Consumer health data privacy

Information, sources and purposes

You provide your skin type, concerns, goals and optional age and sex, photos you choose to submit, cosmetic routine and product notes, questions and ingredient labels. AI features generate appearance estimates, observations, photo-quality notes and comparisons. These records may describe or infer aspects of skin appearance or health-related concerns.

We use enabled skin information to save and display your journal, personalise cosmetic routines and product explanations, and provide AI features you request. Appearance estimates are not diagnoses. We obtain information from you, your chosen uploads and your interactions with Skinreo, and generate estimates using OpenAI. We do not acquire your medical records or buy health profiles from data brokers.

Who processes it

Supabase processes account-linked skin profiles, appearance results, journal metadata, routines and product notes. Vercel handles submitted photos, questions and relevant profile context while operating the website and API. OpenAI receives the photos, questions, label content, recent session messages and relevant skin details needed for the AI feature you request. These providers process data on our behalf under the applicable service arrangements.

Resend processes messages you submit through the contact form, and our support mailbox receives them. Please do not include skin photos or medical details in support messages. Stripe and Apple handle billing; we do not send your skin photos or profile to them for payment processing. A pseudonymous Skinreo account token links an Apple purchase to your account.

We do not sell consumer health data, share it for targeted advertising or use it to train models. We do not share it with affiliates for their independent use. Disclosures required by law are described in the full policy. Provider retention and international processing are explained here.

Your choices and rights

Skin-data storage and OpenAI processing have separate explicit choices, saved in Settings. Withdraw either there. Withdrawal stops future processing covered by that permission; skin-data withdrawal also removes the saved skin records described in the full policy. Account deletion is available separately. Device photos, exports, other devices and provider retention require the separate handling explained in Storage, retention and deletion.

You may ask whether we collect or share your consumer health data, request access and information about recipients, withdraw consent or request deletion, as applicable to your jurisdiction. Use Settings to download your account data, or choose the relevant privacy topic in our contact form. You can also email hello@skinreo.com. We may verify your identity without requesting more information than reasonably necessary.

For requests under Washington’s My Health My Data Act, we ordinarily respond within 45 days. Where the law permits an extension, we explain it within the initial period. If we deny a request, you may appeal by choosing Privacy complaint or appeal in the contact form or replying to our response. We provide the appeal outcome and reasons within 45 days and, if denied, explain how to complain to the Washington Attorney General. Other applicable laws may provide different or shorter timeframes; those still apply.

Changes and contact

We disclose new categories or purposes before introducing them and obtain fresh consent where required. Reading this notice is not consent to a new purpose. Operator details and contact address are in the Privacy Policy.