Privacy Policy — Individual Users
Privacy Policy — Individual Users
Last updated: 20 September 2026 · Version: 1.0 (draft — pending legal review)
This Privacy Policy applies to individual customers who create an account, use skin analysis, manage routines, purchase products, or communicate with a specialist through DermaId (the "Platform", "we", "us"). A separate policy applies to clinics, their staff, and marketplace vendors — see /en/pages/privacy/clinics-vendors.
1. Who we are
COMPANY LEGAL INFORMATION — REGISTRATION DETAILS STILL OUTSTANDING This section must name the exact registered legal entity, not a trading name. It is the data controller for the purposes of this policy.
- Legal name: Levantra
- Registration number (org.nr / equivalent): [ ]
- VAT number: [ ]
- Registered address: [Street, postal code, city, country]
- Data protection contact: contact@dermaid.se
If a Data Protection Officer is appointed, name them here. If not required under Article 37 GDPR for your processing volume, say so explicitly rather than leaving the question open.
We operate the DermaId website, web application, and mobile applications (collectively, the "Service"). This policy explains what personal data we collect about you as an individual user, why, who we share it with, how long we keep it, and the rights you have over it.
2. Cosmetic guidance only — not medical advice
The Service provides cosmetic skincare guidance based on photographs and information you provide. It is not a medical device, and it does not diagnose, treat, or provide medical advice for any disease or condition. Any skin-analysis result, routine recommendation, or answer from the AI assistant is cosmetic guidance only. If you have a medical concern about your skin, consult a qualified healthcare professional. This framing determines how we describe our processing of your photographs and health- related answers throughout this policy: we treat them with the care due to sensitive personal data, without representing the Service as a diagnostic or medical tool.
3. Information we collect
3.1 Account and profile information
Display name; email address and/or phone number; password (stored as a salted hash, never in plain text); date of birth (used solely to confirm you are old enough to use the Service — see §11); gender, if you choose to provide it; preferred language; country and, if you provide a shipping address, city, street address, and geographic coordinates used to resolve nearby clinics and delivery options.
3.2 Skin-health questionnaire (Skinprofile)
If you complete it, your self-reported skin type, current skin concerns and how your skin currently feels, known allergies, current skin conditions, current medications, whether you are pregnant or nursing, recent strong actives or aesthetic treatments (peels, laser, needling, Botox or filler), recent surgery, sun-exposure habits, and similar lifestyle answers (smoking, water intake, occupation). We treat this questionnaire as health-related personal data because several of its answers (medications, pregnancy status, diagnosed skin conditions) are inherently health information, even though the purpose of collecting them is safety-screening for cosmetic recommendations, not clinical care. You choose what to answer; fields are optional except where a specific feature (for example, a specialist consultation) requires a safety answer first.
3.3 Photographs and AI skin analysis — special category data
If you use the skin-analysis feature, we collect the photograph you capture or upload and generate, using a third-party AI vision service (see §6), a set of numerical scores for cosmetic concerns such as acne, pigmentation, wrinkles, pores, redness, dark circles, dryness, and oiliness. A photograph capable of revealing information about your health or physical characteristics is "special category" personal data under Article 9 of the GDPR (and the equivalent heightened category under other applicable data-protection laws). We collect and process it only with your explicit, separate consent, requested distinctly from our general terms of service, before your first analysis. You may withdraw this consent at any time (see §10); doing so stops future analyses but does not retroactively undo analyses already performed.
Photographs are stored in a private cloud storage bucket and are never given a public or permanent web address — every access to a photograph is through a cryptographically signed link that expires automatically, typically within minutes.
3.4 Orders and purchases
Products ordered, quantities, prices, currency, shipping address, order status, and communications about an order. We do not store your full payment card number — card payments are handled directly by our payment processor (§6); we retain only the transaction reference and outcome (authorized, captured, refunded).
3.5 Communications
Messages you send to our AI assistant and, separately, to a clinic specialist, if you choose to reach one (see §3.6 on how these two are kept apart); messages to clinic staff through the general clinic messaging channel; any image you attach to a conversation; feedback you submit; and, for orders, communications about fulfillment.
3.6 The AI assistant and a human specialist are two separate, non-overlapping
conversations
This is a deliberate design commitment, not an incidental detail, and we state it here because it materially affects what is shared with whom: your conversation with the AI assistant is never shown, in full or in part, to any clinic or human specialist. If you choose to speak with a specialist, that is a second, independent conversation that only contains what you write into it. The only thing that can ever move from the AI conversation to a specialist is a skincare routine you explicitly choose to send for review — never the surrounding conversation that produced it.
3.7 Consent and relationship records
A log of every consent you have granted or withdrawn (what, when, and — where relevant — in relation to which clinic), which clinics you are linked to and the status of that link, your notification-channel preferences, and your subscription/plan history.
3.8 Technical and device information
IP address (used transiently to resolve your country for currency, shipping, and content targeting — not stored as a persistent profile field), browser/device type, approximate location derived from your IP or, with your permission, device GPS, push notification tokens if you enable notifications on a mobile device, and standard web server logs.
4. How we use your information
| Purpose | Examples |
|---|---|
| Provide the Service | Create and run your account, process orders, run skin analyses, build and track routines |
| Personalize recommendations | Match products and routine steps to your profile, analysis results, and known allergies/medications so unsuitable recommendations are excluded before they are ever suggested |
| Safety | Screen out ingredients unsafe for a declared pregnancy, allergy, or active oral retinoid therapy from any recommendation, automatically |
| Communicate with you | Order confirmations, appointment reminders, responses from a specialist, service notices |
| Improve the Service | Aggregate, de-identified usage statistics; diagnosing technical problems |
| Legal and safety obligations | Fraud prevention, tax and accounting records, responding to lawful requests from authorities |
| Marketing | Only with your separate opt-in consent, and you can withdraw it at any time without affecting any other part of the Service |
We do not use your photographs, health questionnaire answers, or AI conversations to train any third-party AI model, and we do not sell your personal data to anyone.
5. Legal bases for processing (GDPR Article 6 and Article 9)
| Data | Legal basis |
|---|---|
| Account creation, order fulfillment, routine management | Performance of a contract with you (Art. 6(1)(b)) |
| Face photographs and their AI-generated scores | Explicit consent (Art. 9(2)(a)), collected separately from these terms |
| Skin-health questionnaire | Explicit consent, on the same basis as §3.3 above, given that several of its fields are health-related. [Legal review note: confirm whether a dedicated, itemized consent record should be introduced for the questionnaire specifically, distinct from the photo-analysis consent it currently rides alongside.] |
| Sharing your profile/analysis with a clinic you link to | Explicit consent, granted separately per clinic and revocable per clinic at any time |
| Marketing communications | Consent, withdrawable at any time |
| Fraud prevention, security logging, safety exclusions in recommendations | Legitimate interest, balanced against your rights — you may object (§10) |
| Tax, accounting, and invoicing records | Legal obligation |
| Responding to a lawful authority request | Legal obligation |
6. Who we share your information with
We share personal data only where necessary to provide the Service, and only to the extent necessary for the purpose stated. We do not sell personal data.
- AI processing (Anthropic). Your skin-analysis photographs (for the duration of processing a single analysis) and, on your most recent chat message only, any image you attach, are sent to our AI provider to generate analysis scores and chat responses. Older images in a long conversation are not re-sent. Anthropic is based in the United States; see §8 on international transfers.
- Payment processing (Stripe). Card details are entered directly into Stripe's own secure payment page; we never see or store your card number. For a marketplace order that includes products from more than one vendor, Stripe automatically splits the payment among the vendors and our commission on our instruction — this requires sharing the order total and vendor allocation, not your card details, with each vendor's Stripe-connected account.
- A clinic you link to, only with your explicit, per-clinic consent. Once linked and consented, a clinic's specialists and, depending on their role, its receptionists/administrators, may see: your contact details, the parts of your Skinprofile and analysis history you have consented to share, your routine, and messages you send that clinic. They do not see your AI assistant conversation (§3.6). Every access a member of clinic staff makes to your data is logged.
- A marketplace vendor whose product you order, to the extent needed to fulfill that order: your shipping address, the items ordered, and order status. A vendor does not receive your payment card details, your skin-analysis results, or your health questionnaire.
- Infrastructure and hosting providers, who process data on our behalf under contract, strictly to operate the Service: our database and file-storage provider (Supabase), our application-hosting providers (Railway for the backend, Vercel for the website), and our transactional email provider (SendGrid), which sends account, order, and clinic-alert emails on our behalf.
- Notification channels you or a clinic opts into, such as Telegram, only for the specific alert you or the clinic has enabled.
- Authorities, regulators, or courts, where we are legally required to disclose information, or to protect the rights, property, or safety of the Platform, our users, or the public.
- A successor entity, if the business is sold, merged, or reorganized, subject to the same protections described in this policy, and with notice to you.
7. International data transfers
Some of the providers listed in §6 — including our AI provider and elements of our payment and email infrastructure — process data outside the European Economic Area, principally in the United States. Where we transfer personal data outside the EEA, we rely on an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism recognized under the GDPR. [Legal review note: the specific transfer mechanism relied upon for each processor named in §6 should be documented and, where Standard Contractual Clauses are used, formally executed and kept on file before this policy is published.]
8. Data retention
| Data | Retention |
|---|---|
| Skin-analysis photographs | Governed by the retention setting you choose in your account (immediately after scoring, one week, one month, or three months). Deleting a photograph never deletes the numerical scores derived from it, which we keep so your trend comparisons over time remain accurate. |
| Skin-analysis scores | Kept for as long as your account exists, or until you delete the analysis yourself |
| Account and profile data | Kept while your account is active. If you request deletion (§10), we anonymize your account — removing your name, contact details, and credentials — while certain records (see below) are retained where we have a legal basis to keep them |
| Orders and invoices | Retained for the period required by applicable tax and accounting law (typically several years) even after account deletion, because this is a legal record obligation, not a Service feature |
| Consent records | Retained as an audit trail of what you consented to and when, including after account deletion, since this is itself evidence of compliance |
| Marketing consent | Until withdrawn |
| A pending request awaiting a clinic's response at the time you delete your account | Closed out (not left open indefinitely) as part of the deletion process; the clinic's own record of the request is retained as their business record |
9. Your rights
Subject to the conditions and exceptions set out in applicable law, you have the right to:
- Access a copy of the personal data we hold about you (available directly from your account's data-export feature, or by contacting us).
- Rectify inaccurate or incomplete data — most fields are editable directly in your account.
- Erase your data ("right to be forgotten") — available directly from your account as an account-deletion request, which we act on immediately and without exception, consistent with §8 above.
- Restrict processing in certain circumstances.
- Object to processing based on our legitimate interest, and to direct marketing at any time.
- Data portability — receive your data in a structured, commonly used, machine-readable format.
- Withdraw consent at any time, for any processing based on consent, without affecting the lawfulness of processing carried out before the withdrawal. Consent for biometric analysis, marketing, AI-chat personalization, and each clinic data-sharing link can each be withdrawn independently in your account settings.
- Lodge a complaint with your national data-protection supervisory authority. For users in Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se. Users elsewhere may complain to their own national authority or to ours.
To exercise any of these rights, use the relevant feature in your account or contact us at contact@dermaid.se. We will respond within the time limit required by applicable law (one month under the GDPR, extendable by two further months for complex requests, with notice to you).
10. How to manage or withdraw consent
Every consent described in this policy — biometric photo analysis, marketing communications, sharing your profile with a specific clinic, and AI-chat personalization — is recorded individually and can be reviewed and withdrawn independently from your account settings. Withdrawing consent takes effect immediately for future processing; it does not undo processing already lawfully carried out.
11. Children
The Service is not directed at, and may not be used by, anyone under 16 years of age. Where you register directly with an email and password, we require you to confirm you meet this minimum age at registration. Where you sign in through a third-party identity provider that does not collect a birthdate, we require an explicit, separate confirmation of your age the first time you attempt to book a consultation or reach a human specialist. If we become aware that we have collected personal data from someone under this minimum age without the appropriate consent, we will delete it.
12. Automated decision-making
Your skin-analysis result and any routine our AI assistant proposes are generated using automated processing. We do not use this automated processing to make any decision about you that produces a legal effect or similarly significantly affects you. The output is cosmetic guidance for you to accept, adjust, or disregard, and, for certain plans, a real specialist can review and adjust it before it is treated as approved. You may always ask to speak with a human specialist instead of relying on the automated result, subject to your clinic link and plan (see §6).
13. Security
We apply technical and organizational measures appropriate to the sensitivity of the data described in this policy, including encrypted connections, encrypted storage, signed time-limited access to photographs, role- and permission-based access control, and logging of clinic-staff access to client data. Full detail is set out in our Data Handling Policy & Procedures (/en/pages/data-handling), which this policy incorporates by reference.
14. Cookies and similar technologies
Our website uses only the storage strictly necessary to keep you signed in and to remember your language and display preferences. We do not use third-party advertising trackers. [Legal review note: confirm this statement against the final build before publishing, and add a cookie-consent banner if any non-essential storage is introduced later.]
15. Region-specific notices
- Sweden / European Economic Area. This policy is written to meet the requirements of the GDPR as implemented in Sweden. See §9 for your rights and how to complain to IMY.
- Gulf Cooperation Council countries (UAE, Saudi Arabia, and others as the Service expands). [Legal review note: each Gulf jurisdiction in which the Service operates has its own data-protection law (for example the UAE's PDPL and Saudi Arabia's PDPL) with requirements that may differ from the GDPR framework this policy is primarily built around — including local data-residency preferences and registration obligations. This section must be reviewed and, where necessary, expanded by counsel licensed in each such jurisdiction before the Service processes personal data of residents there.]
- Syria. Syria is subject to comprehensive international sanctions. We do not process card payments for users in Syria; orders there are cash-on-delivery only, and no payment card data is collected or transmitted for Syrian transactions.
16. Changes to this policy
We may update this policy from time to time. We will post the updated version with a new "Last updated" date, and where a change is material, we will take reasonable additional steps to notify you (such as an in-app notice or email) before it takes effect.
17. Contact us
Questions about this policy or how we handle your personal data: contact@dermaid.se · [registered postal address]
This document is a draft prepared for legal review and has not yet been finalized by counsel.