Regulatory
High severityRisk
Aesthetic preview imagery sits at the intersection of several regulatory regimes. GDPR treats face photos as biometric data, special-category data under Article 9, requiring explicit consent and documented processing basis. Medical device regulation (MDR in the EU, FDA in the US) applies if the tool is interpreted as predicting a clinical outcome. Cosmetic-procedure advertising is restricted by jurisdiction-specific rules, UK ASA guidelines, Germany's Heilmittelwerbegesetz, France's public-health advertising code, UAE's DHA and DHCC codes (notably strict on aesthetic advertising). And the medical vs non-medical distinction matters: a preview shown by a beauty salon for a treatment that legally requires a medical license in that jurisdiction is a regulatory problem for both the salon and, by extension, the operator.
Mitigation
The product is scoped as aesthetic visualization, not clinical prediction. Every generated image carries a visible "aesthetic preview only; not a clinical outcome prediction" disclosure. Consent is collected in-widget before any upload. Medical and non-medical contract templates are separated, with the salon-facing contract restricting the preview to treatments legal for non-medical providers in the target jurisdiction. Country-specific advertising-compliance notes are provided to the operator. Honest disclosure: this mitigation depends on the operator enforcing the medical/non-medical filter when onboarding. The marketplace cannot audit every clinic's licensing in every country, we rely on the operator's judgement, which is why the sales training is explicit about who to decline.

