DermaView

1. Introduction
Welcome to DermaView. We are a standardization and documentation tool that helps you create a consistent skin timeline and keep it organized over time. This Privacy Policy explains how we collect, use, protect, and handle your personal information.
 
Important: DermaView is a standardization and documentation tool, NOT a medical device. We help you create a standardized skin timeline that you can share with your healthcare provider. All documentation decisions remain yours.
 
Who We Are
 
DermaView is operated by DermaView LLC.
 
You can contact us at:
 

• Email: privacy@dermaview.io

• Address: 202 Walton Way, Suite 192-133, Cedar Park, TX 78613
   

2. Information We Collect
2.1 Account Information
 
When you create an account, we collect:
 

• Email address (for authentication and account recovery)

• Name (optional, for personalization)

• Authentication credentials (managed securely through Google Sign-In or email link)

 
2.2 Skin Photography Data
 
When you use DermaView to document your skin, we collect:
 

• Photographs you take using our Progressive Web App (PWA)

• Metadata about your photos:

  • Date and time of capture

  • Body location tag (selected by you from predefined options)

  • Image quality measurements (blur and lighting checks)

  • Calibration marker read results

  • Device type and browser information

  • User-added notes or annotations (optional)

  • References linking a photograph to an earlier photograph when you use guided repositioning, together with the size of the adjustment and the time it was made

 
HOW YOUR PHOTOGRAPHS ARE HANDLED
 
Processing is automated. Software reads the calibration marker in your photograph and checks the image for blur and lighting problems.
 
No DermaView employee, engineer, contractor, or support representative views your photographs. Troubleshooting is performed using metadata only. See Section 4.2.
 
2.3 Technical and Usage Data
 
We automatically collect:
 

• Device information: Browser type, operating system, screen resolution

• Usage data: app interactions, feature usage, and error logs. These records may reference which photograph an action related to, but do not contain image content and do not include your name or contact details.

• Performance data: load times, marker-read success rates (anonymized and aggregated)

 
2.4 Information We Do Not Collect — each statement below is a limitation, not a feature:
 

• DermaView does not collect medical diagnoses or health records.

• DermaView does not collect genomic or biometric data beyond the photographs you choose to upload.

• DermaView does not collect location data or GPS coordinates.

• DermaView does not collect financial information. During the Phase A beta program, no payments are processed.

• DermaView does not collect Social Security numbers or government identification numbers.
   

3. How We Use Your Information
3.1 Primary Purposes (With Your Consent)
 
We use your information to:
 

• Provide the Service: store, organize, and display your skin timeline.

• Enable Sharing: allow you to export or share your visual records with healthcare providers.

• Check Image Quality: check photographs for blur and lighting problems and guide you to retake if needed.

• Standardize Photographs: read the calibration marker in your photograph so that images can be compared consistently over time.

• Communicate: send service updates, account notifications, and educational content. You can opt out of non-essential messages.

 
3.2 What We Do Not Do — each statement below is a limitation, not a feature:
 

• DermaView does not analyze your photographs for medical diagnoses or risk assessment.

• DermaView does not share your photographs with third parties, except as required by law or when you choose to share them.

• DermaView does not use your photographs to train artificial-intelligence models.

• DermaView does not sell your personal data to advertisers or data brokers.

• DermaView does not permit its personnel to view your photographs. See Section 4.2 for the one narrow circumstance in which we may be legally compelled to disclose specific images.
   

4. Zero-Trust Security Architecture
4.1 Encryption
 

• At Rest: All photos are encrypted using AES-256 encryption in Firebase Storage (Google Cloud Platform)

• In Transit: All data transmission uses TLS 1.3 encryption

• Access Control: Photos are stored in private, access-controlled storage buckets

 
4.2 Human Access to Photographs
 
No DermaView employee, engineer, contractor, or support representative views your photographs. This is an architectural commitment, not a policy preference: our systems are configured so that photographs are accessible only through your authenticated account.
 

• Engineering: engineers work from metadata logs — timestamps, file sizes, marker-read results, error codes — not from image content.

• Support: customer support assists with account issues using metadata only. We will never ask you to send us a photograph, and if you send one we will ask you not to and will delete it.

• Legal compulsion: if we receive a valid legal order requiring disclosure of specific images, we will comply. We will notify you unless prohibited by law. See Section 5.1.3.

 
4.3 Infrastructure
 

• Hosting: Google Cloud Platform (Firebase), in United States regions.

• Storage: photographs are held in private, access-controlled storage buckets.

• Audit logging: data access attempts are recorded in Firebase Audit Logs.

 
4.4 Your Controls
 

• Access: only you can access your photographs, through your authenticated account.

• Deletion: you can have your photographs or your entire account deleted at any time. See Section 6.3.

• Export: you can export your photograph timeline. See Section 6.1.

 
4.5 Beta Program (Phase A)
 
DermaView is currently running a closed beta program. The access model described in Section 4.2 applies to beta participants in full and without exception — there is no beta carve-out.
 
Beta participants accept a separate Beta Participant Terms document when they join. It sets out the beta-specific commitments, including the 30-day deletion commitment described in Section 6.3 and the commitment that beta participants' data is never sold or licensed.
 
The beta program is limited to participants aged 18 or older, documenting their own skin. See Section 8.

5. Data Sharing and Disclosure
5.1 We Share Your Data Only When:
 
5.1.1 You Explicitly Consent
 

• Healthcare Provider Sharing: If you choose to export or share your timeline with a doctor

 
5.1.2 Service Providers
 
We use the following service providers to operate DermaView:
 

• Cloud infrastructure and storage — Google Cloud Platform (Firebase). Your photographs are stored here, encrypted at rest. Google provides infrastructure to us and is not permitted to use your photographs for its own purposes.

• Website and marketing email — Wix. Hosts our website and sign-up forms and sends beta and product email. Receives your email address and form responses. Does not receive your photographs.

• Business email — Zoho. Handles email we send and receive at our dermaview.io addresses. Does not receive your photographs.

• Analytics — Google Analytics. Receives anonymized usage data as described in Section 10.2. Does not receive your photographs.

 
Apart from our cloud infrastructure provider, which stores your photographs so that the Service can display them back to you, no service provider receives your photographs. No service provider is permitted to use your photographs, or any data we share with it, for its own purposes.
 
5.1.3 Legal Requirements
 
We may disclose data if required by:
 

• Valid legal process (subpoena, court order)

• Law enforcement with appropriate legal authority

• Protection of our rights or safety of users

 
Standard: We will notify you before disclosure unless legally prohibited.
 
5.2 We Do NOT Share Data For:
 

• ❌ Advertising or marketing by third parties

• ❌ Sale to data brokers

• ❌ AI model training by external companies

• ❌ Insurance underwriting or employment screening
   

6. Your Rights and Choices
6.1 Access and Portability
 

• View: Access all your photos and metadata through the app

• Export: Download your complete timeline in a standard, machine-readable format

• Copy: Request a copy of your data in machine-readable format

 
6.2 Correction
 

• Update: Edit body location tags, notes, or account information at any time

• Request: Contact us to correct any inaccuracies

 
6.3 Deletion
 

• Account deletion: you may request deletion of your account at any time by emailing privacy@dermaview.io. All associated photographs and data are permanently removed within 30 days.

• Individual photographs: during the Phase A beta program, to remove a specific photograph, email privacy@dermaview.io and we will remove it.

• Right to be forgotten: we honor deletion requests in accordance with applicable privacy laws.

 
6.4 Opt-Out Rights
 

• Marketing Emails: Unsubscribe from newsletters (service notifications still required)
   

7. Data Retention
7.1 Active Account
 

• Photos: Retained while your account is active (you control retention)

• Metadata: Retained to support timeline functionality

• Usage Logs: Retained for 12 months (anonymized after 90 days)

 
7.2 Account Deletion
 

• Photos: Permanently deleted within 30 days of deletion request

• Metadata: Anonymized and retained for 90 days for audit purposes, then deleted

• Backups: Removed from backup systems within 90 days

 
7.3 Regulatory Retention
 
If required by law (e.g., financial records for tax compliance), minimal data may be retained for the legally required period.
8. Children's Privacy
DermaView is for adults documenting their own skin. You must be at least 18 years old to use DermaView.
 
During the Phase A beta program, DermaView may be used only by participants aged 18 or older, and only to document their own skin. Do not create an account for, or upload photographs of, a child or any other person — including a child for whom you are the parent or legal guardian. We will tell you if this changes in a future release.
 
If we learn that we have collected information from a person under 18, we will delete it promptly.

9. Where Your Data Is Held
DermaView data is hosted on Google Cloud Platform in United States regions.
 
During the Phase A beta program, DermaView is open to participants in the United States only.
 
If DermaView becomes available outside the United States, we will update this policy to describe the applicable data-transfer safeguards and your rights under local law before doing so.

10. Cookies and Tracking
10.1 Essential Cookies
 
We use cookies and similar technologies for:
 

• Authentication: Keeping you logged in

• Session Management: Maintaining app state

• Security: Preventing fraud and abuse

 
10.2 Optional Cookies
 
With your consent, we may use:
 

• Analytics Cookies: Google Analytics (anonymized) to improve the app

• Performance Cookies: To monitor app load times and errors

 
Your Choice: You can disable non-essential cookies in your browser settings. Essential cookies are required for the service to function.
 
We do NOT use:
 

• ❌ Advertising or tracking cookies

• ❌ Third-party advertising networks

• ❌ Cross-site tracking
   

11. Changes to This Policy
We may update this Privacy Policy to reflect changes in applicable law, new features or services, or feedback from users and regulators.
 
Notification. For material changes, we will notify you by email and in-app notification 30 days before the changes take effect. Minor changes are posted to this page with an updated "Last Updated" date.
 
Commitments that do not change for you. Some commitments we make to you when you join continue to apply to you even if we later change this policy for new users. In particular, the commitments made to Phase A beta participants in the Beta Participant Terms — including the commitment never to sell or license their data — continue to apply to those participants permanently, regardless of any future version of this policy. We will not use the notice mechanism above to weaken those commitments.
 
Your consent. For changes other than those described immediately above, continued use of the Service after notification constitutes acceptance.
 
Version history. Prior versions of this policy are available on request at privacy@dermaview.io.

12. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
 
12.1 Right to Know
 
Request disclosure of:
 

• Categories of personal information collected

• Sources of that information

• Business purpose for collection

• Categories of third parties with whom we share data

 
12.2 Right to Delete
 
Request deletion of your personal information (subject to legal exceptions)
 
12.3 Right to Opt-Out
 
DermaView does not sell or share personal information, as those terms are defined under the California Consumer Privacy Act.
 
12.4 Right to Non-Discrimination
 
We will not discriminate against you for exercising your CCPA rights.
 
How to Exercise: Email privacy@dermaview.io with subject line "CCPA Request"
 
Response Time: We will respond within 45 days.

13. Contact Us
Privacy Questions or Requests:
 

• Email: privacy@dermaview.io

• Subject Line Format:

  • "Access Request" — to view your data

  • "Deletion Request" — to delete your account

  • "Privacy Question" — for general inquiries

 
Legal Notices:
 

• Address: 202 Walton Way, Suite 192-133, Cedar Park, TX 78613

 
Response Time: We aim to respond to all privacy inquiries within 48 hours (excluding weekends/holidays).

14. Effective Date and Acceptance
Effective Date: [date v1.7 goes live — use your publish day] Last Updated: August 7, 2026 Acceptance: By creating an account or using DermaView, you acknowledge that you have read, understood, and agree to this Privacy Policy. Document Status: v1.7