Who we are
DermatoGPT is operated by Smart Things Research SRL ("DermatoGPT", "we", "us"), a company based in Bucharest, Romania. We are the data controller for the personal data described in this policy, which applies to our website at dermatogpt.app, the DermatoGPT app, and any emails we send you (together, the "Service").
For any privacy question or request, contact us at contact@dermatogpt.app.
Data we collect
Information you give us
- Contact details, such as your email address when you join early access or create an account.
- Skin photos you upload for an assessment.
- Health information you provide, such as symptoms, how long a concern has lasted, its location on your body, your age, skin type and relevant medical history.
- Messages you send us, for example support requests or feedback.
- Payment information if you subscribe to a paid plan. Payments are handled by our payment provider; we never see or store your full card number.
Information collected automatically
- Usage data, such as the pages and features you use, and when.
- Device and log data, such as IP address, browser type, operating system and error reports.
How we use your data
Under the EU General Data Protection Regulation (GDPR), we must have a legal basis for each use of your data:
- To provide assessments, analysing your photo and answers to show possible causes and next steps. Basis: performance of our contract with you, and your explicit consent for health data.
- To run your account and keep a history of your past assessments. Basis: contract.
- To keep the Service safe and reliable, including fixing bugs, preventing abuse and monitoring the quality and safety of our guidance. Basis: our legitimate interests.
- To improve our models using your photos and answers, only if you opt in. Basis: your explicit consent, which you can withdraw at any time.
- To send you updates about early access and product news. Basis: consent. Every email includes an unsubscribe link.
- To meet legal obligations, such as tax and accounting rules, or responding to lawful requests from authorities. Basis: legal obligation.
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. DermatoGPT's output is guidance for you to consider, not a medical decision.
Your photos and health data
Health data is a "special category" of personal data under the GDPR, and we treat it that way.
- We only process your photos and health information with your explicit consent, which we ask for before your first assessment.
- We never sell your data, and we never use it for advertising.
- We do not use your photos to train or improve our models unless you switch this on in your settings. You can switch it off at any time.
- If you opt in, a small number of de-identified cases may be reviewed by qualified clinicians working with us under strict confidentiality, to check the quality and safety of our guidance.
- You can delete any single assessment, or your whole account, at any time from the app or by emailing us.
Please only upload photos of your own skin, or of someone who has given you permission (or for whom you are the parent or legal guardian). Avoid including your face or identifying features unless they are part of the concern.
Where your data is stored
We store your photos and assessment data in the European Union. If a service provider needs to process personal data outside the European Economic Area, we only allow it where the destination has an adequacy decision from the European Commission or where we have put Standard Contractual Clauses and additional safeguards in place.
How long we keep your data
- Photos and assessments: for as long as your account is active, or until you delete them. Deleted items are permanently removed from our systems and backups within 30 days.
- Early access emails: until you unsubscribe, or 24 months after you signed up if you never create an account.
- Server logs: up to 12 months.
- Billing records: for as long as Romanian tax and accounting law requires.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate or incomplete;
- delete your data ("right to be forgotten");
- restrict or object to certain processing, including processing based on our legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw your consent at any time, without affecting processing that happened before.
To use any of these rights, email contact@dermatogpt.app. We will reply within one month. We may need to confirm your identity first.
You also have the right to complain to a data protection authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro. You can also contact the authority in the EU country where you live.
Security
We use encryption in transit (TLS) and at rest, strict access controls, and logging of access to sensitive data. Only a small number of team members can access personal data, and only when needed to support you or run the Service. No system is perfectly secure, but if a breach affects your data we will notify you and the relevant authority as the law requires.
Children
The Service is intended for people aged 18 and over. A parent or legal guardian may use DermatoGPT to ask about a concern affecting their child, in which case the parent or guardian is responsible for the information they provide. We do not knowingly create accounts for children.
Changes to this policy
We may update this policy as the Service develops. We will post the new version on this page and change the "last updated" date. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.
Contact us
Smart Things Research SRL
Bucharest, Romania
contact@dermatogpt.app