, to provide the hair analysis you requested, create your account, fulfill your order, or provide your purchased program); consent (where required for sensitive-data processing, AI analysis, marketing, photographs, certain tracking, or other purposes); legal obligations (for example, tax, accounting, regulatory compliance, fraud prevention, or lawful government requests); and legitimate business purposes where permitted by applicable law and not overridden by customer rights (for example, security, fraud prevention, software improvement, customer support, and service performance).

Where consent is the basis for processing, you may withdraw consent subject to applicable law and the practical consequences of withdrawal.

26Data Retention

ROOTÉ retains personal information only for as long as reasonably necessary. Retention periods may vary according to the type of information, for example:

• hair and scalp images — retained as necessary to provide analysis and progress tracking, unless the customer requests deletion or a legal reason requires longer retention
• questionnaire and analysis results — retained while reasonably necessary to maintain the customer's program and progress history
• account information — retained while the account is active and for a reasonable period after closure where needed for legal, security or administrative purposes
• order and payment records — certain records may be retained for accounting, tax, fraud-prevention and legal obligations
• customer support records — may be retained for quality assurance and dispute handling
• marketing information — retained until consent is withdrawn, the individual unsubscribes, or the information is no longer needed

ROOTÉ maintains or will maintain retention practices appropriate to the categories of information processed, applicable legal obligations, the customer relationship, and the sensitivity of the information. ROOTÉ does not retain personal information indefinitely merely because storage is technically available.

27Deletion and De-Identification

Where applicable, ROOTÉ may delete personal information or convert it into information that is no longer reasonably linkable to an identifiable individual. When a valid deletion request is received, ROOTÉ will delete or de-identify eligible information unless retention is permitted or required for reasons such as tax or accounting obligations, fraud prevention, legal claims, regulatory obligations, security, or another lawful requirement.

Deleted information may remain temporarily in backup systems until backups are overwritten in the ordinary course.

28Data Security

ROOTÉ uses reasonable administrative, organizational and technical safeguards designed to protect personal information. Such safeguards may include:

• encryption in transit
• encryption at rest where appropriate
• access controls
• role-based permissions
• authentication
• logging
• restricted staff access
• vendor agreements
• monitoring
• backup procedures
• and incident-response processes

ROOTÉ applies heightened access restrictions to hair photographs and health-related information compared with ordinary marketing information. No electronic system can be guaranteed to be completely secure.

29Data Breaches and Security Incidents

ROOTÉ maintains procedures intended to identify, investigate and respond to suspected security incidents. Where applicable law requires notification to affected individuals or regulators, ROOTÉ will make notifications as legally required.

30Your Privacy Rights

Depending on your location and applicable law, you may have rights concerning your personal information, including the right to:

• ask what information ROOTÉ holds about you
• access eligible personal information
• request correction
• request deletion
• withdraw consent
• object to certain processing
• restrict certain processing
• receive information about disclosures
• opt out of marketing
• and, where applicable, request data portability

ROOTÉ may verify your identity before responding to certain requests. Send privacy requests to support@roote.us.

31Rights of Users in Israel

Users in Israel may have rights under the Israeli Protection of Privacy Law and related regulations. Because ROOTÉ may process hair/scalp photographs and health-related questionnaire information, certain information may qualify as personal information of special sensitivity under Israeli law. ROOTÉ will apply applicable Israeli privacy, information-security, access/correction, database-governance, and cross-border-transfer requirements to the extent they apply to ROOTÉ and the relevant processing activity.

ROOTÉ will handle qualifying requests in accordance with applicable Israeli law. Where applicable, such rights may include rights relating to:

• access
• correction
• deletion in applicable circumstances
• information concerning data use
• security
• and withdrawal of consent where processing depends upon consent

Israel's current privacy framework also includes obligations concerning unnecessary data, data accuracy and deletion in certain contexts. If ROOTÉ maintains a database meeting statutory thresholds or categories under Israeli law, ROOTÉ will comply with applicable registration, notification, security and governance requirements.

32California Privacy Rights

If and to the extent ROOTÉ is subject to the California Consumer Privacy Act, as amended by the CPRA, California residents may have rights including:

• the right to know
• the right to access
• the right to delete
• the right to correct
• the right to opt out of sale or sharing
• the right to limit certain uses of sensitive personal information
• and the right not to be discriminated against for exercising applicable privacy rights

ROOTÉ does not currently intend to sell personal information for monetary consideration. If ROOTÉ begins engaging in conduct legally considered “selling” or “sharing,” this Privacy Policy and applicable opt-out mechanisms must be updated.

33Automated Decisions

ROOTÉ may use automated tools to analyze hair photographs, determine questionnaire routing, generate recommendations, prioritize educational content, or generate progress measurements. Consumer-facing AI recommendations do not independently authorize prescription medication. Where a treatment requires professional medical approval, the relevant clinical decision must be made through the applicable medical process.

34Children

ROOTÉ's standard consumer Services are intended for users aged 18 and older. ROOTÉ does not knowingly seek hair photographs or health-related questionnaire information from children through its normal adult assessment. If ROOTÉ learns that information from an ineligible minor has been collected through the standard flow, it may delete or restrict that information as appropriate.

35Account Closure vs Data Deletion

Closing an account, cancelling an order or cancelling a subscription are not necessarily the same as requesting deletion of personal information. For example: cancelling a subscription stops future qualifying renewals; closing an account removes access to the customer account; deleting personal data starts a privacy request for deletion of eligible information.

ROOTÉ treats subscription cancellation, account closure, and privacy deletion as separate actions and explains those distinctions in the application where applicable.

36Third-Party Links

ROOTÉ may contain links to websites or services operated independently by third parties. ROOTÉ does not control the privacy practices of independent third-party websites. Customers should review the privacy policies of those services.

37Business Transfers

If ROOTÉ or 91 ENTERPRISE LLC is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, personal information may be transferred as part of that transaction subject to applicable law and appropriate confidentiality protections.

38Required Disclosures

ROOTÉ may disclose information where reasonably necessary to comply with law, respond to a valid legal request, protect a person from harm, investigate suspected fraud, enforce legal agreements, defend legal claims, or protect ROOTÉ's rights and systems.

39Changes to This Privacy Policy

ROOTÉ may update this Privacy Policy as the Service changes, new providers are added, new products are offered, or privacy laws change. The date at the top indicates the latest revision. Where legally required, material changes will be communicated or additional consent will be requested.

40Contact ROOTÉ

For questions, privacy requests or complaints, contact ROOTÉ / 91 ENTERPRISE LLC at support@roote.us, +1 (310) 651-7283, or PO BOX 48112, LOS ANGELES, CA 90036, USA.