Log inStart comparing
Your data

Your data. Kept safe.

Photos of your scalp and details about your health are private. Here, without small print: how we protect them technically, who sees what, where everything is kept and how to have it deleted.

Six layers of protection, always on

For us, data protection is not a paragraph in the terms, it is engineering. Each of these layers is built in and applies to every request, without you having to set anything.

  • Encrypted transfer

    Every connection between your device, Trichio and the clinics is encrypted. Someone on the same Wi-Fi cannot read along.

    HTTPS with TLS

  • Encrypted storage, in the EU

    Answers, photos and contact details are stored encrypted with AES-256 in data centres in the European Union, backups included.

    Supabase, AES-256 encryption at rest

  • Access only where it is needed

    The database checks who is asking on every single query. A clinic only sees requests assigned to it, never anyone else's.

    Row Level Security inside the database

  • Private photos

    Your photos have no public address. An assigned clinic gets a personal link that expires on its own after 10 minutes. We delete the photos 30 days after your choice or after the window closes.

    Private storage, signed links valid for 10 minutes, deletion after 30 days

  • No password to steal

    You sign in with a link sent by email. There is no password that could be guessed or leaked from another service.

    Magic link sign-in

  • Statistics without content

    To improve Trichio we only count which step was reached. Answers, photos, email and phone number never go into the statistics.

    PostHog (EU servers), no cookies

The lock is in the database. Not just in a promise.

That clinics only see your name after you choose is not an agreement you have to trust. The rule is built into the database itself: if a clinic asks for your contact details before you have confirmed it, it gets an empty answer.

A clinic asks for your name and email:
Before assignmentYour request is not assigned to itlocked
While offers are madeIt sees photos and details, you have not chosen yetlocked
After you confirmOnly the one clinic you chosereleased

The path of your data

The envelope shows where your contact details are. It stays closed until you open it yourself.

  1. 1. You enter them

    Answers, photos and contact details are stored encrypted at Trichio. No clinic sees them yet.

  2. 2. Clinics see photos

    Up to three partner clinics at a time receive photos and details, without your name, and make you an offer. If one declines or doesn't reply in time, another can take its place.

  3. 3. You release

    Only when you choose and confirm a clinic does exactly that one clinic get your contact details. The others never do.

Who sees what?

Up to 3 clinics at a time

before you choose

  • sees photos and details
  • does not see name, email, phone

The clinic you choose

after you confirm

  • sees photos and details
  • sees name, email, phone

The other clinics

after your choice

  • gets no contact details
  • gets no new details

Trichio

so the comparison works

  • sees everything you enter
  • uses it only for your request

You only release your phone number if you want to be contacted by phone. How the whole process works

Where your data is kept

We work with a few well-known service providers. Each one only gets what it needs for its job.

Database and photosSupabase · data centres in the EU
Everything you enter is kept here, stored encrypted. Sign-in also runs through it.
WebsiteVercel · USA, delivered worldwide
Delivers the pages and passes your input to the database over an encrypted connection.
EmailsResend · USA
Sends sign-in links and notifications. Gets your email address for this, never your photos.
OperatorEdert Ventures LLC · USA
Trichio is operated by a US company. That is why data is also transferred to the USA, only with your explicit consent.
Clinics outside the EUe.g. Turkey or Thailand
Only with your explicit consent. Where possible we sign EU standard contractual clauses with these clinics.

What we never do

  • Sell or rent out your data
  • Pass on your contact details without you choosing a clinic
  • Give your contact details to clinics you did not choose
  • Use advertising cookies or tracking pixels from ad networks
  • Inform your health insurer, employer or insurance companies
  • Bother you with sales calls

If something does go wrong

  • We follow up on every report of a security problem and close gaps as quickly as possible.
  • We report a data breach to the supervisory authority within 72 hours and inform you if there is a risk to you, as the GDPR requires.
  • Found a vulnerability? Write to us, we answer personally.

What you can do yourself

  • Do not forward sign-in links. Whoever has the link can get into your account while it is valid.
  • Trichio never asks you for a password or payment details. If you get a request like that, it is not from us.
  • Your head is all your photos need to show. No ID documents, no other people in the picture.

Your rights. Any time.

The GDPR puts you in control of your data. A short email is enough, no reason needed and free of charge.

  • Find out what we have stored
  • Correct wrong details
  • Have everything deleted
  • Get a copy of your data
  • Withdraw consent for the future
  • Complain to a data protection authority
Have everything deleted

Send us a short email. We delete your answers, photos and contact details.

support@trichio.comWithdrawing consent works the same way.
Already sent a request? In your account you can see at any time which data we hold. Go to your data

Questions about your data

Will my health insurer or employer find out?

No. Your data only goes to the clinics invited to your request and to the technical service providers above who work for us.

What happens to my photos if I do not choose a clinic?

We delete them automatically 30 days after the window for cost estimates closes, or earlier if you ask. No clinic gets your contact details.

Can I take back my release?

You can withdraw your consent for the future at any time. If a clinic has already received your contact details, it is responsible for them from then on.

Does Trichio see my photos?

Technically yes, so your request can be assigned to suitable clinics and we can help if something goes wrong. We only look at them when your request requires it.

Why is data transferred to the USA?

Trichio is operated by a US company, and the website and email delivery run through US providers. This only happens with your explicit consent. Database and photos are kept in data centres in the EU.

How long is my data kept?

We delete photos automatically 30 days after you choose or the window closes. We delete health information 6 months after your last activity if you don't choose a clinic, otherwise 12 months after the release. You can have it done earlier at any time with a short email.

Can clinics download my photos?

Until you choose a clinic, clinics may only view your photos on Trichio. Our terms prohibit saving, screenshots and other copies, and breaches lead to exclusion. A screenshot can't be fully prevented technically, which is why only partner clinics that have contractually committed to this get access, and your name isn't shown. The clinic you choose may save the photos for your consultation.

Compare at your own pace. Your contact details stay with you.

Start comparing Read the privacy policy