P072 · canonical /ai-tongue-explorer/privacy/ · legacy /ai-tongue-assessment/privacy/ should 301 here · index, follow
P072 · Privacy / Consent Control Center
AI Assessment Privacy & Consent
Before you upload a tongue photo, see exactly what data is collected, what the AI uses it for, whether it is stored or used for training, and how to delete or export your data.
This is the feature-specific privacy notice for the AI Tongue & Constitution Explorer; it supplements rather than replaces the site-wide Privacy Policy.
A tongue photo and AI-generated constitution/health-adjacent inference can be sensitive. P072 supplements the global Privacy Policy and treats this data as high-sensitivity operationally while exact legal classification remains jurisdiction- and processing-specific.
Data map
What the Explorer May Process
The exact live inventory controls. Unknown data categories are not filled with assumptions.
Input
Tongue Image
The submitted image needed for the assessment workflow.
Metadata
Only What Is Needed
Do not silently retain EXIF location, original filename or device metadata without a real purpose.
Derived
Assessment Data
May include visible-feature labels, image-quality score, constitution-oriented estimate, uncertainty, timestamp and model version.
By default, the tool should not ask for diagnosis, prescription list, medical record, insurance data or laboratory results unless a future feature has separately reviewed necessity and legal basis.
Consent design
Required vs Optional Processing
Do not bundle assessment, marketing, analytics, research and model training into one checkbox.
Illustrative Consent Architecture
Core assessment processing
Image processing needed to run the requested educational assessment.
Required if assessment runs
Save assessment history
Optional account/history feature when implemented.
Separate choice
Model improvement / training
Separate opt-in when consent is the selected basis; explain raw image vs derived data and withdrawal limits.
Separate choice
Research participation
Only if a real research use and notice exist.
Separate choice
This is policy architecture, not proof that the live controls are implemented. Consent must exist in the actual interface before upload where required.
Training choice
AI Training & Processor Secondary Use
Core assessment and optional model improvement should not silently become the same purpose.
Current Training Policy
Not Published
Do not promise technical model unlearning unless implemented.
Current AI Processors
Not Published
A processor receiving data means “we do not share data” may be false even when no advertising sale occurs.
Storage ledger
Storage & Retention
A public privacy notice should expose missing operational values rather than invent a reassuring retention period.
Data
Current Retention
Status
Raw tongue image
Not Published
Dynamic
Derived result
Not Published
Dynamic
Image-quality data
Not Published
Dynamic
Consent record
Not Published
Dynamic
Security logs
Not Published
Dynamic
Backups
Not Published
Dynamic
Rights
Deletion, Export & Withdrawal
Do not promise “instant deletion from all backups” or export functionality before it exists.
Delete RouteNot Published
Export StatusNot Published
Age RuleNot Published
Ad/Tracking AuditNot Published
Where consent is used, withdrawal should be as practical as giving consent. Explain what stops, what may be retained by law and what can or cannot be removed from an already trained model.
Legal-classification caution
Is a Tongue Photo “Biometric Data”?
Do not make a universal cross-country statement. Legal classification depends on the technical processing and purpose; health-related inferences can create separate sensitive-data questions.
Operational policy: treat tongue images and constitution/health-adjacent inferences as high-sensitivity personal data while documenting the exact legal classification separately by jurisdiction and purpose.
Policy relationship
Which Privacy Page Controls What?
P072 is specific to the AI feature; P055 remains the site-wide privacy owner.
P072
AI Feature Notice
Tongue photo, inference, training choice, retention, deletion and processor detail.
P055
Global Privacy Policy
Account, orders, payments, contact, analytics and broader rights.