Privacy Policy
This policy explains what Derma Pal collects, why it is used, when it is shared, and the controls available to you.
1. Information we collect
Account and authentication
We may collect your email address, display name, sign-in provider identifiers, verification status, and security information used to maintain authenticated sessions. Passwords are stored only in hashed form.
Skin profile and preferences
We collect the onboarding answers you choose to provide, such as age or birth date, gender, skin type, visible concerns, diagnosed conditions you disclose, sensitivities, environment, goals, budget, routine preferences, and habits.
Routine and progress data
We store your generated routine, product categories, checklist activity, habit logs, reminders, progress summaries, assistant conversations, and changes you request.
Photos
If you choose to use photo features, we process the front and side images you capture. A pre-account onboarding image is used for the requested analysis and is not saved to your Derma Pal account. Progress check-in photos you submit after signing in are stored with your account so you can compare them over time.
Subscription and technical data
Apple provides verified subscription and entitlement information such as product, status, and transaction identifiers. Derma Pal does not receive your full payment-card details. We may also process limited device, app-version, IP-address, request, and error information for security, rate limiting, reliability, and abuse prevention.
2. How we use information
- Create, personalize, and update your skincare routine and habit plan.
- Sync your account, checklists, reminders, progress, and subscription access.
- Provide routine-aware product guidance and answer questions you ask.
- Operate photo check-ins and generate progress context.
- Authenticate users, prevent abuse, diagnose failures, and secure the service.
- Meet legal obligations and enforce our terms.
3. Photos and AI-assisted features
Derma Pal uses automated systems to help create routines, describe visible skin appearance, provide product-category guidance, and support assistant conversations. AI output can be incomplete or wrong and is not a medical diagnosis.
When an AI feature needs your onboarding context, question, or photo, only the information reasonably needed for that request is sent to the configured AI service. Photo analysis requests are configured to request zero-data-retention provider routing where supported. Derma Pal does not use facial recognition to identify you and does not create a biometric identity model from the guided photo capture.
4. When information is shared
We share information only as needed to operate Derma Pal, comply with law, protect users, or complete a transaction you request. Providers may include:
- Hosting, database, caching, and object-storage providers, including Cloudflare R2 for account photo storage.
- AI infrastructure providers used for routine, assistant, product-guidance, or photo-analysis requests.
- Apple for StoreKit subscriptions and Sign in with Apple, and Google when you choose Google sign-in.
- Email-delivery, monitoring, security, and support providers where enabled.
We do not sell your personal information. We may disclose information if required by law, to investigate fraud or abuse, or as part of a business reorganization subject to appropriate safeguards.
5. Retention and deletion
We retain account information while your account is active and for only as long afterward as reasonably necessary for security, legal compliance, dispute resolution, and backup cycles. Different records may have different retention periods.
You can delete your account from the profile menu in the app. Account deletion is designed to remove your profile, onboarding answers, routines, logs, assistant history, stored photo records, and associated object-storage files. Limited records may remain when required by law, needed to prevent fraud, or temporarily present in protected backups.
6. Your choices and rights
- Photo features are optional. You may decline camera or photo-library access in iOS Settings.
- You may review or update profile information in the app and request routine changes.
- You may sign out, revoke sessions, or delete your account and associated data.
- You may manage or cancel subscriptions through your Apple account.
- Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal information.
Derma Pal is not intended for children under 13. If you believe a child provided personal information without appropriate consent, contact us.
7. Security and international processing
We use technical and organizational safeguards intended to protect information, including encrypted transport, scoped authentication, server-side ownership checks, and restricted storage access. No system can guarantee absolute security.
Derma Pal and its providers may process information in countries other than where you live. Where required, we use appropriate safeguards for international transfers.
8. Changes to this policy
We may update this policy as Derma Pal changes. The effective date above shows the latest revision. Material changes may also be communicated in the app or through another appropriate channel.
9. Contact
Questions or privacy requests can be sent to [email protected].