Washington Consumer Health Data Privacy Policy

Effective November 3, 2026 · All of Us Portraits is a trade name of Cadia First Holdings LLC, a California limited liability company, 2817 High St, Apt 10, Oakland, CA 94619

Washington residents may order portraits of pets only for now, with photos that show no people. A photo of a pet contains no one's face, so these orders don't involve consumer health data, and we run no face detection or face matching on them. We keep this policy in place because a Washington resident may still appear in a photo someone else uploads, or in a pet photo by mistake.

We make AI portraits; we're not a health service. But Washington's My Health My Data Act (RCW 19.373) defines "biometric data," including "imagery of the … face … from which an identifier template can be extracted," as consumer health data. Because the photos you upload show faces, we treat them as consumer health data for Washington consumers and follow this policy. It adds to our main Privacy Policy.

1. Categories of consumer health data we collect

Images of the faces of the people in the photos you upload (and the resulting AI portraits and previews, which show those faces).
A resemblance score (1 to 10) for each person, showing how closely the portrait resembles them, a short note on anything that doesn't match, and a check for visual defects.

We don't collect any other health information, and we don't infer health information from your photos.

2. Sources

Directly from you, when you upload photos on our upload page. If you appear in a photo someone else uploaded, we received it from that person.

3. Why we collect it and how we use it

Only to provide the portrait you asked for:

to create the portrait;
to check how closely it resembles each person and pet, so we only show you portraits that pass;
to deliver it and let you re-download it.

We never use it to recognize or identify anyone, for advertising, to train AI, or to infer anything about anyone's health. We collect it with your consent, given on the upload page, and because it is necessary to provide the service you requested.

4. Categories of consumer health data we share

Face images, portraits and previews go to our service providers ("processors"), which handle them only on our instructions under written contracts. We don't share consumer health data with any third party for its own purposes, and we never sell it. We have no affiliates.

5. Processors that receive it, and how to contact them

Processor	Role	Contact
Google LLC (Gemini API, paid service)	creates the portrait	Google's U.S. privacy request page
Replicate, Inc.	backup portrait creation and print upscaling	[email protected]
Anthropic, PBC	likeness check	[email protected]
The Constant Company, LLC (Vultr)	runs our servers and stores files	[email protected]
Cloudflare, Inc.	network security and delivery; encrypted offsite backup of delivered portraits	[email protected]

6. How long we keep it

Uploaded photos, full-size renders and resemblance scores and notes: deleted 30 days after your portrait is delivered, or 30 days after upload if you don't order.
Previews you didn't buy: deleted with your photos.
Purchased portraits: kept 12 months so you can re-download them, then deleted. You can have them deleted sooner at any time.
Uploaded photos are never copied to backups. Database backup copies expire within 7 days; the encrypted offsite copy of purchased portraits is deleted within 24 hours of the originals.
The full schedule is in our Privacy Policy.

7. Your rights

You have the right to:

confirm whether we collect, share or sell your consumer health data, and access it, including a list of every processor and third party we've shared it with and how to contact them (above);
withdraw your consent to our collecting and sharing it;
have it deleted. We delete it from our systems (copies in our short-term backups expire within 7 days, and the offsite copy of delivered portraits within 24 hours) and notify every processor to delete it too. If you appear in someone else's photo or portrait, you can ask for deletion even though you didn't place the order.

8. How to exercise your rights

Email [email protected], ideally from the email address used for the order, and tell us what you'd like. You don't need an account. We may ask for information needed to confirm the request is yours. We respond without undue delay and within 45 days. If we need more time (up to 45 more days), we'll tell you why within the first 45 days. Requests are free (up to twice a year). We won't treat you differently for using these rights.

9. Appeals

If we decline your request, reply to our answer with the word "Appeal." We'll respond in writing within 45 days, explaining what we did or didn't do and why. If we deny your appeal, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint.

10. Changes

If we want to collect new categories of consumer health data, or use or share it for a new purpose, we'll ask for your consent first. We'll post changes here with a new effective date.

Questions: [email protected] · Cadia First Holdings LLC, 2817 High St, Apt 10, Oakland, CA 94619