AI Transparency & Compliance Statement
Formal regulatory disclosure regarding the deployment, risk classification, non-medical cosmetic demarcation, data minimization protocols, and governance of Artificial Intelligence systems across the Divamea Platform, pursuant to Regulation (EU) 2024/1689 (EU AI Act) and Regulation (EU) 2016/679 (GDPR).
Transparency First (Art. 50)
Clear disclosure that users interact with AI. Permanent visible marking and machine-readable metadata on simulated routine visuals.
Cosmetic Demarcation (Non-MDR)
Evaluates strictly multi-parameter cosmetic metrics. Non-medical, non-diagnostic, strictly excluded from Medical Device Regulation (EU 2017/745).
30-Min Photo TTL & Purge
Original facial photos auto-expire after 30 minutes with storage purge. No biometric profiling; facial features anonymized.
Zero AI Model Training
Customer documents, prompts, and photos are strictly NEVER used to train foundation models. All inference is processed via enterprise-grade endpoints with strict zero-data-retention and zero-training commitments.
1. EU AI Act System Classification & Demarcation
Under Regulation (EU) 2024/1689 (EU AI Act), artificial intelligence systems deployed within the European Union are categorized into risk tiers: Prohibited Practices (Art. 5), High-Risk Systems (Art. 6 & Annex III), Specific Transparency Risk (Art. 50), and Minimal/General Risk.
- Absence of Prohibited Practices (Article 5): The Divamea platform does NOT implement subliminal manipulation, vulnerability exploitation, biometric categorization inferring protected sensitive traits, or real-time remote biometric identification.
- Strict Demarcation from High-Risk Biometric & Medical Systems (Art. 6 & Annex III): Divamea is an aesthetic and cosmetic customer engagement platform. It does not perform biometric identification, verification, or categorization of individuals, nor does it perform medical diagnoses or clinical triage. The platform operates outside the scope of High-Risk Annex III and Regulation (EU) 2017/745 (Medical Device Regulation - MDR).
- Transparency Obligations (Article 50): Divamea complies comprehensively with Art. 50 transparency requirements: notifying users of AI interaction (Art. 50(1)) and marking all synthetically generated before/after cosmetic simulations with visible watermarks and machine-readable metadata (Art. 50(2)).
2. Inventory of AI Engines & Processing Logic
The Divamea platform orchestrates specialized AI capabilities designed for aesthetic and skincare brand enablement:
2.1 Visual Skin Analysis Engine (Multi-Parameter Cosmetic Metrics)
The Visual Skin Analysis Engine evaluates user-uploaded facial photographs across multi-parameter cosmetic surface metrics:
- Blemishes, Redness, Skin Texture, Dark Spots / Hyperpigmentation, Pore Visibility, Under-Eye Circles, Surface Hydration, Fine Lines / Wrinkles, Radiance, and Skin Firmness.
Safety & Privacy Protocols (Client-Side Edge Redaction): Unlike legacy solutions requiring raw portrait transmission, Divamea executes client-side biometric redaction directly in the user's browser via WebAssembly and Canvas (GDPR Art. 9 & Art. 4(14)). Geometric opaque masks black out eyes, eyebrows, lips, and facial contours BEFORE any cloud transmission, ensuring Zero Biometric Leakage. The engine supports full frontal portraits, 3/4 profiles, medical goggles, and dermatological close-ups. Any processed cloud images are governed by a strict 30-minute Time-To-Live (TTL) with automated background storage purge, retaining strictly de-identified numerical cosmetic vectors.
2.2 Conversational AI (Retrieval-Augmented Generation - RAG)
The conversational assistant interacts in natural language (100+ languages supported; widget UI localized in 37 languages). Responses are strictly grounded in the verified brand knowledge base through semantic vector retrieval and intelligent folder routing. Every factual statement is accompanied by message-level document citations (filename, page numbers, timestamps, and similarity scores) to eliminate hallucination risk.
2.3 Product Catalog & Smart Recommendation Engine
Matches user cosmetic profiles and conversational preferences with the brand's verified product catalog (synced via Shopify, WooCommerce, PrestaShop, or Amazon SP-API). Recommendations are deterministic and catalog-constrained.
2.4 Visual Routine Simulation (Before/After Projection)
Visual simulations illustrate the prospective aesthetic benefits of consistent skincare routines. In strict adherence to Art. 50(2) EU AI Act, every simulated image is permanently marked with an explicit “AI Simulation · Non-Clinical Projection” indicator to ensure consumers are never misled into confusing synthetic projections with clinical outcomes.
3. Data Protection, Sub-Processors & GDPR Commitments
Pursuant to Articles 13, 14, and 28 of the GDPR, DISINDEX S.R.L. provides complete visibility into cloud sub-processors involved in platform AI execution:
| Sub-Processor | Role & Capability | Processing Location & Safeguards | Customer Data Training |
|---|---|---|---|
| Tier-1 Enterprise Multimodal & Vision Sub-Processors | Multimodal LLM inference, Vision cosmetic parameter evaluation, vector embedding | EU / US (EU-U.S. Data Privacy Framework & SCCs) | NO - Zero-retention enterprise terms |
| Tier-1 Enterprise Conversational LLM Sub-Processors | Conversational LLM chat inference & text generation | EU / US (EU-U.S. Data Privacy Framework & SCCs) | NO - Enterprise zero-data-retention |
| Supabase / PostgreSQL | Tenant database with Row-Level Security (RLS) | EU Frankfurt / Ireland (AWS/GCP infrastructure) | NO - Dedicated database storage only |
| Google Cloud Storage | Encrypted document & temporary photo storage (30-min TTL) | EU (europe-west1 / europe-west3) | NO - Infrastructure storage only |
⚠️ Strict Demarcation: Non-Medical Use Only (GDPR Art. 9 & MDR Demarcation)
The Divamea platform is not a medical device and is not intended for the diagnosis, cure, mitigation, treatment, or prevention of dermatological diseases (such as melanoma, severe dermatitis, psoriasis, or rosacea). Tenants and end users are strictly prohibited from uploading clinical health records or identifiable medical documentation. Skin analysis photos are processed exclusively for non-medical cosmetic self-assessment upon explicit user consent and are automatically purged after 30 minutes.
4. Human Oversight & Data Subject Rights
In accordance with Article 14 of the EU AI Act (Human Oversight) and Articles 15–22 of the GDPR:
- Brand & Practitioner Oversight: Brand tenants maintain full administrative control over assistant behavior, knowledge base contents, system prompts, product catalogs, and activation parameters. Human staff can review conversation histories, deactivate assistants, or intervene at any time.
- Right to Explanation & Contestability: End users interacting with the assistant have access to inline document sources and verification metadata. Users may decline AI skin analysis without impacting general website browsing.
- Atomic Right to Erasure: Pursuant to GDPR Art. 17, our backend provides an atomic
scrub_conversation_dataAPI function that immediately soft-deletes the conversation, permanently purges messages and retrieval events, scrubs personal fields, and triggers immediate storage deletion of associated photographs.
Questions & Regulatory Inquiries
For inquiries regarding our EU AI Act compliance program, Data Processing Agreements (DPA), or to exercise data protection rights, please contact our Data Protection Office at privacy@divamea.com or consult our Privacy Policy and Terms of Service.