Privacy Policy of SkinTracker App

Last updated: October 2026

This Privacy Policy describes how DermIA S.r.l. collects and processes personal data of users of the SkinTracker App, in accordance with Regulation (EU) 2016/679 (GDPR).

Data controller: DermIA S.R.L.

Registered office: Viale Luigi Majno 28, 20122 Milano (MI)

Email: info@dermia.org

VAT number: 14454230963

Data We Process

• Account: email address, display name of your choice, and role (patient, dermatologist, administrator). If you sign in via Google, we also receive your Google account identifier, as well as the name and profile picture provided by Google along with your email address; however, we do not use this information.
  
• Profile: gender and year of birth, if provided by you.
  
• Lesion Diary: the location of lesions on the body map, photographs, and overview images. These remain on your phone and are not transmitted to us, unless you choose to attach them to a teleconsultation.
  
• Teleconsultation (if used): the photos you choose to submit — stripped of metadata (no GPS location or device data)—the location of the lesion on the body map, responses to questionnaires, your questions and messages, the dermatologist’s written response, and any requests from the dermatologist for additional photos. This constitutes health-related data.
  
• Consents: a record of what you have consented to, including the date and the version of the text.
  
• Access Log: account identifier, action performed (e.g., “teleconsultation submitted”), and date. This log does not contain clinical content.
  
• Interest Statistics: the frequency with which users access pages for features that are not yet available. This data contains no identifiers — neither yours nor your device’s.
  
• Usage statistics: collected once a day when you open the app, including the week of installation, the number of days since installation, your operating system, and whether it is your first use of the week or month. No identifiers — neither yours nor your phone’s — are included, and no health data is collected. You can disable this feature under Profile > Privacy.
  
• Technical data: IP address and connection data, processed by server providers to deliver and secure the service.
  

Your approximate location, if you choose to share it, is used only on your device to sort dermatologists by distance; it is never sent to us.

Why we process your data and on what legal basis

• Creating and managing your account and enabling access to the app: performance of a contract (Art. 6.1.b).
  
• Transmitting your teleconsultation to a dermatologist and displaying their response: your explicit consent for the processing of health data (Art. 9.2.a), which we request before each submission and which you may revoke.
  
• Ensuring service security, maintaining records of consent, and logging access: legal obligation and legitimate interest (Art. 6.1.c and 6.1.f).
  
• Aggregated statistics on interest in new features: legitimate interest (Art. 6.1.f), with no identifiers.
  
• Aggregated statistics on app usage over time: legitimate interest (Art. 6.1.f), with no identifiers; you may object to this by disabling it under Profile > Privacy.
  

The app does not provide diagnoses, measure lesions, or assign priority levels; clinical assessments are made solely by the dermatologist. We do not engage in profiling, nor do we make automated decisions that affect you.

Is it mandatory to provide this information?

An email address is required to create an account. Consent for health-related data is required solely for teleconsultations; you may use all other features without providing such consent.

Who has access to your data

• The dermatologist handling your teleconsultation: they can see the information you have submitted, your gender, and your year of birth, but not your name or email address. While a request is in the queue, it may be viewed by verified dermatologists on the platform who are available to take on the case.
  
• Service providers who process data on our behalf (data processors): Supabase Inc., which handles databases, image storage, and authentication, with servers located in the European Union (Frankfurt).
  
• Google (Google Ireland Limited): only if you choose the “Continue with Google” option. Google verifies your identity and shares your email address, name, and profile picture with us. For this login process, Google acts as an independent data controller — governed by its own privacy policy (policies.google.com/privacy) — and becomes aware that you use SkinTracker.
  
• OpenFreeMap (a mapping service): receives your IP address and the map area you are viewing when you open the dermatologist map.
  

We do not sell or share your data with third parties for commercial purposes.

Transfers outside the European Union

Data is stored within the EU. Supabase Inc. is based in the United States; any access from abroad—for instance, for technical support — is subject to the safeguards required by the GDPR.

Retention period

Data is retained for as long as your account exists. If you delete your account, we will immediately remove your account, profile, lesion records, photos, teleconsultations, messages, dermatologist responses, and consents — both from the service platform and from your device. All that remains is the access log, containing an identifier that no longer points back to you, for [LOG RETENTION PERIOD]. Backup copies held by our service provider are overwritten within [BACKUP RETENTION PERIOD].

Your rights

You may request access to your data, as well as its rectification, erasure, or the restriction of its processing; you may also request data portability or object to processing based on legitimate interest. You may withdraw your consent at any time, without affecting the lawfulness of any processing that took place prior to such withdrawal.

Within the app, under Profile > Privacy, you can: review this privacy policy, grant or withdraw consent regarding your health data, export all your data into a file, or delete your account. Your name and year of birth can be corrected under “Your data.” Dermatologist accounts can be deleted by emailing info@dermia.org, as these accounts also involve cases concerning other individuals. For any other requests, please email info@dermia.org; we will respond within one month.

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it).

Minimum age

The app is intended for individuals who are at least 18 years old.

Security

All communications are encrypted. Each user can only access data relevant to them, with access rules enforced by the server. On your phone, photos and data are stored within the area reserved for the app and are excluded from cloud backups; login credentials are protected by the Android Keystore or the iOS Keychain. 11. Changes
If this policy changes, we will show it to you the next time you log in and ask you to review it again.