PassportPhotoFlowThis Consumer Health Data Privacy Policy applies to residents of Washington and Nevada. It explains how PassportPhotoFlow, a business managed by Mobile Flow Ltd ("PassportPhotoFlow," "we," "us"), handles "consumer health data" as defined by Washington's My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (SB 370, NRS 603A), when you use passportphotoflow.com and our web app at app.passportphotoflow.com. It supplements our Privacy Notice and our Biometric Data Retention and Destruction Policy, which describe the other personal data we process.
1. Consumer Health Data We Collect and Why
| Category | Why we collect it and how we use it |
|---|---|
| Images of your face (the photos you take or upload, including a child's photo you take or upload as their parent or legal guardian) | To check each photo against the requirements and to make the photo files you order. We never use them to identify anyone or to infer anything about your health. |
| Face measurements (points on the face, such as the eyes and chin) | Made in your browser on your device only to check your photo; discarded when the check finishes and never sent to us or anyone else. |
We collect and use consumer health data only to provide the service you ask for, with your consent. We do not use it for advertising, to build profiles, or to infer anything about your health.
2. Where We Get It (Sources)
Directly from you, when you take or upload a photo in our web app, or from a child's parent or legal guardian when the photo is of a child. We do not get consumer health data from any other source.
3. Consumer Health Data We Share, and With Whom
Images of your face (your photos) pass through the service providers below, which host our services and process them only on our behalf to seal your photo and make your files. Face measurements are never shared: they never leave your device.
| Service provider (processor) | What it does for us | Privacy policy |
|---|---|---|
| Vercel | Runs our web app's server code; your photo passes through it to be sealed and to make your download files; not stored. | vercel.com/legal/privacy-policy |
| Google Cloud / Firebase | Stores order records and, only if you request a refund and upload a rejection notice, that attachment (90 days); never the face measurements. | firebase.google.com/support/privacy |
These service providers process consumer health data only on our behalf and under contracts that limit them to providing their service to us.
4. Third Parties and Affiliates
We do not share consumer health data with any third party other than the service providers listed in Section 3, and we do not share it with any affiliate. We do not share it with advertising or analytics partners; in the session analytics described in our Privacy Notice, your photos are always masked. We may disclose it only if the law requires us to, as described in our Privacy Notice.
5. Your Rights and How to Use Them
- Confirm and access. You can ask us to confirm whether we collect, share or sell your consumer health data, and to give you access to it, including a list of all third parties and affiliates with whom we have shared it and an email address or other online way to contact them.
- Delete. You can ask us to delete your consumer health data. We delete it from our records and tell every service provider that holds it to delete it too.
- Withdraw consent. You can withdraw your consent to the collection and sharing of your consumer health data at any time. We then stop collecting it and delete what we hold, except where the law requires us to keep it.
- How to make a request. Email support@passportphotoflow.com from the email address you used for your order, with "Consumer health data request" in the subject line. We may ask for information that lets us confirm the request is yours (for example, details of your order). We respond within 45 days of receiving your request; if we need more time, we may extend this once by another 45 days and tell you why within the first 45 days. Requests are free of charge up to twice in any 12 months.
- Appeal. If we decline your request, you can appeal by replying to our answer with "Appeal" in the subject line. We answer an appeal in writing within 45 days and explain our decision. If you live in Washington and we deny your appeal, you may contact the Washington State Attorney General at https://www.atg.wa.gov/file-complaint. If you live in Nevada and we deny your appeal, you may contact the Nevada Attorney General at https://ag.nv.gov/Complaints/File_Complaint/.
- No discrimination. We never charge you more, or offer you a worse service, because you used these rights.
6. We Do Not Sell Consumer Health Data
We do not sell consumer health data, and we do not use a geofence around any place that provides in-person health care services.
7. Changes to This Policy
If we change this policy, we post the new version on this page and change the "Last updated" date at the top. Before we collect or share consumer health data for a purpose not described here, we ask for your consent.
8. Contact Us
Email support@passportphotoflow.com or visit https://passportphotoflow.com/support. Mobile Flow Ltd, Kiryat HaMada St 20, Jerusalem, Israel 9777600.