Effective date: September 1, 2026
This Data Processing Agreement ("DPA") describes how Tabitha F Hair INC ("TrichoEDU", "we," "us," or "our") processes personal data on behalf of a TrichoMAP account holder in the course of providing the service. It is incorporated into the Terms of Service at /legal/terms and applies whenever an account holder enters client personal data into TrichoMAP.
The account holder is the controller of the client personal data they enter into TrichoMAP — they decide what to collect and why. TrichoEDU is the processor, acting only on the controller's documented instructions. Using the service and entering data into it is the instruction; TrichoEDU does not decide, on its own, what client data to collect or how to use it beyond providing the service.
Processing under this DPA covers: storing the intake answers, notes, and uploaded files a controller enters or collects; using AI assistance to help draft the internal summary and client email for each evaluation; emailing the account holder about their account and usage; and letting the controller export their data. Nothing beyond this.
The data processed includes client identity and contact details, and health-adjacent information about hair, scalp, health, and lifestyle drawn from intake answers, notes, test results, and uploaded files. We treat this information as sensitive in kind — worth the same care as the categories of data that statutes single out for special protection — even where no specific statute classifies it that way.
We maintain the following as commitments to every controller: each account's data is kept isolated from every other account's at the data layer, so one account cannot see another's information; all traffic to and from TrichoMAP is encrypted in transit; access to the underlying systems is limited to the operator, Amaris Digital LLC, for the purpose of running and maintaining the service; and files and stored data live on EU-hosted infrastructure (Hetzner). Our arrangement with Anthropic, the provider of the AI assistance used to help draft documents, is still being finalized as of September 1, 2026 — we intend for that arrangement to confirm that client data sent to Anthropic is not retained beyond what is needed to serve the request and is not used to train Anthropic's models, and this section will be updated to state that as fact once the arrangement is complete rather than pending.
TrichoEDU uses the following subprocessors to provide TrichoMAP:
We will notify account holders by email before adding a new subprocessor. A controller who objects to a new subprocessor may close their account and export their data as described in Section 7.
If we become aware of a personal-data breach affecting a controller's client data, we will notify the affected controller without undue delay, including what is known at the time: the nature of the breach, its likely consequences, and the measures taken or proposed to address it.
Before closing their account, a controller may export all of their data using the "download all my data" option on their account page. After an account closes, we delete the controller's data within 90 days, the same window described in our Privacy Policy.
A controller may reasonably request written information from us about the processing described in this DPA — an audit by questionnaire, rather than an on-site inspection — and we will respond in reasonable time.
If and to the extent HIPAA applies to a controller's use of TrichoMAP, a separately executed Business Associate Agreement supersedes this DPA for the data it covers.
Questions about this DPA can be sent to info@trichoedu.com.